net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   3
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 106
 107 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 108                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 109
 110 struct pending_cmd {
 111         struct list_head list;
 112         u16 opcode;
 113         int index;
 114         void *param;
 115         struct sock *sk;
 116         void *user_data;
 117 };
 118
 119 /* HCI to MGMT error code conversion table */
 120 static u8 mgmt_status_table[] = {
 121         MGMT_STATUS_SUCCESS,
 122         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 123         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 124         MGMT_STATUS_FAILED,             /* Hardware Failure */
 125         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 126         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 127         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 128         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 129         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 130         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 131         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 132         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 133         MGMT_STATUS_BUSY,               /* Command Disallowed */
 134         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 135         MGMT_STATUS_REJECTED,           /* Rejected Security */
 136         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 137         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 138         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 139         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 140         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 141         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 142         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 143         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 144         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 145         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 146         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 147         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 148         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 149         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 150         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 151         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 152         MGMT_STATUS_FAILED,             /* Unspecified Error */
 153         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 154         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 155         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 156         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 157         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 158         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 159         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 161         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 162         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 163         MGMT_STATUS_FAILED,             /* Transaction Collision */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 165         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 167         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 168         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 169         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 170         MGMT_STATUS_FAILED,             /* Slot Violation */
 171         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 172         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 174         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 175         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 176         MGMT_STATUS_BUSY,               /* Controller Busy */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 178         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 179         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 180         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 181         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 182 };
 183
 184 bool mgmt_valid_hdev(struct hci_dev *hdev)
 185 {
 186         return hdev->dev_type == HCI_BREDR;
 187 }
 188
 189 static u8 mgmt_status(u8 hci_status)
 190 {
 191         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 192                 return mgmt_status_table[hci_status];
 193
 194         return MGMT_STATUS_FAILED;
 195 }
 196
 197 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 198 {
 199         struct sk_buff *skb;
 200         struct mgmt_hdr *hdr;
 201         struct mgmt_ev_cmd_status *ev;
 202         int err;
 203
 204         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 205
 206         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 207         if (!skb)
 208                 return -ENOMEM;
 209
 210         hdr = (void *) skb_put(skb, sizeof(*hdr));
 211
 212         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 213         hdr->index = cpu_to_le16(index);
 214         hdr->len = cpu_to_le16(sizeof(*ev));
 215
 216         ev = (void *) skb_put(skb, sizeof(*ev));
 217         ev->status = status;
 218         ev->opcode = cpu_to_le16(cmd);
 219
 220         err = sock_queue_rcv_skb(sk, skb);
 221         if (err < 0)
 222                 kfree_skb(skb);
 223
 224         return err;
 225 }
 226
 227 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 228                         void *rp, size_t rp_len)
 229 {
 230         struct sk_buff *skb;
 231         struct mgmt_hdr *hdr;
 232         struct mgmt_ev_cmd_complete *ev;
 233         int err;
 234
 235         BT_DBG("sock %p", sk);
 236
 237         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 238         if (!skb)
 239                 return -ENOMEM;
 240
 241         hdr = (void *) skb_put(skb, sizeof(*hdr));
 242
 243         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 244         hdr->index = cpu_to_le16(index);
 245         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 246
 247         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 248         ev->opcode = cpu_to_le16(cmd);
 249         ev->status = status;
 250
 251         if (rp)
 252                 memcpy(ev->data, rp, rp_len);
 253
 254         err = sock_queue_rcv_skb(sk, skb);
 255         if (err < 0)
 256                 kfree_skb(skb);
 257
 258         return err;
 259 }
 260
 261 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 262                         u16 data_len)
 263 {
 264         struct mgmt_rp_read_version rp;
 265
 266         BT_DBG("sock %p", sk);
 267
 268         rp.version = MGMT_VERSION;
 269         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 270
 271         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 272                             sizeof(rp));
 273 }
 274
 275 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 276                          u16 data_len)
 277 {
 278         struct mgmt_rp_read_commands *rp;
 279         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 280         const u16 num_events = ARRAY_SIZE(mgmt_events);
 281         __le16 *opcode;
 282         size_t rp_size;
 283         int i, err;
 284
 285         BT_DBG("sock %p", sk);
 286
 287         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 288
 289         rp = kmalloc(rp_size, GFP_KERNEL);
 290         if (!rp)
 291                 return -ENOMEM;
 292
 293         rp->num_commands = __constant_cpu_to_le16(num_commands);
 294         rp->num_events = __constant_cpu_to_le16(num_events);
 295
 296         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 297                 put_unaligned_le16(mgmt_commands[i], opcode);
 298
 299         for (i = 0; i < num_events; i++, opcode++)
 300                 put_unaligned_le16(mgmt_events[i], opcode);
 301
 302         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 303                            rp_size);
 304         kfree(rp);
 305
 306         return err;
 307 }
 308
 309 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 310                            u16 data_len)
 311 {
 312         struct mgmt_rp_read_index_list *rp;
 313         struct hci_dev *d;
 314         size_t rp_len;
 315         u16 count;
 316         int err;
 317
 318         BT_DBG("sock %p", sk);
 319
 320         read_lock(&hci_dev_list_lock);
 321
 322         count = 0;
 323         list_for_each_entry(d, &hci_dev_list, list) {
 324                 if (!mgmt_valid_hdev(d))
 325                         continue;
 326
 327                 count++;
 328         }
 329
 330         rp_len = sizeof(*rp) + (2 * count);
 331         rp = kmalloc(rp_len, GFP_ATOMIC);
 332         if (!rp) {
 333                 read_unlock(&hci_dev_list_lock);
 334                 return -ENOMEM;
 335         }
 336
 337         count = 0;
 338         list_for_each_entry(d, &hci_dev_list, list) {
 339                 if (test_bit(HCI_SETUP, &d->dev_flags))
 340                         continue;
 341
 342                 if (!mgmt_valid_hdev(d))
 343                         continue;
 344
 345                 rp->index[count++] = cpu_to_le16(d->id);
 346                 BT_DBG("Added hci%u", d->id);
 347         }
 348
 349         rp->num_controllers = cpu_to_le16(count);
 350         rp_len = sizeof(*rp) + (2 * count);
 351
 352         read_unlock(&hci_dev_list_lock);
 353
 354         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 355                            rp_len);
 356
 357         kfree(rp);
 358
 359         return err;
 360 }
 361
 362 static u32 get_supported_settings(struct hci_dev *hdev)
 363 {
 364         u32 settings = 0;
 365
 366         settings |= MGMT_SETTING_POWERED;
 367         settings |= MGMT_SETTING_PAIRABLE;
 368
 369         if (lmp_ssp_capable(hdev))
 370                 settings |= MGMT_SETTING_SSP;
 371
 372         if (lmp_bredr_capable(hdev)) {
 373                 settings |= MGMT_SETTING_CONNECTABLE;
 374                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 375                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 376                 settings |= MGMT_SETTING_DISCOVERABLE;
 377                 settings |= MGMT_SETTING_BREDR;
 378                 settings |= MGMT_SETTING_LINK_SECURITY;
 379         }
 380
 381         if (enable_hs)
 382                 settings |= MGMT_SETTING_HS;
 383
 384         if (lmp_le_capable(hdev))
 385                 settings |= MGMT_SETTING_LE;
 386
 387         return settings;
 388 }
 389
 390 static u32 get_current_settings(struct hci_dev *hdev)
 391 {
 392         u32 settings = 0;
 393
 394         if (hdev_is_powered(hdev))
 395                 settings |= MGMT_SETTING_POWERED;
 396
 397         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 398                 settings |= MGMT_SETTING_CONNECTABLE;
 399
 400         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 401                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 402
 403         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 404                 settings |= MGMT_SETTING_DISCOVERABLE;
 405
 406         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 407                 settings |= MGMT_SETTING_PAIRABLE;
 408
 409         if (lmp_bredr_capable(hdev))
 410                 settings |= MGMT_SETTING_BREDR;
 411
 412         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 413                 settings |= MGMT_SETTING_LE;
 414
 415         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 416                 settings |= MGMT_SETTING_LINK_SECURITY;
 417
 418         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 419                 settings |= MGMT_SETTING_SSP;
 420
 421         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 422                 settings |= MGMT_SETTING_HS;
 423
 424         return settings;
 425 }
 426
 427 #define PNP_INFO_SVCLASS_ID             0x1200
 428
 429 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 430 {
 431         u8 *ptr = data, *uuids_start = NULL;
 432         struct bt_uuid *uuid;
 433
 434         if (len < 4)
 435                 return ptr;
 436
 437         list_for_each_entry(uuid, &hdev->uuids, list) {
 438                 u16 uuid16;
 439
 440                 if (uuid->size != 16)
 441                         continue;
 442
 443                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 444                 if (uuid16 < 0x1100)
 445                         continue;
 446
 447                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 448                         continue;
 449
 450                 if (!uuids_start) {
 451                         uuids_start = ptr;
 452                         uuids_start[0] = 1;
 453                         uuids_start[1] = EIR_UUID16_ALL;
 454                         ptr += 2;
 455                 }
 456
 457                 /* Stop if not enough space to put next UUID */
 458                 if ((ptr - data) + sizeof(u16) > len) {
 459                         uuids_start[1] = EIR_UUID16_SOME;
 460                         break;
 461                 }
 462
 463                 *ptr++ = (uuid16 & 0x00ff);
 464                 *ptr++ = (uuid16 & 0xff00) >> 8;
 465                 uuids_start[0] += sizeof(uuid16);
 466         }
 467
 468         return ptr;
 469 }
 470
 471 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 472 {
 473         u8 *ptr = data, *uuids_start = NULL;
 474         struct bt_uuid *uuid;
 475
 476         if (len < 6)
 477                 return ptr;
 478
 479         list_for_each_entry(uuid, &hdev->uuids, list) {
 480                 if (uuid->size != 32)
 481                         continue;
 482
 483                 if (!uuids_start) {
 484                         uuids_start = ptr;
 485                         uuids_start[0] = 1;
 486                         uuids_start[1] = EIR_UUID32_ALL;
 487                         ptr += 2;
 488                 }
 489
 490                 /* Stop if not enough space to put next UUID */
 491                 if ((ptr - data) + sizeof(u32) > len) {
 492                         uuids_start[1] = EIR_UUID32_SOME;
 493                         break;
 494                 }
 495
 496                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 497                 ptr += sizeof(u32);
 498                 uuids_start[0] += sizeof(u32);
 499         }
 500
 501         return ptr;
 502 }
 503
 504 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 505 {
 506         u8 *ptr = data, *uuids_start = NULL;
 507         struct bt_uuid *uuid;
 508
 509         if (len < 18)
 510                 return ptr;
 511
 512         list_for_each_entry(uuid, &hdev->uuids, list) {
 513                 if (uuid->size != 128)
 514                         continue;
 515
 516                 if (!uuids_start) {
 517                         uuids_start = ptr;
 518                         uuids_start[0] = 1;
 519                         uuids_start[1] = EIR_UUID128_ALL;
 520                         ptr += 2;
 521                 }
 522
 523                 /* Stop if not enough space to put next UUID */
 524                 if ((ptr - data) + 16 > len) {
 525                         uuids_start[1] = EIR_UUID128_SOME;
 526                         break;
 527                 }
 528
 529                 memcpy(ptr, uuid->uuid, 16);
 530                 ptr += 16;
 531                 uuids_start[0] += 16;
 532         }
 533
 534         return ptr;
 535 }
 536
 537 static void create_eir(struct hci_dev *hdev, u8 *data)
 538 {
 539         u8 *ptr = data;
 540         size_t name_len;
 541
 542         name_len = strlen(hdev->dev_name);
 543
 544         if (name_len > 0) {
 545                 /* EIR Data type */
 546                 if (name_len > 48) {
 547                         name_len = 48;
 548                         ptr[1] = EIR_NAME_SHORT;
 549                 } else
 550                         ptr[1] = EIR_NAME_COMPLETE;
 551
 552                 /* EIR Data length */
 553                 ptr[0] = name_len + 1;
 554
 555                 memcpy(ptr + 2, hdev->dev_name, name_len);
 556
 557                 ptr += (name_len + 2);
 558         }
 559
 560         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 561                 ptr[0] = 2;
 562                 ptr[1] = EIR_TX_POWER;
 563                 ptr[2] = (u8) hdev->inq_tx_power;
 564
 565                 ptr += 3;
 566         }
 567
 568         if (hdev->devid_source > 0) {
 569                 ptr[0] = 9;
 570                 ptr[1] = EIR_DEVICE_ID;
 571
 572                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 573                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 574                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 575                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 576
 577                 ptr += 10;
 578         }
 579
 580         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 581         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 582         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 583 }
 584
 585 static void update_eir(struct hci_request *req)
 586 {
 587         struct hci_dev *hdev = req->hdev;
 588         struct hci_cp_write_eir cp;
 589
