net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   3
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 106
 107 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 108                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 109
 110 struct pending_cmd {
 111         struct list_head list;
 112         u16 opcode;
 113         int index;
 114         void *param;
 115         struct sock *sk;
 116         void *user_data;
 117 };
 118
 119 /* HCI to MGMT error code conversion table */
 120 static u8 mgmt_status_table[] = {
 121         MGMT_STATUS_SUCCESS,
 122         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 123         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 124         MGMT_STATUS_FAILED,             /* Hardware Failure */
 125         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 126         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 127         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 128         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 129         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 130         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 131         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 132         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 133         MGMT_STATUS_BUSY,               /* Command Disallowed */
 134         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 135         MGMT_STATUS_REJECTED,           /* Rejected Security */
 136         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 137         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 138         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 139         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 140         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 141         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 142         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 143         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 144         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 145         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 146         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 147         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 148         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 149         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 150         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 151         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 152         MGMT_STATUS_FAILED,             /* Unspecified Error */
 153         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 154         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 155         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 156         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 157         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 158         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 159         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 161         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 162         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 163         MGMT_STATUS_FAILED,             /* Transaction Collision */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 165         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 167         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 168         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 169         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 170         MGMT_STATUS_FAILED,             /* Slot Violation */
 171         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 172         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 174         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 175         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 176         MGMT_STATUS_BUSY,               /* Controller Busy */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 178         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 179         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 180         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 181         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 182 };
 183
 184 bool mgmt_valid_hdev(struct hci_dev *hdev)
 185 {
 186         return hdev->dev_type == HCI_BREDR;
 187 }
 188
 189 static u8 mgmt_status(u8 hci_status)
 190 {
 191         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 192                 return mgmt_status_table[hci_status];
 193
 194         return MGMT_STATUS_FAILED;
 195 }
 196
 197 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 198 {
 199         struct sk_buff *skb;
 200         struct mgmt_hdr *hdr;
 201         struct mgmt_ev_cmd_status *ev;
 202         int err;
 203
 204         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 205
 206         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 207         if (!skb)
 208                 return -ENOMEM;
 209
 210         hdr = (void *) skb_put(skb, sizeof(*hdr));
 211
 212         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 213         hdr->index = cpu_to_le16(index);
 214         hdr->len = cpu_to_le16(sizeof(*ev));
 215
 216         ev = (void *) skb_put(skb, sizeof(*ev));
 217         ev->status = status;
 218         ev->opcode = cpu_to_le16(cmd);
 219
 220         err = sock_queue_rcv_skb(sk, skb);
 221         if (err < 0)
 222                 kfree_skb(skb);
 223
 224         return err;
 225 }
 226
 227 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 228                         void *rp, size_t rp_len)
 229 {
 230         struct sk_buff *skb;
 231         struct mgmt_hdr *hdr;
 232         struct mgmt_ev_cmd_complete *ev;
 233         int err;
 234
 235         BT_DBG("sock %p", sk);
 236
 237         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 238         if (!skb)
 239                 return -ENOMEM;
 240
 241         hdr = (void *) skb_put(skb, sizeof(*hdr));
 242
 243         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 244         hdr->index = cpu_to_le16(index);
 245         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 246
 247         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 248         ev->opcode = cpu_to_le16(cmd);
 249         ev->status = status;
 250
 251         if (rp)
 252                 memcpy(ev->data, rp, rp_len);
 253
 254         err = sock_queue_rcv_skb(sk, skb);
 255         if (err < 0)
 256                 kfree_skb(skb);
 257
 258         return err;
 259 }
 260
 261 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 262                         u16 data_len)
 263 {
 264         struct mgmt_rp_read_version rp;
 265
 266         BT_DBG("sock %p", sk);
 267
 268         rp.version = MGMT_VERSION;
 269         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 270
 271         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 272                             sizeof(rp));
 273 }
 274
 275 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 276                          u16 data_len)
 277 {
 278         struct mgmt_rp_read_commands *rp;
 279         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 280         const u16 num_events = ARRAY_SIZE(mgmt_events);
 281         __le16 *opcode;
 282         size_t rp_size;
 283         int i, err;
 284
 285         BT_DBG("sock %p", sk);
 286
 287         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 288
 289         rp = kmalloc(rp_size, GFP_KERNEL);
 290         if (!rp)
 291                 return -ENOMEM;
 292
 293         rp->num_commands = __constant_cpu_to_le16(num_commands);
 294         rp->num_events = __constant_cpu_to_le16(num_events);
 295
 296         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 297                 put_unaligned_le16(mgmt_commands[i], opcode);
 298
 299         for (i = 0; i < num_events; i++, opcode++)
 300                 put_unaligned_le16(mgmt_events[i], opcode);
 301
 302         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 303                            rp_size);
 304         kfree(rp);
 305
 306         return err;
 307 }
 308
 309 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 310                            u16 data_len)
 311 {
 312         struct mgmt_rp_read_index_list *rp;
 313         struct hci_dev *d;
 314         size_t rp_len;
 315         u16 count;
 316         int err;
 317
 318         BT_DBG("sock %p", sk);
 319
 320         read_lock(&hci_dev_list_lock);
 321
 322         count = 0;
 323         list_for_each_entry(d, &hci_dev_list, list) {
 324                 if (!mgmt_valid_hdev(d))
 325                         continue;
 326
 327                 count++;
 328         }
 329
 330         rp_len = sizeof(*rp) + (2 * count);
 331         rp = kmalloc(rp_len, GFP_ATOMIC);
 332         if (!rp) {
 333                 read_unlock(&hci_dev_list_lock);
 334                 return -ENOMEM;
 335         }
 336
 337         count = 0;
 338         list_for_each_entry(d, &hci_dev_list, list) {
 339                 if (test_bit(HCI_SETUP, &d->dev_flags))
 340                         continue;
 341
 342                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 343                         continue;
 344
 345                 if (!mgmt_valid_hdev(d))
 346                         continue;
 347
 348                 rp->index[count++] = cpu_to_le16(d->id);
 349                 BT_DBG("Added hci%u", d->id);
 350         }
 351
 352         rp->num_controllers = cpu_to_le16(count);
 353         rp_len = sizeof(*rp) + (2 * count);
 354
 355         read_unlock(&hci_dev_list_lock);
 356
 357         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 358                            rp_len);
 359
 360         kfree(rp);
 361
 362         return err;
 363 }
 364
 365 static u32 get_supported_settings(struct hci_dev *hdev)
 366 {
 367         u32 settings = 0;
 368
 369         settings |= MGMT_SETTING_POWERED;
 370         settings |= MGMT_SETTING_PAIRABLE;
 371
 372         if (lmp_ssp_capable(hdev))
 373                 settings |= MGMT_SETTING_SSP;
 374
 375         if (lmp_bredr_capable(hdev)) {
 376                 settings |= MGMT_SETTING_CONNECTABLE;
 377                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 378                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 379                 settings |= MGMT_SETTING_DISCOVERABLE;
 380                 settings |= MGMT_SETTING_BREDR;
 381                 settings |= MGMT_SETTING_LINK_SECURITY;
 382         }
 383
 384         if (enable_hs)
 385                 settings |= MGMT_SETTING_HS;
 386
 387         if (lmp_le_capable(hdev))
 388                 settings |= MGMT_SETTING_LE;
 389
 390         return settings;
 391 }
 392
 393 static u32 get_current_settings(struct hci_dev *hdev)
 394 {
 395         u32 settings = 0;
 396
 397         if (hdev_is_powered(hdev))
 398                 settings |= MGMT_SETTING_POWERED;
 399
 400         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 401                 settings |= MGMT_SETTING_CONNECTABLE;
 402
 403         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 404                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 405
 406         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 407                 settings |= MGMT_SETTING_DISCOVERABLE;
 408
 409         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 410                 settings |= MGMT_SETTING_PAIRABLE;
 411
 412         if (lmp_bredr_capable(hdev))
 413                 settings |= MGMT_SETTING_BREDR;
 414
