net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   3
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 106
 107 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 108                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 109
 110 struct pending_cmd {
 111         struct list_head list;
 112         u16 opcode;
 113         int index;
 114         void *param;
 115         struct sock *sk;
 116         void *user_data;
 117 };
 118
 119 /* HCI to MGMT error code conversion table */
 120 static u8 mgmt_status_table[] = {
 121         MGMT_STATUS_SUCCESS,
 122         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 123         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 124         MGMT_STATUS_FAILED,             /* Hardware Failure */
 125         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 126         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 127         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 128         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 129         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 130         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 131         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 132         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 133         MGMT_STATUS_BUSY,               /* Command Disallowed */
 134         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 135         MGMT_STATUS_REJECTED,           /* Rejected Security */
 136         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 137         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 138         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 139         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 140         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 141         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 142         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 143         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 144         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 145         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 146         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 147         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 148         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 149         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 150         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 151         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 152         MGMT_STATUS_FAILED,             /* Unspecified Error */
 153         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 154         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 155         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 156         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 157         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 158         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 159         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 161         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 162         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 163         MGMT_STATUS_FAILED,             /* Transaction Collision */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 165         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 167         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 168         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 169         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 170         MGMT_STATUS_FAILED,             /* Slot Violation */
 171         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 172         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 174         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 175         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 176         MGMT_STATUS_BUSY,               /* Controller Busy */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 178         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 179         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 180         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 181         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 182 };
 183
 184 bool mgmt_valid_hdev(struct hci_dev *hdev)
 185 {
 186         return hdev->dev_type == HCI_BREDR;
 187 }
 188
 189 static u8 mgmt_status(u8 hci_status)
 190 {
 191         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 192                 return mgmt_status_table[hci_status];
 193
 194         return MGMT_STATUS_FAILED;
 195 }
 196
 197 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 198 {
 199         struct sk_buff *skb;
 200         struct mgmt_hdr *hdr;
 201         struct mgmt_ev_cmd_status *ev;
 202         int err;
 203
 204         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 205
 206         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 207         if (!skb)
 208                 return -ENOMEM;
 209
 210         hdr = (void *) skb_put(skb, sizeof(*hdr));
 211
 212         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 213         hdr->index = cpu_to_le16(index);
 214         hdr->len = cpu_to_le16(sizeof(*ev));
 215
 216         ev = (void *) skb_put(skb, sizeof(*ev));
 217         ev->status = status;
 218         ev->opcode = cpu_to_le16(cmd);
 219
 220         err = sock_queue_rcv_skb(sk, skb);
 221         if (err < 0)
 222                 kfree_skb(skb);
 223
 224         return err;
 225 }
 226
 227 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 228                         void *rp, size_t rp_len)
 229 {
 230         struct sk_buff *skb;
 231         struct mgmt_hdr *hdr;
 232         struct mgmt_ev_cmd_complete *ev;
 233         int err;
 234
 235         BT_DBG("sock %p", sk);
 236
 237         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 238         if (!skb)
 239                 return -ENOMEM;
 240
 241         hdr = (void *) skb_put(skb, sizeof(*hdr));
 242
 243         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 244         hdr->index = cpu_to_le16(index);
 245         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 246
 247         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 248         ev->opcode = cpu_to_le16(cmd);
 249         ev->status = status;
 250
 251         if (rp)
 252                 memcpy(ev->data, rp, rp_len);
 253
 254         err = sock_queue_rcv_skb(sk, skb);
 255         if (err < 0)
 256                 kfree_skb(skb);
 257
 258         return err;
 259 }
 260
 261 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 262                         u16 data_len)
 263 {
 264         struct mgmt_rp_read_version rp;
 265
 266         BT_DBG("sock %p", sk);
 267
 268         rp.version = MGMT_VERSION;
 269         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 270
 271         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 272                             sizeof(rp));
 273 }
 274
 275 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 276                          u16 data_len)
 277 {
 278         struct mgmt_rp_read_commands *rp;
 279         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 280         const u16 num_events = ARRAY_SIZE(mgmt_events);
 281         __le16 *opcode;
 282         size_t rp_size;
 283         int i, err;
 284
 285         BT_DBG("sock %p", sk);
 286
 287         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 288
 289         rp = kmalloc(rp_size, GFP_KERNEL);
 290         if (!rp)
 291                 return -ENOMEM;
 292
 293         rp->num_commands = __constant_cpu_to_le16(num_commands);
 294         rp->num_events = __constant_cpu_to_le16(num_events);
 295
 296         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 297                 put_unaligned_le16(mgmt_commands[i], opcode);
 298
 299         for (i = 0; i < num_events; i++, opcode++)
 300                 put_unaligned_le16(mgmt_events[i], opcode);
 301
 302         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 303                            rp_size);
 304         kfree(rp);
 305
 306         return err;
 307 }
 308
 309 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 310                            u16 data_len)
 311 {
 312         struct mgmt_rp_read_index_list *rp;
 313         struct hci_dev *d;
 314         size_t rp_len;
 315         u16 count;
 316         int err;
 317
 318         BT_DBG("sock %p", sk);
 319
 320         read_lock(&hci_dev_list_lock);
 321
 322         count = 0;
 323         list_for_each_entry(d, &hci_dev_list, list) {
 324                 if (!mgmt_valid_hdev(d))
 325                         continue;
 326
 327                 count++;
 328         }
 329
 330         rp_len = sizeof(*rp) + (2 * count);
 331         rp = kmalloc(rp_len, GFP_ATOMIC);
 332         if (!rp) {
 333                 read_unlock(&hci_dev_list_lock);
 334                 return -ENOMEM;
 335         }
 336
 337         count = 0;
 338         list_for_each_entry(d, &hci_dev_list, list) {
 339                 if (test_bit(HCI_SETUP, &d->dev_flags))
 340                         continue;
 341
 342                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 343                         continue;
 344
 345                 if (!mgmt_valid_hdev(d))
 346                         continue;
 347
 348                 rp->index[count++] = cpu_to_le16(d->id);
 349                 BT_DBG("Added hci%u", d->id);
 350         }
 351
 352         rp->num_controllers = cpu_to_le16(count);
 353         rp_len = sizeof(*rp) + (2 * count);
 354
 355         read_unlock(&hci_dev_list_lock);
 356
 357         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 358                            rp_len);
 359
 360         kfree(rp);
 361
 362         return err;
 363 }
 364
 365 static u32 get_supported_settings(struct hci_dev *hdev)
 366 {
 367         u32 settings = 0;
 368
 369         settings |= MGMT_SETTING_POWERED;
 370         settings |= MGMT_SETTING_PAIRABLE;
 371
 372         if (lmp_ssp_capable(hdev))
 373                 settings |= MGMT_SETTING_SSP;
 374
 375         if (lmp_bredr_capable(hdev)) {
 376                 settings |= MGMT_SETTING_CONNECTABLE;
 377                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 378                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 379                 settings |= MGMT_SETTING_DISCOVERABLE;
 380                 settings |= MGMT_SETTING_BREDR;
 381                 settings |= MGMT_SETTING_LINK_SECURITY;
 382         }
 383
 384         if (enable_hs)
 385                 settings |= MGMT_SETTING_HS;
 386
 387         if (lmp_le_capable(hdev)) {
 388                 settings |= MGMT_SETTING_LE;
 389                 settings |= MGMT_SETTING_ADVERTISING;
 390         }
 391
 392         return settings;
 393 }
 394
 395 static u32 get_current_settings(struct hci_dev *hdev)
 396 {
 397         u32 settings = 0;
 398
 399         if (hdev_is_powered(hdev))
 400                 settings |= MGMT_SETTING_POWERED;
 401
 402         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 403                 settings |= MGMT_SETTING_CONNECTABLE;
 404
 405         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 406                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 407
 408         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 409                 settings |= MGMT_SETTING_DISCOVERABLE;
 410
 411         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 412                 settings |= MGMT_SETTING_PAIRABLE;
 413
 414         if (lmp_bredr_capable(hdev))
 415                 settings |= MGMT_SETTING_BREDR;
 416
 417         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 418                 settings |= MGMT_SETTING_LE;
 419
 420         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 421                 settings |= MGMT_SETTING_LINK_SECURITY;
 422
 423         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 424                 settings |= MGMT_SETTING_SSP;
 425
 426         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 427                 settings |= MGMT_SETTING_HS;
 428
 429         if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
 430                 settings |= MGMT_SETTING_ADVERTISING;
 431
 432         return settings;
 433 }
 434
 435 #define PNP_INFO_SVCLASS_ID             0x1200
 436
 437 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 438 {
 439         u8 *ptr = data, *uuids_start = NULL;
 440         struct bt_uuid *uuid;
 441
 442         if (len < 4)
 443                 return ptr;
 444
 445         list_for_each_entry(uuid, &hdev->uuids, list) {
 446                 u16 uuid16;
 447
 448                 if (uuid->size != 16)
 449                         continue;
 450
 451                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 452                 if (uuid16 < 0x1100)
 453                         continue;
 454
 455                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 456                         continue;
 457
 458                 if (!uuids_start) {
 459                         uuids_start = ptr;
 460                         uuids_start[0] = 1;
 461                         uuids_start[1] = EIR_UUID16_ALL;
 462                         ptr += 2;
 463                 }
 464
 465                 /* Stop if not enough space to put next UUID */
 466                 if ((ptr - data) + sizeof(u16) > len) {
 467                         uuids_start[1] = EIR_UUID16_SOME;
 468                         break;
 469                 }
 470
 471                 *ptr++ = (uuid16 & 0x00ff);
 472                 *ptr++ = (uuid16 & 0xff00) >> 8;
 473                 uuids_start[0] += sizeof(uuid16);
 474         }
 475
 476         return ptr;
 477 }
 478
 479 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 480 {
 481         u8 *ptr = data, *uuids_start = NULL;
 482         struct bt_uuid *uuid;
 483
 484         if (len < 6)
 485                 return ptr;
 486
 487         list_for_each_entry(uuid, &hdev->uuids, list) {
 488                 if (uuid->size != 32)
 489                         continue;
 490
 491                 if (!uuids_start) {
 492                         uuids_start = ptr;
 493                         uuids_start[0] = 1;
 494                         uuids_start[1] = EIR_UUID32_ALL;
 495                         ptr += 2;
 496                 }
 497
 498                 /* Stop if not enough space to put next UUID */
 499                 if ((ptr - data) + sizeof(u32) > len) {
 500                         uuids_start[1] = EIR_UUID32_SOME;
 501                         break;
 502                 }
 503
 504                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 505                 ptr += sizeof(u32);
 506                 uuids_start[0] += sizeof(u32);
 507         }
 508
 509         return ptr;
 510 }
 511
 512 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 513 {
 514         u8 *ptr = data, *uuids_start = NULL;
 515         struct bt_uuid *uuid;
 516
 517         if (len < 18)
 518                 return ptr;
 519
 520         list_for_each_entry(uuid, &hdev->uuids, list) {
 521                 if (uuid->size != 128)
 522                         continue;
 523
 524                 if (!uuids_start) {
 525                         uuids_start = ptr;
 526                         uuids_start[0] = 1;
 527                         uuids_start[1] = EIR_UUID128_ALL;
 528                         ptr += 2;
 529                 }
 530
 531                 /* Stop if not enough space to put next UUID */
 532                 if ((ptr - data) + 16 > len) {
 533                         uuids_start[1] = EIR_UUID128_SOME;
 534                         break;
 535                 }
 536
 537                 memcpy(ptr, uuid->uuid, 16);
 538                 ptr += 16;
 539                 uuids_start[0] += 16;
 540         }
 541
 542         return ptr;
 543 }
 544
 545 static void create_eir(struct hci_dev *hdev, u8 *data)
 546 {
 547         u8 *ptr = data;
 548         size_t name_len;
 549
 550         name_len = strlen(hdev->dev_name);
 551
 552         if (name_len > 0) {
 553                 /* EIR Data type */
 554                 if (name_len > 48) {
 555                         name_len = 48;
 556                         ptr[1] = EIR_NAME_SHORT;
 557                 } else
 558                         ptr[1] = EIR_NAME_COMPLETE;
 559
 560                 /* EIR Data length */
 561                 ptr[0] = name_len + 1;
 562
 563                 memcpy(ptr + 2, hdev->dev_name, name_len);
 564
 565                 ptr += (name_len + 2);
 566         }
 567
 568         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 569                 ptr[0] = 2;
 570                 ptr[1] = EIR_TX_POWER;
 571                 ptr[2] = (u8) hdev->inq_tx_power;
 572
 573                 ptr += 3;
 574         }
 575
 576         if (hdev->devid_source > 0) {
 577                 ptr[0] = 9;
 578                 ptr[1] = EIR_DEVICE_ID;
 579
 580                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 581                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 582                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 583                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 584
 585                 ptr += 10;
 586         }
 587
 588         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 589         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 590         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 591 }
 592
 593 static void update_eir(struct hci_request *req)
 594 {
 595         struct hci_dev *hdev = req->hdev;
 596         struct hci_cp_write_eir cp;
 597
 598         if (!hdev_is_powered(hdev))
 599                 return;
 600
 601         if (!lmp_ext_inq_capable(hdev))
 602                 return;
 603
 604         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 605                 return;