 590         if (!hdev_is_powered(hdev))
 591                 return;
 592
 593         if (!lmp_ext_inq_capable(hdev))
 594                 return;
 595
 596         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 597                 return;
 598
 599         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 600                 return;
 601
 602         memset(&cp, 0, sizeof(cp));
 603
 604         create_eir(hdev, cp.data);
 605
 606         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 607                 return;
 608
 609         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 610
 611         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 612 }
 613
 614 static u8 get_service_classes(struct hci_dev *hdev)
 615 {
 616         struct bt_uuid *uuid;
 617         u8 val = 0;
 618
 619         list_for_each_entry(uuid, &hdev->uuids, list)
 620                 val |= uuid->svc_hint;
 621
 622         return val;
 623 }
 624
 625 static void update_class(struct hci_request *req)
 626 {
 627         struct hci_dev *hdev = req->hdev;
 628         u8 cod[3];
 629
 630         BT_DBG("%s", hdev->name);
 631
 632         if (!hdev_is_powered(hdev))
 633                 return;
 634
 635         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 636                 return;
 637
 638         cod[0] = hdev->minor_class;
 639         cod[1] = hdev->major_class;
 640         cod[2] = get_service_classes(hdev);
 641
 642         if (memcmp(cod, hdev->dev_class, 3) == 0)
 643                 return;
 644
 645         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 646 }
 647
 648 static void service_cache_off(struct work_struct *work)
 649 {
 650         struct hci_dev *hdev = container_of(work, struct hci_dev,
 651                                             service_cache.work);
 652         struct hci_request req;
 653
 654         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 655                 return;
 656
 657         hci_req_init(&req, hdev);
 658
 659         hci_dev_lock(hdev);
 660
 661         update_eir(&req);
 662         update_class(&req);
 663
 664         hci_dev_unlock(hdev);
 665
 666         hci_req_run(&req, NULL);
 667 }
 668
 669 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 670 {
 671         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 672                 return;
 673
 674         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 675
 676         /* Non-mgmt controlled devices get this bit set
 677          * implicitly so that pairing works for them, however
 678          * for mgmt we require user-space to explicitly enable
 679          * it
 680          */
 681         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 682 }
 683
 684 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 685                                 void *data, u16 data_len)
 686 {
 687         struct mgmt_rp_read_info rp;
 688
 689         BT_DBG("sock %p %s", sk, hdev->name);
 690
 691         hci_dev_lock(hdev);
 692
 693         memset(&rp, 0, sizeof(rp));
 694
 695         bacpy(&rp.bdaddr, &hdev->bdaddr);
 696
 697         rp.version = hdev->hci_ver;
 698         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 699
 700         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 701         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 702
 703         memcpy(rp.dev_class, hdev->dev_class, 3);
 704
 705         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 706         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 707
 708         hci_dev_unlock(hdev);
 709
 710         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 711                             sizeof(rp));
 712 }
 713
 714 static void mgmt_pending_free(struct pending_cmd *cmd)
 715 {
 716         sock_put(cmd->sk);
 717         kfree(cmd->param);
 718         kfree(cmd);
 719 }
 720
 721 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 722                                             struct hci_dev *hdev, void *data,
 723                                             u16 len)
 724 {
 725         struct pending_cmd *cmd;
 726
 727         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 728         if (!cmd)
 729                 return NULL;
 730
 731         cmd->opcode = opcode;
 732         cmd->index = hdev->id;
 733
 734         cmd->param = kmalloc(len, GFP_KERNEL);
 735         if (!cmd->param) {
 736                 kfree(cmd);
 737                 return NULL;
 738         }
 739
 740         if (data)
 741                 memcpy(cmd->param, data, len);
 742
 743         cmd->sk = sk;
 744         sock_hold(sk);
 745
 746         list_add(&cmd->list, &hdev->mgmt_pending);
 747
 748         return cmd;
 749 }
 750
 751 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 752                                  void (*cb)(struct pending_cmd *cmd,
 753                                             void *data),
 754                                  void *data)
 755 {
 756         struct pending_cmd *cmd, *tmp;
 757
 758         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 759                 if (opcode > 0 && cmd->opcode != opcode)
 760                         continue;
 761
 762                 cb(cmd, data);
 763         }
 764 }
 765
 766 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 767 {
 768         struct pending_cmd *cmd;
 769
 770         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 771                 if (cmd->opcode == opcode)
 772                         return cmd;
 773         }
 774
 775         return NULL;
 776 }
 777
 778 static void mgmt_pending_remove(struct pending_cmd *cmd)
 779 {
 780         list_del(&cmd->list);
 781         mgmt_pending_free(cmd);
 782 }
 783
 784 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 785 {
 786         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 787
 788         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 789                             sizeof(settings));
 790 }
 791
 792 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 793                        u16 len)
 794 {
 795         struct mgmt_mode *cp = data;
 796         struct pending_cmd *cmd;
 797         int err;
 798
 799         BT_DBG("request for %s", hdev->name);
 800
 801         if (cp->val != 0x00 && cp->val != 0x01)
 802                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 803                                   MGMT_STATUS_INVALID_PARAMS);
 804
 805         hci_dev_lock(hdev);
 806
 807         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 808                 cancel_delayed_work(&hdev->power_off);
 809
 810                 if (cp->val) {
 811                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 812                                          data, len);
 813                         err = mgmt_powered(hdev, 1);
 814                         goto failed;
 815                 }
 816         }
 817
 818         if (!!cp->val == hdev_is_powered(hdev)) {
 819                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 820                 goto failed;
 821         }
 822
 823         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 824                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 825                                  MGMT_STATUS_BUSY);
 826                 goto failed;
 827         }
 828
 829         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 830         if (!cmd) {
 831                 err = -ENOMEM;
 832                 goto failed;
 833         }
 834
 835         if (cp->val)
 836                 queue_work(hdev->req_workqueue, &hdev->power_on);
 837         else
 838                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 839
 840         err = 0;
 841
 842 failed:
 843         hci_dev_unlock(hdev);
 844         return err;
 845 }
 846
 847 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 848                       struct sock *skip_sk)
 849 {
 850         struct sk_buff *skb;
 851         struct mgmt_hdr *hdr;
 852
 853         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 854         if (!skb)
 855                 return -ENOMEM;
 856
 857         hdr = (void *) skb_put(skb, sizeof(*hdr));
 858         hdr->opcode = cpu_to_le16(event);
 859         if (hdev)
 860                 hdr->index = cpu_to_le16(hdev->id);
 861         else
 862                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 863         hdr->len = cpu_to_le16(data_len);
 864
 865         if (data)
 866                 memcpy(skb_put(skb, data_len), data, data_len);
 867
 868         /* Time stamp */
 869         __net_timestamp(skb);
 870
 871         hci_send_to_control(skb, skip_sk);
 872         kfree_skb(skb);
 873
 874         return 0;
 875 }
 876
 877 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 878 {
 879         __le32 ev;
 880
 881         ev = cpu_to_le32(get_current_settings(hdev));
 882
 883         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 884 }
 885
 886 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 887                             u16 len)
 888 {
 889         struct mgmt_cp_set_discoverable *cp = data;
 890         struct pending_cmd *cmd;
 891         u16 timeout;
 892         u8 scan;
 893         int err;
 894
 895         BT_DBG("request for %s", hdev->name);
 896
 897         if (!lmp_bredr_capable(hdev))
 898                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 899                                  MGMT_STATUS_NOT_SUPPORTED);
 900
 901         if (cp->val != 0x00 && cp->val != 0x01)
 902                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 903                                   MGMT_STATUS_INVALID_PARAMS);
 904
 905         timeout = __le16_to_cpu(cp->timeout);
 906         if (!cp->val && timeout > 0)
 907                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 908                                   MGMT_STATUS_INVALID_PARAMS);
 909
 910         hci_dev_lock(hdev);
 911
 912         if (!hdev_is_powered(hdev) && timeout > 0) {
 913                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 914                                  MGMT_STATUS_NOT_POWERED);
 915                 goto failed;
 916         }
 917
 918         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 919             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 920                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 921                                  MGMT_STATUS_BUSY);
 922                 goto failed;
 923         }
 924
 925         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 926                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 927                                  MGMT_STATUS_REJECTED);
 928                 goto failed;
 929         }
 930
 931         if (!hdev_is_powered(hdev)) {
 932                 bool changed = false;
 933
 934                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 935                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 936                         changed = true;
 937                 }
 938
 939                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 940                 if (err < 0)
 941                         goto failed;
 942
 943                 if (changed)
 944                         err = new_settings(hdev, sk);
 945
 946                 goto failed;
 947         }
 948
 949         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 950                 if (hdev->discov_timeout > 0) {
 951                         cancel_delayed_work(&hdev->discov_off);
 952                         hdev->discov_timeout = 0;
 953                 }
 954
 955                 if (cp->val && timeout > 0) {
 956                         hdev->discov_timeout = timeout;
 957                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 958                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 959                 }
 960
 961                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 962                 goto failed;
 963         }
 964
 965         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 966         if (!cmd) {
 967                 err = -ENOMEM;
 968                 goto failed;
 969         }
 970
 971         scan = SCAN_PAGE;
 972
 973         if (cp->val)
 974                 scan |= SCAN_INQUIRY;
 975         else
 976                 cancel_delayed_work(&hdev->discov_off);
 977
 978         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 979         if (err < 0)
 980                 mgmt_pending_remove(cmd);
 981
 982         if (cp->val)
 983                 hdev->discov_timeout = timeout;
 984
 985 failed:
 986         hci_dev_unlock(hdev);
 987         return err;
 988 }
 989
 990 static void write_fast_connectable(struct hci_request *req, bool enable)
 991 {
 992         struct hci_dev *hdev = req->hdev;
 993         struct hci_cp_write_page_scan_activity acp;
 994         u8 type;
 995
 996         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
 997                 return;
 998
 999         if (enable) {
1000                 type = PAGE_SCAN_TYPE_INTERLACED;
1001
1002                 /* 160 msec page scan interval */
1003                 acp.interval = __constant_cpu_to_le16(0x0100);
1004         } else {
1005                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1006
1007                 /* default 1.28 sec page scan */
1008                 acp.interval = __constant_cpu_to_le16(0x0800);
1009         }
1010
1011         acp.window = __constant_cpu_to_le16(0x0012);
1012
1013         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1014             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1015                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1016                             sizeof(acp), &acp);
1017
1018         if (hdev->page_scan_type != type)
1019                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1020 }
1021
1022 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1023 {
1024         struct pending_cmd *cmd;
1025
1026         BT_DBG("status 0x%02x", status);
1027
1028         hci_dev_lock(hdev);
1029
1030         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1031         if (!cmd)
1032                 goto unlock;
1033
1034         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1035
1036         mgmt_pending_remove(cmd);
1037
1038 unlock:
1039         hci_dev_unlock(hdev);
1040 }
1041
1042 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1043                            u16 len)
1044 {
1045         struct mgmt_mode *cp = data;
1046         struct pending_cmd *cmd;
1047         struct hci_request req;
1048         u8 scan;
1049         int err;
1050
1051         BT_DBG("request for %s", hdev->name);
1052
1053         if (!lmp_bredr_capable(hdev))
1054                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1055                                   MGMT_STATUS_NOT_SUPPORTED);
1056
1057         if (cp->val != 0x00 && cp->val != 0x01)
1058                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1059                                   MGMT_STATUS_INVALID_PARAMS);
1060
1061         hci_dev_lock(hdev);
1062
1063         if (!hdev_is_powered(hdev)) {
1064                 bool changed = false;
1065
1066                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1067                         changed = true;
1068
1069                 if (cp->val) {
1070                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1071                 } else {
1072                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1073                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1074                 }
1075
1076                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1077                 if (err < 0)
1078                         goto failed;
1079
1080                 if (changed)
1081                         err = new_settings(hdev, sk);
1082
1083                 goto failed;
1084         }
1085
1086         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1087             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1088                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1089                                  MGMT_STATUS_BUSY);
1090                 goto failed;
1091         }
1092
1093         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1094                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1095                 goto failed;
1096         }
1097
1098         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1099         if (!cmd) {
1100                 err = -ENOMEM;
1101                 goto failed;
1102         }
1103
1104         if (cp->val) {
1105                 scan = SCAN_PAGE;
1106         } else {
1107                 scan = 0;
1108
1109                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1110                     hdev->discov_timeout > 0)
1111                         cancel_delayed_work(&hdev->discov_off);
1112         }
1113
1114         hci_req_init(&req, hdev);
1115
1116         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1117
1118         /* If we're going from non-connectable to connectable or
1119          * vice-versa when fast connectable is enabled ensure that fast
1120          * connectable gets disabled. write_fast_connectable won't do
1121          * anything if the page scan parameters are already what they
1122          * should be.