 415         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 416                 settings |= MGMT_SETTING_LE;
 417
 418         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 419                 settings |= MGMT_SETTING_LINK_SECURITY;
 420
 421         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 422                 settings |= MGMT_SETTING_SSP;
 423
 424         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 425                 settings |= MGMT_SETTING_HS;
 426
 427         return settings;
 428 }
 429
 430 #define PNP_INFO_SVCLASS_ID             0x1200
 431
 432 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 433 {
 434         u8 *ptr = data, *uuids_start = NULL;
 435         struct bt_uuid *uuid;
 436
 437         if (len < 4)
 438                 return ptr;
 439
 440         list_for_each_entry(uuid, &hdev->uuids, list) {
 441                 u16 uuid16;
 442
 443                 if (uuid->size != 16)
 444                         continue;
 445
 446                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 447                 if (uuid16 < 0x1100)
 448                         continue;
 449
 450                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 451                         continue;
 452
 453                 if (!uuids_start) {
 454                         uuids_start = ptr;
 455                         uuids_start[0] = 1;
 456                         uuids_start[1] = EIR_UUID16_ALL;
 457                         ptr += 2;
 458                 }
 459
 460                 /* Stop if not enough space to put next UUID */
 461                 if ((ptr - data) + sizeof(u16) > len) {
 462                         uuids_start[1] = EIR_UUID16_SOME;
 463                         break;
 464                 }
 465
 466                 *ptr++ = (uuid16 & 0x00ff);
 467                 *ptr++ = (uuid16 & 0xff00) >> 8;
 468                 uuids_start[0] += sizeof(uuid16);
 469         }
 470
 471         return ptr;
 472 }
 473
 474 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 475 {
 476         u8 *ptr = data, *uuids_start = NULL;
 477         struct bt_uuid *uuid;
 478
 479         if (len < 6)
 480                 return ptr;
 481
 482         list_for_each_entry(uuid, &hdev->uuids, list) {
 483                 if (uuid->size != 32)
 484                         continue;
 485
 486                 if (!uuids_start) {
 487                         uuids_start = ptr;
 488                         uuids_start[0] = 1;
 489                         uuids_start[1] = EIR_UUID32_ALL;
 490                         ptr += 2;
 491                 }
 492
 493                 /* Stop if not enough space to put next UUID */
 494                 if ((ptr - data) + sizeof(u32) > len) {
 495                         uuids_start[1] = EIR_UUID32_SOME;
 496                         break;
 497                 }
 498
 499                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 500                 ptr += sizeof(u32);
 501                 uuids_start[0] += sizeof(u32);
 502         }
 503
 504         return ptr;
 505 }
 506
 507 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 508 {
 509         u8 *ptr = data, *uuids_start = NULL;
 510         struct bt_uuid *uuid;
 511
 512         if (len < 18)
 513                 return ptr;
 514
 515         list_for_each_entry(uuid, &hdev->uuids, list) {
 516                 if (uuid->size != 128)
 517                         continue;
 518
 519                 if (!uuids_start) {
 520                         uuids_start = ptr;
 521                         uuids_start[0] = 1;
 522                         uuids_start[1] = EIR_UUID128_ALL;
 523                         ptr += 2;
 524                 }
 525
 526                 /* Stop if not enough space to put next UUID */
 527                 if ((ptr - data) + 16 > len) {
 528                         uuids_start[1] = EIR_UUID128_SOME;
 529                         break;
 530                 }
 531
 532                 memcpy(ptr, uuid->uuid, 16);
 533                 ptr += 16;
 534                 uuids_start[0] += 16;
 535         }
 536
 537         return ptr;
 538 }
 539
 540 static void create_eir(struct hci_dev *hdev, u8 *data)
 541 {
 542         u8 *ptr = data;
 543         size_t name_len;
 544
 545         name_len = strlen(hdev->dev_name);
 546
 547         if (name_len > 0) {
 548                 /* EIR Data type */
 549                 if (name_len > 48) {
 550                         name_len = 48;
 551                         ptr[1] = EIR_NAME_SHORT;
 552                 } else
 553                         ptr[1] = EIR_NAME_COMPLETE;
 554
 555                 /* EIR Data length */
 556                 ptr[0] = name_len + 1;
 557
 558                 memcpy(ptr + 2, hdev->dev_name, name_len);
 559
 560                 ptr += (name_len + 2);
 561         }
 562
 563         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 564                 ptr[0] = 2;
 565                 ptr[1] = EIR_TX_POWER;
 566                 ptr[2] = (u8) hdev->inq_tx_power;
 567
 568                 ptr += 3;
 569         }
 570
 571         if (hdev->devid_source > 0) {
 572                 ptr[0] = 9;
 573                 ptr[1] = EIR_DEVICE_ID;
 574
 575                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 576                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 577                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 578                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 579
 580                 ptr += 10;
 581         }
 582
 583         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 584         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 585         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 586 }
 587
 588 static void update_eir(struct hci_request *req)
 589 {
 590         struct hci_dev *hdev = req->hdev;
 591         struct hci_cp_write_eir cp;
 592
 593         if (!hdev_is_powered(hdev))
 594                 return;
 595
 596         if (!lmp_ext_inq_capable(hdev))
 597                 return;
 598
 599         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 600                 return;
 601
 602         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 603                 return;
 604
 605         memset(&cp, 0, sizeof(cp));
 606
 607         create_eir(hdev, cp.data);
 608
 609         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 610                 return;
 611
 612         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 613
 614         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 615 }
 616
 617 static u8 get_service_classes(struct hci_dev *hdev)
 618 {
 619         struct bt_uuid *uuid;
 620         u8 val = 0;
 621
 622         list_for_each_entry(uuid, &hdev->uuids, list)
 623                 val |= uuid->svc_hint;
 624
 625         return val;
 626 }
 627
 628 static void update_class(struct hci_request *req)
 629 {
 630         struct hci_dev *hdev = req->hdev;
 631         u8 cod[3];
 632
 633         BT_DBG("%s", hdev->name);
 634
 635         if (!hdev_is_powered(hdev))
 636                 return;
 637
 638         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 639                 return;
 640
 641         cod[0] = hdev->minor_class;
 642         cod[1] = hdev->major_class;
 643         cod[2] = get_service_classes(hdev);
 644
 645         if (memcmp(cod, hdev->dev_class, 3) == 0)
 646                 return;
 647
 648         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 649 }
 650
 651 static void service_cache_off(struct work_struct *work)
 652 {
 653         struct hci_dev *hdev = container_of(work, struct hci_dev,
 654                                             service_cache.work);
 655         struct hci_request req;
 656
 657         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 658                 return;
 659
 660         hci_req_init(&req, hdev);
 661
 662         hci_dev_lock(hdev);
 663
 664         update_eir(&req);
 665         update_class(&req);
 666
 667         hci_dev_unlock(hdev);
 668
 669         hci_req_run(&req, NULL);
 670 }
 671
 672 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 673 {
 674         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 675                 return;
 676
 677         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 678
 679         /* Non-mgmt controlled devices get this bit set
 680          * implicitly so that pairing works for them, however
 681          * for mgmt we require user-space to explicitly enable
 682          * it
 683          */
 684         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 685 }
 686
 687 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 688                                 void *data, u16 data_len)
 689 {
 690         struct mgmt_rp_read_info rp;
 691
 692         BT_DBG("sock %p %s", sk, hdev->name);
 693
 694         hci_dev_lock(hdev);
 695
 696         memset(&rp, 0, sizeof(rp));
 697
 698         bacpy(&rp.bdaddr, &hdev->bdaddr);
 699
 700         rp.version = hdev->hci_ver;
 701         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 702
 703         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 704         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 705
 706         memcpy(rp.dev_class, hdev->dev_class, 3);
 707
 708         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 709         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 710
 711         hci_dev_unlock(hdev);
 712
 713         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 714                             sizeof(rp));
 715 }
 716
 717 static void mgmt_pending_free(struct pending_cmd *cmd)
 718 {
 719         sock_put(cmd->sk);
 720         kfree(cmd->param);
 721         kfree(cmd);
 722 }
 723
 724 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 725                                             struct hci_dev *hdev, void *data,
 726                                             u16 len)
 727 {
 728         struct pending_cmd *cmd;
 729
 730         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 731         if (!cmd)
 732                 return NULL;
 733
 734         cmd->opcode = opcode;
 735         cmd->index = hdev->id;
 736
 737         cmd->param = kmalloc(len, GFP_KERNEL);
 738         if (!cmd->param) {
 739                 kfree(cmd);
 740                 return NULL;
 741         }
 742
 743         if (data)
 744                 memcpy(cmd->param, data, len);
 745
 746         cmd->sk = sk;
 747         sock_hold(sk);
 748
 749         list_add(&cmd->list, &hdev->mgmt_pending);
 750
 751         return cmd;
 752 }
 753
 754 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 755                                  void (*cb)(struct pending_cmd *cmd,
 756                                             void *data),
 757                                  void *data)
 758 {
 759         struct pending_cmd *cmd, *tmp;
 760
 761         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 762                 if (opcode > 0 && cmd->opcode != opcode)
 763                         continue;
 764
 765                 cb(cmd, data);
 766         }
 767 }
 768
 769 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 770 {
 771         struct pending_cmd *cmd;
 772
 773         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 774                 if (cmd->opcode == opcode)
 775                         return cmd;
 776         }
 777
 778         return NULL;
 779 }
 780
 781 static void mgmt_pending_remove(struct pending_cmd *cmd)
 782 {
 783         list_del(&cmd->list);
 784         mgmt_pending_free(cmd);
 785 }
 786
 787 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 788 {