 606
 607         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 608                 return;
 609
 610         memset(&cp, 0, sizeof(cp));
 611
 612         create_eir(hdev, cp.data);
 613
 614         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 615                 return;
 616
 617         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 618
 619         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 620 }
 621
 622 static u8 get_service_classes(struct hci_dev *hdev)
 623 {
 624         struct bt_uuid *uuid;
 625         u8 val = 0;
 626
 627         list_for_each_entry(uuid, &hdev->uuids, list)
 628                 val |= uuid->svc_hint;
 629
 630         return val;
 631 }
 632
 633 static void update_class(struct hci_request *req)
 634 {
 635         struct hci_dev *hdev = req->hdev;
 636         u8 cod[3];
 637
 638         BT_DBG("%s", hdev->name);
 639
 640         if (!hdev_is_powered(hdev))
 641                 return;
 642
 643         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 644                 return;
 645
 646         cod[0] = hdev->minor_class;
 647         cod[1] = hdev->major_class;
 648         cod[2] = get_service_classes(hdev);
 649
 650         if (memcmp(cod, hdev->dev_class, 3) == 0)
 651                 return;
 652
 653         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 654 }
 655
 656 static void service_cache_off(struct work_struct *work)
 657 {
 658         struct hci_dev *hdev = container_of(work, struct hci_dev,
 659                                             service_cache.work);
 660         struct hci_request req;
 661
 662         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 663                 return;
 664
 665         hci_req_init(&req, hdev);
 666
 667         hci_dev_lock(hdev);
 668
 669         update_eir(&req);
 670         update_class(&req);
 671
 672         hci_dev_unlock(hdev);
 673
 674         hci_req_run(&req, NULL);
 675 }
 676
 677 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 678 {
 679         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 680                 return;
 681
 682         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 683
 684         /* Non-mgmt controlled devices get this bit set
 685          * implicitly so that pairing works for them, however
 686          * for mgmt we require user-space to explicitly enable
 687          * it
 688          */
 689         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 690 }
 691
 692 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 693                                 void *data, u16 data_len)
 694 {
 695         struct mgmt_rp_read_info rp;
 696
 697         BT_DBG("sock %p %s", sk, hdev->name);
 698
 699         hci_dev_lock(hdev);
 700
 701         memset(&rp, 0, sizeof(rp));
 702
 703         bacpy(&rp.bdaddr, &hdev->bdaddr);
 704
 705         rp.version = hdev->hci_ver;
 706         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 707
 708         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 709         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 710
 711         memcpy(rp.dev_class, hdev->dev_class, 3);
 712
 713         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 714         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 715
 716         hci_dev_unlock(hdev);
 717
 718         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 719                             sizeof(rp));
 720 }
 721
 722 static void mgmt_pending_free(struct pending_cmd *cmd)
 723 {
 724         sock_put(cmd->sk);
 725         kfree(cmd->param);
 726         kfree(cmd);
 727 }
 728
 729 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 730                                             struct hci_dev *hdev, void *data,
 731                                             u16 len)
 732 {
 733         struct pending_cmd *cmd;
 734
 735         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 736         if (!cmd)
 737                 return NULL;
 738
 739         cmd->opcode = opcode;
 740         cmd->index = hdev->id;
 741
 742         cmd->param = kmalloc(len, GFP_KERNEL);
 743         if (!cmd->param) {
 744                 kfree(cmd);
 745                 return NULL;
 746         }
 747
 748         if (data)
 749                 memcpy(cmd->param, data, len);
 750
 751         cmd->sk = sk;
 752         sock_hold(sk);
 753
 754         list_add(&cmd->list, &hdev->mgmt_pending);
 755
 756         return cmd;
 757 }
 758
 759 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 760                                  void (*cb)(struct pending_cmd *cmd,
 761                                             void *data),
 762                                  void *data)
 763 {
 764         struct pending_cmd *cmd, *tmp;
 765
 766         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 767                 if (opcode > 0 && cmd->opcode != opcode)
 768                         continue;
 769
 770                 cb(cmd, data);
 771         }
 772 }
 773
 774 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 775 {
 776         struct pending_cmd *cmd;
 777
 778         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 779                 if (cmd->opcode == opcode)
 780                         return cmd;
 781         }
 782
 783         return NULL;
 784 }
 785
 786 static void mgmt_pending_remove(struct pending_cmd *cmd)
 787 {
 788         list_del(&cmd->list);
 789         mgmt_pending_free(cmd);
 790 }
 791
 792 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 793 {
 794         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 795
 796         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 797                             sizeof(settings));
 798 }
 799
 800 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 801                        u16 len)
 802 {
 803         struct mgmt_mode *cp = data;
 804         struct pending_cmd *cmd;
 805         int err;
 806
 807         BT_DBG("request for %s", hdev->name);
 808
 809         if (cp->val != 0x00 && cp->val != 0x01)
 810                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 811                                   MGMT_STATUS_INVALID_PARAMS);
 812
 813         hci_dev_lock(hdev);
 814
 815         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 816                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 817                                  MGMT_STATUS_BUSY);
 818                 goto failed;
 819         }
 820
 821         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 822                 cancel_delayed_work(&hdev->power_off);
 823
 824                 if (cp->val) {
 825                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 826                                          data, len);
 827                         err = mgmt_powered(hdev, 1);
 828                         goto failed;
 829                 }
 830         }
 831
 832         if (!!cp->val == hdev_is_powered(hdev)) {
 833                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 834                 goto failed;
 835         }
 836
 837         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 838         if (!cmd) {
 839                 err = -ENOMEM;
 840                 goto failed;
 841         }
 842
 843         if (cp->val)
 844                 queue_work(hdev->req_workqueue, &hdev->power_on);
 845         else
 846                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 847
 848         err = 0;
 849
 850 failed:
 851         hci_dev_unlock(hdev);
 852         return err;
 853 }
 854
 855 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 856                       struct sock *skip_sk)
 857 {
 858         struct sk_buff *skb;
 859         struct mgmt_hdr *hdr;
 860
 861         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 862         if (!skb)
 863                 return -ENOMEM;
 864
 865         hdr = (void *) skb_put(skb, sizeof(*hdr));
 866         hdr->opcode = cpu_to_le16(event);
 867         if (hdev)
 868                 hdr->index = cpu_to_le16(hdev->id);
 869         else
 870                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 871         hdr->len = cpu_to_le16(data_len);
 872
 873         if (data)
 874                 memcpy(skb_put(skb, data_len), data, data_len);
 875
 876         /* Time stamp */
 877         __net_timestamp(skb);
 878
 879         hci_send_to_control(skb, skip_sk);
 880         kfree_skb(skb);
 881
 882         return 0;
 883 }
 884
 885 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 886 {
 887         __le32 ev;
 888
 889         ev = cpu_to_le32(get_current_settings(hdev));
 890
 891         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 892 }
 893
 894 struct cmd_lookup {
 895         struct sock *sk;
 896         struct hci_dev *hdev;
 897         u8 mgmt_status;
 898 };
 899
 900 static void settings_rsp(struct pending_cmd *cmd, void *data)
 901 {
 902         struct cmd_lookup *match = data;
 903
 904         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
 905
 906         list_del(&cmd->list);
 907
 908         if (match->sk == NULL) {
 909                 match->sk = cmd->sk;
 910                 sock_hold(match->sk);
 911         }
 912
 913         mgmt_pending_free(cmd);
 914 }
 915
 916 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
 917 {
 918         u8 *status = data;
 919
 920         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
 921         mgmt_pending_remove(cmd);
 922 }
 923
 924 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 925                             u16 len)
 926 {
 927         struct mgmt_cp_set_discoverable *cp = data;
 928         struct pending_cmd *cmd;
 929         u16 timeout;
 930         u8 scan;
 931         int err;
 932
 933         BT_DBG("request for %s", hdev->name);
 934
 935         if (!lmp_bredr_capable(hdev))
 936                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 937                                  MGMT_STATUS_NOT_SUPPORTED);
 938
 939         if (cp->val != 0x00 && cp->val != 0x01)
 940                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 941                                   MGMT_STATUS_INVALID_PARAMS);
 942
 943         timeout = __le16_to_cpu(cp->timeout);
 944         if (!cp->val && timeout > 0)
 945                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 946                                   MGMT_STATUS_INVALID_PARAMS);
 947
 948         hci_dev_lock(hdev);
 949
 950         if (!hdev_is_powered(hdev) && timeout > 0) {
 951                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 952                                  MGMT_STATUS_NOT_POWERED);
 953                 goto failed;
 954         }
 955
 956         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 957             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 958                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 959                                  MGMT_STATUS_BUSY);
 960                 goto failed;
 961         }
 962
 963         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 964                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 965                                  MGMT_STATUS_REJECTED);
 966                 goto failed;
 967         }
 968
 969         if (!hdev_is_powered(hdev)) {
 970                 bool changed = false;
 971
 972                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 973                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 974                         changed = true;
 975                 }
 976
 977                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 978                 if (err < 0)
 979                         goto failed;
 980
 981                 if (changed)
 982                         err = new_settings(hdev, sk);
 983
 984                 goto failed;
 985         }
 986
 987         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 988                 if (hdev->discov_timeout > 0) {
 989                         cancel_delayed_work(&hdev->discov_off);
 990                         hdev->discov_timeout = 0;
 991                 }
 992
 993                 if (cp->val && timeout > 0) {
 994                         hdev->discov_timeout = timeout;
 995                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 996                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 997                 }
 998
 999                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1000                 goto failed;
1001         }
1002
1003         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1004         if (!cmd) {
1005                 err = -ENOMEM;
1006                 goto failed;
1007         }
1008
1009         scan = SCAN_PAGE;
1010
1011         if (cp->val)
1012                 scan |= SCAN_INQUIRY;
1013         else
1014                 cancel_delayed_work(&hdev->discov_off);
1015
1016         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1017         if (err < 0)
1018                 mgmt_pending_remove(cmd);
1019
1020         if (cp->val)
1021                 hdev->discov_timeout = timeout;
1022
1023 failed:
1024         hci_dev_unlock(hdev);
1025         return err;
1026 }
1027
1028 static void write_fast_connectable(struct hci_request *req, bool enable)
1029 {
1030         struct hci_dev *hdev = req->hdev;
1031         struct hci_cp_write_page_scan_activity acp;
1032         u8 type;
1033
1034         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1035                 return;
1036
1037         if (enable) {
1038                 type = PAGE_SCAN_TYPE_INTERLACED;
1039
1040                 /* 160 msec page scan interval */
1041                 acp.interval = __constant_cpu_to_le16(0x0100);
1042         } else {
1043                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1044
1045                 /* default 1.28 sec page scan */
1046                 acp.interval = __constant_cpu_to_le16(0x0800);
1047         }
1048
1049         acp.window = __constant_cpu_to_le16(0x0012);
1050
1051         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1052             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1053                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1054                             sizeof(acp), &acp);
1055
1056         if (hdev->page_scan_type != type)
1057                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1058 }
1059
1060 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1061 {
1062         struct pending_cmd *cmd;
1063
1064         BT_DBG("status 0x%02x", status);
1065
1066         hci_dev_lock(hdev);
1067
1068         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1069         if (!cmd)
1070                 goto unlock;
1071
1072         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1073
1074         mgmt_pending_remove(cmd);
1075
1076 unlock:
1077         hci_dev_unlock(hdev);
1078 }
1079
1080 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1081                            u16 len)
1082 {
1083         struct mgmt_mode *cp = data;
1084         struct pending_cmd *cmd;
1085         struct hci_request req;
1086         u8 scan;
1087         int err;
1088
1089         BT_DBG("request for %s", hdev->name);
1090
1091         if (!lmp_bredr_capable(hdev))
1092                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1093                                   MGMT_STATUS_NOT_SUPPORTED);
1094
1095         if (cp->val != 0x00 && cp->val != 0x01)
1096                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1097                                   MGMT_STATUS_INVALID_PARAMS);
1098
1099         hci_dev_lock(hdev);
1100
1101         if (!hdev_is_powered(hdev)) {
1102                 bool changed = false;
1103
1104                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1105                         changed = true;
1106
1107                 if (cp->val) {
1108                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1109                 } else {
1110                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1111                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1112                 }
1113
1114                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1115                 if (err < 0)
1116                         goto failed;
1117
1118                 if (changed)
1119                         err = new_settings(hdev, sk);
1120
1121                 goto failed;
1122         }
1123
1124         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1125             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1126                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1127                                  MGMT_STATUS_BUSY);
1128                 goto failed;
1129         }
1130
1131         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1132                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1133                 goto failed;
1134         }
1135
1136         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1137         if (!cmd) {
1138                 err = -ENOMEM;
1139                 goto failed;
1140         }
1141
1142         if (cp->val) {
1143                 scan = SCAN_PAGE;
1144         } else {
1145                 scan = 0;
1146
1147                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1148                     hdev->discov_timeout > 0)
1149                         cancel_delayed_work(&hdev->discov_off);
1150         }
1151
1152         hci_req_init(&req, hdev);
1153
1154         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1155
1156         /* If we're going from non-connectable to connectable or
1157          * vice-versa when fast connectable is enabled ensure that fast
1158          * connectable gets disabled. write_fast_connectable won't do
1159          * anything if the page scan parameters are already what they
1160          * should be.