1123          */
1124         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1125                 write_fast_connectable(&req, false);
1126
1127         err = hci_req_run(&req, set_connectable_complete);
1128         if (err < 0)
1129                 mgmt_pending_remove(cmd);
1130
1131 failed:
1132         hci_dev_unlock(hdev);
1133         return err;
1134 }
1135
1136 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1137                         u16 len)
1138 {
1139         struct mgmt_mode *cp = data;
1140         int err;
1141
1142         BT_DBG("request for %s", hdev->name);
1143
1144         if (cp->val != 0x00 && cp->val != 0x01)
1145                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1146                                   MGMT_STATUS_INVALID_PARAMS);
1147
1148         hci_dev_lock(hdev);
1149
1150         if (cp->val)
1151                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1152         else
1153                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1154
1155         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1156         if (err < 0)
1157                 goto failed;
1158
1159         err = new_settings(hdev, sk);
1160
1161 failed:
1162         hci_dev_unlock(hdev);
1163         return err;
1164 }
1165
1166 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1167                              u16 len)
1168 {
1169         struct mgmt_mode *cp = data;
1170         struct pending_cmd *cmd;
1171         u8 val;
1172         int err;
1173
1174         BT_DBG("request for %s", hdev->name);
1175
1176         if (!lmp_bredr_capable(hdev))
1177                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1178                                   MGMT_STATUS_NOT_SUPPORTED);
1179
1180         if (cp->val != 0x00 && cp->val != 0x01)
1181                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1182                                   MGMT_STATUS_INVALID_PARAMS);
1183
1184         hci_dev_lock(hdev);
1185
1186         if (!hdev_is_powered(hdev)) {
1187                 bool changed = false;
1188
1189                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1190                                           &hdev->dev_flags)) {
1191                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1192                         changed = true;
1193                 }
1194
1195                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1196                 if (err < 0)
1197                         goto failed;
1198
1199                 if (changed)
1200                         err = new_settings(hdev, sk);
1201
1202                 goto failed;
1203         }
1204
1205         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1206                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1207                                  MGMT_STATUS_BUSY);
1208                 goto failed;
1209         }
1210
1211         val = !!cp->val;
1212
1213         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1214                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1215                 goto failed;
1216         }
1217
1218         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1219         if (!cmd) {
1220                 err = -ENOMEM;
1221                 goto failed;
1222         }
1223
1224         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1225         if (err < 0) {
1226                 mgmt_pending_remove(cmd);
1227                 goto failed;
1228         }
1229
1230 failed:
1231         hci_dev_unlock(hdev);
1232         return err;
1233 }
1234
1235 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1236 {
1237         struct mgmt_mode *cp = data;
1238         struct pending_cmd *cmd;
1239         u8 val;
1240         int err;
1241
1242         BT_DBG("request for %s", hdev->name);
1243
1244         if (!lmp_ssp_capable(hdev))
1245                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1246                                   MGMT_STATUS_NOT_SUPPORTED);
1247
1248         if (cp->val != 0x00 && cp->val != 0x01)
1249                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1250                                   MGMT_STATUS_INVALID_PARAMS);
1251
1252         hci_dev_lock(hdev);
1253
1254         val = !!cp->val;
1255
1256         if (!hdev_is_powered(hdev)) {
1257                 bool changed = false;
1258
1259                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1260                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1261                         changed = true;
1262                 }
1263
1264                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1265                 if (err < 0)
1266                         goto failed;
1267
1268                 if (changed)
1269                         err = new_settings(hdev, sk);
1270
1271                 goto failed;
1272         }
1273
1274         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1275                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1276                                  MGMT_STATUS_BUSY);
1277                 goto failed;
1278         }
1279
1280         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1281                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1282                 goto failed;
1283         }
1284
1285         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1286         if (!cmd) {
1287                 err = -ENOMEM;
1288                 goto failed;
1289         }
1290
1291         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1292         if (err < 0) {
1293                 mgmt_pending_remove(cmd);
1294                 goto failed;
1295         }
1296
1297 failed:
1298         hci_dev_unlock(hdev);
1299         return err;
1300 }
1301
1302 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1303 {
1304         struct mgmt_mode *cp = data;
1305
1306         BT_DBG("request for %s", hdev->name);
1307
1308         if (!enable_hs)
1309                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1310                                   MGMT_STATUS_NOT_SUPPORTED);
1311
1312         if (cp->val != 0x00 && cp->val != 0x01)
1313                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1314                                   MGMT_STATUS_INVALID_PARAMS);
1315
1316         if (cp->val)
1317                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1318         else
1319                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1320
1321         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1322 }
1323
1324 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1325 {
1326         struct mgmt_mode *cp = data;
1327         struct hci_cp_write_le_host_supported hci_cp;
1328         struct pending_cmd *cmd;
1329         int err;
1330         u8 val, enabled;
1331
1332         BT_DBG("request for %s", hdev->name);
1333
1334         if (!lmp_le_capable(hdev))
1335                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1336                                   MGMT_STATUS_NOT_SUPPORTED);
1337
1338         if (cp->val != 0x00 && cp->val != 0x01)
1339                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1340                                   MGMT_STATUS_INVALID_PARAMS);
1341
1342         /* LE-only devices do not allow toggling LE on/off */
1343         if (!lmp_bredr_capable(hdev))
1344                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1345                                   MGMT_STATUS_REJECTED);
1346
1347         hci_dev_lock(hdev);
1348
1349         val = !!cp->val;
1350         enabled = lmp_host_le_capable(hdev);
1351
1352         if (!hdev_is_powered(hdev) || val == enabled) {
1353                 bool changed = false;
1354
1355                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1356                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1357                         changed = true;
1358                 }
1359
1360                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1361                 if (err < 0)
1362                         goto unlock;
1363
1364                 if (changed)
1365                         err = new_settings(hdev, sk);
1366
1367                 goto unlock;
1368         }
1369
1370         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1371                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1372                                  MGMT_STATUS_BUSY);
1373                 goto unlock;
1374         }
1375
1376         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1377         if (!cmd) {
1378                 err = -ENOMEM;
1379                 goto unlock;
1380         }
1381
1382         memset(&hci_cp, 0, sizeof(hci_cp));
1383
1384         if (val) {
1385                 hci_cp.le = val;
1386                 hci_cp.simul = lmp_le_br_capable(hdev);
1387         }
1388
1389         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1390                            &hci_cp);
1391         if (err < 0)
1392                 mgmt_pending_remove(cmd);
1393
1394 unlock:
1395         hci_dev_unlock(hdev);
1396         return err;
1397 }
1398
1399 /* This is a helper function to test for pending mgmt commands that can
1400  * cause CoD or EIR HCI commands. We can only allow one such pending
1401  * mgmt command at a time since otherwise we cannot easily track what
1402  * the current values are, will be, and based on that calculate if a new
1403  * HCI command needs to be sent and if yes with what value.
1404  */
1405 static bool pending_eir_or_class(struct hci_dev *hdev)
1406 {
1407         struct pending_cmd *cmd;
1408
1409         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1410                 switch (cmd->opcode) {
1411                 case MGMT_OP_ADD_UUID:
1412                 case MGMT_OP_REMOVE_UUID:
1413                 case MGMT_OP_SET_DEV_CLASS:
1414                 case MGMT_OP_SET_POWERED:
1415                         return true;
1416                 }
1417         }
1418
1419         return false;
1420 }
1421
1422 static const u8 bluetooth_base_uuid[] = {
1423                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1424                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1425 };
1426
1427 static u8 get_uuid_size(const u8 *uuid)
1428 {
1429         u32 val;
1430
1431         if (memcmp(uuid, bluetooth_base_uuid, 12))
1432                 return 128;
1433
1434         val = get_unaligned_le32(&uuid[12]);
1435         if (val > 0xffff)
1436                 return 32;
1437
1438         return 16;
1439 }
1440
1441 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1442 {
1443         struct pending_cmd *cmd;
1444
1445         hci_dev_lock(hdev);
1446
1447         cmd = mgmt_pending_find(mgmt_op, hdev);
1448         if (!cmd)
1449                 goto unlock;
1450
1451         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1452                      hdev->dev_class, 3);
1453
1454         mgmt_pending_remove(cmd);
1455
1456 unlock:
1457         hci_dev_unlock(hdev);
1458 }
1459
1460 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1461 {
1462         BT_DBG("status 0x%02x", status);
1463
1464         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1465 }
1466
1467 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1468 {
1469         struct mgmt_cp_add_uuid *cp = data;
1470         struct pending_cmd *cmd;
1471         struct hci_request req;
1472         struct bt_uuid *uuid;
1473         int err;
1474
1475         BT_DBG("request for %s", hdev->name);
1476
1477         hci_dev_lock(hdev);
1478
1479         if (pending_eir_or_class(hdev)) {
1480                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1481                                  MGMT_STATUS_BUSY);
1482                 goto failed;
1483         }
1484
1485         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1486         if (!uuid) {
1487                 err = -ENOMEM;
1488                 goto failed;
1489         }
1490
1491         memcpy(uuid->uuid, cp->uuid, 16);
1492         uuid->svc_hint = cp->svc_hint;
1493         uuid->size = get_uuid_size(cp->uuid);
1494
1495         list_add_tail(&uuid->list, &hdev->uuids);
1496
1497         hci_req_init(&req, hdev);
1498
1499         update_class(&req);
1500         update_eir(&req);
1501
1502         err = hci_req_run(&req, add_uuid_complete);
1503         if (err < 0) {
1504                 if (err != -ENODATA)
1505                         goto failed;
1506
1507                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1508                                    hdev->dev_class, 3);
1509                 goto failed;
1510         }
1511
1512         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1513         if (!cmd) {
1514                 err = -ENOMEM;
1515                 goto failed;
1516         }
1517
1518         err = 0;
1519
1520 failed:
1521         hci_dev_unlock(hdev);
1522         return err;
1523 }
1524
1525 static bool enable_service_cache(struct hci_dev *hdev)
1526 {
1527         if (!hdev_is_powered(hdev))
1528                 return false;
1529
1530         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1531                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1532                                    CACHE_TIMEOUT);
1533                 return true;
1534         }
1535
1536         return false;
1537 }
1538
1539 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1540 {
1541         BT_DBG("status 0x%02x", status);
1542
1543         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1544 }
1545
1546 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1547                        u16 len)
1548 {
1549         struct mgmt_cp_remove_uuid *cp = data;
1550         struct pending_cmd *cmd;
1551         struct bt_uuid *match, *tmp;
1552         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1553         struct hci_request req;
1554         int err, found;
1555
1556         BT_DBG("request for %s", hdev->name);
1557
1558         hci_dev_lock(hdev);
1559
1560         if (pending_eir_or_class(hdev)) {
1561                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1562                                  MGMT_STATUS_BUSY);
1563                 goto unlock;
1564         }
1565
1566         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1567                 err = hci_uuids_clear(hdev);
1568
1569                 if (enable_service_cache(hdev)) {
1570                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1571                                            0, hdev->dev_class, 3);
1572                         goto unlock;
1573                 }
1574
1575                 goto update_class;
1576         }
1577
1578         found = 0;
1579
1580         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1581                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1582                         continue;
1583
1584                 list_del(&match->list);
1585                 kfree(match);
1586                 found++;
1587         }
1588
1589         if (found == 0) {
1590                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1591                                  MGMT_STATUS_INVALID_PARAMS);
1592                 goto unlock;
1593         }
1594
1595 update_class:
1596         hci_req_init(&req, hdev);
1597
1598         update_class(&req);
1599         update_eir(&req);
1600
1601         err = hci_req_run(&req, remove_uuid_complete);
1602         if (err < 0) {
1603                 if (err != -ENODATA)
1604                         goto unlock;
1605
1606                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1607                                    hdev->dev_class, 3);
1608                 goto unlock;
1609         }
1610
1611         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1612         if (!cmd) {
1613                 err = -ENOMEM;
1614                 goto unlock;
1615         }
1616
1617         err = 0;
1618
1619 unlock:
1620         hci_dev_unlock(hdev);
1621         return err;
1622 }
1623
1624 static void set_class_complete(struct hci_dev *hdev, u8 status)
1625 {
1626         BT_DBG("status 0x%02x", status);
1627
1628         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1629 }
1630
1631 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1632                          u16 len)
1633 {
1634         struct mgmt_cp_set_dev_class *cp = data;
1635         struct pending_cmd *cmd;
1636         struct hci_request req;
1637         int err;
1638
1639         BT_DBG("request for %s", hdev->name);
1640
1641         if (!lmp_bredr_capable(hdev))
1642                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1643                                   MGMT_STATUS_NOT_SUPPORTED);
1644
1645         hci_dev_lock(hdev);
1646
1647         if (pending_eir_or_class(hdev)) {
1648                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1649                                  MGMT_STATUS_BUSY);
1650                 goto unlock;
1651         }
1652
1653         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1654                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1655                                  MGMT_STATUS_INVALID_PARAMS);
1656                 goto unlock;
1657         }
1658
1659         hdev->major_class = cp->major;
1660         hdev->minor_class = cp->minor;
1661
1662         if (!hdev_is_powered(hdev)) {
1663                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1664                                    hdev->dev_class, 3);
1665                 goto unlock;
1666         }
1667
1668         hci_req_init(&req, hdev);
1669
1670         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1671                 hci_dev_unlock(hdev);
1672                 cancel_delayed_work_sync(&hdev->service_cache);
1673                 hci_dev_lock(hdev);
1674                 update_eir(&req);
1675         }
1676
1677         update_class(&req);
1678
1679         err = hci_req_run(&req, set_class_complete);
1680         if (err < 0) {