 789         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 790
 791         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 792                             sizeof(settings));
 793 }
 794
 795 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 796                        u16 len)
 797 {
 798         struct mgmt_mode *cp = data;
 799         struct pending_cmd *cmd;
 800         int err;
 801
 802         BT_DBG("request for %s", hdev->name);
 803
 804         if (cp->val != 0x00 && cp->val != 0x01)
 805                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 806                                   MGMT_STATUS_INVALID_PARAMS);
 807
 808         hci_dev_lock(hdev);
 809
 810         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 811                 cancel_delayed_work(&hdev->power_off);
 812
 813                 if (cp->val) {
 814                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 815                                          data, len);
 816                         err = mgmt_powered(hdev, 1);
 817                         goto failed;
 818                 }
 819         }
 820
 821         if (!!cp->val == hdev_is_powered(hdev)) {
 822                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 823                 goto failed;
 824         }
 825
 826         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 827                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 828                                  MGMT_STATUS_BUSY);
 829                 goto failed;
 830         }
 831
 832         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 833         if (!cmd) {
 834                 err = -ENOMEM;
 835                 goto failed;
 836         }
 837
 838         if (cp->val)
 839                 queue_work(hdev->req_workqueue, &hdev->power_on);
 840         else
 841                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 842
 843         err = 0;
 844
 845 failed:
 846         hci_dev_unlock(hdev);
 847         return err;
 848 }
 849
 850 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 851                       struct sock *skip_sk)
 852 {
 853         struct sk_buff *skb;
 854         struct mgmt_hdr *hdr;
 855
 856         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 857         if (!skb)
 858                 return -ENOMEM;
 859
 860         hdr = (void *) skb_put(skb, sizeof(*hdr));
 861         hdr->opcode = cpu_to_le16(event);
 862         if (hdev)
 863                 hdr->index = cpu_to_le16(hdev->id);
 864         else
 865                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 866         hdr->len = cpu_to_le16(data_len);
 867
 868         if (data)
 869                 memcpy(skb_put(skb, data_len), data, data_len);
 870
 871         /* Time stamp */
 872         __net_timestamp(skb);
 873
 874         hci_send_to_control(skb, skip_sk);
 875         kfree_skb(skb);
 876
 877         return 0;
 878 }
 879
 880 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 881 {
 882         __le32 ev;
 883
 884         ev = cpu_to_le32(get_current_settings(hdev));
 885
 886         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 887 }
 888
 889 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 890                             u16 len)
 891 {
 892         struct mgmt_cp_set_discoverable *cp = data;
 893         struct pending_cmd *cmd;
 894         u16 timeout;
 895         u8 scan;
 896         int err;
 897
 898         BT_DBG("request for %s", hdev->name);
 899
 900         if (!lmp_bredr_capable(hdev))
 901                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 902                                  MGMT_STATUS_NOT_SUPPORTED);
 903
 904         if (cp->val != 0x00 && cp->val != 0x01)
 905                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 906                                   MGMT_STATUS_INVALID_PARAMS);
 907
 908         timeout = __le16_to_cpu(cp->timeout);
 909         if (!cp->val && timeout > 0)
 910                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 911                                   MGMT_STATUS_INVALID_PARAMS);
 912
 913         hci_dev_lock(hdev);
 914
 915         if (!hdev_is_powered(hdev) && timeout > 0) {
 916                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 917                                  MGMT_STATUS_NOT_POWERED);
 918                 goto failed;
 919         }
 920
 921         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 922             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 923                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 924                                  MGMT_STATUS_BUSY);
 925                 goto failed;
 926         }
 927
 928         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 929                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 930                                  MGMT_STATUS_REJECTED);
 931                 goto failed;
 932         }
 933
 934         if (!hdev_is_powered(hdev)) {
 935                 bool changed = false;
 936
 937                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 938                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 939                         changed = true;
 940                 }
 941
 942                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 943                 if (err < 0)
 944                         goto failed;
 945
 946                 if (changed)
 947                         err = new_settings(hdev, sk);
 948
 949                 goto failed;
 950         }
 951
 952         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 953                 if (hdev->discov_timeout > 0) {
 954                         cancel_delayed_work(&hdev->discov_off);
 955                         hdev->discov_timeout = 0;
 956                 }
 957
 958                 if (cp->val && timeout > 0) {
 959                         hdev->discov_timeout = timeout;
 960                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 961                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 962                 }
 963
 964                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 965                 goto failed;
 966         }
 967
 968         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 969         if (!cmd) {
 970                 err = -ENOMEM;
 971                 goto failed;
 972         }
 973
 974         scan = SCAN_PAGE;
 975
 976         if (cp->val)
 977                 scan |= SCAN_INQUIRY;
 978         else
 979                 cancel_delayed_work(&hdev->discov_off);
 980
 981         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 982         if (err < 0)
 983                 mgmt_pending_remove(cmd);
 984
 985         if (cp->val)
 986                 hdev->discov_timeout = timeout;
 987
 988 failed:
 989         hci_dev_unlock(hdev);
 990         return err;
 991 }
 992
 993 static void write_fast_connectable(struct hci_request *req, bool enable)
 994 {
 995         struct hci_dev *hdev = req->hdev;
 996         struct hci_cp_write_page_scan_activity acp;
 997         u8 type;
 998
 999         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1000                 return;
1001
1002         if (enable) {
1003                 type = PAGE_SCAN_TYPE_INTERLACED;
1004
1005                 /* 160 msec page scan interval */
1006                 acp.interval = __constant_cpu_to_le16(0x0100);
1007         } else {
1008                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1009
1010                 /* default 1.28 sec page scan */
1011                 acp.interval = __constant_cpu_to_le16(0x0800);
1012         }
1013
1014         acp.window = __constant_cpu_to_le16(0x0012);
1015
1016         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1017             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1018                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1019                             sizeof(acp), &acp);
1020
1021         if (hdev->page_scan_type != type)
1022                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1023 }
1024
1025 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1026 {
1027         struct pending_cmd *cmd;
1028
1029         BT_DBG("status 0x%02x", status);
1030
1031         hci_dev_lock(hdev);
1032
1033         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1034         if (!cmd)
1035                 goto unlock;
1036
1037         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1038
1039         mgmt_pending_remove(cmd);
1040
1041 unlock:
1042         hci_dev_unlock(hdev);
1043 }
1044
1045 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1046                            u16 len)
1047 {
1048         struct mgmt_mode *cp = data;
1049         struct pending_cmd *cmd;
1050         struct hci_request req;
1051         u8 scan;
1052         int err;
1053
1054         BT_DBG("request for %s", hdev->name);
1055
1056         if (!lmp_bredr_capable(hdev))
1057                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1058                                   MGMT_STATUS_NOT_SUPPORTED);
1059
1060         if (cp->val != 0x00 && cp->val != 0x01)
1061                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1062                                   MGMT_STATUS_INVALID_PARAMS);
1063
1064         hci_dev_lock(hdev);
1065
1066         if (!hdev_is_powered(hdev)) {
1067                 bool changed = false;
1068
1069                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1070                         changed = true;
1071
1072                 if (cp->val) {
1073                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1074                 } else {
1075                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1076                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1077                 }
1078
1079                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1080                 if (err < 0)
1081                         goto failed;
1082
1083                 if (changed)
1084                         err = new_settings(hdev, sk);
1085
1086                 goto failed;
1087         }
1088
1089         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1090             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1091                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1092                                  MGMT_STATUS_BUSY);
1093                 goto failed;
1094         }
1095
1096         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1097                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1098                 goto failed;
1099         }
1100
1101         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1102         if (!cmd) {
1103                 err = -ENOMEM;
1104                 goto failed;
1105         }
1106
1107         if (cp->val) {
1108                 scan = SCAN_PAGE;
1109         } else {
1110                 scan = 0;
1111
1112                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1113                     hdev->discov_timeout > 0)
1114                         cancel_delayed_work(&hdev->discov_off);
1115         }
1116
1117         hci_req_init(&req, hdev);
1118
1119         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1120
1121         /* If we're going from non-connectable to connectable or
1122          * vice-versa when fast connectable is enabled ensure that fast
1123          * connectable gets disabled. write_fast_connectable won't do
1124          * anything if the page scan parameters are already what they
1125          * should be.