1161          */
1162         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1163                 write_fast_connectable(&req, false);
1164
1165         err = hci_req_run(&req, set_connectable_complete);
1166         if (err < 0)
1167                 mgmt_pending_remove(cmd);
1168
1169 failed:
1170         hci_dev_unlock(hdev);
1171         return err;
1172 }
1173
1174 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1175                         u16 len)
1176 {
1177         struct mgmt_mode *cp = data;
1178         int err;
1179
1180         BT_DBG("request for %s", hdev->name);
1181
1182         if (cp->val != 0x00 && cp->val != 0x01)
1183                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1184                                   MGMT_STATUS_INVALID_PARAMS);
1185
1186         hci_dev_lock(hdev);
1187
1188         if (cp->val)
1189                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1190         else
1191                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1192
1193         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1194         if (err < 0)
1195                 goto failed;
1196
1197         err = new_settings(hdev, sk);
1198
1199 failed:
1200         hci_dev_unlock(hdev);
1201         return err;
1202 }
1203
1204 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1205                              u16 len)
1206 {
1207         struct mgmt_mode *cp = data;
1208         struct pending_cmd *cmd;
1209         u8 val;
1210         int err;
1211
1212         BT_DBG("request for %s", hdev->name);
1213
1214         if (!lmp_bredr_capable(hdev))
1215                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1216                                   MGMT_STATUS_NOT_SUPPORTED);
1217
1218         if (cp->val != 0x00 && cp->val != 0x01)
1219                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1220                                   MGMT_STATUS_INVALID_PARAMS);
1221
1222         hci_dev_lock(hdev);
1223
1224         if (!hdev_is_powered(hdev)) {
1225                 bool changed = false;
1226
1227                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1228                                           &hdev->dev_flags)) {
1229                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1230                         changed = true;
1231                 }
1232
1233                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1234                 if (err < 0)
1235                         goto failed;
1236
1237                 if (changed)
1238                         err = new_settings(hdev, sk);
1239
1240                 goto failed;
1241         }
1242
1243         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1244                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1245                                  MGMT_STATUS_BUSY);
1246                 goto failed;
1247         }
1248
1249         val = !!cp->val;
1250
1251         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1252                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1253                 goto failed;
1254         }
1255
1256         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1257         if (!cmd) {
1258                 err = -ENOMEM;
1259                 goto failed;
1260         }
1261
1262         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1263         if (err < 0) {
1264                 mgmt_pending_remove(cmd);
1265                 goto failed;
1266         }
1267
1268 failed:
1269         hci_dev_unlock(hdev);
1270         return err;
1271 }
1272
1273 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1274 {
1275         struct mgmt_mode *cp = data;
1276         struct pending_cmd *cmd;
1277         u8 val;
1278         int err;
1279
1280         BT_DBG("request for %s", hdev->name);
1281
1282         if (!lmp_ssp_capable(hdev))
1283                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1284                                   MGMT_STATUS_NOT_SUPPORTED);
1285
1286         if (cp->val != 0x00 && cp->val != 0x01)
1287                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1288                                   MGMT_STATUS_INVALID_PARAMS);
1289
1290         hci_dev_lock(hdev);
1291
1292         val = !!cp->val;
1293
1294         if (!hdev_is_powered(hdev)) {
1295                 bool changed = false;
1296
1297                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1298                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1299                         changed = true;
1300                 }
1301
1302                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1303                 if (err < 0)
1304                         goto failed;
1305
1306                 if (changed)
1307                         err = new_settings(hdev, sk);
1308
1309                 goto failed;
1310         }
1311
1312         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1313                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1314                                  MGMT_STATUS_BUSY);
1315                 goto failed;
1316         }
1317
1318         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1319                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1320                 goto failed;
1321         }
1322
1323         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1324         if (!cmd) {
1325                 err = -ENOMEM;
1326                 goto failed;
1327         }
1328
1329         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1330         if (err < 0) {
1331                 mgmt_pending_remove(cmd);
1332                 goto failed;
1333         }
1334
1335 failed:
1336         hci_dev_unlock(hdev);
1337         return err;
1338 }
1339
1340 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1341 {
1342         struct mgmt_mode *cp = data;
1343
1344         BT_DBG("request for %s", hdev->name);
1345
1346         if (!enable_hs)
1347                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1348                                   MGMT_STATUS_NOT_SUPPORTED);
1349
1350         if (cp->val != 0x00 && cp->val != 0x01)
1351                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1352                                   MGMT_STATUS_INVALID_PARAMS);
1353
1354         if (cp->val)
1355                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1356         else
1357                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1358
1359         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1360 }
1361
1362 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1363 {
1364         struct cmd_lookup match = { NULL, hdev };
1365
1366         if (status) {
1367                 u8 mgmt_err = mgmt_status(status);
1368
1369                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1370                                      &mgmt_err);
1371                 return;
1372         }
1373
1374         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1375
1376         new_settings(hdev, match.sk);
1377
1378         if (match.sk)
1379                 sock_put(match.sk);
1380 }
1381
1382 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1383 {
1384         struct mgmt_mode *cp = data;
1385         struct hci_cp_write_le_host_supported hci_cp;
1386         struct pending_cmd *cmd;
1387         struct hci_request req;
1388         int err;
1389         u8 val, enabled;
1390
1391         BT_DBG("request for %s", hdev->name);
1392
1393         if (!lmp_le_capable(hdev))
1394                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1395                                   MGMT_STATUS_NOT_SUPPORTED);
1396
1397         if (cp->val != 0x00 && cp->val != 0x01)
1398                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1399                                   MGMT_STATUS_INVALID_PARAMS);
1400
1401         /* LE-only devices do not allow toggling LE on/off */
1402         if (!lmp_bredr_capable(hdev))
1403                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1404                                   MGMT_STATUS_REJECTED);
1405
1406         hci_dev_lock(hdev);
1407
1408         val = !!cp->val;
1409         enabled = lmp_host_le_capable(hdev);
1410
1411         if (!hdev_is_powered(hdev) || val == enabled) {
1412                 bool changed = false;
1413
1414                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1415                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1416                         changed = true;
1417                 }
1418
1419                 if (!val && test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
1420                         clear_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags);
1421                         changed = true;
1422                 }
1423
1424                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1425                 if (err < 0)
1426                         goto unlock;
1427
1428                 if (changed)
1429                         err = new_settings(hdev, sk);
1430
1431                 goto unlock;
1432         }
1433
1434         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1435                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1436                                  MGMT_STATUS_BUSY);
1437                 goto unlock;
1438         }
1439
1440         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1441         if (!cmd) {
1442                 err = -ENOMEM;
1443                 goto unlock;
1444         }
1445
1446         memset(&hci_cp, 0, sizeof(hci_cp));
1447
1448         if (val) {
1449                 hci_cp.le = val;
1450                 hci_cp.simul = lmp_le_br_capable(hdev);
1451         }
1452
1453         hci_req_init(&req, hdev);
1454
1455         if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags) && !val)
1456                 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(val), &val);
1457
1458         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1459                     &hci_cp);
1460
1461         err = hci_req_run(&req, le_enable_complete);
1462         if (err < 0)
1463                 mgmt_pending_remove(cmd);
1464
1465 unlock:
1466         hci_dev_unlock(hdev);
1467         return err;
1468 }
1469
1470 /* This is a helper function to test for pending mgmt commands that can
1471  * cause CoD or EIR HCI commands. We can only allow one such pending
1472  * mgmt command at a time since otherwise we cannot easily track what
1473  * the current values are, will be, and based on that calculate if a new
1474  * HCI command needs to be sent and if yes with what value.
1475  */
1476 static bool pending_eir_or_class(struct hci_dev *hdev)
1477 {
1478         struct pending_cmd *cmd;
1479
1480         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1481                 switch (cmd->opcode) {
1482                 case MGMT_OP_ADD_UUID:
1483                 case MGMT_OP_REMOVE_UUID:
1484                 case MGMT_OP_SET_DEV_CLASS:
1485                 case MGMT_OP_SET_POWERED:
1486                         return true;
1487                 }
1488         }
1489
1490         return false;
1491 }
1492
1493 static const u8 bluetooth_base_uuid[] = {
1494                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1495                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1496 };
1497
1498 static u8 get_uuid_size(const u8 *uuid)
1499 {
1500         u32 val;
1501
1502         if (memcmp(uuid, bluetooth_base_uuid, 12))
1503                 return 128;
1504
1505         val = get_unaligned_le32(&uuid[12]);
1506         if (val > 0xffff)
1507                 return 32;
1508
1509         return 16;
1510 }
1511
1512 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1513 {
1514         struct pending_cmd *cmd;
1515
1516         hci_dev_lock(hdev);
1517
1518         cmd = mgmt_pending_find(mgmt_op, hdev);
1519         if (!cmd)
1520                 goto unlock;
1521
1522         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1523                      hdev->dev_class, 3);
1524
1525         mgmt_pending_remove(cmd);
1526
1527 unlock:
1528         hci_dev_unlock(hdev);
1529 }
1530
1531 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1532 {
1533         BT_DBG("status 0x%02x", status);
1534
1535         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1536 }
1537
1538 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1539 {
1540         struct mgmt_cp_add_uuid *cp = data;
1541         struct pending_cmd *cmd;
1542         struct hci_request req;
1543         struct bt_uuid *uuid;
1544         int err;
1545
1546         BT_DBG("request for %s", hdev->name);
1547
1548         hci_dev_lock(hdev);
1549
1550         if (pending_eir_or_class(hdev)) {
1551                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1552                                  MGMT_STATUS_BUSY);
1553                 goto failed;
1554         }
1555
1556         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1557         if (!uuid) {
1558                 err = -ENOMEM;
1559                 goto failed;
1560         }
1561
1562         memcpy(uuid->uuid, cp->uuid, 16);
1563         uuid->svc_hint = cp->svc_hint;
1564         uuid->size = get_uuid_size(cp->uuid);
1565
1566         list_add_tail(&uuid->list, &hdev->uuids);
1567
1568         hci_req_init(&req, hdev);
1569
1570         update_class(&req);
1571         update_eir(&req);
1572
1573         err = hci_req_run(&req, add_uuid_complete);
1574         if (err < 0) {
1575                 if (err != -ENODATA)
1576                         goto failed;
1577
1578                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1579                                    hdev->dev_class, 3);
1580                 goto failed;
1581         }
1582
1583         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1584         if (!cmd) {
1585                 err = -ENOMEM;
1586                 goto failed;
1587         }
1588
1589         err = 0;
1590
1591 failed:
1592         hci_dev_unlock(hdev);
1593         return err;
1594 }
1595
1596 static bool enable_service_cache(struct hci_dev *hdev)
1597 {
1598         if (!hdev_is_powered(hdev))
1599                 return false;
1600
1601         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1602                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1603                                    CACHE_TIMEOUT);
1604                 return true;
1605         }
1606
1607         return false;
1608 }
1609
1610 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1611 {
1612         BT_DBG("status 0x%02x", status);
1613
1614         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1615 }
1616
1617 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1618                        u16 len)
1619 {
1620         struct mgmt_cp_remove_uuid *cp = data;
1621         struct pending_cmd *cmd;
1622         struct bt_uuid *match, *tmp;
1623         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1624         struct hci_request req;
1625         int err, found;
1626
1627         BT_DBG("request for %s", hdev->name);
1628
1629         hci_dev_lock(hdev);
1630
1631         if (pending_eir_or_class(hdev)) {
1632                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1633                                  MGMT_STATUS_BUSY);
1634                 goto unlock;
1635         }
1636
1637         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1638                 err = hci_uuids_clear(hdev);
1639
1640                 if (enable_service_cache(hdev)) {
1641                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1642                                            0, hdev->dev_class, 3);
1643                         goto unlock;
1644                 }
1645
1646                 goto update_class;
1647         }
1648
1649         found = 0;
1650
1651         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1652                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1653                         continue;
1654
1655                 list_del(&match->list);
1656                 kfree(match);
1657                 found++;
1658         }
1659
1660         if (found == 0) {
1661                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1662                                  MGMT_STATUS_INVALID_PARAMS);
1663                 goto unlock;
1664         }
1665
1666 update_class:
1667         hci_req_init(&req, hdev);
1668
1669         update_class(&req);
1670         update_eir(&req);
1671
1672         err = hci_req_run(&req, remove_uuid_complete);
1673         if (err < 0) {
1674                 if (err != -ENODATA)
1675                         goto unlock;
1676
1677                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1678                                    hdev->dev_class, 3);
1679                 goto unlock;
1680         }
1681
1682         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1683         if (!cmd) {
1684                 err = -ENOMEM;
1685                 goto unlock;
1686         }
1687
1688         err = 0;
1689
1690 unlock:
1691         hci_dev_unlock(hdev);
1692         return err;
1693 }
1694
1695 static void set_class_complete(struct hci_dev *hdev, u8 status)
1696 {
1697         BT_DBG("status 0x%02x", status);
1698
1699         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1700 }
1701
1702 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1703                          u16 len)
1704 {
1705         struct mgmt_cp_set_dev_class *cp = data;
1706         struct pending_cmd *cmd;
1707         struct hci_request req;
1708         int err;
1709
1710         BT_DBG("request for %s", hdev->name);
1711
1712         if (!lmp_bredr_capable(hdev))
1713                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1714                                   MGMT_STATUS_NOT_SUPPORTED);
1715
1716         hci_dev_lock(hdev);
1717
1718         if (pending_eir_or_class(hdev)) {