1681                 if (err != -ENODATA)
1682                         goto unlock;
1683
1684                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1685                                    hdev->dev_class, 3);
1686                 goto unlock;
1687         }
1688
1689         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1690         if (!cmd) {
1691                 err = -ENOMEM;
1692                 goto unlock;
1693         }
1694
1695         err = 0;
1696
1697 unlock:
1698         hci_dev_unlock(hdev);
1699         return err;
1700 }
1701
1702 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1703                           u16 len)
1704 {
1705         struct mgmt_cp_load_link_keys *cp = data;
1706         u16 key_count, expected_len;
1707         int i;
1708
1709         key_count = __le16_to_cpu(cp->key_count);
1710
1711         expected_len = sizeof(*cp) + key_count *
1712                                         sizeof(struct mgmt_link_key_info);
1713         if (expected_len != len) {
1714                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1715                        len, expected_len);
1716                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1717                                   MGMT_STATUS_INVALID_PARAMS);
1718         }
1719
1720         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1721                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1722                                   MGMT_STATUS_INVALID_PARAMS);
1723
1724         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1725                key_count);
1726
1727         for (i = 0; i < key_count; i++) {
1728                 struct mgmt_link_key_info *key = &cp->keys[i];
1729
1730                 if (key->addr.type != BDADDR_BREDR)
1731                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1732                                           MGMT_STATUS_INVALID_PARAMS);
1733         }
1734
1735         hci_dev_lock(hdev);
1736
1737         hci_link_keys_clear(hdev);
1738
1739         if (cp->debug_keys)
1740                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1741         else
1742                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1743
1744         for (i = 0; i < key_count; i++) {
1745                 struct mgmt_link_key_info *key = &cp->keys[i];
1746
1747                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1748                                  key->type, key->pin_len);
1749         }
1750
1751         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1752
1753         hci_dev_unlock(hdev);
1754
1755         return 0;
1756 }
1757
1758 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1759                            u8 addr_type, struct sock *skip_sk)
1760 {
1761         struct mgmt_ev_device_unpaired ev;
1762
1763         bacpy(&ev.addr.bdaddr, bdaddr);
1764         ev.addr.type = addr_type;
1765
1766         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1767                           skip_sk);
1768 }
1769
1770 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1771                          u16 len)
1772 {
1773         struct mgmt_cp_unpair_device *cp = data;
1774         struct mgmt_rp_unpair_device rp;
1775         struct hci_cp_disconnect dc;
1776         struct pending_cmd *cmd;
1777         struct hci_conn *conn;
1778         int err;
1779
1780         memset(&rp, 0, sizeof(rp));
1781         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1782         rp.addr.type = cp->addr.type;
1783
1784         if (!bdaddr_type_is_valid(cp->addr.type))
1785                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1786                                     MGMT_STATUS_INVALID_PARAMS,
1787                                     &rp, sizeof(rp));
1788
1789         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1790                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1791                                     MGMT_STATUS_INVALID_PARAMS,
1792                                     &rp, sizeof(rp));
1793
1794         hci_dev_lock(hdev);
1795
1796         if (!hdev_is_powered(hdev)) {
1797                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1798                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1799                 goto unlock;
1800         }
1801
1802         if (cp->addr.type == BDADDR_BREDR)
1803                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1804         else
1805                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1806
1807         if (err < 0) {
1808                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1809                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1810                 goto unlock;
1811         }
1812
1813         if (cp->disconnect) {
1814                 if (cp->addr.type == BDADDR_BREDR)
1815                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1816                                                        &cp->addr.bdaddr);
1817                 else
1818                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1819                                                        &cp->addr.bdaddr);
1820         } else {
1821                 conn = NULL;
1822         }
1823
1824         if (!conn) {
1825                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1826                                    &rp, sizeof(rp));
1827                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1828                 goto unlock;
1829         }
1830
1831         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1832                                sizeof(*cp));
1833         if (!cmd) {
1834                 err = -ENOMEM;
1835                 goto unlock;
1836         }
1837
1838         dc.handle = cpu_to_le16(conn->handle);
1839         dc.reason = 0x13; /* Remote User Terminated Connection */
1840         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1841         if (err < 0)
1842                 mgmt_pending_remove(cmd);
1843
1844 unlock:
1845         hci_dev_unlock(hdev);
1846         return err;
1847 }
1848
1849 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1850                       u16 len)
1851 {
1852         struct mgmt_cp_disconnect *cp = data;
1853         struct mgmt_rp_disconnect rp;
1854         struct hci_cp_disconnect dc;
1855         struct pending_cmd *cmd;
1856         struct hci_conn *conn;
1857         int err;
1858
1859         BT_DBG("");
1860
1861         memset(&rp, 0, sizeof(rp));
1862         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1863         rp.addr.type = cp->addr.type;
1864
1865         if (!bdaddr_type_is_valid(cp->addr.type))
1866                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1867                                     MGMT_STATUS_INVALID_PARAMS,
1868                                     &rp, sizeof(rp));
1869
1870         hci_dev_lock(hdev);
1871
1872         if (!test_bit(HCI_UP, &hdev->flags)) {
1873                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1874                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1875                 goto failed;
1876         }
1877
1878         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1879                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1880                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1881                 goto failed;
1882         }
1883
1884         if (cp->addr.type == BDADDR_BREDR)
1885                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1886                                                &cp->addr.bdaddr);
1887         else
1888                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1889
1890         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1891                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1892                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1893                 goto failed;
1894         }
1895
1896         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1897         if (!cmd) {
1898                 err = -ENOMEM;
1899                 goto failed;
1900         }
1901
1902         dc.handle = cpu_to_le16(conn->handle);
1903         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1904
1905         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1906         if (err < 0)
1907                 mgmt_pending_remove(cmd);
1908
1909 failed:
1910         hci_dev_unlock(hdev);
1911         return err;
1912 }
1913
1914 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1915 {
1916         switch (link_type) {
1917         case LE_LINK:
1918                 switch (addr_type) {
1919                 case ADDR_LE_DEV_PUBLIC:
1920                         return BDADDR_LE_PUBLIC;
1921
1922                 default:
1923                         /* Fallback to LE Random address type */
1924                         return BDADDR_LE_RANDOM;
1925                 }
1926
1927         default:
1928                 /* Fallback to BR/EDR type */
1929                 return BDADDR_BREDR;
1930         }
1931 }
1932
1933 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1934                            u16 data_len)
1935 {
1936         struct mgmt_rp_get_connections *rp;
1937         struct hci_conn *c;
1938         size_t rp_len;
1939         int err;
1940         u16 i;
1941
1942         BT_DBG("");
1943
1944         hci_dev_lock(hdev);
1945
1946         if (!hdev_is_powered(hdev)) {
1947                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1948                                  MGMT_STATUS_NOT_POWERED);
1949                 goto unlock;
1950         }
1951
1952         i = 0;
1953         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1954                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1955                         i++;
1956         }
1957
1958         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1959         rp = kmalloc(rp_len, GFP_KERNEL);
1960         if (!rp) {
1961                 err = -ENOMEM;
1962                 goto unlock;
1963         }
1964
1965         i = 0;
1966         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1967                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1968                         continue;
1969                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1970                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1971                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1972                         continue;
1973                 i++;
1974         }
1975
1976         rp->conn_count = cpu_to_le16(i);
1977
1978         /* Recalculate length in case of filtered SCO connections, etc */
1979         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1980
1981         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1982                            rp_len);
1983
1984         kfree(rp);
1985
1986 unlock:
1987         hci_dev_unlock(hdev);
1988         return err;
1989 }
1990
1991 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1992                                    struct mgmt_cp_pin_code_neg_reply *cp)
1993 {
1994         struct pending_cmd *cmd;
1995         int err;
1996
1997         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1998                                sizeof(*cp));
1999         if (!cmd)
2000                 return -ENOMEM;
2001
2002         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2003                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2004         if (err < 0)
2005                 mgmt_pending_remove(cmd);
2006
2007         return err;
2008 }
2009
2010 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2011                           u16 len)
2012 {
2013         struct hci_conn *conn;
2014         struct mgmt_cp_pin_code_reply *cp = data;
2015         struct hci_cp_pin_code_reply reply;
2016         struct pending_cmd *cmd;
2017         int err;
2018
2019         BT_DBG("");
2020
2021         hci_dev_lock(hdev);
2022
2023         if (!hdev_is_powered(hdev)) {
2024                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2025                                  MGMT_STATUS_NOT_POWERED);
2026                 goto failed;
2027         }
2028
2029         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2030         if (!conn) {
2031                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2032                                  MGMT_STATUS_NOT_CONNECTED);
2033                 goto failed;
2034         }
2035
2036         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2037                 struct mgmt_cp_pin_code_neg_reply ncp;
2038
2039                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2040
2041                 BT_ERR("PIN code is not 16 bytes long");
2042
2043                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2044                 if (err >= 0)
2045                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2046                                          MGMT_STATUS_INVALID_PARAMS);
2047
2048                 goto failed;
2049         }
2050
2051         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2052         if (!cmd) {
2053                 err = -ENOMEM;
2054                 goto failed;
2055         }
2056
2057         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2058         reply.pin_len = cp->pin_len;
2059         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2060
2061         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2062         if (err < 0)
2063                 mgmt_pending_remove(cmd);
2064
2065 failed:
2066         hci_dev_unlock(hdev);
2067         return err;
2068 }
2069
2070 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2071                              u16 len)
2072 {
2073         struct mgmt_cp_set_io_capability *cp = data;
2074
2075         BT_DBG("");
2076
2077         hci_dev_lock(hdev);
2078
2079         hdev->io_capability = cp->io_capability;
2080
2081         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2082                hdev->io_capability);
2083
2084         hci_dev_unlock(hdev);
2085
2086         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2087                             0);
2088 }
2089
2090 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2091 {
2092         struct hci_dev *hdev = conn->hdev;
2093         struct pending_cmd *cmd;
2094
2095         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2096                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2097                         continue;
2098
2099                 if (cmd->user_data != conn)
2100                         continue;
2101
2102                 return cmd;
2103         }
2104
2105         return NULL;
2106 }
2107
2108 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2109 {
2110         struct mgmt_rp_pair_device rp;
2111         struct hci_conn *conn = cmd->user_data;
2112
2113         bacpy(&rp.addr.bdaddr, &conn->dst);
2114         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2115
2116         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2117                      &rp, sizeof(rp));
2118
2119         /* So we don't get further callbacks for this connection */
2120         conn->connect_cfm_cb = NULL;
2121         conn->security_cfm_cb = NULL;
2122         conn->disconn_cfm_cb = NULL;
2123
2124         hci_conn_drop(conn);
2125
2126         mgmt_pending_remove(cmd);
2127 }
2128
2129 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2130 {
2131         struct pending_cmd *cmd;
2132
2133         BT_DBG("status %u", status);
2134
2135         cmd = find_pairing(conn);
2136         if (!cmd)
2137                 BT_DBG("Unable to find a pending command");
2138         else
2139                 pairing_complete(cmd, mgmt_status(status));
2140 }
2141
2142 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2143 {
2144         struct pending_cmd *cmd;
2145
2146         BT_DBG("status %u", status);
2147
2148         if (!status)
2149                 return;
2150
2151         cmd = find_pairing(conn);
2152         if (!cmd)
2153                 BT_DBG("Unable to find a pending command");
2154         else
2155                 pairing_complete(cmd, mgmt_status(status));
2156 }
2157
2158 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2159                        u16 len)
2160 {
2161         struct mgmt_cp_pair_device *cp = data;
2162         struct mgmt_rp_pair_device rp;
2163         struct pending_cmd *cmd;
2164         u8 sec_level, auth_type;
2165         struct hci_conn *conn;
2166         int err;
2167
2168         BT_DBG("");
2169
2170         memset(&rp, 0, sizeof(rp));
2171         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2172         rp.addr.type = cp->addr.type;
2173
2174         if (!bdaddr_type_is_valid(cp->addr.type))
2175                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2176                                     MGMT_STATUS_INVALID_PARAMS,
2177                                     &rp, sizeof(rp));
2178
2179         hci_dev_lock(hdev);
2180
2181         if (!hdev_is_powered(hdev)) {
2182                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2183                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2184                 goto unlock;
2185         }
2186
2187         sec_level = BT_SECURITY_MEDIUM;
2188         if (cp->io_cap == 0x03)
2189                 auth_type = HCI_AT_DEDICATED_BONDING;
2190         else
2191                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2192
2193         if (cp->addr.type == BDADDR_BREDR)
2194                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2195                                    cp->addr.type, sec_level, auth_type);
2196         else
2197                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2198                                    cp->addr.type, sec_level, auth_type);
2199
2200         if (IS_ERR(conn)) {
2201                 int status;
2202
2203                 if (PTR_ERR(conn) == -EBUSY)