1126          */
1127         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1128                 write_fast_connectable(&req, false);
1129
1130         err = hci_req_run(&req, set_connectable_complete);
1131         if (err < 0)
1132                 mgmt_pending_remove(cmd);
1133
1134 failed:
1135         hci_dev_unlock(hdev);
1136         return err;
1137 }
1138
1139 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1140                         u16 len)
1141 {
1142         struct mgmt_mode *cp = data;
1143         int err;
1144
1145         BT_DBG("request for %s", hdev->name);
1146
1147         if (cp->val != 0x00 && cp->val != 0x01)
1148                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1149                                   MGMT_STATUS_INVALID_PARAMS);
1150
1151         hci_dev_lock(hdev);
1152
1153         if (cp->val)
1154                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1155         else
1156                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1157
1158         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1159         if (err < 0)
1160                 goto failed;
1161
1162         err = new_settings(hdev, sk);
1163
1164 failed:
1165         hci_dev_unlock(hdev);
1166         return err;
1167 }
1168
1169 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1170                              u16 len)
1171 {
1172         struct mgmt_mode *cp = data;
1173         struct pending_cmd *cmd;
1174         u8 val;
1175         int err;
1176
1177         BT_DBG("request for %s", hdev->name);
1178
1179         if (!lmp_bredr_capable(hdev))
1180                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1181                                   MGMT_STATUS_NOT_SUPPORTED);
1182
1183         if (cp->val != 0x00 && cp->val != 0x01)
1184                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1185                                   MGMT_STATUS_INVALID_PARAMS);
1186
1187         hci_dev_lock(hdev);
1188
1189         if (!hdev_is_powered(hdev)) {
1190                 bool changed = false;
1191
1192                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1193                                           &hdev->dev_flags)) {
1194                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1195                         changed = true;
1196                 }
1197
1198                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1199                 if (err < 0)
1200                         goto failed;
1201
1202                 if (changed)
1203                         err = new_settings(hdev, sk);
1204
1205                 goto failed;
1206         }
1207
1208         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1209                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1210                                  MGMT_STATUS_BUSY);
1211                 goto failed;
1212         }
1213
1214         val = !!cp->val;
1215
1216         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1217                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1218                 goto failed;
1219         }
1220
1221         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1222         if (!cmd) {
1223                 err = -ENOMEM;
1224                 goto failed;
1225         }
1226
1227         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1228         if (err < 0) {
1229                 mgmt_pending_remove(cmd);
1230                 goto failed;
1231         }
1232
1233 failed:
1234         hci_dev_unlock(hdev);
1235         return err;
1236 }
1237
1238 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1239 {
1240         struct mgmt_mode *cp = data;
1241         struct pending_cmd *cmd;
1242         u8 val;
1243         int err;
1244
1245         BT_DBG("request for %s", hdev->name);
1246
1247         if (!lmp_ssp_capable(hdev))
1248                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1249                                   MGMT_STATUS_NOT_SUPPORTED);
1250
1251         if (cp->val != 0x00 && cp->val != 0x01)
1252                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1253                                   MGMT_STATUS_INVALID_PARAMS);
1254
1255         hci_dev_lock(hdev);
1256
1257         val = !!cp->val;
1258
1259         if (!hdev_is_powered(hdev)) {
1260                 bool changed = false;
1261
1262                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1263                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1264                         changed = true;
1265                 }
1266
1267                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1268                 if (err < 0)
1269                         goto failed;
1270
1271                 if (changed)
1272                         err = new_settings(hdev, sk);
1273
1274                 goto failed;
1275         }
1276
1277         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1278                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1279                                  MGMT_STATUS_BUSY);
1280                 goto failed;
1281         }
1282
1283         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1284                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1285                 goto failed;
1286         }
1287
1288         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1289         if (!cmd) {
1290                 err = -ENOMEM;
1291                 goto failed;
1292         }
1293
1294         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1295         if (err < 0) {
1296                 mgmt_pending_remove(cmd);
1297                 goto failed;
1298         }
1299
1300 failed:
1301         hci_dev_unlock(hdev);
1302         return err;
1303 }
1304
1305 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1306 {
1307         struct mgmt_mode *cp = data;
1308
1309         BT_DBG("request for %s", hdev->name);
1310
1311         if (!enable_hs)
1312                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1313                                   MGMT_STATUS_NOT_SUPPORTED);
1314
1315         if (cp->val != 0x00 && cp->val != 0x01)
1316                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1317                                   MGMT_STATUS_INVALID_PARAMS);
1318
1319         if (cp->val)
1320                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1321         else
1322                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1323
1324         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1325 }
1326
1327 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1328 {
1329         struct mgmt_mode *cp = data;
1330         struct hci_cp_write_le_host_supported hci_cp;
1331         struct pending_cmd *cmd;
1332         int err;
1333         u8 val, enabled;
1334
1335         BT_DBG("request for %s", hdev->name);
1336
1337         if (!lmp_le_capable(hdev))
1338                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1339                                   MGMT_STATUS_NOT_SUPPORTED);
1340
1341         if (cp->val != 0x00 && cp->val != 0x01)
1342                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1343                                   MGMT_STATUS_INVALID_PARAMS);
1344
1345         /* LE-only devices do not allow toggling LE on/off */
1346         if (!lmp_bredr_capable(hdev))
1347                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1348                                   MGMT_STATUS_REJECTED);
1349
1350         hci_dev_lock(hdev);
1351
1352         val = !!cp->val;
1353         enabled = lmp_host_le_capable(hdev);
1354
1355         if (!hdev_is_powered(hdev) || val == enabled) {
1356                 bool changed = false;
1357
1358                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1359                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1360                         changed = true;
1361                 }
1362
1363                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1364                 if (err < 0)
1365                         goto unlock;
1366
1367                 if (changed)
1368                         err = new_settings(hdev, sk);
1369
1370                 goto unlock;
1371         }
1372
1373         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1374                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1375                                  MGMT_STATUS_BUSY);
1376                 goto unlock;
1377         }
1378
1379         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1380         if (!cmd) {
1381                 err = -ENOMEM;
1382                 goto unlock;
1383         }
1384
1385         memset(&hci_cp, 0, sizeof(hci_cp));
1386
1387         if (val) {
1388                 hci_cp.le = val;
1389                 hci_cp.simul = lmp_le_br_capable(hdev);
1390         }
1391
1392         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1393                            &hci_cp);
1394         if (err < 0)
1395                 mgmt_pending_remove(cmd);
1396
1397 unlock:
1398         hci_dev_unlock(hdev);
1399         return err;
1400 }
1401
1402 /* This is a helper function to test for pending mgmt commands that can
1403  * cause CoD or EIR HCI commands. We can only allow one such pending
1404  * mgmt command at a time since otherwise we cannot easily track what
1405  * the current values are, will be, and based on that calculate if a new
1406  * HCI command needs to be sent and if yes with what value.