1719                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1720                                  MGMT_STATUS_BUSY);
1721                 goto unlock;
1722         }
1723
1724         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1725                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1726                                  MGMT_STATUS_INVALID_PARAMS);
1727                 goto unlock;
1728         }
1729
1730         hdev->major_class = cp->major;
1731         hdev->minor_class = cp->minor;
1732
1733         if (!hdev_is_powered(hdev)) {
1734                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1735                                    hdev->dev_class, 3);
1736                 goto unlock;
1737         }
1738
1739         hci_req_init(&req, hdev);
1740
1741         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1742                 hci_dev_unlock(hdev);
1743                 cancel_delayed_work_sync(&hdev->service_cache);
1744                 hci_dev_lock(hdev);
1745                 update_eir(&req);
1746         }
1747
1748         update_class(&req);
1749
1750         err = hci_req_run(&req, set_class_complete);
1751         if (err < 0) {
1752                 if (err != -ENODATA)
1753                         goto unlock;
1754
1755                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1756                                    hdev->dev_class, 3);
1757                 goto unlock;
1758         }
1759
1760         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1761         if (!cmd) {
1762                 err = -ENOMEM;
1763                 goto unlock;
1764         }
1765
1766         err = 0;
1767
1768 unlock:
1769         hci_dev_unlock(hdev);
1770         return err;
1771 }
1772
1773 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1774                           u16 len)
1775 {
1776         struct mgmt_cp_load_link_keys *cp = data;
1777         u16 key_count, expected_len;
1778         int i;
1779
1780         key_count = __le16_to_cpu(cp->key_count);
1781
1782         expected_len = sizeof(*cp) + key_count *
1783                                         sizeof(struct mgmt_link_key_info);
1784         if (expected_len != len) {
1785                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1786                        len, expected_len);
1787                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1788                                   MGMT_STATUS_INVALID_PARAMS);
1789         }
1790
1791         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1792                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1793                                   MGMT_STATUS_INVALID_PARAMS);
1794
1795         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1796                key_count);
1797
1798         for (i = 0; i < key_count; i++) {
1799                 struct mgmt_link_key_info *key = &cp->keys[i];
1800
1801                 if (key->addr.type != BDADDR_BREDR)
1802                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1803                                           MGMT_STATUS_INVALID_PARAMS);
1804         }
1805
1806         hci_dev_lock(hdev);
1807
1808         hci_link_keys_clear(hdev);
1809
1810         if (cp->debug_keys)
1811                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1812         else
1813                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1814
1815         for (i = 0; i < key_count; i++) {
1816                 struct mgmt_link_key_info *key = &cp->keys[i];
1817
1818                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1819                                  key->type, key->pin_len);
1820         }
1821
1822         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1823
1824         hci_dev_unlock(hdev);
1825
1826         return 0;
1827 }
1828
1829 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1830                            u8 addr_type, struct sock *skip_sk)
1831 {
1832         struct mgmt_ev_device_unpaired ev;
1833
1834         bacpy(&ev.addr.bdaddr, bdaddr);
1835         ev.addr.type = addr_type;
1836
1837         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1838                           skip_sk);
1839 }
1840
1841 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1842                          u16 len)
1843 {
1844         struct mgmt_cp_unpair_device *cp = data;
1845         struct mgmt_rp_unpair_device rp;
1846         struct hci_cp_disconnect dc;
1847         struct pending_cmd *cmd;
1848         struct hci_conn *conn;
1849         int err;
1850
1851         memset(&rp, 0, sizeof(rp));
1852         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1853         rp.addr.type = cp->addr.type;
1854
1855         if (!bdaddr_type_is_valid(cp->addr.type))
1856                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1857                                     MGMT_STATUS_INVALID_PARAMS,
1858                                     &rp, sizeof(rp));
1859
1860         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1861                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1862                                     MGMT_STATUS_INVALID_PARAMS,
1863                                     &rp, sizeof(rp));
1864
1865         hci_dev_lock(hdev);
1866
1867         if (!hdev_is_powered(hdev)) {
1868                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1869                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1870                 goto unlock;
1871         }
1872
1873         if (cp->addr.type == BDADDR_BREDR)
1874                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1875         else
1876                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1877
1878         if (err < 0) {
1879                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1880                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1881                 goto unlock;
1882         }
1883
1884         if (cp->disconnect) {
1885                 if (cp->addr.type == BDADDR_BREDR)
1886                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1887                                                        &cp->addr.bdaddr);
1888                 else
1889                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1890                                                        &cp->addr.bdaddr);
1891         } else {
1892                 conn = NULL;
1893         }
1894
1895         if (!conn) {
1896                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1897                                    &rp, sizeof(rp));
1898                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1899                 goto unlock;
1900         }
1901
1902         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1903                                sizeof(*cp));
1904         if (!cmd) {
1905                 err = -ENOMEM;
1906                 goto unlock;
1907         }
1908
1909         dc.handle = cpu_to_le16(conn->handle);
1910         dc.reason = 0x13; /* Remote User Terminated Connection */
1911         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1912         if (err < 0)
1913                 mgmt_pending_remove(cmd);
1914
1915 unlock:
1916         hci_dev_unlock(hdev);
1917         return err;
1918 }
1919
1920 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1921                       u16 len)
1922 {
1923         struct mgmt_cp_disconnect *cp = data;
1924         struct mgmt_rp_disconnect rp;
1925         struct hci_cp_disconnect dc;
1926         struct pending_cmd *cmd;
1927         struct hci_conn *conn;
1928         int err;
1929
1930         BT_DBG("");
1931
1932         memset(&rp, 0, sizeof(rp));
1933         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1934         rp.addr.type = cp->addr.type;
1935
1936         if (!bdaddr_type_is_valid(cp->addr.type))
1937                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1938                                     MGMT_STATUS_INVALID_PARAMS,
1939                                     &rp, sizeof(rp));
1940
1941         hci_dev_lock(hdev);
1942
1943         if (!test_bit(HCI_UP, &hdev->flags)) {
1944                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1945                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1946                 goto failed;
1947         }
1948
1949         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1950                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1951                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1952                 goto failed;
1953         }
1954
1955         if (cp->addr.type == BDADDR_BREDR)
1956                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1957                                                &cp->addr.bdaddr);
1958         else
1959                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1960
1961         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1962                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1963                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1964                 goto failed;
1965         }
1966
1967         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1968         if (!cmd) {
1969                 err = -ENOMEM;
1970                 goto failed;
1971         }
1972
1973         dc.handle = cpu_to_le16(conn->handle);
1974         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1975
1976         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1977         if (err < 0)
1978                 mgmt_pending_remove(cmd);
1979
1980 failed:
1981         hci_dev_unlock(hdev);
1982         return err;
1983 }
1984
1985 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1986 {
1987         switch (link_type) {
1988         case LE_LINK:
1989                 switch (addr_type) {
1990                 case ADDR_LE_DEV_PUBLIC:
1991                         return BDADDR_LE_PUBLIC;
1992
1993                 default:
1994                         /* Fallback to LE Random address type */
1995                         return BDADDR_LE_RANDOM;
1996                 }
1997
1998         default:
1999                 /* Fallback to BR/EDR type */
2000                 return BDADDR_BREDR;
2001         }
2002 }
2003
2004 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2005                            u16 data_len)
2006 {
2007         struct mgmt_rp_get_connections *rp;
2008         struct hci_conn *c;
2009         size_t rp_len;
2010         int err;
2011         u16 i;
2012
2013         BT_DBG("");
2014
2015         hci_dev_lock(hdev);
2016
2017         if (!hdev_is_powered(hdev)) {
2018                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2019                                  MGMT_STATUS_NOT_POWERED);
2020                 goto unlock;
2021         }
2022
2023         i = 0;
2024         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2025                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2026                         i++;
2027         }
2028
2029         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2030         rp = kmalloc(rp_len, GFP_KERNEL);
2031         if (!rp) {
2032                 err = -ENOMEM;
2033                 goto unlock;
2034         }
2035
2036         i = 0;
2037         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2038                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2039                         continue;
2040                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2041                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2042                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2043                         continue;
2044                 i++;
2045         }
2046
2047         rp->conn_count = cpu_to_le16(i);
2048
2049         /* Recalculate length in case of filtered SCO connections, etc */
2050         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2051
2052         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2053                            rp_len);
2054
2055         kfree(rp);
2056
2057 unlock:
2058         hci_dev_unlock(hdev);
2059         return err;
2060 }
2061
2062 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2063                                    struct mgmt_cp_pin_code_neg_reply *cp)
2064 {
2065         struct pending_cmd *cmd;
2066         int err;
2067
2068         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2069                                sizeof(*cp));
2070         if (!cmd)
2071                 return -ENOMEM;
2072
2073         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2074                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2075         if (err < 0)
2076                 mgmt_pending_remove(cmd);
2077
2078         return err;
2079 }
2080
2081 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2082                           u16 len)
2083 {
2084         struct hci_conn *conn;
2085         struct mgmt_cp_pin_code_reply *cp = data;
2086         struct hci_cp_pin_code_reply reply;
2087         struct pending_cmd *cmd;
2088         int err;
2089
2090         BT_DBG("");
2091
2092         hci_dev_lock(hdev);
2093
2094         if (!hdev_is_powered(hdev)) {
2095                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2096                                  MGMT_STATUS_NOT_POWERED);
2097                 goto failed;
2098         }
2099
2100         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2101         if (!conn) {
2102                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2103                                  MGMT_STATUS_NOT_CONNECTED);
2104                 goto failed;
2105         }
2106
2107         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2108                 struct mgmt_cp_pin_code_neg_reply ncp;
2109
2110                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2111
2112                 BT_ERR("PIN code is not 16 bytes long");
2113
2114                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2115                 if (err >= 0)
2116                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2117                                          MGMT_STATUS_INVALID_PARAMS);
2118
2119                 goto failed;
2120         }
2121
2122         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2123         if (!cmd) {
2124                 err = -ENOMEM;
2125                 goto failed;
2126         }
2127
2128         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2129         reply.pin_len = cp->pin_len;
2130         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2131
2132         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2133         if (err < 0)
2134                 mgmt_pending_remove(cmd);
2135
2136 failed:
2137         hci_dev_unlock(hdev);
2138         return err;
2139 }
2140
2141 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2142                              u16 len)
2143 {
2144         struct mgmt_cp_set_io_capability *cp = data;
2145
2146         BT_DBG("");
2147
2148         hci_dev_lock(hdev);
2149
2150         hdev->io_capability = cp->io_capability;
2151
2152         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2153                hdev->io_capability);
2154
2155         hci_dev_unlock(hdev);
2156
2157         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2158                             0);
2159 }
2160
2161 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2162 {
2163         struct hci_dev *hdev = conn->hdev;
2164         struct pending_cmd *cmd;
2165
2166         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2167                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2168                         continue;
2169
2170                 if (cmd->user_data != conn)
2171                         continue;
2172
2173                 return cmd;
2174         }
2175
2176         return NULL;
2177 }
2178
2179 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2180 {
2181         struct mgmt_rp_pair_device rp;
2182         struct hci_conn *conn = cmd->user_data;
2183
2184         bacpy(&rp.addr.bdaddr, &conn->dst);
2185         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2186
2187         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2188                      &rp, sizeof(rp));
2189
2190         /* So we don't get further callbacks for this connection */
2191         conn->connect_cfm_cb = NULL;
2192         conn->security_cfm_cb = NULL;
2193         conn->disconn_cfm_cb = NULL;
2194
2195         hci_conn_drop(conn);
2196
2197         mgmt_pending_remove(cmd);
2198 }
2199
2200 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2201 {
2202         struct pending_cmd *cmd;
2203
2204         BT_DBG("status %u", status);
2205
2206         cmd = find_pairing(conn);
2207         if (!cmd)
2208                 BT_DBG("Unable to find a pending command");
2209         else
2210                 pairing_complete(cmd, mgmt_status(status));
2211 }
2212
2213 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2214 {
2215         struct pending_cmd *cmd;
2216
2217         BT_DBG("status %u", status);
2218
2219         if (!status)
2220                 return;
2221
2222         cmd = find_pairing(conn);
2223         if (!cmd)
2224                 BT_DBG("Unable to find a pending command");
2225         else
2226                 pairing_complete(cmd, mgmt_status(status));
2227 }
2228
2229 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2230                        u16 len)
2231 {
2232         struct mgmt_cp_pair_device *cp = data;
2233         struct mgmt_rp_pair_device rp;
2234         struct pending_cmd *cmd;
2235         u8 sec_level, auth_type;
2236         struct hci_conn *conn;
2237         int err;
2238
2239         BT_DBG("");
2240
2241         memset(&rp, 0, sizeof(rp));
2242         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2243         rp.addr.type = cp->addr.type;
2244