2204                         status = MGMT_STATUS_BUSY;
2205                 else
2206                         status = MGMT_STATUS_CONNECT_FAILED;
2207
2208                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2209                                    status, &rp,
2210                                    sizeof(rp));
2211                 goto unlock;
2212         }
2213
2214         if (conn->connect_cfm_cb) {
2215                 hci_conn_drop(conn);
2216                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2217                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2218                 goto unlock;
2219         }
2220
2221         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2222         if (!cmd) {
2223                 err = -ENOMEM;
2224                 hci_conn_drop(conn);
2225                 goto unlock;
2226         }
2227
2228         /* For LE, just connecting isn't a proof that the pairing finished */
2229         if (cp->addr.type == BDADDR_BREDR)
2230                 conn->connect_cfm_cb = pairing_complete_cb;
2231         else
2232                 conn->connect_cfm_cb = le_connect_complete_cb;
2233
2234         conn->security_cfm_cb = pairing_complete_cb;
2235         conn->disconn_cfm_cb = pairing_complete_cb;
2236         conn->io_capability = cp->io_cap;
2237         cmd->user_data = conn;
2238
2239         if (conn->state == BT_CONNECTED &&
2240             hci_conn_security(conn, sec_level, auth_type))
2241                 pairing_complete(cmd, 0);
2242
2243         err = 0;
2244
2245 unlock:
2246         hci_dev_unlock(hdev);
2247         return err;
2248 }
2249
2250 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2251                               u16 len)
2252 {
2253         struct mgmt_addr_info *addr = data;
2254         struct pending_cmd *cmd;
2255         struct hci_conn *conn;
2256         int err;
2257
2258         BT_DBG("");
2259
2260         hci_dev_lock(hdev);
2261
2262         if (!hdev_is_powered(hdev)) {
2263                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2264                                  MGMT_STATUS_NOT_POWERED);
2265                 goto unlock;
2266         }
2267
2268         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2269         if (!cmd) {
2270                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2271                                  MGMT_STATUS_INVALID_PARAMS);
2272                 goto unlock;
2273         }
2274
2275         conn = cmd->user_data;
2276
2277         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2278                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2279                                  MGMT_STATUS_INVALID_PARAMS);
2280                 goto unlock;
2281         }
2282
2283         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2284
2285         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2286                            addr, sizeof(*addr));
2287 unlock:
2288         hci_dev_unlock(hdev);
2289         return err;
2290 }
2291
2292 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2293                              struct mgmt_addr_info *addr, u16 mgmt_op,
2294                              u16 hci_op, __le32 passkey)
2295 {
2296         struct pending_cmd *cmd;
2297         struct hci_conn *conn;
2298         int err;
2299
2300         hci_dev_lock(hdev);
2301
2302         if (!hdev_is_powered(hdev)) {
2303                 err = cmd_complete(sk, hdev->id, mgmt_op,
2304                                    MGMT_STATUS_NOT_POWERED, addr,
2305                                    sizeof(*addr));
2306                 goto done;
2307         }
2308
2309         if (addr->type == BDADDR_BREDR)
2310                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2311         else
2312                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2313
2314         if (!conn) {
2315                 err = cmd_complete(sk, hdev->id, mgmt_op,
2316                                    MGMT_STATUS_NOT_CONNECTED, addr,
2317                                    sizeof(*addr));
2318                 goto done;
2319         }
2320
2321         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2322                 /* Continue with pairing via SMP */
2323                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2324
2325                 if (!err)
2326                         err = cmd_complete(sk, hdev->id, mgmt_op,
2327                                            MGMT_STATUS_SUCCESS, addr,
2328                                            sizeof(*addr));
2329                 else
2330                         err = cmd_complete(sk, hdev->id, mgmt_op,
2331                                            MGMT_STATUS_FAILED, addr,
2332                                            sizeof(*addr));
2333
2334                 goto done;
2335         }
2336
2337         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2338         if (!cmd) {
2339                 err = -ENOMEM;
2340                 goto done;
2341         }
2342
2343         /* Continue with pairing via HCI */
2344         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2345                 struct hci_cp_user_passkey_reply cp;
2346
2347                 bacpy(&cp.bdaddr, &addr->bdaddr);
2348                 cp.passkey = passkey;
2349                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2350         } else
2351                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2352                                    &addr->bdaddr);
2353
2354         if (err < 0)
2355                 mgmt_pending_remove(cmd);
2356
2357 done:
2358         hci_dev_unlock(hdev);
2359         return err;
2360 }
2361
2362 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2363                               void *data, u16 len)
2364 {
2365         struct mgmt_cp_pin_code_neg_reply *cp = data;
2366
2367         BT_DBG("");
2368
2369         return user_pairing_resp(sk, hdev, &cp->addr,
2370                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2371                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2372 }
2373
2374 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2375                               u16 len)
2376 {
2377         struct mgmt_cp_user_confirm_reply *cp = data;
2378
2379         BT_DBG("");
2380
2381         if (len != sizeof(*cp))
2382                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2383                                   MGMT_STATUS_INVALID_PARAMS);
2384
2385         return user_pairing_resp(sk, hdev, &cp->addr,
2386                                  MGMT_OP_USER_CONFIRM_REPLY,
2387                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2388 }
2389
2390 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2391                                   void *data, u16 len)
2392 {
2393         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2394
2395         BT_DBG("");
2396
2397         return user_pairing_resp(sk, hdev, &cp->addr,
2398                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2399                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2400 }
2401
2402 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2403                               u16 len)
2404 {
2405         struct mgmt_cp_user_passkey_reply *cp = data;
2406
2407         BT_DBG("");
2408
2409         return user_pairing_resp(sk, hdev, &cp->addr,
2410                                  MGMT_OP_USER_PASSKEY_REPLY,
2411                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2412 }
2413
2414 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2415                                   void *data, u16 len)
2416 {
2417         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2418
2419         BT_DBG("");
2420
2421         return user_pairing_resp(sk, hdev, &cp->addr,
2422                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2423                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2424 }
2425
2426 static void update_name(struct hci_request *req)
2427 {
2428         struct hci_dev *hdev = req->hdev;
2429         struct hci_cp_write_local_name cp;
2430
2431         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2432
2433         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2434 }
2435
2436 static void set_name_complete(struct hci_dev *hdev, u8 status)
2437 {
2438         struct mgmt_cp_set_local_name *cp;
2439         struct pending_cmd *cmd;
2440
2441         BT_DBG("status 0x%02x", status);
2442
2443         hci_dev_lock(hdev);
2444
2445         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2446         if (!cmd)
2447                 goto unlock;
2448
2449         cp = cmd->param;
2450
2451         if (status)
2452                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2453                            mgmt_status(status));
2454         else
2455                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2456                              cp, sizeof(*cp));
2457
2458         mgmt_pending_remove(cmd);
2459
2460 unlock:
2461         hci_dev_unlock(hdev);
2462 }
2463
2464 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2465                           u16 len)
2466 {
2467         struct mgmt_cp_set_local_name *cp = data;
2468         struct pending_cmd *cmd;
2469         struct hci_request req;
2470         int err;
2471
2472         BT_DBG("");
2473
2474         hci_dev_lock(hdev);
2475
2476         /* If the old values are the same as the new ones just return a
2477          * direct command complete event.
2478          */
2479         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2480             !memcmp(hdev->short_name, cp->short_name,
2481                     sizeof(hdev->short_name))) {
2482                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2483                                    data, len);
2484                 goto failed;
2485         }
2486
2487         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2488
2489         if (!hdev_is_powered(hdev)) {
2490                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2491
2492                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2493                                    data, len);
2494                 if (err < 0)
2495                         goto failed;
2496
2497                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2498                                  sk);
2499
2500                 goto failed;
2501         }
2502
2503         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2504         if (!cmd) {
2505                 err = -ENOMEM;
2506                 goto failed;
2507         }
2508
2509         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2510
2511         hci_req_init(&req, hdev);
2512
2513         if (lmp_bredr_capable(hdev)) {
2514                 update_name(&req);
2515                 update_eir(&req);
2516         }
2517
2518         if (lmp_le_capable(hdev))
2519                 hci_update_ad(&req);
2520
2521         err = hci_req_run(&req, set_name_complete);
2522         if (err < 0)
2523                 mgmt_pending_remove(cmd);
2524
2525 failed:
2526         hci_dev_unlock(hdev);
2527         return err;
2528 }
2529
2530 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2531                                void *data, u16 data_len)
2532 {
2533         struct pending_cmd *cmd;
2534         int err;
2535
2536         BT_DBG("%s", hdev->name);
2537
2538         hci_dev_lock(hdev);
2539
2540         if (!hdev_is_powered(hdev)) {
2541                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2542                                  MGMT_STATUS_NOT_POWERED);
2543                 goto unlock;
2544         }
2545
2546         if (!lmp_ssp_capable(hdev)) {
2547                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2548                                  MGMT_STATUS_NOT_SUPPORTED);
2549                 goto unlock;
2550         }
2551
2552         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2553                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2554                                  MGMT_STATUS_BUSY);
2555                 goto unlock;
2556         }
2557
2558         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2559         if (!cmd) {
2560                 err = -ENOMEM;
2561                 goto unlock;
2562         }
2563
2564         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2565         if (err < 0)
2566                 mgmt_pending_remove(cmd);
2567
2568 unlock:
2569         hci_dev_unlock(hdev);
2570         return err;
2571 }
2572
2573 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2574                                void *data, u16 len)
2575 {
2576         struct mgmt_cp_add_remote_oob_data *cp = data;
2577         u8 status;
2578         int err;
2579
2580         BT_DBG("%s ", hdev->name);
2581
2582         hci_dev_lock(hdev);
2583
2584         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2585                                       cp->randomizer);
2586         if (err < 0)
2587                 status = MGMT_STATUS_FAILED;
2588         else
2589                 status = MGMT_STATUS_SUCCESS;
2590
2591         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2592                            &cp->addr, sizeof(cp->addr));
2593
2594         hci_dev_unlock(hdev);
2595         return err;
2596 }
2597
2598 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2599                                   void *data, u16 len)
2600 {
2601         struct mgmt_cp_remove_remote_oob_data *cp = data;
2602         u8 status;
2603         int err;
2604
2605         BT_DBG("%s", hdev->name);
2606
2607         hci_dev_lock(hdev);
2608
2609         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2610         if (err < 0)
2611                 status = MGMT_STATUS_INVALID_PARAMS;
2612         else
2613                 status = MGMT_STATUS_SUCCESS;
2614
2615         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2616                            status, &cp->addr, sizeof(cp->addr));
2617
2618         hci_dev_unlock(hdev);
2619         return err;
2620 }
2621
2622 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2623 {
2624         struct pending_cmd *cmd;
2625         u8 type;
2626         int err;
2627
2628         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2629
2630         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2631         if (!cmd)
2632                 return -ENOENT;
2633
2634         type = hdev->discovery.type;
2635
2636         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2637                            &type, sizeof(type));
2638         mgmt_pending_remove(cmd);
2639
2640         return err;
2641 }
2642
2643 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
2644 {
2645         BT_DBG("status %d", status);
2646
2647         if (status) {
2648                 hci_dev_lock(hdev);
2649                 mgmt_start_discovery_failed(hdev, status);
2650                 hci_dev_unlock(hdev);
2651                 return;
2652         }
2653
2654         hci_dev_lock(hdev);
2655         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2656         hci_dev_unlock(hdev);
2657
2658         switch (hdev->discovery.type) {
2659         case DISCOV_TYPE_LE:
2660                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2661                                    DISCOV_LE_TIMEOUT);
2662                 break;
2663
2664         case DISCOV_TYPE_INTERLEAVED:
2665                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2666                                    DISCOV_INTERLEAVED_TIMEOUT);
2667                 break;
2668
2669         case DISCOV_TYPE_BREDR:
2670                 break;
2671
2672         default:
2673                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
2674         }
2675 }
2676
2677 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2678                            void *data, u16 len)
2679 {
2680         struct mgmt_cp_start_discovery *cp = data;
2681         struct pending_cmd *cmd;
2682         struct hci_cp_le_set_scan_param param_cp;
2683         struct hci_cp_le_set_scan_enable enable_cp;
2684         struct hci_cp_inquiry inq_cp;
2685         struct hci_request req;
2686         /* General inquiry access code (GIAC) */
2687         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2688         int err;
2689
2690         BT_DBG("%s", hdev->name);
2691
2692         hci_dev_lock(hdev);
2693
2694         if (!hdev_is_powered(hdev)) {
2695                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2696                                  MGMT_STATUS_NOT_POWERED);
2697                 goto failed;
2698         }
2699
2700         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2701                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2702                                  MGMT_STATUS_BUSY);
2703                 goto failed;
2704         }
2705
2706         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2707                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2708                                  MGMT_STATUS_BUSY);
2709                 goto failed;
2710         }
2711
2712         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2713         if (!cmd) {
2714                 err = -ENOMEM;
2715                 goto failed;
2716         }
2717
2718         hdev->discovery.type = cp->type;
2719
2720         hci_req_init(&req, hdev);
2721
2722         switch (hdev->discovery.type) {
2723         case DISCOV_TYPE_BREDR:
2724                 if (!lmp_bredr_capable(hdev)) {
2725                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2726                                          MGMT_STATUS_NOT_SUPPORTED);
2727                         mgmt_pending_remove(cmd);
2728                         goto failed;
2729                 }
2730
2731                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2732                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2733                                          MGMT_STATUS_BUSY);