1407  */
1408 static bool pending_eir_or_class(struct hci_dev *hdev)
1409 {
1410         struct pending_cmd *cmd;
1411
1412         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1413                 switch (cmd->opcode) {
1414                 case MGMT_OP_ADD_UUID:
1415                 case MGMT_OP_REMOVE_UUID:
1416                 case MGMT_OP_SET_DEV_CLASS:
1417                 case MGMT_OP_SET_POWERED:
1418                         return true;
1419                 }
1420         }
1421
1422         return false;
1423 }
1424
1425 static const u8 bluetooth_base_uuid[] = {
1426                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1427                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1428 };
1429
1430 static u8 get_uuid_size(const u8 *uuid)
1431 {
1432         u32 val;
1433
1434         if (memcmp(uuid, bluetooth_base_uuid, 12))
1435                 return 128;
1436
1437         val = get_unaligned_le32(&uuid[12]);
1438         if (val > 0xffff)
1439                 return 32;
1440
1441         return 16;
1442 }
1443
1444 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1445 {
1446         struct pending_cmd *cmd;
1447
1448         hci_dev_lock(hdev);
1449
1450         cmd = mgmt_pending_find(mgmt_op, hdev);
1451         if (!cmd)
1452                 goto unlock;
1453
1454         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1455                      hdev->dev_class, 3);
1456
1457         mgmt_pending_remove(cmd);
1458
1459 unlock:
1460         hci_dev_unlock(hdev);
1461 }
1462
1463 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1464 {
1465         BT_DBG("status 0x%02x", status);
1466
1467         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1468 }
1469
1470 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1471 {
1472         struct mgmt_cp_add_uuid *cp = data;
1473         struct pending_cmd *cmd;
1474         struct hci_request req;
1475         struct bt_uuid *uuid;
1476         int err;
1477
1478         BT_DBG("request for %s", hdev->name);
1479
1480         hci_dev_lock(hdev);
1481
1482         if (pending_eir_or_class(hdev)) {
1483                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1484                                  MGMT_STATUS_BUSY);
1485                 goto failed;
1486         }
1487
1488         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1489         if (!uuid) {
1490                 err = -ENOMEM;
1491                 goto failed;
1492         }
1493
1494         memcpy(uuid->uuid, cp->uuid, 16);
1495         uuid->svc_hint = cp->svc_hint;
1496         uuid->size = get_uuid_size(cp->uuid);
1497
1498         list_add_tail(&uuid->list, &hdev->uuids);
1499
1500         hci_req_init(&req, hdev);
1501
1502         update_class(&req);
1503         update_eir(&req);
1504
1505         err = hci_req_run(&req, add_uuid_complete);
1506         if (err < 0) {
1507                 if (err != -ENODATA)
1508                         goto failed;
1509
1510                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1511                                    hdev->dev_class, 3);
1512                 goto failed;
1513         }
1514
1515         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1516         if (!cmd) {
1517                 err = -ENOMEM;
1518                 goto failed;
1519         }
1520
1521         err = 0;
1522
1523 failed:
1524         hci_dev_unlock(hdev);
1525         return err;
1526 }
1527
1528 static bool enable_service_cache(struct hci_dev *hdev)
1529 {
1530         if (!hdev_is_powered(hdev))
1531                 return false;
1532
1533         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1534                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1535                                    CACHE_TIMEOUT);
1536                 return true;
1537         }
1538
1539         return false;
1540 }
1541
1542 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1543 {
1544         BT_DBG("status 0x%02x", status);
1545
1546         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1547 }
1548
1549 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1550                        u16 len)
1551 {
1552         struct mgmt_cp_remove_uuid *cp = data;
1553         struct pending_cmd *cmd;
1554         struct bt_uuid *match, *tmp;
1555         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1556         struct hci_request req;
1557         int err, found;
1558
1559         BT_DBG("request for %s", hdev->name);
1560
1561         hci_dev_lock(hdev);
1562
1563         if (pending_eir_or_class(hdev)) {
1564                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1565                                  MGMT_STATUS_BUSY);
1566                 goto unlock;
1567         }
1568
1569         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1570                 err = hci_uuids_clear(hdev);
1571
1572                 if (enable_service_cache(hdev)) {
1573                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1574                                            0, hdev->dev_class, 3);
1575                         goto unlock;
1576                 }
1577
1578                 goto update_class;
1579         }
1580
1581         found = 0;
1582
1583         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1584                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1585                         continue;
1586
1587                 list_del(&match->list);
1588                 kfree(match);
1589                 found++;
1590         }
1591
1592         if (found == 0) {
1593                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1594                                  MGMT_STATUS_INVALID_PARAMS);
1595                 goto unlock;
1596         }
1597
1598 update_class:
1599         hci_req_init(&req, hdev);
1600
1601         update_class(&req);
1602         update_eir(&req);
1603
1604         err = hci_req_run(&req, remove_uuid_complete);
1605         if (err < 0) {
1606                 if (err != -ENODATA)
1607                         goto unlock;
1608
1609                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1610                                    hdev->dev_class, 3);
1611                 goto unlock;
1612         }
1613
1614         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1615         if (!cmd) {
1616                 err = -ENOMEM;
1617                 goto unlock;
1618         }
1619
1620         err = 0;
1621
1622 unlock:
1623         hci_dev_unlock(hdev);
1624         return err;
1625 }
1626
1627 static void set_class_complete(struct hci_dev *hdev, u8 status)
1628 {
1629         BT_DBG("status 0x%02x", status);
1630
1631         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1632 }
1633
1634 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1635                          u16 len)
1636 {
1637         struct mgmt_cp_set_dev_class *cp = data;
1638         struct pending_cmd *cmd;
1639         struct hci_request req;
1640         int err;
1641
1642         BT_DBG("request for %s", hdev->name);
1643
1644         if (!lmp_bredr_capable(hdev))
1645                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1646                                   MGMT_STATUS_NOT_SUPPORTED);
1647
1648         hci_dev_lock(hdev);
1649
1650         if (pending_eir_or_class(hdev)) {
1651                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1652                                  MGMT_STATUS_BUSY);
1653                 goto unlock;
1654         }
1655
1656         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1657                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1658                                  MGMT_STATUS_INVALID_PARAMS);
1659                 goto unlock;
1660         }
1661
1662         hdev->major_class = cp->major;
1663         hdev->minor_class = cp->minor;
1664
1665         if (!hdev_is_powered(hdev)) {
1666                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1667                                    hdev->dev_class, 3);
1668                 goto unlock;
1669         }
1670
1671         hci_req_init(&req, hdev);
1672
1673         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1674                 hci_dev_unlock(hdev);
1675                 cancel_delayed_work_sync(&hdev->service_cache);
1676                 hci_dev_lock(hdev);
1677                 update_eir(&req);
1678         }
1679
1680         update_class(&req);
1681
1682         err = hci_req_run(&req, set_class_complete);
1683         if (err < 0) {
1684                 if (err != -ENODATA)
1685                         goto unlock;
1686
1687                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1688                                    hdev->dev_class, 3);
1689                 goto unlock;
1690         }
1691
1692         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1693         if (!cmd) {
1694                 err = -ENOMEM;
1695                 goto unlock;
1696         }
1697
1698         err = 0;
1699
1700 unlock:
1701         hci_dev_unlock(hdev);
1702         return err;
1703 }
1704
1705 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1706                           u16 len)
1707 {
1708         struct mgmt_cp_load_link_keys *cp = data;
1709         u16 key_count, expected_len;
1710         int i;
1711
1712         key_count = __le16_to_cpu(cp->key_count);
1713
1714         expected_len = sizeof(*cp) + key_count *
1715                                         sizeof(struct mgmt_link_key_info);
1716         if (expected_len != len) {
1717                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1718                        len, expected_len);
1719                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1720                                   MGMT_STATUS_INVALID_PARAMS);
1721         }
1722
1723         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1724                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1725                                   MGMT_STATUS_INVALID_PARAMS);
1726
1727         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1728                key_count);
1729
1730         for (i = 0; i < key_count; i++) {
1731                 struct mgmt_link_key_info *key = &cp->keys[i];
1732
1733                 if (key->addr.type != BDADDR_BREDR)
1734                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1735                                           MGMT_STATUS_INVALID_PARAMS);
1736         }
1737
1738         hci_dev_lock(hdev);
1739
1740         hci_link_keys_clear(hdev);
1741
1742         if (cp->debug_keys)
1743                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1744         else
1745                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1746
1747         for (i = 0; i < key_count; i++) {
1748                 struct mgmt_link_key_info *key = &cp->keys[i];
1749
1750                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1751                                  key->type, key->pin_len);
1752         }
1753
1754         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1755
1756         hci_dev_unlock(hdev);
1757
1758         return 0;
1759 }
1760
1761 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1762                            u8 addr_type, struct sock *skip_sk)
1763 {
1764         struct mgmt_ev_device_unpaired ev;
1765
1766         bacpy(&ev.addr.bdaddr, bdaddr);
1767         ev.addr.type = addr_type;
1768
1769         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1770                           skip_sk);
1771 }
1772
1773 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1774                          u16 len)
1775 {
1776         struct mgmt_cp_unpair_device *cp = data;
1777         struct mgmt_rp_unpair_device rp;
1778         struct hci_cp_disconnect dc;
1779         struct pending_cmd *cmd;
1780         struct hci_conn *conn;
1781         int err;
1782
1783         memset(&rp, 0, sizeof(rp));
1784         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1785         rp.addr.type = cp->addr.type;