2245         if (!bdaddr_type_is_valid(cp->addr.type))
2246                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2247                                     MGMT_STATUS_INVALID_PARAMS,
2248                                     &rp, sizeof(rp));
2249
2250         hci_dev_lock(hdev);
2251
2252         if (!hdev_is_powered(hdev)) {
2253                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2254                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2255                 goto unlock;
2256         }
2257
2258         sec_level = BT_SECURITY_MEDIUM;
2259         if (cp->io_cap == 0x03)
2260                 auth_type = HCI_AT_DEDICATED_BONDING;
2261         else
2262                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2263
2264         if (cp->addr.type == BDADDR_BREDR)
2265                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2266                                    cp->addr.type, sec_level, auth_type);
2267         else
2268                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2269                                    cp->addr.type, sec_level, auth_type);
2270
2271         if (IS_ERR(conn)) {
2272                 int status;
2273
2274                 if (PTR_ERR(conn) == -EBUSY)
2275                         status = MGMT_STATUS_BUSY;
2276                 else
2277                         status = MGMT_STATUS_CONNECT_FAILED;
2278
2279                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2280                                    status, &rp,
2281                                    sizeof(rp));
2282                 goto unlock;
2283         }
2284
2285         if (conn->connect_cfm_cb) {
2286                 hci_conn_drop(conn);
2287                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2288                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2289                 goto unlock;
2290         }
2291
2292         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2293         if (!cmd) {
2294                 err = -ENOMEM;
2295                 hci_conn_drop(conn);
2296                 goto unlock;
2297         }
2298
2299         /* For LE, just connecting isn't a proof that the pairing finished */
2300         if (cp->addr.type == BDADDR_BREDR)
2301                 conn->connect_cfm_cb = pairing_complete_cb;
2302         else
2303                 conn->connect_cfm_cb = le_connect_complete_cb;
2304
2305         conn->security_cfm_cb = pairing_complete_cb;
2306         conn->disconn_cfm_cb = pairing_complete_cb;
2307         conn->io_capability = cp->io_cap;
2308         cmd->user_data = conn;
2309
2310         if (conn->state == BT_CONNECTED &&
2311             hci_conn_security(conn, sec_level, auth_type))
2312                 pairing_complete(cmd, 0);
2313
2314         err = 0;
2315
2316 unlock:
2317         hci_dev_unlock(hdev);
2318         return err;
2319 }
2320
2321 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2322                               u16 len)
2323 {
2324         struct mgmt_addr_info *addr = data;
2325         struct pending_cmd *cmd;
2326         struct hci_conn *conn;
2327         int err;
2328
2329         BT_DBG("");
2330
2331         hci_dev_lock(hdev);
2332
2333         if (!hdev_is_powered(hdev)) {
2334                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2335                                  MGMT_STATUS_NOT_POWERED);
2336                 goto unlock;
2337         }
2338
2339         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2340         if (!cmd) {
2341                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2342                                  MGMT_STATUS_INVALID_PARAMS);
2343                 goto unlock;
2344         }
2345
2346         conn = cmd->user_data;
2347
2348         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2349                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2350                                  MGMT_STATUS_INVALID_PARAMS);
2351                 goto unlock;
2352         }
2353
2354         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2355
2356         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2357                            addr, sizeof(*addr));
2358 unlock:
2359         hci_dev_unlock(hdev);
2360         return err;
2361 }
2362
2363 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2364                              struct mgmt_addr_info *addr, u16 mgmt_op,
2365                              u16 hci_op, __le32 passkey)
2366 {
2367         struct pending_cmd *cmd;
2368         struct hci_conn *conn;
2369         int err;
2370
2371         hci_dev_lock(hdev);
2372
2373         if (!hdev_is_powered(hdev)) {
2374                 err = cmd_complete(sk, hdev->id, mgmt_op,
2375                                    MGMT_STATUS_NOT_POWERED, addr,
2376                                    sizeof(*addr));
2377                 goto done;
2378         }
2379
2380         if (addr->type == BDADDR_BREDR)
2381                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2382         else
2383                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2384
2385         if (!conn) {
2386                 err = cmd_complete(sk, hdev->id, mgmt_op,
2387                                    MGMT_STATUS_NOT_CONNECTED, addr,
2388                                    sizeof(*addr));
2389                 goto done;
2390         }
2391
2392         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2393                 /* Continue with pairing via SMP */
2394                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2395
2396                 if (!err)
2397                         err = cmd_complete(sk, hdev->id, mgmt_op,
2398                                            MGMT_STATUS_SUCCESS, addr,
2399                                            sizeof(*addr));
2400                 else
2401                         err = cmd_complete(sk, hdev->id, mgmt_op,
2402                                            MGMT_STATUS_FAILED, addr,
2403                                            sizeof(*addr));
2404
2405                 goto done;
2406         }
2407
2408         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2409         if (!cmd) {
2410                 err = -ENOMEM;
2411                 goto done;
2412         }
2413
2414         /* Continue with pairing via HCI */
2415         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2416                 struct hci_cp_user_passkey_reply cp;
2417
2418                 bacpy(&cp.bdaddr, &addr->bdaddr);
2419                 cp.passkey = passkey;
2420                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2421         } else
2422                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2423                                    &addr->bdaddr);
2424
2425         if (err < 0)
2426                 mgmt_pending_remove(cmd);
2427
2428 done:
2429         hci_dev_unlock(hdev);
2430         return err;
2431 }
2432
2433 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2434                               void *data, u16 len)
2435 {
2436         struct mgmt_cp_pin_code_neg_reply *cp = data;
2437
2438         BT_DBG("");
2439
2440         return user_pairing_resp(sk, hdev, &cp->addr,
2441                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2442                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2443 }
2444
2445 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2446                               u16 len)
2447 {
2448         struct mgmt_cp_user_confirm_reply *cp = data;
2449
2450         BT_DBG("");
2451
2452         if (len != sizeof(*cp))
2453                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2454                                   MGMT_STATUS_INVALID_PARAMS);
2455
2456         return user_pairing_resp(sk, hdev, &cp->addr,
2457                                  MGMT_OP_USER_CONFIRM_REPLY,
2458                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2459 }
2460
2461 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2462                                   void *data, u16 len)
2463 {
2464         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2465
2466         BT_DBG("");
2467
2468         return user_pairing_resp(sk, hdev, &cp->addr,
2469                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2470                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2471 }
2472
2473 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2474                               u16 len)
2475 {
2476         struct mgmt_cp_user_passkey_reply *cp = data;
2477
2478         BT_DBG("");
2479
2480         return user_pairing_resp(sk, hdev, &cp->addr,
2481                                  MGMT_OP_USER_PASSKEY_REPLY,
2482                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2483 }
2484
2485 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2486                                   void *data, u16 len)
2487 {
2488         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2489
2490         BT_DBG("");
2491
2492         return user_pairing_resp(sk, hdev, &cp->addr,
2493                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2494                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2495 }
2496
2497 static void update_name(struct hci_request *req)
2498 {
2499         struct hci_dev *hdev = req->hdev;
2500         struct hci_cp_write_local_name cp;
2501
2502         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2503
2504         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2505 }
2506
2507 static void set_name_complete(struct hci_dev *hdev, u8 status)
2508 {
2509         struct mgmt_cp_set_local_name *cp;
2510         struct pending_cmd *cmd;
2511
2512         BT_DBG("status 0x%02x", status);
2513
2514         hci_dev_lock(hdev);
2515
2516         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2517         if (!cmd)
2518                 goto unlock;
2519
2520         cp = cmd->param;
2521
2522         if (status)
2523                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2524                            mgmt_status(status));
2525         else
2526                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2527                              cp, sizeof(*cp));
2528
2529         mgmt_pending_remove(cmd);
2530
2531 unlock:
2532         hci_dev_unlock(hdev);
2533 }
2534
2535 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2536                           u16 len)
2537 {
2538         struct mgmt_cp_set_local_name *cp = data;
2539         struct pending_cmd *cmd;
2540         struct hci_request req;
2541         int err;
2542
2543         BT_DBG("");
2544
2545         hci_dev_lock(hdev);
2546
2547         /* If the old values are the same as the new ones just return a
2548          * direct command complete event.
2549          */
2550         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2551             !memcmp(hdev->short_name, cp->short_name,
2552                     sizeof(hdev->short_name))) {
2553                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2554                                    data, len);
2555                 goto failed;
2556         }
2557
2558         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2559
2560         if (!hdev_is_powered(hdev)) {
2561                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2562
2563                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2564                                    data, len);
2565                 if (err < 0)
2566                         goto failed;
2567
2568                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2569                                  sk);
2570
2571                 goto failed;
2572         }
2573
2574         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2575         if (!cmd) {
2576                 err = -ENOMEM;
2577                 goto failed;
2578         }
2579
2580         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2581
2582         hci_req_init(&req, hdev);
2583
2584         if (lmp_bredr_capable(hdev)) {
2585                 update_name(&req);
2586                 update_eir(&req);
2587         }
2588
2589         if (lmp_le_capable(hdev))
2590                 hci_update_ad(&req);
2591
2592         err = hci_req_run(&req, set_name_complete);
2593         if (err < 0)
2594                 mgmt_pending_remove(cmd);
2595
2596 failed:
2597         hci_dev_unlock(hdev);
2598         return err;
2599 }
2600
2601 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2602                                void *data, u16 data_len)
2603 {
2604         struct pending_cmd *cmd;
2605         int err;
2606
2607         BT_DBG("%s", hdev->name);
2608
2609         hci_dev_lock(hdev);
2610
2611         if (!hdev_is_powered(hdev)) {
2612                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2613                                  MGMT_STATUS_NOT_POWERED);
2614                 goto unlock;
2615         }
2616
2617         if (!lmp_ssp_capable(hdev)) {
2618                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2619                                  MGMT_STATUS_NOT_SUPPORTED);
2620                 goto unlock;
2621         }
2622
2623         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2624                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2625                                  MGMT_STATUS_BUSY);
2626                 goto unlock;
2627         }
2628
2629         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2630         if (!cmd) {
2631                 err = -ENOMEM;
2632                 goto unlock;
2633         }
2634
2635         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2636         if (err < 0)
2637                 mgmt_pending_remove(cmd);
2638
2639 unlock:
2640         hci_dev_unlock(hdev);
2641         return err;
2642 }
2643
2644 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2645                                void *data, u16 len)
2646 {
2647         struct mgmt_cp_add_remote_oob_data *cp = data;
2648         u8 status;
2649         int err;
2650
2651         BT_DBG("%s ", hdev->name);
2652
2653         hci_dev_lock(hdev);
2654
2655         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2656                                       cp->randomizer);
2657         if (err < 0)
2658                 status = MGMT_STATUS_FAILED;
2659         else
2660                 status = MGMT_STATUS_SUCCESS;
2661
2662         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2663                            &cp->addr, sizeof(cp->addr));
2664
2665         hci_dev_unlock(hdev);
2666         return err;
2667 }
2668
2669 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2670                                   void *data, u16 len)
2671 {
2672         struct mgmt_cp_remove_remote_oob_data *cp = data;
2673         u8 status;
2674         int err;
2675
2676         BT_DBG("%s", hdev->name);
2677
2678         hci_dev_lock(hdev);
2679
2680         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2681         if (err < 0)
2682                 status = MGMT_STATUS_INVALID_PARAMS;
2683         else
2684                 status = MGMT_STATUS_SUCCESS;
2685
2686         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2687                            status, &cp->addr, sizeof(cp->addr));
2688
2689         hci_dev_unlock(hdev);
2690         return err;
2691 }
2692
2693 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2694 {
2695         struct pending_cmd *cmd;
2696         u8 type;
2697         int err;
2698
2699         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2700
2701         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2702         if (!cmd)
2703                 return -ENOENT;
2704
2705         type = hdev->discovery.type;
2706
2707         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2708                            &type, sizeof(type));
2709         mgmt_pending_remove(cmd);
2710
2711         return err;
2712 }
2713
2714 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
2715 {
2716         BT_DBG("status %d", status);
2717
2718         if (status) {
2719                 hci_dev_lock(hdev);
2720                 mgmt_start_discovery_failed(hdev, status);
2721                 hci_dev_unlock(hdev);
2722                 return;
2723         }
2724
2725         hci_dev_lock(hdev);
2726         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2727         hci_dev_unlock(hdev);
2728
2729         switch (hdev->discovery.type) {
2730         case DISCOV_TYPE_LE:
2731                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2732                                    DISCOV_LE_TIMEOUT);
2733                 break;
2734
2735         case DISCOV_TYPE_INTERLEAVED:
2736                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2737                                    DISCOV_INTERLEAVED_TIMEOUT);
2738                 break;
2739
2740         case DISCOV_TYPE_BREDR:
2741                 break;
2742
2743         default:
2744                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
2745         }
2746 }
2747
2748 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2749                            void *data, u16 len)
2750 {
2751         struct mgmt_cp_start_discovery *cp = data;
2752         struct pending_cmd *cmd;
2753         struct hci_cp_le_set_scan_param param_cp;
2754         struct hci_cp_le_set_scan_enable enable_cp;
2755         struct hci_cp_inquiry inq_cp;
2756         struct hci_request req;
2757         /* General inquiry access code (GIAC) */
2758         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2759         int err;
2760
2761         BT_DBG("%s", hdev->name);
2762
2763         hci_dev_lock(hdev);
2764
2765         if (!hdev_is_powered(hdev)) {
2766                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2767                                  MGMT_STATUS_NOT_POWERED);
2768                 goto failed;
2769         }
2770