2734                         mgmt_pending_remove(cmd);
2735                         goto failed;
2736                 }
2737
2738                 hci_inquiry_cache_flush(hdev);
2739
2740                 memset(&inq_cp, 0, sizeof(inq_cp));
2741                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
2742                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
2743                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
2744                 break;
2745
2746         case DISCOV_TYPE_LE:
2747         case DISCOV_TYPE_INTERLEAVED:
2748                 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2749                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2750                                          MGMT_STATUS_NOT_SUPPORTED);
2751                         mgmt_pending_remove(cmd);
2752                         goto failed;
2753                 }
2754
2755                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
2756                     !lmp_bredr_capable(hdev)) {
2757                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2758                                          MGMT_STATUS_NOT_SUPPORTED);
2759                         mgmt_pending_remove(cmd);
2760                         goto failed;
2761                 }
2762
2763                 if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
2764                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2765                                          MGMT_STATUS_REJECTED);
2766                         mgmt_pending_remove(cmd);
2767                         goto failed;
2768                 }
2769
2770                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
2771                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2772                                          MGMT_STATUS_BUSY);
2773                         mgmt_pending_remove(cmd);
2774                         goto failed;
2775                 }
2776
2777                 memset(&param_cp, 0, sizeof(param_cp));
2778                 param_cp.type = LE_SCAN_ACTIVE;
2779                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
2780                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
2781                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
2782                             &param_cp);
2783
2784                 memset(&enable_cp, 0, sizeof(enable_cp));
2785                 enable_cp.enable = LE_SCAN_ENABLE;
2786                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2787                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
2788                             &enable_cp);
2789                 break;
2790
2791         default:
2792                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2793                                  MGMT_STATUS_INVALID_PARAMS);
2794                 mgmt_pending_remove(cmd);
2795                 goto failed;
2796         }
2797
2798         err = hci_req_run(&req, start_discovery_complete);
2799         if (err < 0)
2800                 mgmt_pending_remove(cmd);
2801         else
2802                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2803
2804 failed:
2805         hci_dev_unlock(hdev);
2806         return err;
2807 }
2808
2809 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2810 {
2811         struct pending_cmd *cmd;
2812         int err;
2813
2814         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2815         if (!cmd)
2816                 return -ENOENT;
2817
2818         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2819                            &hdev->discovery.type, sizeof(hdev->discovery.type));
2820         mgmt_pending_remove(cmd);
2821
2822         return err;
2823 }
2824
2825 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
2826 {
2827         BT_DBG("status %d", status);
2828
2829         hci_dev_lock(hdev);
2830
2831         if (status) {
2832                 mgmt_stop_discovery_failed(hdev, status);
2833                 goto unlock;
2834         }
2835
2836         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2837
2838 unlock:
2839         hci_dev_unlock(hdev);
2840 }
2841
2842 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2843                           u16 len)
2844 {
2845         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2846         struct pending_cmd *cmd;
2847         struct hci_cp_remote_name_req_cancel cp;
2848         struct inquiry_entry *e;
2849         struct hci_request req;
2850         struct hci_cp_le_set_scan_enable enable_cp;
2851         int err;
2852
2853         BT_DBG("%s", hdev->name);
2854
2855         hci_dev_lock(hdev);
2856
2857         if (!hci_discovery_active(hdev)) {
2858                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2859                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2860                                    sizeof(mgmt_cp->type));
2861                 goto unlock;
2862         }
2863
2864         if (hdev->discovery.type != mgmt_cp->type) {
2865                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2866                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2867                                    sizeof(mgmt_cp->type));
2868                 goto unlock;
2869         }
2870
2871         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2872         if (!cmd) {
2873                 err = -ENOMEM;
2874                 goto unlock;
2875         }
2876
2877         hci_req_init(&req, hdev);
2878
2879         switch (hdev->discovery.state) {
2880         case DISCOVERY_FINDING:
2881                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2882                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2883                 } else {
2884                         cancel_delayed_work(&hdev->le_scan_disable);
2885
2886                         memset(&enable_cp, 0, sizeof(enable_cp));
2887                         enable_cp.enable = LE_SCAN_DISABLE;
2888                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
2889                                     sizeof(enable_cp), &enable_cp);
2890                 }
2891
2892                 break;
2893
2894         case DISCOVERY_RESOLVING:
2895                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2896                                                      NAME_PENDING);
2897                 if (!e) {
2898                         mgmt_pending_remove(cmd);
2899                         err = cmd_complete(sk, hdev->id,
2900                                            MGMT_OP_STOP_DISCOVERY, 0,
2901                                            &mgmt_cp->type,
2902                                            sizeof(mgmt_cp->type));
2903                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2904                         goto unlock;
2905                 }
2906
2907                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2908                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
2909                             &cp);
2910
2911                 break;
2912
2913         default:
2914                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2915
2916                 mgmt_pending_remove(cmd);
2917                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2918                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
2919                                    sizeof(mgmt_cp->type));
2920                 goto unlock;
2921         }
2922
2923         err = hci_req_run(&req, stop_discovery_complete);
2924         if (err < 0)
2925                 mgmt_pending_remove(cmd);
2926         else
2927                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2928
2929 unlock:
2930         hci_dev_unlock(hdev);
2931         return err;
2932 }
2933
2934 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2935                         u16 len)
2936 {
2937         struct mgmt_cp_confirm_name *cp = data;
2938         struct inquiry_entry *e;
2939         int err;
2940
2941         BT_DBG("%s", hdev->name);
2942
2943         hci_dev_lock(hdev);
2944
2945         if (!hci_discovery_active(hdev)) {
2946                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2947                                  MGMT_STATUS_FAILED);
2948                 goto failed;
2949         }
2950
2951         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2952         if (!e) {
2953                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2954                                  MGMT_STATUS_INVALID_PARAMS);
2955                 goto failed;
2956         }
2957
2958         if (cp->name_known) {
2959                 e->name_state = NAME_KNOWN;
2960                 list_del(&e->list);
2961         } else {
2962                 e->name_state = NAME_NEEDED;
2963                 hci_inquiry_cache_update_resolve(hdev, e);
2964         }
2965
2966         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
2967                            sizeof(cp->addr));
2968
2969 failed:
2970         hci_dev_unlock(hdev);
2971         return err;
2972 }
2973
2974 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2975                         u16 len)
2976 {
2977         struct mgmt_cp_block_device *cp = data;
2978         u8 status;
2979         int err;
2980
2981         BT_DBG("%s", hdev->name);
2982
2983         if (!bdaddr_type_is_valid(cp->addr.type))
2984                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
2985                                     MGMT_STATUS_INVALID_PARAMS,
2986                                     &cp->addr, sizeof(cp->addr));
2987
2988         hci_dev_lock(hdev);
2989
2990         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2991         if (err < 0)
2992                 status = MGMT_STATUS_FAILED;
2993         else
2994                 status = MGMT_STATUS_SUCCESS;
2995
2996         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2997                            &cp->addr, sizeof(cp->addr));
2998
2999         hci_dev_unlock(hdev);
3000
3001         return err;
3002 }
3003
3004 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3005                           u16 len)
3006 {
3007         struct mgmt_cp_unblock_device *cp = data;
3008         u8 status;
3009         int err;
3010
3011         BT_DBG("%s", hdev->name);
3012
3013         if (!bdaddr_type_is_valid(cp->addr.type))
3014                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3015                                     MGMT_STATUS_INVALID_PARAMS,
3016                                     &cp->addr, sizeof(cp->addr));
3017
3018         hci_dev_lock(hdev);
3019
3020         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3021         if (err < 0)
3022                 status = MGMT_STATUS_INVALID_PARAMS;
3023         else
3024                 status = MGMT_STATUS_SUCCESS;
3025
3026         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3027                            &cp->addr, sizeof(cp->addr));
3028
3029         hci_dev_unlock(hdev);
3030
3031         return err;
3032 }
3033
3034 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3035                          u16 len)
3036 {
3037         struct mgmt_cp_set_device_id *cp = data;
3038         struct hci_request req;
3039         int err;
3040         __u16 source;
3041
3042         BT_DBG("%s", hdev->name);
3043
3044         source = __le16_to_cpu(cp->source);
3045
3046         if (source > 0x0002)
3047                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3048                                   MGMT_STATUS_INVALID_PARAMS);
3049
3050         hci_dev_lock(hdev);
3051
3052         hdev->devid_source = source;
3053         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3054         hdev->devid_product = __le16_to_cpu(cp->product);
3055         hdev->devid_version = __le16_to_cpu(cp->version);
3056
3057         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3058
3059         hci_req_init(&req, hdev);
3060         update_eir(&req);
3061         hci_req_run(&req, NULL);
3062
3063         hci_dev_unlock(hdev);
3064
3065         return err;
3066 }
3067
3068 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3069 {
3070         struct pending_cmd *cmd;
3071
3072         BT_DBG("status 0x%02x", status);
3073
3074         hci_dev_lock(hdev);
3075
3076         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3077         if (!cmd)
3078                 goto unlock;
3079
3080         if (status) {
3081                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3082                            mgmt_status(status));
3083         } else {
3084                 struct mgmt_mode *cp = cmd->param;
3085
3086                 if (cp->val)
3087                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3088                 else
3089                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3090
3091                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3092                 new_settings(hdev, cmd->sk);
3093         }
3094
3095         mgmt_pending_remove(cmd);
3096
3097 unlock:
3098         hci_dev_unlock(hdev);
3099 }
3100
3101 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3102                                 void *data, u16 len)
3103 {
3104         struct mgmt_mode *cp = data;
3105         struct pending_cmd *cmd;
3106         struct hci_request req;
3107         int err;
3108
3109         BT_DBG("%s", hdev->name);
3110
3111         if (!lmp_bredr_capable(hdev) || hdev->hci_ver < BLUETOOTH_VER_1_2)
3112                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3113                                   MGMT_STATUS_NOT_SUPPORTED);
3114
3115         if (cp->val != 0x00 && cp->val != 0x01)
3116                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3117                                   MGMT_STATUS_INVALID_PARAMS);
3118
3119         if (!hdev_is_powered(hdev))
3120                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3121                                   MGMT_STATUS_NOT_POWERED);
3122
3123         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3124                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3125                                   MGMT_STATUS_REJECTED);
3126
3127         hci_dev_lock(hdev);
3128
3129         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3130                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3131                                  MGMT_STATUS_BUSY);
3132                 goto unlock;
3133         }
3134
3135         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3136                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3137                                         hdev);
3138                 goto unlock;
3139         }
3140
3141         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3142                                data, len);
3143         if (!cmd) {
3144                 err = -ENOMEM;
3145                 goto unlock;
3146         }
3147
3148         hci_req_init(&req, hdev);
3149
3150         write_fast_connectable(&req, cp->val);
3151
3152         err = hci_req_run(&req, fast_connectable_complete);
3153         if (err < 0) {
3154                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3155                                  MGMT_STATUS_FAILED);
3156                 mgmt_pending_remove(cmd);
3157         }
3158
3159 unlock:
3160         hci_dev_unlock(hdev);
3161
3162         return err;
3163 }
3164
3165 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3166 {
3167         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3168                 return false;
3169         if (key->master != 0x00 && key->master != 0x01)
3170                 return false;
3171         if (!bdaddr_type_is_le(key->addr.type))
3172                 return false;
3173         return true;
3174 }
3175
3176 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3177                                void *cp_data, u16 len)
3178 {
3179         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3180         u16 key_count, expected_len;
3181         int i, err;
3182
3183         key_count = __le16_to_cpu(cp->key_count);
3184
3185         expected_len = sizeof(*cp) + key_count *
3186                                         sizeof(struct mgmt_ltk_info);
3187         if (expected_len != len) {
3188                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3189                        len, expected_len);
3190                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3191                                   MGMT_STATUS_INVALID_PARAMS);
3192         }
3193
3194         BT_DBG("%s key_count %u", hdev->name, key_count);
3195
3196         for (i = 0; i < key_count; i++) {
3197                 struct mgmt_ltk_info *key = &cp->keys[i];
3198
3199                 if (!ltk_is_valid(key))
3200                         return cmd_status(sk, hdev->id,
3201                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3202                                           MGMT_STATUS_INVALID_PARAMS);
3203         }
3204
3205         hci_dev_lock(hdev);
3206
3207         hci_smp_ltks_clear(hdev);
3208
3209         for (i = 0; i < key_count; i++) {
3210                 struct mgmt_ltk_info *key = &cp->keys[i];
3211                 u8 type;
3212
3213                 if (key->master)
3214                         type = HCI_SMP_LTK;
3215                 else
3216                         type = HCI_SMP_LTK_SLAVE;
3217
3218                 hci_add_ltk(hdev, &key->addr.bdaddr,
3219                             bdaddr_to_le(key->addr.type),
3220                             type, 0, key->authenticated, key->val,
3221                             key->enc_size, key->ediv, key->rand);
3222         }
3223
3224         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3225                            NULL, 0);
3226
3227         hci_dev_unlock(hdev);
3228
3229         return err;
3230 }
3231
3232 static const struct mgmt_handler {
3233         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3234                      u16 data_len);