1786
1787         if (!bdaddr_type_is_valid(cp->addr.type))
1788                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1789                                     MGMT_STATUS_INVALID_PARAMS,
1790                                     &rp, sizeof(rp));
1791
1792         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1793                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1794                                     MGMT_STATUS_INVALID_PARAMS,
1795                                     &rp, sizeof(rp));
1796
1797         hci_dev_lock(hdev);
1798
1799         if (!hdev_is_powered(hdev)) {
1800                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1801                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1802                 goto unlock;
1803         }
1804
1805         if (cp->addr.type == BDADDR_BREDR)
1806                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1807         else
1808                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1809
1810         if (err < 0) {
1811                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1812                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1813                 goto unlock;
1814         }
1815
1816         if (cp->disconnect) {
1817                 if (cp->addr.type == BDADDR_BREDR)
1818                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1819                                                        &cp->addr.bdaddr);
1820                 else
1821                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1822                                                        &cp->addr.bdaddr);
1823         } else {
1824                 conn = NULL;
1825         }
1826
1827         if (!conn) {
1828                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1829                                    &rp, sizeof(rp));
1830                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1831                 goto unlock;
1832         }
1833
1834         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1835                                sizeof(*cp));
1836         if (!cmd) {
1837                 err = -ENOMEM;
1838                 goto unlock;
1839         }
1840
1841         dc.handle = cpu_to_le16(conn->handle);
1842         dc.reason = 0x13; /* Remote User Terminated Connection */
1843         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1844         if (err < 0)
1845                 mgmt_pending_remove(cmd);
1846
1847 unlock:
1848         hci_dev_unlock(hdev);
1849         return err;
1850 }
1851
1852 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1853                       u16 len)
1854 {
1855         struct mgmt_cp_disconnect *cp = data;
1856         struct mgmt_rp_disconnect rp;
1857         struct hci_cp_disconnect dc;
1858         struct pending_cmd *cmd;
1859         struct hci_conn *conn;
1860         int err;
1861
1862         BT_DBG("");
1863
1864         memset(&rp, 0, sizeof(rp));
1865         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1866         rp.addr.type = cp->addr.type;
1867
1868         if (!bdaddr_type_is_valid(cp->addr.type))
1869                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1870                                     MGMT_STATUS_INVALID_PARAMS,
1871                                     &rp, sizeof(rp));
1872
1873         hci_dev_lock(hdev);
1874
1875         if (!test_bit(HCI_UP, &hdev->flags)) {
1876                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1877                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1878                 goto failed;
1879         }
1880
1881         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1882                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1883                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1884                 goto failed;
1885         }
1886
1887         if (cp->addr.type == BDADDR_BREDR)
1888                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1889                                                &cp->addr.bdaddr);
1890         else
1891                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1892
1893         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1894                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1895                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1896                 goto failed;
1897         }
1898
1899         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1900         if (!cmd) {
1901                 err = -ENOMEM;
1902                 goto failed;
1903         }
1904
1905         dc.handle = cpu_to_le16(conn->handle);
1906         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1907
1908         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1909         if (err < 0)
1910                 mgmt_pending_remove(cmd);
1911
1912 failed:
1913         hci_dev_unlock(hdev);
1914         return err;
1915 }
1916
1917 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1918 {
1919         switch (link_type) {
1920         case LE_LINK:
1921                 switch (addr_type) {
1922                 case ADDR_LE_DEV_PUBLIC:
1923                         return BDADDR_LE_PUBLIC;
1924
1925                 default:
1926                         /* Fallback to LE Random address type */
1927                         return BDADDR_LE_RANDOM;
1928                 }
1929
1930         default:
1931                 /* Fallback to BR/EDR type */
1932                 return BDADDR_BREDR;
1933         }
1934 }
1935
1936 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1937                            u16 data_len)
1938 {
1939         struct mgmt_rp_get_connections *rp;
1940         struct hci_conn *c;
1941         size_t rp_len;
1942         int err;
1943         u16 i;
1944
1945         BT_DBG("");
1946
1947         hci_dev_lock(hdev);
1948
1949         if (!hdev_is_powered(hdev)) {
1950                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1951                                  MGMT_STATUS_NOT_POWERED);
1952                 goto unlock;
1953         }
1954
1955         i = 0;
1956         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1957                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1958                         i++;
1959         }
1960
1961         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1962         rp = kmalloc(rp_len, GFP_KERNEL);
1963         if (!rp) {
1964                 err = -ENOMEM;
1965                 goto unlock;
1966         }
1967
1968         i = 0;
1969         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1970                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1971                         continue;
1972                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1973                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1974                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1975                         continue;
1976                 i++;
1977         }
1978
1979         rp->conn_count = cpu_to_le16(i);
1980
1981         /* Recalculate length in case of filtered SCO connections, etc */
1982         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1983
1984         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1985                            rp_len);
1986
1987         kfree(rp);
1988
1989 unlock:
1990         hci_dev_unlock(hdev);
1991         return err;
1992 }
1993
1994 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1995                                    struct mgmt_cp_pin_code_neg_reply *cp)
1996 {
1997         struct pending_cmd *cmd;
1998         int err;
1999
2000         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2001                                sizeof(*cp));
2002         if (!cmd)
2003                 return -ENOMEM;
2004
2005         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2006                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2007         if (err < 0)
2008                 mgmt_pending_remove(cmd);
2009
2010         return err;
2011 }
2012
2013 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2014                           u16 len)
2015 {
2016         struct hci_conn *conn;
2017         struct mgmt_cp_pin_code_reply *cp = data;
2018         struct hci_cp_pin_code_reply reply;
2019         struct pending_cmd *cmd;
2020         int err;
2021
2022         BT_DBG("");
2023
2024         hci_dev_lock(hdev);
2025
2026         if (!hdev_is_powered(hdev)) {
2027                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2028                                  MGMT_STATUS_NOT_POWERED);
2029                 goto failed;
2030         }
2031
2032         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2033         if (!conn) {
2034                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2035                                  MGMT_STATUS_NOT_CONNECTED);
2036                 goto failed;
2037         }
2038
2039         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2040                 struct mgmt_cp_pin_code_neg_reply ncp;
2041
2042                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2043
2044                 BT_ERR("PIN code is not 16 bytes long");
2045
2046                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2047                 if (err >= 0)
2048                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2049                                          MGMT_STATUS_INVALID_PARAMS);
2050
2051                 goto failed;
2052         }
2053
2054         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2055         if (!cmd) {
2056                 err = -ENOMEM;
2057                 goto failed;
2058         }
2059
2060         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2061         reply.pin_len = cp->pin_len;
2062         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2063
2064         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2065         if (err < 0)
2066                 mgmt_pending_remove(cmd);
2067
2068 failed:
2069         hci_dev_unlock(hdev);
2070         return err;
2071 }
2072
2073 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2074                              u16 len)
2075 {
2076         struct mgmt_cp_set_io_capability *cp = data;
2077
2078         BT_DBG("");
2079
2080         hci_dev_lock(hdev);
2081
2082         hdev->io_capability = cp->io_capability;
2083
2084         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2085                hdev->io_capability);
2086
2087         hci_dev_unlock(hdev);
2088
2089         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2090                             0);
2091 }
2092
2093 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2094 {
2095         struct hci_dev *hdev = conn->hdev;
2096         struct pending_cmd *cmd;
2097
2098         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2099                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2100                         continue;
2101
2102                 if (cmd->user_data != conn)
2103                         continue;
2104
2105                 return cmd;
2106         }
2107
2108         return NULL;
2109 }
2110
2111 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2112 {
2113         struct mgmt_rp_pair_device rp;
2114         struct hci_conn *conn = cmd->user_data;
2115
2116         bacpy(&rp.addr.bdaddr, &conn->dst);
2117         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2118
2119         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2120                      &rp, sizeof(rp));
2121
2122         /* So we don't get further callbacks for this connection */
2123         conn->connect_cfm_cb = NULL;
2124         conn->security_cfm_cb = NULL;
2125         conn->disconn_cfm_cb = NULL;
2126
2127         hci_conn_drop(conn);
2128
2129         mgmt_pending_remove(cmd);
2130 }
2131
2132 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2133 {
2134         struct pending_cmd *cmd;