2771         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2772                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2773                                  MGMT_STATUS_BUSY);
2774                 goto failed;
2775         }
2776
2777         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2778                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2779                                  MGMT_STATUS_BUSY);
2780                 goto failed;
2781         }
2782
2783         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2784         if (!cmd) {
2785                 err = -ENOMEM;
2786                 goto failed;
2787         }
2788
2789         hdev->discovery.type = cp->type;
2790
2791         hci_req_init(&req, hdev);
2792
2793         switch (hdev->discovery.type) {
2794         case DISCOV_TYPE_BREDR:
2795                 if (!lmp_bredr_capable(hdev)) {
2796                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2797                                          MGMT_STATUS_NOT_SUPPORTED);
2798                         mgmt_pending_remove(cmd);
2799                         goto failed;
2800                 }
2801
2802                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2803                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2804                                          MGMT_STATUS_BUSY);
2805                         mgmt_pending_remove(cmd);
2806                         goto failed;
2807                 }
2808
2809                 hci_inquiry_cache_flush(hdev);
2810
2811                 memset(&inq_cp, 0, sizeof(inq_cp));
2812                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
2813                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
2814                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
2815                 break;
2816
2817         case DISCOV_TYPE_LE:
2818         case DISCOV_TYPE_INTERLEAVED:
2819                 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2820                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2821                                          MGMT_STATUS_NOT_SUPPORTED);
2822                         mgmt_pending_remove(cmd);
2823                         goto failed;
2824                 }
2825
2826                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
2827                     !lmp_bredr_capable(hdev)) {
2828                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2829                                          MGMT_STATUS_NOT_SUPPORTED);
2830                         mgmt_pending_remove(cmd);
2831                         goto failed;
2832                 }
2833
2834                 if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
2835                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2836                                          MGMT_STATUS_REJECTED);
2837                         mgmt_pending_remove(cmd);
2838                         goto failed;
2839                 }
2840
2841                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
2842                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2843                                          MGMT_STATUS_BUSY);
2844                         mgmt_pending_remove(cmd);
2845                         goto failed;
2846                 }
2847
2848                 memset(&param_cp, 0, sizeof(param_cp));
2849                 param_cp.type = LE_SCAN_ACTIVE;
2850                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
2851                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
2852                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
2853                             &param_cp);
2854
2855                 memset(&enable_cp, 0, sizeof(enable_cp));
2856                 enable_cp.enable = LE_SCAN_ENABLE;
2857                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2858                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
2859                             &enable_cp);
2860                 break;
2861
2862         default:
2863                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2864                                  MGMT_STATUS_INVALID_PARAMS);
2865                 mgmt_pending_remove(cmd);
2866                 goto failed;
2867         }
2868
2869         err = hci_req_run(&req, start_discovery_complete);
2870         if (err < 0)
2871                 mgmt_pending_remove(cmd);
2872         else
2873                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2874
2875 failed:
2876         hci_dev_unlock(hdev);
2877         return err;
2878 }
2879
2880 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2881 {
2882         struct pending_cmd *cmd;
2883         int err;
2884
2885         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2886         if (!cmd)
2887                 return -ENOENT;
2888
2889         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2890                            &hdev->discovery.type, sizeof(hdev->discovery.type));
2891         mgmt_pending_remove(cmd);
2892
2893         return err;
2894 }
2895
2896 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
2897 {
2898         BT_DBG("status %d", status);
2899
2900         hci_dev_lock(hdev);
2901
2902         if (status) {
2903                 mgmt_stop_discovery_failed(hdev, status);
2904                 goto unlock;
2905         }
2906
2907         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2908
2909 unlock:
2910         hci_dev_unlock(hdev);
2911 }
2912
2913 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2914                           u16 len)
2915 {
2916         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2917         struct pending_cmd *cmd;
2918         struct hci_cp_remote_name_req_cancel cp;
2919         struct inquiry_entry *e;
2920         struct hci_request req;
2921         struct hci_cp_le_set_scan_enable enable_cp;
2922         int err;
2923
2924         BT_DBG("%s", hdev->name);
2925
2926         hci_dev_lock(hdev);
2927
2928         if (!hci_discovery_active(hdev)) {
2929                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2930                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2931                                    sizeof(mgmt_cp->type));
2932                 goto unlock;
2933         }
2934
2935         if (hdev->discovery.type != mgmt_cp->type) {
2936                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2937                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2938                                    sizeof(mgmt_cp->type));
2939                 goto unlock;
2940         }
2941
2942         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2943         if (!cmd) {
2944                 err = -ENOMEM;
2945                 goto unlock;
2946         }
2947
2948         hci_req_init(&req, hdev);
2949
2950         switch (hdev->discovery.state) {
2951         case DISCOVERY_FINDING:
2952                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2953                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2954                 } else {
2955                         cancel_delayed_work(&hdev->le_scan_disable);
2956
2957                         memset(&enable_cp, 0, sizeof(enable_cp));
2958                         enable_cp.enable = LE_SCAN_DISABLE;
2959                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
2960                                     sizeof(enable_cp), &enable_cp);
2961                 }
2962
2963                 break;
2964
2965         case DISCOVERY_RESOLVING:
2966                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2967                                                      NAME_PENDING);
2968                 if (!e) {
2969                         mgmt_pending_remove(cmd);
2970                         err = cmd_complete(sk, hdev->id,
2971                                            MGMT_OP_STOP_DISCOVERY, 0,
2972                                            &mgmt_cp->type,
2973                                            sizeof(mgmt_cp->type));
2974                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2975                         goto unlock;
2976                 }
2977
2978                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2979                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
2980                             &cp);
2981
2982                 break;
2983
2984         default:
2985                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2986
2987                 mgmt_pending_remove(cmd);
2988                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2989                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
2990                                    sizeof(mgmt_cp->type));
2991                 goto unlock;
2992         }
2993
2994         err = hci_req_run(&req, stop_discovery_complete);
2995         if (err < 0)
2996                 mgmt_pending_remove(cmd);
2997         else
2998                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2999
3000 unlock:
3001         hci_dev_unlock(hdev);
3002         return err;
3003 }
3004
3005 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3006                         u16 len)
3007 {
3008         struct mgmt_cp_confirm_name *cp = data;
3009         struct inquiry_entry *e;
3010         int err;
3011
3012         BT_DBG("%s", hdev->name);
3013
3014         hci_dev_lock(hdev);
3015
3016         if (!hci_discovery_active(hdev)) {
3017                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3018                                  MGMT_STATUS_FAILED);
3019                 goto failed;
3020         }
3021
3022         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3023         if (!e) {
3024                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3025                                  MGMT_STATUS_INVALID_PARAMS);
3026                 goto failed;
3027         }
3028
3029         if (cp->name_known) {
3030                 e->name_state = NAME_KNOWN;
3031                 list_del(&e->list);
3032         } else {
3033                 e->name_state = NAME_NEEDED;
3034                 hci_inquiry_cache_update_resolve(hdev, e);
3035         }
3036
3037         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3038                            sizeof(cp->addr));
3039
3040 failed:
3041         hci_dev_unlock(hdev);
3042         return err;
3043 }
3044
3045 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3046                         u16 len)
3047 {
3048         struct mgmt_cp_block_device *cp = data;
3049         u8 status;
3050         int err;
3051
3052         BT_DBG("%s", hdev->name);
3053
3054         if (!bdaddr_type_is_valid(cp->addr.type))
3055                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3056                                     MGMT_STATUS_INVALID_PARAMS,
3057                                     &cp->addr, sizeof(cp->addr));
3058
3059         hci_dev_lock(hdev);
3060
3061         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3062         if (err < 0)
3063                 status = MGMT_STATUS_FAILED;
3064         else
3065                 status = MGMT_STATUS_SUCCESS;
3066
3067         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3068                            &cp->addr, sizeof(cp->addr));
3069
3070         hci_dev_unlock(hdev);
3071
3072         return err;
3073 }
3074
3075 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3076                           u16 len)
3077 {
3078         struct mgmt_cp_unblock_device *cp = data;
3079         u8 status;
3080         int err;
3081
3082         BT_DBG("%s", hdev->name);
3083
3084         if (!bdaddr_type_is_valid(cp->addr.type))
3085                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3086                                     MGMT_STATUS_INVALID_PARAMS,
3087                                     &cp->addr, sizeof(cp->addr));
3088
3089         hci_dev_lock(hdev);
3090
3091         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3092         if (err < 0)
3093                 status = MGMT_STATUS_INVALID_PARAMS;
3094         else
3095                 status = MGMT_STATUS_SUCCESS;
3096
3097         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3098                            &cp->addr, sizeof(cp->addr));
3099
3100         hci_dev_unlock(hdev);
3101
3102         return err;
3103 }
3104
3105 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3106                          u16 len)
3107 {
3108         struct mgmt_cp_set_device_id *cp = data;
3109         struct hci_request req;
3110         int err;
3111         __u16 source;
3112
3113         BT_DBG("%s", hdev->name);
3114
3115         source = __le16_to_cpu(cp->source);
3116
3117         if (source > 0x0002)
3118                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3119                                   MGMT_STATUS_INVALID_PARAMS);
3120
3121         hci_dev_lock(hdev);
3122
3123         hdev->devid_source = source;
3124         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3125         hdev->devid_product = __le16_to_cpu(cp->product);
3126         hdev->devid_version = __le16_to_cpu(cp->version);
3127
3128         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3129
3130         hci_req_init(&req, hdev);
3131         update_eir(&req);
3132         hci_req_run(&req, NULL);
3133
3134         hci_dev_unlock(hdev);
3135
3136         return err;
3137 }
3138
3139 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3140 {
3141         struct pending_cmd *cmd;
3142
3143         BT_DBG("status 0x%02x", status);
3144
3145         hci_dev_lock(hdev);
3146
3147         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3148         if (!cmd)
3149                 goto unlock;
3150
3151         if (status) {
3152                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3153                            mgmt_status(status));
3154         } else {
3155                 struct mgmt_mode *cp = cmd->param;
3156
3157                 if (cp->val)
3158                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3159                 else
3160                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3161
3162                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3163                 new_settings(hdev, cmd->sk);
3164         }
3165
3166         mgmt_pending_remove(cmd);
3167
3168 unlock:
3169         hci_dev_unlock(hdev);
3170 }
3171
3172 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3173                                 void *data, u16 len)
3174 {
3175         struct mgmt_mode *cp = data;
3176         struct pending_cmd *cmd;
3177         struct hci_request req;
3178         int err;
3179
3180         BT_DBG("%s", hdev->name);
3181
3182         if (!lmp_bredr_capable(hdev) || hdev->hci_ver < BLUETOOTH_VER_1_2)
3183                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3184                                   MGMT_STATUS_NOT_SUPPORTED);
3185
3186         if (cp->val != 0x00 && cp->val != 0x01)
3187                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3188                                   MGMT_STATUS_INVALID_PARAMS);
3189
3190         if (!hdev_is_powered(hdev))
3191                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3192                                   MGMT_STATUS_NOT_POWERED);
3193
3194         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3195                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3196                                   MGMT_STATUS_REJECTED);
3197
3198         hci_dev_lock(hdev);
3199
3200         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3201                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3202                                  MGMT_STATUS_BUSY);
3203                 goto unlock;
3204         }
3205
3206         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3207                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3208                                         hdev);
3209                 goto unlock;
3210         }
3211
3212         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3213                                data, len);
3214         if (!cmd) {
3215                 err = -ENOMEM;
3216                 goto unlock;
3217         }
3218
3219         hci_req_init(&req, hdev);
3220
3221         write_fast_connectable(&req, cp->val);
3222
3223         err = hci_req_run(&req, fast_connectable_complete);
3224         if (err < 0) {
3225                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3226                                  MGMT_STATUS_FAILED);
3227                 mgmt_pending_remove(cmd);
3228         }
3229
3230 unlock:
3231         hci_dev_unlock(hdev);
3232
3233         return err;
3234 }
3235
3236 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3237 {
3238         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3239                 return false;
3240         if (key->master != 0x00 && key->master != 0x01)
3241                 return false;
3242         if (!bdaddr_type_is_le(key->addr.type))
3243                 return false;
3244         return true;
3245 }
3246
3247 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3248                                void *cp_data, u16 len)
3249 {
3250         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3251         u16 key_count, expected_len;
3252         int i, err;
3253
3254         key_count = __le16_to_cpu(cp->key_count);
3255
3256         expected_len = sizeof(*cp) + key_count *
3257                                         sizeof(struct mgmt_ltk_info);
3258         if (expected_len != len) {
3259                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3260                        len, expected_len);
3261                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3262                                   MGMT_STATUS_INVALID_PARAMS);
3263         }
3264