3235         bool var_len;
3236         size_t data_len;
3237 } mgmt_handlers[] = {
3238         { NULL }, /* 0x0000 (no command) */
3239         { read_version,           false, MGMT_READ_VERSION_SIZE },
3240         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3241         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3242         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3243         { set_powered,            false, MGMT_SETTING_SIZE },
3244         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3245         { set_connectable,        false, MGMT_SETTING_SIZE },
3246         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3247         { set_pairable,           false, MGMT_SETTING_SIZE },
3248         { set_link_security,      false, MGMT_SETTING_SIZE },
3249         { set_ssp,                false, MGMT_SETTING_SIZE },
3250         { set_hs,                 false, MGMT_SETTING_SIZE },
3251         { set_le,                 false, MGMT_SETTING_SIZE },
3252         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3253         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3254         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3255         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3256         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3257         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3258         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3259         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3260         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3261         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3262         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3263         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3264         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3265         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3266         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3267         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3268         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3269         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3270         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3271         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3272         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3273         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3274         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3275         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3276         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3277         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3278         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3279 };
3280
3281
3282 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3283 {
3284         void *buf;
3285         u8 *cp;
3286         struct mgmt_hdr *hdr;
3287         u16 opcode, index, len;
3288         struct hci_dev *hdev = NULL;
3289         const struct mgmt_handler *handler;
3290         int err;
3291
3292         BT_DBG("got %zu bytes", msglen);
3293
3294         if (msglen < sizeof(*hdr))
3295                 return -EINVAL;
3296
3297         buf = kmalloc(msglen, GFP_KERNEL);
3298         if (!buf)
3299                 return -ENOMEM;
3300
3301         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3302                 err = -EFAULT;
3303                 goto done;
3304         }
3305
3306         hdr = buf;
3307         opcode = __le16_to_cpu(hdr->opcode);
3308         index = __le16_to_cpu(hdr->index);
3309         len = __le16_to_cpu(hdr->len);
3310
3311         if (len != msglen - sizeof(*hdr)) {
3312                 err = -EINVAL;
3313                 goto done;
3314         }
3315
3316         if (index != MGMT_INDEX_NONE) {
3317                 hdev = hci_dev_get(index);
3318                 if (!hdev) {
3319                         err = cmd_status(sk, index, opcode,
3320                                          MGMT_STATUS_INVALID_INDEX);
3321                         goto done;
3322                 }
3323         }
3324
3325         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3326             mgmt_handlers[opcode].func == NULL) {
3327                 BT_DBG("Unknown op %u", opcode);
3328                 err = cmd_status(sk, index, opcode,
3329                                  MGMT_STATUS_UNKNOWN_COMMAND);
3330                 goto done;
3331         }
3332
3333         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3334             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3335                 err = cmd_status(sk, index, opcode,
3336                                  MGMT_STATUS_INVALID_INDEX);
3337                 goto done;
3338         }
3339
3340         handler = &mgmt_handlers[opcode];
3341
3342         if ((handler->var_len && len < handler->data_len) ||
3343             (!handler->var_len && len != handler->data_len)) {
3344                 err = cmd_status(sk, index, opcode,
3345                                  MGMT_STATUS_INVALID_PARAMS);
3346                 goto done;
3347         }
3348
3349         if (hdev)
3350                 mgmt_init_hdev(sk, hdev);
3351
3352         cp = buf + sizeof(*hdr);
3353
3354         err = handler->func(sk, hdev, cp, len);
3355         if (err < 0)
3356                 goto done;
3357
3358         err = msglen;
3359
3360 done:
3361         if (hdev)
3362                 hci_dev_put(hdev);
3363
3364         kfree(buf);
3365         return err;
3366 }
3367
3368 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
3369 {
3370         u8 *status = data;
3371
3372         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
3373         mgmt_pending_remove(cmd);
3374 }
3375
3376 int mgmt_index_added(struct hci_dev *hdev)
3377 {
3378         if (!mgmt_valid_hdev(hdev))
3379                 return -ENOTSUPP;
3380
3381         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3382 }
3383
3384 int mgmt_index_removed(struct hci_dev *hdev)
3385 {
3386         u8 status = MGMT_STATUS_INVALID_INDEX;
3387
3388         if (!mgmt_valid_hdev(hdev))
3389                 return -ENOTSUPP;
3390
3391         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3392
3393         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3394 }
3395
3396 struct cmd_lookup {
3397         struct sock *sk;
3398         struct hci_dev *hdev;
3399         u8 mgmt_status;
3400 };
3401
3402 static void settings_rsp(struct pending_cmd *cmd, void *data)
3403 {
3404         struct cmd_lookup *match = data;
3405
3406         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
3407
3408         list_del(&cmd->list);
3409
3410         if (match->sk == NULL) {
3411                 match->sk = cmd->sk;
3412                 sock_hold(match->sk);
3413         }
3414
3415         mgmt_pending_free(cmd);
3416 }
3417
3418 static void set_bredr_scan(struct hci_request *req)
3419 {
3420         struct hci_dev *hdev = req->hdev;
3421         u8 scan = 0;
3422
3423         /* Ensure that fast connectable is disabled. This function will
3424          * not do anything if the page scan parameters are already what
3425          * they should be.
3426          */
3427         write_fast_connectable(req, false);
3428
3429         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3430                 scan |= SCAN_PAGE;
3431         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3432                 scan |= SCAN_INQUIRY;
3433
3434         if (scan)
3435                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3436 }
3437
3438 static void powered_complete(struct hci_dev *hdev, u8 status)
3439 {
3440         struct cmd_lookup match = { NULL, hdev };
3441
3442         BT_DBG("status 0x%02x", status);
3443
3444         hci_dev_lock(hdev);
3445
3446         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3447
3448         new_settings(hdev, match.sk);
3449
3450         hci_dev_unlock(hdev);
3451
3452         if (match.sk)
3453                 sock_put(match.sk);
3454 }
3455
3456 static int powered_update_hci(struct hci_dev *hdev)
3457 {
3458         struct hci_request req;
3459         u8 link_sec;
3460
3461         hci_req_init(&req, hdev);
3462
3463         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3464             !lmp_host_ssp_capable(hdev)) {
3465                 u8 ssp = 1;
3466
3467                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3468         }
3469
3470         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
3471             lmp_bredr_capable(hdev)) {
3472                 struct hci_cp_write_le_host_supported cp;
3473
3474                 cp.le = 1;
3475                 cp.simul = lmp_le_br_capable(hdev);
3476
3477                 /* Check first if we already have the right
3478                  * host state (host features set)
3479                  */
3480                 if (cp.le != lmp_host_le_capable(hdev) ||
3481                     cp.simul != lmp_host_le_br_capable(hdev))
3482                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3483                                     sizeof(cp), &cp);
3484         }
3485
3486         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3487         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3488                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3489                             sizeof(link_sec), &link_sec);
3490
3491         if (lmp_bredr_capable(hdev)) {
3492                 set_bredr_scan(&req);
3493                 update_class(&req);
3494                 update_name(&req);
3495                 update_eir(&req);
3496         }
3497
3498         return hci_req_run(&req, powered_complete);
3499 }
3500
3501 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3502 {
3503         struct cmd_lookup match = { NULL, hdev };
3504         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3505         u8 zero_cod[] = { 0, 0, 0 };
3506         int err;
3507
3508         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3509                 return 0;
3510
3511         if (powered) {
3512                 if (powered_update_hci(hdev) == 0)
3513                         return 0;
3514
3515                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3516                                      &match);
3517                 goto new_settings;
3518         }
3519
3520         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3521         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3522
3523         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3524                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3525                            zero_cod, sizeof(zero_cod), NULL);
3526
3527 new_settings:
3528         err = new_settings(hdev, match.sk);
3529
3530         if (match.sk)
3531                 sock_put(match.sk);
3532
3533         return err;
3534 }
3535
3536 int mgmt_set_powered_failed(struct hci_dev *hdev, int err)
3537 {
3538         struct pending_cmd *cmd;
3539         u8 status;
3540
3541         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
3542         if (!cmd)
3543                 return -ENOENT;
3544
3545         if (err == -ERFKILL)
3546                 status = MGMT_STATUS_RFKILLED;
3547         else
3548                 status = MGMT_STATUS_FAILED;
3549
3550         err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
3551
3552         mgmt_pending_remove(cmd);
3553
3554         return err;
3555 }
3556
3557 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3558 {
3559         struct cmd_lookup match = { NULL, hdev };
3560         bool changed = false;
3561         int err = 0;
3562
3563         if (discoverable) {
3564                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3565                         changed = true;
3566         } else {
3567                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3568                         changed = true;
3569         }
3570
3571         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3572                              &match);
3573
3574         if (changed)
3575                 err = new_settings(hdev, match.sk);
3576
3577         if (match.sk)
3578                 sock_put(match.sk);
3579
3580         return err;
3581 }
3582
3583 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3584 {
3585         struct pending_cmd *cmd;
3586         bool changed = false;
3587         int err = 0;
3588
3589         if (connectable) {
3590                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3591                         changed = true;
3592         } else {
3593                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3594                         changed = true;
3595         }
3596
3597         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
3598
3599         if (changed)
3600                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
3601
3602         return err;
3603 }
3604
3605 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3606 {
3607         u8 mgmt_err = mgmt_status(status);
3608
3609         if (scan & SCAN_PAGE)
3610                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3611                                      cmd_status_rsp, &mgmt_err);
3612
3613         if (scan & SCAN_INQUIRY)
3614                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3615                                      cmd_status_rsp, &mgmt_err);
3616
3617         return 0;
3618 }
3619
3620 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3621                       bool persistent)
3622 {
3623         struct mgmt_ev_new_link_key ev;
3624
3625         memset(&ev, 0, sizeof(ev));
3626
3627         ev.store_hint = persistent;
3628         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3629         ev.key.addr.type = BDADDR_BREDR;
3630         ev.key.type = key->type;
3631         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3632         ev.key.pin_len = key->pin_len;
3633
3634         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3635 }
3636
3637 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3638 {
3639         struct mgmt_ev_new_long_term_key ev;
3640
3641         memset(&ev, 0, sizeof(ev));
3642
3643         ev.store_hint = persistent;
3644         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3645         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3646         ev.key.authenticated = key->authenticated;
3647         ev.key.enc_size = key->enc_size;
3648         ev.key.ediv = key->ediv;
3649
3650         if (key->type == HCI_SMP_LTK)
3651                 ev.key.master = 1;
3652
3653         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3654         memcpy(ev.key.val, key->val, sizeof(key->val));
3655
3656         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3657                           NULL);
3658 }
3659
3660 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3661                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3662                           u8 *dev_class)
3663 {
3664         char buf[512];
3665         struct mgmt_ev_device_connected *ev = (void *) buf;
3666         u16 eir_len = 0;
3667
3668         bacpy(&ev->addr.bdaddr, bdaddr);
3669         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3670
3671         ev->flags = __cpu_to_le32(flags);
3672
3673         if (name_len > 0)
3674                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3675                                           name, name_len);
3676
3677         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3678                 eir_len = eir_append_data(ev->eir, eir_len,
3679                                           EIR_CLASS_OF_DEV, dev_class, 3);
3680
3681         ev->eir_len = cpu_to_le16(eir_len);
3682
3683         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3684                           sizeof(*ev) + eir_len, NULL);
3685 }
3686
3687 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3688 {
3689         struct mgmt_cp_disconnect *cp = cmd->param;
3690         struct sock **sk = data;
3691         struct mgmt_rp_disconnect rp;
3692
3693         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3694         rp.addr.type = cp->addr.type;
3695
3696         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3697                      sizeof(rp));
3698
3699         *sk = cmd->sk;
3700         sock_hold(*sk);
3701
3702         mgmt_pending_remove(cmd);
3703 }
3704
3705 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3706 {
3707         struct hci_dev *hdev = data;
3708         struct mgmt_cp_unpair_device *cp = cmd->param;
3709         struct mgmt_rp_unpair_device rp;
3710
3711         memset(&rp, 0, sizeof(rp));
3712         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3713         rp.addr.type = cp->addr.type;
3714
3715         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3716
3717         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3718
3719         mgmt_pending_remove(cmd);
3720 }
3721
3722 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3723                              u8 link_type, u8 addr_type, u8 reason)
3724 {
3725         struct mgmt_ev_device_disconnected ev;
3726         struct sock *sk = NULL;
3727         int err;
3728
3729         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3730
3731         bacpy(&ev.addr.bdaddr, bdaddr);
3732         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3733         ev.reason = reason;
3734
3735         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3736                          sk);
3737
3738         if (sk)
3739                 sock_put(sk);
3740
3741         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3742                              hdev);
3743
3744         return err;
3745 }
3746
3747 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3748                            u8 link_type, u8 addr_type, u8 status)
3749 {
3750         struct mgmt_rp_disconnect rp;
3751         struct pending_cmd *cmd;
3752         int err;