2135
2136         BT_DBG("status %u", status);
2137
2138         cmd = find_pairing(conn);
2139         if (!cmd)
2140                 BT_DBG("Unable to find a pending command");
2141         else
2142                 pairing_complete(cmd, mgmt_status(status));
2143 }
2144
2145 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2146 {
2147         struct pending_cmd *cmd;
2148
2149         BT_DBG("status %u", status);
2150
2151         if (!status)
2152                 return;
2153
2154         cmd = find_pairing(conn);
2155         if (!cmd)
2156                 BT_DBG("Unable to find a pending command");
2157         else
2158                 pairing_complete(cmd, mgmt_status(status));
2159 }
2160
2161 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2162                        u16 len)
2163 {
2164         struct mgmt_cp_pair_device *cp = data;
2165         struct mgmt_rp_pair_device rp;
2166         struct pending_cmd *cmd;
2167         u8 sec_level, auth_type;
2168         struct hci_conn *conn;
2169         int err;
2170
2171         BT_DBG("");
2172
2173         memset(&rp, 0, sizeof(rp));
2174         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2175         rp.addr.type = cp->addr.type;
2176
2177         if (!bdaddr_type_is_valid(cp->addr.type))
2178                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2179                                     MGMT_STATUS_INVALID_PARAMS,
2180                                     &rp, sizeof(rp));
2181
2182         hci_dev_lock(hdev);
2183
2184         if (!hdev_is_powered(hdev)) {
2185                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2186                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2187                 goto unlock;
2188         }
2189
2190         sec_level = BT_SECURITY_MEDIUM;
2191         if (cp->io_cap == 0x03)
2192                 auth_type = HCI_AT_DEDICATED_BONDING;
2193         else
2194                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2195
2196         if (cp->addr.type == BDADDR_BREDR)
2197                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2198                                    cp->addr.type, sec_level, auth_type);
2199         else
2200                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2201                                    cp->addr.type, sec_level, auth_type);
2202
2203         if (IS_ERR(conn)) {
2204                 int status;
2205
2206                 if (PTR_ERR(conn) == -EBUSY)
2207                         status = MGMT_STATUS_BUSY;
2208                 else
2209                         status = MGMT_STATUS_CONNECT_FAILED;
2210
2211                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2212                                    status, &rp,
2213                                    sizeof(rp));
2214                 goto unlock;
2215         }
2216
2217         if (conn->connect_cfm_cb) {
2218                 hci_conn_drop(conn);
2219                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2220                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2221                 goto unlock;
2222         }
2223
2224         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2225         if (!cmd) {
2226                 err = -ENOMEM;
2227                 hci_conn_drop(conn);
2228                 goto unlock;
2229         }
2230
2231         /* For LE, just connecting isn't a proof that the pairing finished */
2232         if (cp->addr.type == BDADDR_BREDR)
2233                 conn->connect_cfm_cb = pairing_complete_cb;
2234         else
2235                 conn->connect_cfm_cb = le_connect_complete_cb;
2236
2237         conn->security_cfm_cb = pairing_complete_cb;
2238         conn->disconn_cfm_cb = pairing_complete_cb;
2239         conn->io_capability = cp->io_cap;
2240         cmd->user_data = conn;
2241
2242         if (conn->state == BT_CONNECTED &&
2243             hci_conn_security(conn, sec_level, auth_type))
2244                 pairing_complete(cmd, 0);
2245
2246         err = 0;
2247
2248 unlock:
2249         hci_dev_unlock(hdev);
2250         return err;
2251 }
2252
2253 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2254                               u16 len)
2255 {
2256         struct mgmt_addr_info *addr = data;
2257         struct pending_cmd *cmd;
2258         struct hci_conn *conn;
2259         int err;
2260
2261         BT_DBG("");
2262
2263         hci_dev_lock(hdev);
2264
2265         if (!hdev_is_powered(hdev)) {
2266                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2267                                  MGMT_STATUS_NOT_POWERED);
2268                 goto unlock;
2269         }
2270
2271         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2272         if (!cmd) {
2273                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2274                                  MGMT_STATUS_INVALID_PARAMS);
2275                 goto unlock;
2276         }
2277
2278         conn = cmd->user_data;
2279
2280         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2281                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2282                                  MGMT_STATUS_INVALID_PARAMS);
2283                 goto unlock;
2284         }
2285
2286         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2287
2288         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2289                            addr, sizeof(*addr));
2290 unlock:
2291         hci_dev_unlock(hdev);
2292         return err;
2293 }
2294
2295 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2296                              struct mgmt_addr_info *addr, u16 mgmt_op,
2297                              u16 hci_op, __le32 passkey)
2298 {
2299         struct pending_cmd *cmd;
2300         struct hci_conn *conn;
2301         int err;
2302
2303         hci_dev_lock(hdev);
2304
2305         if (!hdev_is_powered(hdev)) {
2306                 err = cmd_complete(sk, hdev->id, mgmt_op,
2307                                    MGMT_STATUS_NOT_POWERED, addr,
2308                                    sizeof(*addr));
2309                 goto done;
2310         }
2311
2312         if (addr->type == BDADDR_BREDR)
2313                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2314         else
2315                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2316
2317         if (!conn) {
2318                 err = cmd_complete(sk, hdev->id, mgmt_op,
2319                                    MGMT_STATUS_NOT_CONNECTED, addr,
2320                                    sizeof(*addr));
2321                 goto done;
2322         }
2323
2324         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2325                 /* Continue with pairing via SMP */
2326                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2327
2328                 if (!err)
2329                         err = cmd_complete(sk, hdev->id, mgmt_op,
2330                                            MGMT_STATUS_SUCCESS, addr,
2331                                            sizeof(*addr));
2332                 else
2333                         err = cmd_complete(sk, hdev->id, mgmt_op,
2334                                            MGMT_STATUS_FAILED, addr,
2335                                            sizeof(*addr));
2336
2337                 goto done;
2338         }
2339
2340         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2341         if (!cmd) {
2342                 err = -ENOMEM;
2343                 goto done;
2344         }
2345
2346         /* Continue with pairing via HCI */
2347         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2348                 struct hci_cp_user_passkey_reply cp;
2349
2350                 bacpy(&cp.bdaddr, &addr->bdaddr);
2351                 cp.passkey = passkey;
2352                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2353         } else
2354                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2355                                    &addr->bdaddr);
2356
2357         if (err < 0)
2358                 mgmt_pending_remove(cmd);
2359
2360 done:
2361         hci_dev_unlock(hdev);
2362         return err;
2363 }
2364
2365 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2366                               void *data, u16 len)
2367 {
2368         struct mgmt_cp_pin_code_neg_reply *cp = data;
2369
2370         BT_DBG("");
2371
2372         return user_pairing_resp(sk, hdev, &cp->addr,
2373                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2374                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2375 }
2376
2377 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2378                               u16 len)
2379 {
2380         struct mgmt_cp_user_confirm_reply *cp = data;
2381
2382         BT_DBG("");
2383
2384         if (len != sizeof(*cp))
2385                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2386                                   MGMT_STATUS_INVALID_PARAMS);
2387
2388         return user_pairing_resp(sk, hdev, &cp->addr,
2389                                  MGMT_OP_USER_CONFIRM_REPLY,
2390                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2391 }
2392
2393 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2394                                   void *data, u16 len)
2395 {
2396         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2397
2398         BT_DBG("");
2399
2400         return user_pairing_resp(sk, hdev, &cp->addr,
2401                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2402                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2403 }
2404
2405 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2406                               u16 len)
2407 {
2408         struct mgmt_cp_user_passkey_reply *cp = data;
2409
2410         BT_DBG("");
2411
2412         return user_pairing_resp(sk, hdev, &cp->addr,
2413                                  MGMT_OP_USER_PASSKEY_REPLY,
2414                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2415 }
2416
2417 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2418                                   void *data, u16 len)
2419 {
2420         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2421
2422         BT_DBG("");
2423
2424         return user_pairing_resp(sk, hdev, &cp->addr,
2425                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2426                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2427 }
2428
2429 static void update_name(struct hci_request *req)
2430 {
2431         struct hci_dev *hdev = req->hdev;
2432         struct hci_cp_write_local_name cp;
2433
2434         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2435
2436         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2437 }
2438
2439 static void set_name_complete(struct hci_dev *hdev, u8 status)
2440 {
2441         struct mgmt_cp_set_local_name *cp;
2442         struct pending_cmd *cmd;
2443
2444         BT_DBG("status 0x%02x", status);
2445
2446         hci_dev_lock(hdev);
2447
2448         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2449         if (!cmd)
2450                 goto unlock;
2451
2452         cp = cmd->param;
2453
2454         if (status)
2455                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2456                            mgmt_status(status));
2457         else
2458                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2459                              cp, sizeof(*cp));
2460
2461         mgmt_pending_remove(cmd);
2462
2463 unlock:
2464         hci_dev_unlock(hdev);
2465 }
2466
2467 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2468                           u16 len)
2469 {
2470         struct mgmt_cp_set_local_name *cp = data;
2471         struct pending_cmd *cmd;
2472         struct hci_request req;
2473         int err;
2474
2475         BT_DBG("");
2476
2477         hci_dev_lock(hdev);
2478
2479         /* If the old values are the same as the new ones just return a
2480          * direct command complete event.