3265         BT_DBG("%s key_count %u", hdev->name, key_count);
3266
3267         for (i = 0; i < key_count; i++) {
3268                 struct mgmt_ltk_info *key = &cp->keys[i];
3269
3270                 if (!ltk_is_valid(key))
3271                         return cmd_status(sk, hdev->id,
3272                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3273                                           MGMT_STATUS_INVALID_PARAMS);
3274         }
3275
3276         hci_dev_lock(hdev);
3277
3278         hci_smp_ltks_clear(hdev);
3279
3280         for (i = 0; i < key_count; i++) {
3281                 struct mgmt_ltk_info *key = &cp->keys[i];
3282                 u8 type;
3283
3284                 if (key->master)
3285                         type = HCI_SMP_LTK;
3286                 else
3287                         type = HCI_SMP_LTK_SLAVE;
3288
3289                 hci_add_ltk(hdev, &key->addr.bdaddr,
3290                             bdaddr_to_le(key->addr.type),
3291                             type, 0, key->authenticated, key->val,
3292                             key->enc_size, key->ediv, key->rand);
3293         }
3294
3295         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3296                            NULL, 0);
3297
3298         hci_dev_unlock(hdev);
3299
3300         return err;
3301 }
3302
3303 static const struct mgmt_handler {
3304         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3305                      u16 data_len);
3306         bool var_len;
3307         size_t data_len;
3308 } mgmt_handlers[] = {
3309         { NULL }, /* 0x0000 (no command) */
3310         { read_version,           false, MGMT_READ_VERSION_SIZE },
3311         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3312         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3313         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3314         { set_powered,            false, MGMT_SETTING_SIZE },
3315         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3316         { set_connectable,        false, MGMT_SETTING_SIZE },
3317         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3318         { set_pairable,           false, MGMT_SETTING_SIZE },
3319         { set_link_security,      false, MGMT_SETTING_SIZE },
3320         { set_ssp,                false, MGMT_SETTING_SIZE },
3321         { set_hs,                 false, MGMT_SETTING_SIZE },
3322         { set_le,                 false, MGMT_SETTING_SIZE },
3323         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3324         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3325         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3326         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3327         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3328         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3329         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3330         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3331         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3332         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3333         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3334         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3335         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3336         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3337         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3338         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3339         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3340         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3341         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3342         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3343         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3344         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3345         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3346         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3347         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3348         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3349         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3350 };
3351
3352
3353 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3354 {
3355         void *buf;
3356         u8 *cp;
3357         struct mgmt_hdr *hdr;
3358         u16 opcode, index, len;
3359         struct hci_dev *hdev = NULL;
3360         const struct mgmt_handler *handler;
3361         int err;
3362
3363         BT_DBG("got %zu bytes", msglen);
3364
3365         if (msglen < sizeof(*hdr))
3366                 return -EINVAL;
3367
3368         buf = kmalloc(msglen, GFP_KERNEL);
3369         if (!buf)
3370                 return -ENOMEM;
3371
3372         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3373                 err = -EFAULT;
3374                 goto done;
3375         }
3376
3377         hdr = buf;
3378         opcode = __le16_to_cpu(hdr->opcode);
3379         index = __le16_to_cpu(hdr->index);
3380         len = __le16_to_cpu(hdr->len);
3381
3382         if (len != msglen - sizeof(*hdr)) {
3383                 err = -EINVAL;
3384                 goto done;
3385         }
3386
3387         if (index != MGMT_INDEX_NONE) {
3388                 hdev = hci_dev_get(index);
3389                 if (!hdev) {
3390                         err = cmd_status(sk, index, opcode,
3391                                          MGMT_STATUS_INVALID_INDEX);
3392                         goto done;
3393                 }
3394
3395                 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
3396                         err = cmd_status(sk, index, opcode,
3397                                          MGMT_STATUS_INVALID_INDEX);
3398                         goto done;
3399                 }
3400         }
3401
3402         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3403             mgmt_handlers[opcode].func == NULL) {
3404                 BT_DBG("Unknown op %u", opcode);
3405                 err = cmd_status(sk, index, opcode,
3406                                  MGMT_STATUS_UNKNOWN_COMMAND);
3407                 goto done;
3408         }
3409
3410         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3411             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3412                 err = cmd_status(sk, index, opcode,
3413                                  MGMT_STATUS_INVALID_INDEX);
3414                 goto done;
3415         }
3416
3417         handler = &mgmt_handlers[opcode];
3418
3419         if ((handler->var_len && len < handler->data_len) ||
3420             (!handler->var_len && len != handler->data_len)) {
3421                 err = cmd_status(sk, index, opcode,
3422                                  MGMT_STATUS_INVALID_PARAMS);
3423                 goto done;
3424         }
3425
3426         if (hdev)
3427                 mgmt_init_hdev(sk, hdev);
3428
3429         cp = buf + sizeof(*hdr);
3430
3431         err = handler->func(sk, hdev, cp, len);
3432         if (err < 0)
3433                 goto done;
3434
3435         err = msglen;
3436
3437 done:
3438         if (hdev)
3439                 hci_dev_put(hdev);
3440
3441         kfree(buf);
3442         return err;
3443 }
3444
3445 int mgmt_index_added(struct hci_dev *hdev)
3446 {
3447         if (!mgmt_valid_hdev(hdev))
3448                 return -ENOTSUPP;
3449
3450         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3451 }
3452
3453 int mgmt_index_removed(struct hci_dev *hdev)
3454 {
3455         u8 status = MGMT_STATUS_INVALID_INDEX;
3456
3457         if (!mgmt_valid_hdev(hdev))
3458                 return -ENOTSUPP;
3459
3460         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3461
3462         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3463 }
3464
3465 static void set_bredr_scan(struct hci_request *req)
3466 {
3467         struct hci_dev *hdev = req->hdev;
3468         u8 scan = 0;
3469
3470         /* Ensure that fast connectable is disabled. This function will
3471          * not do anything if the page scan parameters are already what
3472          * they should be.
3473          */
3474         write_fast_connectable(req, false);
3475
3476         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3477                 scan |= SCAN_PAGE;
3478         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3479                 scan |= SCAN_INQUIRY;
3480
3481         if (scan)
3482                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3483 }
3484
3485 static void powered_complete(struct hci_dev *hdev, u8 status)
3486 {
3487         struct cmd_lookup match = { NULL, hdev };
3488
3489         BT_DBG("status 0x%02x", status);
3490
3491         hci_dev_lock(hdev);
3492
3493         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3494
3495         new_settings(hdev, match.sk);
3496
3497         hci_dev_unlock(hdev);
3498
3499         if (match.sk)
3500                 sock_put(match.sk);
3501 }
3502
3503 static int powered_update_hci(struct hci_dev *hdev)
3504 {
3505         struct hci_request req;
3506         u8 link_sec;
3507
3508         hci_req_init(&req, hdev);
3509
3510         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3511             !lmp_host_ssp_capable(hdev)) {
3512                 u8 ssp = 1;
3513
3514                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3515         }
3516
3517         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
3518             lmp_bredr_capable(hdev)) {
3519                 struct hci_cp_write_le_host_supported cp;
3520
3521                 cp.le = 1;
3522                 cp.simul = lmp_le_br_capable(hdev);
3523
3524                 /* Check first if we already have the right
3525                  * host state (host features set)
3526                  */
3527                 if (cp.le != lmp_host_le_capable(hdev) ||
3528                     cp.simul != lmp_host_le_br_capable(hdev))
3529                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3530                                     sizeof(cp), &cp);
3531         }
3532
3533         if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
3534                 u8 adv = 0x01;
3535
3536                 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(adv), &adv);
3537         }
3538
3539         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3540         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3541                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3542                             sizeof(link_sec), &link_sec);
3543
3544         if (lmp_bredr_capable(hdev)) {
3545                 set_bredr_scan(&req);
3546                 update_class(&req);
3547                 update_name(&req);
3548                 update_eir(&req);
3549         }
3550
3551         return hci_req_run(&req, powered_complete);
3552 }
3553
3554 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3555 {
3556         struct cmd_lookup match = { NULL, hdev };
3557         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3558         u8 zero_cod[] = { 0, 0, 0 };
3559         int err;
3560
3561         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3562                 return 0;
3563
3564         if (powered) {
3565                 if (powered_update_hci(hdev) == 0)
3566                         return 0;
3567
3568                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3569                                      &match);
3570                 goto new_settings;
3571         }
3572
3573         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3574         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3575
3576         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3577                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3578                            zero_cod, sizeof(zero_cod), NULL);
3579
3580 new_settings:
3581         err = new_settings(hdev, match.sk);
3582
3583         if (match.sk)
3584                 sock_put(match.sk);
3585
3586         return err;
3587 }
3588
3589 int mgmt_set_powered_failed(struct hci_dev *hdev, int err)
3590 {
3591         struct pending_cmd *cmd;
3592         u8 status;
3593
3594         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
3595         if (!cmd)
3596                 return -ENOENT;
3597
3598         if (err == -ERFKILL)
3599                 status = MGMT_STATUS_RFKILLED;
3600         else
3601                 status = MGMT_STATUS_FAILED;
3602
3603         err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
3604
3605         mgmt_pending_remove(cmd);
3606
3607         return err;
3608 }
3609
3610 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3611 {
3612         struct cmd_lookup match = { NULL, hdev };
3613         bool changed = false;
3614         int err = 0;
3615
3616         if (discoverable) {
3617                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3618                         changed = true;
3619         } else {
3620                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3621                         changed = true;
3622         }
3623
3624         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3625                              &match);
3626
3627         if (changed)
3628                 err = new_settings(hdev, match.sk);
3629
3630         if (match.sk)
3631                 sock_put(match.sk);
3632
3633         return err;
3634 }
3635
3636 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3637 {
3638         struct pending_cmd *cmd;
3639         bool changed = false;
3640         int err = 0;
3641
3642         if (connectable) {
3643                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3644                         changed = true;
3645         } else {
3646                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3647                         changed = true;
3648         }
3649
3650         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
3651
3652         if (changed)
3653                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
3654
3655         return err;
3656 }
3657
3658 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3659 {
3660         u8 mgmt_err = mgmt_status(status);
3661
3662         if (scan & SCAN_PAGE)
3663                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3664                                      cmd_status_rsp, &mgmt_err);
3665
3666         if (scan & SCAN_INQUIRY)
3667                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3668                                      cmd_status_rsp, &mgmt_err);
3669
3670         return 0;
3671 }
3672
3673 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3674                       bool persistent)
3675 {
3676         struct mgmt_ev_new_link_key ev;
3677
3678         memset(&ev, 0, sizeof(ev));
3679
3680         ev.store_hint = persistent;
3681         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3682         ev.key.addr.type = BDADDR_BREDR;
3683         ev.key.type = key->type;
3684         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3685         ev.key.pin_len = key->pin_len;
3686
3687         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3688 }
3689
3690 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3691 {
3692         struct mgmt_ev_new_long_term_key ev;
3693
3694         memset(&ev, 0, sizeof(ev));
3695
3696         ev.store_hint = persistent;
3697         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3698         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3699         ev.key.authenticated = key->authenticated;
3700         ev.key.enc_size = key->enc_size;
3701         ev.key.ediv = key->ediv;
3702
3703         if (key->type == HCI_SMP_LTK)
3704                 ev.key.master = 1;
3705
3706         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3707         memcpy(ev.key.val, key->val, sizeof(key->val));
3708
3709         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3710                           NULL);
3711 }
3712
3713 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3714                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3715                           u8 *dev_class)
3716 {
3717         char buf[512];
3718         struct mgmt_ev_device_connected *ev = (void *) buf;
3719         u16 eir_len = 0;
3720
3721         bacpy(&ev->addr.bdaddr, bdaddr);
3722         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3723
3724         ev->flags = __cpu_to_le32(flags);
3725
3726         if (name_len > 0)
3727                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3728                                           name, name_len);
3729
3730         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3731                 eir_len = eir_append_data(ev->eir, eir_len,
3732                                           EIR_CLASS_OF_DEV, dev_class, 3);
3733
3734         ev->eir_len = cpu_to_le16(eir_len);
3735
3736         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3737                           sizeof(*ev) + eir_len, NULL);
3738 }
3739
3740 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3741 {
3742         struct mgmt_cp_disconnect *cp = cmd->param;
3743         struct sock **sk = data;
3744         struct mgmt_rp_disconnect rp;
3745
3746         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3747         rp.addr.type = cp->addr.type;
3748
3749         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3750                      sizeof(rp));
3751
3752         *sk = cmd->sk;
3753         sock_hold(*sk);
3754
3755         mgmt_pending_remove(cmd);
3756 }
3757
3758 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3759 {
3760         struct hci_dev *hdev = data;
3761         struct mgmt_cp_unpair_device *cp = cmd->param;
3762         struct mgmt_rp_unpair_device rp;
3763
3764         memset(&rp, 0, sizeof(rp));
3765         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3766         rp.addr.type = cp->addr.type;
3767
3768         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3769