3753
3754         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3755                              hdev);
3756
3757         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3758         if (!cmd)
3759                 return -ENOENT;
3760
3761         bacpy(&rp.addr.bdaddr, bdaddr);
3762         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3763
3764         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3765                            mgmt_status(status), &rp, sizeof(rp));
3766
3767         mgmt_pending_remove(cmd);
3768
3769         return err;
3770 }
3771
3772 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3773                         u8 addr_type, u8 status)
3774 {
3775         struct mgmt_ev_connect_failed ev;
3776
3777         bacpy(&ev.addr.bdaddr, bdaddr);
3778         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3779         ev.status = mgmt_status(status);
3780
3781         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3782 }
3783
3784 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3785 {
3786         struct mgmt_ev_pin_code_request ev;
3787
3788         bacpy(&ev.addr.bdaddr, bdaddr);
3789         ev.addr.type = BDADDR_BREDR;
3790         ev.secure = secure;
3791
3792         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3793                           NULL);
3794 }
3795
3796 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3797                                  u8 status)
3798 {
3799         struct pending_cmd *cmd;
3800         struct mgmt_rp_pin_code_reply rp;
3801         int err;
3802
3803         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3804         if (!cmd)
3805                 return -ENOENT;
3806
3807         bacpy(&rp.addr.bdaddr, bdaddr);
3808         rp.addr.type = BDADDR_BREDR;
3809
3810         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3811                            mgmt_status(status), &rp, sizeof(rp));
3812
3813         mgmt_pending_remove(cmd);
3814
3815         return err;
3816 }
3817
3818 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3819                                      u8 status)
3820 {
3821         struct pending_cmd *cmd;
3822         struct mgmt_rp_pin_code_reply rp;
3823         int err;
3824
3825         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3826         if (!cmd)
3827                 return -ENOENT;
3828
3829         bacpy(&rp.addr.bdaddr, bdaddr);
3830         rp.addr.type = BDADDR_BREDR;
3831
3832         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3833                            mgmt_status(status), &rp, sizeof(rp));
3834
3835         mgmt_pending_remove(cmd);
3836
3837         return err;
3838 }
3839
3840 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3841                               u8 link_type, u8 addr_type, __le32 value,
3842                               u8 confirm_hint)
3843 {
3844         struct mgmt_ev_user_confirm_request ev;
3845
3846         BT_DBG("%s", hdev->name);
3847
3848         bacpy(&ev.addr.bdaddr, bdaddr);
3849         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3850         ev.confirm_hint = confirm_hint;
3851         ev.value = value;
3852
3853         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3854                           NULL);
3855 }
3856
3857 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3858                               u8 link_type, u8 addr_type)
3859 {
3860         struct mgmt_ev_user_passkey_request ev;
3861
3862         BT_DBG("%s", hdev->name);
3863
3864         bacpy(&ev.addr.bdaddr, bdaddr);
3865         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3866
3867         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3868                           NULL);
3869 }
3870
3871 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3872                                       u8 link_type, u8 addr_type, u8 status,
3873                                       u8 opcode)
3874 {
3875         struct pending_cmd *cmd;
3876         struct mgmt_rp_user_confirm_reply rp;
3877         int err;
3878
3879         cmd = mgmt_pending_find(opcode, hdev);
3880         if (!cmd)
3881                 return -ENOENT;
3882
3883         bacpy(&rp.addr.bdaddr, bdaddr);
3884         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3885         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3886                            &rp, sizeof(rp));
3887
3888         mgmt_pending_remove(cmd);
3889
3890         return err;
3891 }
3892
3893 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3894                                      u8 link_type, u8 addr_type, u8 status)
3895 {
3896         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3897                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3898 }
3899
3900 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3901                                          u8 link_type, u8 addr_type, u8 status)
3902 {
3903         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3904                                           status,
3905                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3906 }
3907
3908 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3909                                      u8 link_type, u8 addr_type, u8 status)
3910 {
3911         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3912                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3913 }
3914
3915 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3916                                          u8 link_type, u8 addr_type, u8 status)
3917 {
3918         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3919                                           status,
3920                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3921 }
3922
3923 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3924                              u8 link_type, u8 addr_type, u32 passkey,
3925                              u8 entered)
3926 {
3927         struct mgmt_ev_passkey_notify ev;
3928
3929         BT_DBG("%s", hdev->name);
3930
3931         bacpy(&ev.addr.bdaddr, bdaddr);
3932         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3933         ev.passkey = __cpu_to_le32(passkey);
3934         ev.entered = entered;
3935
3936         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3937 }
3938
3939 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3940                      u8 addr_type, u8 status)
3941 {
3942         struct mgmt_ev_auth_failed ev;
3943
3944         bacpy(&ev.addr.bdaddr, bdaddr);
3945         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3946         ev.status = mgmt_status(status);
3947
3948         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3949 }
3950
3951 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3952 {
3953         struct cmd_lookup match = { NULL, hdev };
3954         bool changed = false;
3955         int err = 0;
3956
3957         if (status) {
3958                 u8 mgmt_err = mgmt_status(status);
3959                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3960                                      cmd_status_rsp, &mgmt_err);
3961                 return 0;
3962         }
3963
3964         if (test_bit(HCI_AUTH, &hdev->flags)) {
3965                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3966                         changed = true;
3967         } else {
3968                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3969                         changed = true;
3970         }
3971
3972         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3973                              &match);
3974
3975         if (changed)
3976                 err = new_settings(hdev, match.sk);
3977
3978         if (match.sk)
3979                 sock_put(match.sk);
3980
3981         return err;
3982 }
3983
3984 static void clear_eir(struct hci_request *req)
3985 {
3986         struct hci_dev *hdev = req->hdev;
3987         struct hci_cp_write_eir cp;
3988
3989         if (!lmp_ext_inq_capable(hdev))
3990                 return;
3991
3992         memset(hdev->eir, 0, sizeof(hdev->eir));
3993
3994         memset(&cp, 0, sizeof(cp));
3995
3996         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3997 }
3998
3999 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4000 {
4001         struct cmd_lookup match = { NULL, hdev };
4002         struct hci_request req;
4003         bool changed = false;
4004         int err = 0;
4005
4006         if (status) {
4007                 u8 mgmt_err = mgmt_status(status);
4008
4009                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4010                                                  &hdev->dev_flags))
4011                         err = new_settings(hdev, NULL);
4012
4013                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4014                                      &mgmt_err);
4015
4016                 return err;
4017         }
4018
4019         if (enable) {
4020                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4021                         changed = true;
4022         } else {
4023                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4024                         changed = true;
4025         }
4026
4027         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4028
4029         if (changed)
4030                 err = new_settings(hdev, match.sk);
4031
4032         if (match.sk)
4033                 sock_put(match.sk);
4034
4035         hci_req_init(&req, hdev);
4036
4037         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4038                 update_eir(&req);
4039         else
4040                 clear_eir(&req);
4041
4042         hci_req_run(&req, NULL);
4043
4044         return err;
4045 }
4046
4047 static void sk_lookup(struct pending_cmd *cmd, void *data)
4048 {
4049         struct cmd_lookup *match = data;
4050
4051         if (match->sk == NULL) {
4052                 match->sk = cmd->sk;
4053                 sock_hold(match->sk);
4054         }
4055 }
4056
4057 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4058                                    u8 status)
4059 {
4060         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4061         int err = 0;
4062
4063         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4064         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4065         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4066
4067         if (!status)
4068                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4069                                  3, NULL);
4070
4071         if (match.sk)
4072                 sock_put(match.sk);
4073
4074         return err;
4075 }
4076
4077 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4078 {
4079         struct mgmt_cp_set_local_name ev;
4080         struct pending_cmd *cmd;
4081
4082         if (status)
4083                 return 0;
4084
4085         memset(&ev, 0, sizeof(ev));
4086         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4087         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4088
4089         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4090         if (!cmd) {
4091                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4092
4093                 /* If this is a HCI command related to powering on the
4094                  * HCI dev don't send any mgmt signals.
4095                  */
4096                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4097                         return 0;
4098         }
4099
4100         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4101                           cmd ? cmd->sk : NULL);
4102 }
4103
4104 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4105                                             u8 *randomizer, u8 status)
4106 {
4107         struct pending_cmd *cmd;
4108         int err;
4109
4110         BT_DBG("%s status %u", hdev->name, status);
4111
4112         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4113         if (!cmd)
4114                 return -ENOENT;
4115
4116         if (status) {
4117                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4118                                  mgmt_status(status));
4119         } else {
4120                 struct mgmt_rp_read_local_oob_data rp;
4121
4122                 memcpy(rp.hash, hash, sizeof(rp.hash));
4123                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4124
4125                 err = cmd_complete(cmd->sk, hdev->id,
4126                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4127                                    sizeof(rp));
4128         }
4129
4130         mgmt_pending_remove(cmd);
4131
4132         return err;
4133 }
4134
4135 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4136 {
4137         struct cmd_lookup match = { NULL, hdev };
4138         bool changed = false;
4139         int err = 0;
4140
4141         if (status) {
4142                 u8 mgmt_err = mgmt_status(status);
4143
4144                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
4145                                                  &hdev->dev_flags))
4146                         err = new_settings(hdev, NULL);
4147
4148                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
4149                                      &mgmt_err);
4150
4151                 return err;
4152         }
4153
4154         if (enable) {
4155                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4156                         changed = true;
4157         } else {
4158                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4159                         changed = true;
4160         }
4161
4162         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
4163
4164         if (changed)
4165                 err = new_settings(hdev, match.sk);
4166
4167         if (match.sk)
4168                 sock_put(match.sk);
4169
4170         return err;
4171 }
4172
4173 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4174                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4175                       ssp, u8 *eir, u16 eir_len)
4176 {
4177         char buf[512];
4178         struct mgmt_ev_device_found *ev = (void *) buf;
4179         size_t ev_size;
4180
4181         if (!hci_discovery_active(hdev))
4182                 return -EPERM;
4183
4184         /* Leave 5 bytes for a potential CoD field */
4185         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4186                 return -EINVAL;
4187
4188         memset(buf, 0, sizeof(buf));
4189
4190         bacpy(&ev->addr.bdaddr, bdaddr);
4191         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4192         ev->rssi = rssi;
4193         if (cfm_name)
4194                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4195         if (!ssp)
4196                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4197
4198         if (eir_len > 0)
4199                 memcpy(ev->eir, eir, eir_len);
4200
4201         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4202                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4203                                           dev_class, 3);
4204
4205         ev->eir_len = cpu_to_le16(eir_len);
4206         ev_size = sizeof(*ev) + eir_len;
4207
4208         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4209 }
4210
4211 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4212                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4213 {
4214         struct mgmt_ev_device_found *ev;
4215         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4216         u16 eir_len;
4217
4218         ev = (struct mgmt_ev_device_found *) buf;
4219
4220         memset(buf, 0, sizeof(buf));
4221
4222         bacpy(&ev->addr.bdaddr, bdaddr);
4223         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4224         ev->rssi = rssi;
4225
4226         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4227                                   name_len);
4228
4229         ev->eir_len = cpu_to_le16(eir_len);
4230
4231         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4232                           sizeof(*ev) + eir_len, NULL);
4233 }
4234
4235 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4236 {
4237         struct mgmt_ev_discovering ev;
4238         struct pending_cmd *cmd;
4239
4240         BT_DBG("%s discovering %u", hdev->name, discovering);
4241
4242         if (discovering)
4243                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4244         else
4245                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4246
4247         if (cmd != NULL) {
4248                 u8 type = hdev->discovery.type;
4249
4250                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4251                              sizeof(type));
4252                 mgmt_pending_remove(cmd);
4253         }
4254
4255         memset(&ev, 0, sizeof(ev));
4256         ev.type = hdev->discovery.type;
4257         ev.discovering = discovering;
4258
4259         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4260 }
4261
4262 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4263 {
4264         struct pending_cmd *cmd;
4265         struct mgmt_ev_device_blocked ev;
4266
4267         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4268
4269         bacpy(&ev.addr.bdaddr, bdaddr);
4270         ev.addr.type = type;
4271
4272         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4273                           cmd ? cmd->sk : NULL);
4274 }
4275
4276 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4277 {
4278         struct pending_cmd *cmd;
4279         struct mgmt_ev_device_unblocked ev;
4280
4281         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4282
4283         bacpy(&ev.addr.bdaddr, bdaddr);
4284         ev.addr.type = type;
4285
4286         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4287                           cmd ? cmd->sk : NULL);
4288 }
4289
4290 module_param(enable_hs, bool, 0644);
4291 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");