3770         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3771
3772         mgmt_pending_remove(cmd);
3773 }
3774
3775 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3776                              u8 link_type, u8 addr_type, u8 reason)
3777 {
3778         struct mgmt_ev_device_disconnected ev;
3779         struct sock *sk = NULL;
3780         int err;
3781
3782         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3783
3784         bacpy(&ev.addr.bdaddr, bdaddr);
3785         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3786         ev.reason = reason;
3787
3788         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3789                          sk);
3790
3791         if (sk)
3792                 sock_put(sk);
3793
3794         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3795                              hdev);
3796
3797         return err;
3798 }
3799
3800 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3801                            u8 link_type, u8 addr_type, u8 status)
3802 {
3803         struct mgmt_rp_disconnect rp;
3804         struct pending_cmd *cmd;
3805         int err;
3806
3807         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3808                              hdev);
3809
3810         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3811         if (!cmd)
3812                 return -ENOENT;
3813
3814         bacpy(&rp.addr.bdaddr, bdaddr);
3815         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3816
3817         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3818                            mgmt_status(status), &rp, sizeof(rp));
3819
3820         mgmt_pending_remove(cmd);
3821
3822         return err;
3823 }
3824
3825 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3826                         u8 addr_type, u8 status)
3827 {
3828         struct mgmt_ev_connect_failed ev;
3829
3830         bacpy(&ev.addr.bdaddr, bdaddr);
3831         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3832         ev.status = mgmt_status(status);
3833
3834         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3835 }
3836
3837 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3838 {
3839         struct mgmt_ev_pin_code_request ev;
3840
3841         bacpy(&ev.addr.bdaddr, bdaddr);
3842         ev.addr.type = BDADDR_BREDR;
3843         ev.secure = secure;
3844
3845         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3846                           NULL);
3847 }
3848
3849 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3850                                  u8 status)
3851 {
3852         struct pending_cmd *cmd;
3853         struct mgmt_rp_pin_code_reply rp;
3854         int err;
3855
3856         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3857         if (!cmd)
3858                 return -ENOENT;
3859
3860         bacpy(&rp.addr.bdaddr, bdaddr);
3861         rp.addr.type = BDADDR_BREDR;
3862
3863         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3864                            mgmt_status(status), &rp, sizeof(rp));
3865
3866         mgmt_pending_remove(cmd);
3867
3868         return err;
3869 }
3870
3871 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3872                                      u8 status)
3873 {
3874         struct pending_cmd *cmd;
3875         struct mgmt_rp_pin_code_reply rp;
3876         int err;
3877
3878         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3879         if (!cmd)
3880                 return -ENOENT;
3881
3882         bacpy(&rp.addr.bdaddr, bdaddr);
3883         rp.addr.type = BDADDR_BREDR;
3884
3885         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3886                            mgmt_status(status), &rp, sizeof(rp));
3887
3888         mgmt_pending_remove(cmd);
3889
3890         return err;
3891 }
3892
3893 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3894                               u8 link_type, u8 addr_type, __le32 value,
3895                               u8 confirm_hint)
3896 {
3897         struct mgmt_ev_user_confirm_request ev;
3898
3899         BT_DBG("%s", hdev->name);
3900
3901         bacpy(&ev.addr.bdaddr, bdaddr);
3902         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3903         ev.confirm_hint = confirm_hint;
3904         ev.value = value;
3905
3906         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3907                           NULL);
3908 }
3909
3910 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3911                               u8 link_type, u8 addr_type)
3912 {
3913         struct mgmt_ev_user_passkey_request ev;
3914
3915         BT_DBG("%s", hdev->name);
3916
3917         bacpy(&ev.addr.bdaddr, bdaddr);
3918         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3919
3920         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3921                           NULL);
3922 }
3923
3924 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3925                                       u8 link_type, u8 addr_type, u8 status,
3926                                       u8 opcode)
3927 {
3928         struct pending_cmd *cmd;
3929         struct mgmt_rp_user_confirm_reply rp;
3930         int err;
3931
3932         cmd = mgmt_pending_find(opcode, hdev);
3933         if (!cmd)
3934                 return -ENOENT;
3935
3936         bacpy(&rp.addr.bdaddr, bdaddr);
3937         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3938         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3939                            &rp, sizeof(rp));
3940
3941         mgmt_pending_remove(cmd);
3942
3943         return err;
3944 }
3945
3946 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3947                                      u8 link_type, u8 addr_type, u8 status)
3948 {
3949         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3950                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3951 }
3952
3953 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3954                                          u8 link_type, u8 addr_type, u8 status)
3955 {
3956         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3957                                           status,
3958                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3959 }
3960
3961 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3962                                      u8 link_type, u8 addr_type, u8 status)
3963 {
3964         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3965                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3966 }
3967
3968 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3969                                          u8 link_type, u8 addr_type, u8 status)
3970 {
3971         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3972                                           status,
3973                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3974 }
3975
3976 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3977                              u8 link_type, u8 addr_type, u32 passkey,
3978                              u8 entered)
3979 {
3980         struct mgmt_ev_passkey_notify ev;
3981
3982         BT_DBG("%s", hdev->name);
3983
3984         bacpy(&ev.addr.bdaddr, bdaddr);
3985         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3986         ev.passkey = __cpu_to_le32(passkey);
3987         ev.entered = entered;
3988
3989         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3990 }
3991
3992 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3993                      u8 addr_type, u8 status)
3994 {
3995         struct mgmt_ev_auth_failed ev;
3996
3997         bacpy(&ev.addr.bdaddr, bdaddr);
3998         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3999         ev.status = mgmt_status(status);
4000
4001         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
4002 }
4003
4004 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
4005 {
4006         struct cmd_lookup match = { NULL, hdev };
4007         bool changed = false;
4008         int err = 0;
4009
4010         if (status) {
4011                 u8 mgmt_err = mgmt_status(status);
4012                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
4013                                      cmd_status_rsp, &mgmt_err);
4014                 return 0;
4015         }
4016
4017         if (test_bit(HCI_AUTH, &hdev->flags)) {
4018                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4019                         changed = true;
4020         } else {
4021                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4022                         changed = true;
4023         }
4024
4025         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
4026                              &match);
4027
4028         if (changed)
4029                 err = new_settings(hdev, match.sk);
4030
4031         if (match.sk)
4032                 sock_put(match.sk);
4033
4034         return err;
4035 }
4036
4037 static void clear_eir(struct hci_request *req)
4038 {
4039         struct hci_dev *hdev = req->hdev;
4040         struct hci_cp_write_eir cp;
4041
4042         if (!lmp_ext_inq_capable(hdev))
4043                 return;
4044
4045         memset(hdev->eir, 0, sizeof(hdev->eir));
4046
4047         memset(&cp, 0, sizeof(cp));
4048
4049         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4050 }
4051
4052 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4053 {
4054         struct cmd_lookup match = { NULL, hdev };
4055         struct hci_request req;
4056         bool changed = false;
4057         int err = 0;
4058
4059         if (status) {
4060                 u8 mgmt_err = mgmt_status(status);
4061
4062                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4063                                                  &hdev->dev_flags))
4064                         err = new_settings(hdev, NULL);
4065
4066                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4067                                      &mgmt_err);
4068
4069                 return err;
4070         }
4071
4072         if (enable) {
4073                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4074                         changed = true;
4075         } else {
4076                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4077                         changed = true;
4078         }
4079
4080         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4081
4082         if (changed)
4083                 err = new_settings(hdev, match.sk);
4084
4085         if (match.sk)
4086                 sock_put(match.sk);
4087
4088         hci_req_init(&req, hdev);
4089
4090         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4091                 update_eir(&req);
4092         else
4093                 clear_eir(&req);
4094
4095         hci_req_run(&req, NULL);
4096
4097         return err;
4098 }
4099
4100 static void sk_lookup(struct pending_cmd *cmd, void *data)
4101 {
4102         struct cmd_lookup *match = data;
4103
4104         if (match->sk == NULL) {
4105                 match->sk = cmd->sk;
4106                 sock_hold(match->sk);
4107         }
4108 }
4109
4110 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4111                                    u8 status)
4112 {
4113         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4114         int err = 0;
4115
4116         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4117         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4118         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4119
4120         if (!status)
4121                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4122                                  3, NULL);
4123
4124         if (match.sk)
4125                 sock_put(match.sk);
4126
4127         return err;
4128 }
4129
4130 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4131 {
4132         struct mgmt_cp_set_local_name ev;
4133         struct pending_cmd *cmd;
4134
4135         if (status)
4136                 return 0;
4137
4138         memset(&ev, 0, sizeof(ev));
4139         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4140         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4141
4142         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4143         if (!cmd) {
4144                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4145
4146                 /* If this is a HCI command related to powering on the
4147                  * HCI dev don't send any mgmt signals.
4148                  */
4149                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4150                         return 0;
4151         }
4152
4153         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4154                           cmd ? cmd->sk : NULL);
4155 }
4156
4157 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4158                                             u8 *randomizer, u8 status)
4159 {
4160         struct pending_cmd *cmd;
4161         int err;
4162
4163         BT_DBG("%s status %u", hdev->name, status);
4164
4165         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4166         if (!cmd)
4167                 return -ENOENT;
4168
4169         if (status) {
4170                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4171                                  mgmt_status(status));
4172         } else {
4173                 struct mgmt_rp_read_local_oob_data rp;
4174
4175                 memcpy(rp.hash, hash, sizeof(rp.hash));
4176                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4177
4178                 err = cmd_complete(cmd->sk, hdev->id,
4179                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4180                                    sizeof(rp));
4181         }
4182
4183         mgmt_pending_remove(cmd);
4184
4185         return err;
4186 }
4187
4188 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4189                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4190                       ssp, u8 *eir, u16 eir_len)
4191 {
4192         char buf[512];
4193         struct mgmt_ev_device_found *ev = (void *) buf;
4194         size_t ev_size;
4195
4196         if (!hci_discovery_active(hdev))
4197                 return -EPERM;
4198
4199         /* Leave 5 bytes for a potential CoD field */
4200         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4201                 return -EINVAL;
4202
4203         memset(buf, 0, sizeof(buf));
4204
4205         bacpy(&ev->addr.bdaddr, bdaddr);
4206         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4207         ev->rssi = rssi;
4208         if (cfm_name)
4209                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4210         if (!ssp)
4211                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4212
4213         if (eir_len > 0)
4214                 memcpy(ev->eir, eir, eir_len);
4215
4216         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4217                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4218                                           dev_class, 3);
4219
4220         ev->eir_len = cpu_to_le16(eir_len);
4221         ev_size = sizeof(*ev) + eir_len;
4222
4223         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4224 }
4225
4226 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4227                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4228 {
4229         struct mgmt_ev_device_found *ev;
4230         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4231         u16 eir_len;
4232
4233         ev = (struct mgmt_ev_device_found *) buf;
4234
4235         memset(buf, 0, sizeof(buf));
4236
4237         bacpy(&ev->addr.bdaddr, bdaddr);
4238         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4239         ev->rssi = rssi;
4240
4241         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4242                                   name_len);
4243
4244         ev->eir_len = cpu_to_le16(eir_len);
4245
4246         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4247                           sizeof(*ev) + eir_len, NULL);
4248 }
4249
4250 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4251 {
4252         struct mgmt_ev_discovering ev;
4253         struct pending_cmd *cmd;
4254
4255         BT_DBG("%s discovering %u", hdev->name, discovering);
4256
4257         if (discovering)
4258                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4259         else
4260                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4261
4262         if (cmd != NULL) {
4263                 u8 type = hdev->discovery.type;
4264
4265                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4266                              sizeof(type));
4267                 mgmt_pending_remove(cmd);
4268         }
4269
4270         memset(&ev, 0, sizeof(ev));
4271         ev.type = hdev->discovery.type;
4272         ev.discovering = discovering;
4273
4274         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4275 }
4276
4277 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4278 {
4279         struct pending_cmd *cmd;
4280         struct mgmt_ev_device_blocked ev;
4281
4282         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4283
4284         bacpy(&ev.addr.bdaddr, bdaddr);
4285         ev.addr.type = type;
4286
4287         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4288                           cmd ? cmd->sk : NULL);
4289 }
4290
4291 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4292 {
4293         struct pending_cmd *cmd;
4294         struct mgmt_ev_device_unblocked ev;
4295
4296         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4297
4298         bacpy(&ev.addr.bdaddr, bdaddr);
4299         ev.addr.type = type;
4300
4301         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4302                           cmd ? cmd->sk : NULL);
4303 }
4304
4305 module_param(enable_hs, bool, 0644);
4306 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");