2481          */
2482         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2483             !memcmp(hdev->short_name, cp->short_name,
2484                     sizeof(hdev->short_name))) {
2485                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2486                                    data, len);
2487                 goto failed;
2488         }
2489
2490         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2491
2492         if (!hdev_is_powered(hdev)) {
2493                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2494
2495                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2496                                    data, len);
2497                 if (err < 0)
2498                         goto failed;
2499
2500                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2501                                  sk);
2502
2503                 goto failed;
2504         }
2505
2506         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2507         if (!cmd) {
2508                 err = -ENOMEM;
2509                 goto failed;
2510         }
2511
2512         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2513
2514         hci_req_init(&req, hdev);
2515
2516         if (lmp_bredr_capable(hdev)) {
2517                 update_name(&req);
2518                 update_eir(&req);
2519         }
2520
2521         if (lmp_le_capable(hdev))
2522                 hci_update_ad(&req);
2523
2524         err = hci_req_run(&req, set_name_complete);
2525         if (err < 0)
2526                 mgmt_pending_remove(cmd);
2527
2528 failed:
2529         hci_dev_unlock(hdev);
2530         return err;
2531 }
2532
2533 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2534                                void *data, u16 data_len)
2535 {
2536         struct pending_cmd *cmd;
2537         int err;
2538
2539         BT_DBG("%s", hdev->name);
2540
2541         hci_dev_lock(hdev);
2542
2543         if (!hdev_is_powered(hdev)) {
2544                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2545                                  MGMT_STATUS_NOT_POWERED);
2546                 goto unlock;
2547         }
2548
2549         if (!lmp_ssp_capable(hdev)) {
2550                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2551                                  MGMT_STATUS_NOT_SUPPORTED);
2552                 goto unlock;
2553         }
2554
2555         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2556                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2557                                  MGMT_STATUS_BUSY);
2558                 goto unlock;
2559         }
2560
2561         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2562         if (!cmd) {
2563                 err = -ENOMEM;
2564                 goto unlock;
2565         }
2566
2567         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2568         if (err < 0)
2569                 mgmt_pending_remove(cmd);
2570
2571 unlock:
2572         hci_dev_unlock(hdev);
2573         return err;
2574 }
2575
2576 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2577                                void *data, u16 len)
2578 {
2579         struct mgmt_cp_add_remote_oob_data *cp = data;
2580         u8 status;
2581         int err;
2582
2583         BT_DBG("%s ", hdev->name);
2584
2585         hci_dev_lock(hdev);
2586
2587         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2588                                       cp->randomizer);
2589         if (err < 0)
2590                 status = MGMT_STATUS_FAILED;
2591         else
2592                 status = MGMT_STATUS_SUCCESS;
2593
2594         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2595                            &cp->addr, sizeof(cp->addr));
2596
2597         hci_dev_unlock(hdev);
2598         return err;
2599 }
2600
2601 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2602                                   void *data, u16 len)
2603 {
2604         struct mgmt_cp_remove_remote_oob_data *cp = data;
2605         u8 status;
2606         int err;
2607
2608         BT_DBG("%s", hdev->name);
2609
2610         hci_dev_lock(hdev);
2611
2612         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2613         if (err < 0)
2614                 status = MGMT_STATUS_INVALID_PARAMS;
2615         else
2616                 status = MGMT_STATUS_SUCCESS;
2617
2618         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2619                            status, &cp->addr, sizeof(cp->addr));
2620
2621         hci_dev_unlock(hdev);
2622         return err;
2623 }
2624
2625 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2626 {
2627         struct pending_cmd *cmd;
2628         u8 type;
2629         int err;
2630
2631         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2632
2633         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2634         if (!cmd)
2635                 return -ENOENT;
2636
2637         type = hdev->discovery.type;
2638
2639         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2640                            &type, sizeof(type));
2641         mgmt_pending_remove(cmd);
2642
2643         return err;
2644 }
2645
2646 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
2647 {
2648         BT_DBG("status %d", status);
2649
2650         if (status) {
2651                 hci_dev_lock(hdev);
2652                 mgmt_start_discovery_failed(hdev, status);
2653                 hci_dev_unlock(hdev);
2654                 return;
2655         }
2656
2657         hci_dev_lock(hdev);
2658         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2659         hci_dev_unlock(hdev);
2660
2661         switch (hdev->discovery.type) {
2662         case DISCOV_TYPE_LE:
2663                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2664                                    DISCOV_LE_TIMEOUT);
2665                 break;
2666
2667         case DISCOV_TYPE_INTERLEAVED:
2668                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2669                                    DISCOV_INTERLEAVED_TIMEOUT);
2670                 break;
2671
2672         case DISCOV_TYPE_BREDR:
2673                 break;
2674
2675         default:
2676                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
2677         }
2678 }
2679
2680 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2681                            void *data, u16 len)
2682 {
2683         struct mgmt_cp_start_discovery *cp = data;
2684         struct pending_cmd *cmd;
2685         struct hci_cp_le_set_scan_param param_cp;
2686         struct hci_cp_le_set_scan_enable enable_cp;
2687         struct hci_cp_inquiry inq_cp;
2688         struct hci_request req;
2689         /* General inquiry access code (GIAC) */
2690         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2691         int err;
2692
2693         BT_DBG("%s", hdev->name);
2694
2695         hci_dev_lock(hdev);
2696
2697         if (!hdev_is_powered(hdev)) {
2698                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2699                                  MGMT_STATUS_NOT_POWERED);
2700                 goto failed;
2701         }
2702
2703         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2704                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2705                                  MGMT_STATUS_BUSY);
2706                 goto failed;
2707         }
2708
2709         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2710                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2711                                  MGMT_STATUS_BUSY);
2712                 goto failed;
2713         }
2714
2715         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2716         if (!cmd) {
2717                 err = -ENOMEM;
2718                 goto failed;
2719         }
2720
2721         hdev->discovery.type = cp->type;
2722
2723         hci_req_init(&req, hdev);
2724
2725         switch (hdev->discovery.type) {
2726         case DISCOV_TYPE_BREDR:
2727                 if (!lmp_bredr_capable(hdev)) {
2728                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2729                                          MGMT_STATUS_NOT_SUPPORTED);
2730                         mgmt_pending_remove(cmd);
2731                         goto failed;
2732                 }
2733
2734                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2735                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2736                                          MGMT_STATUS_BUSY);
2737                         mgmt_pending_remove(cmd);
2738                         goto failed;
2739                 }
2740
2741                 hci_inquiry_cache_flush(hdev);
2742
2743                 memset(&inq_cp, 0, sizeof(inq_cp));
2744                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
2745                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
2746                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
2747                 break;
2748
2749         case DISCOV_TYPE_LE:
2750         case DISCOV_TYPE_INTERLEAVED:
2751                 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2752                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2753                                          MGMT_STATUS_NOT_SUPPORTED);
2754                         mgmt_pending_remove(cmd);
2755                         goto failed;
2756                 }
2757
2758                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
2759                     !lmp_bredr_capable(hdev)) {
2760                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2761                                          MGMT_STATUS_NOT_SUPPORTED);
2762                         mgmt_pending_remove(cmd);
2763                         goto failed;
2764                 }
2765
2766                 if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
2767                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2768                                          MGMT_STATUS_REJECTED);
2769                         mgmt_pending_remove(cmd);
2770                         goto failed;
2771                 }
2772
2773                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
2774                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2775                                          MGMT_STATUS_BUSY);
2776                         mgmt_pending_remove(cmd);
2777                         goto failed;
2778                 }
2779
2780                 memset(&param_cp, 0, sizeof(param_cp));
2781                 param_cp.type = LE_SCAN_ACTIVE;
2782                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
2783                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
2784                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
2785                             &param_cp);
2786
2787                 memset(&enable_cp, 0, sizeof(enable_cp));
2788                 enable_cp.enable = LE_SCAN_ENABLE;
2789                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2790                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
2791                             &enable_cp);
2792                 break;
2793
2794         default:
2795                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2796                                  MGMT_STATUS_INVALID_PARAMS);
2797                 mgmt_pending_remove(cmd);
2798                 goto failed;
2799         }
2800
2801         err = hci_req_run(&req, start_discovery_complete);
2802         if (err < 0)
2803                 mgmt_pending_remove(cmd);
2804         else
2805                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2806
2807 failed:
2808         hci_dev_unlock(hdev);
2809         return err;
2810 }
2811
2812 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2813 {
2814         struct pending_cmd *cmd;
2815         int err;
2816
2817         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2818         if (!cmd)
2819                 return -ENOENT;
2820
2821         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2822                            &hdev->discovery.type, sizeof(hdev->discovery.type));
2823         mgmt_pending_remove(cmd);
2824
2825         return err;
2826 }
2827
2828 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
2829 {
2830         BT_DBG("status %d", status);
2831
2832         hci_dev_lock(hdev);
2833
2834         if (status) {
2835                 mgmt_stop_discovery_failed(hdev, status);
2836                 goto unlock;
2837         }
2838
2839         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2840
2841 unlock:
2842         hci_dev_unlock(hdev);
2843 }
2844
2845 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2846                           u16 len)
2847 {
2848         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2849         struct pending_cmd *cmd;
2850         struct hci_cp_remote_name_req_cancel cp;
2851         struct inquiry_entry *e;
2852         struct hci_request req;
2853         struct hci_cp_le_set_scan_enable enable_cp;
2854         int err;
2855
2856         BT_DBG("%s", hdev->name);
2857
2858         hci_dev_lock(hdev);
2859
2860         if (!hci_discovery_active(hdev)) {
2861                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2862                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2863                                    sizeof(mgmt_cp->type));
2864                 goto unlock;
2865         }
2866
2867         if (hdev->discovery.type != mgmt_cp->type) {
2868                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2869                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2870                                    sizeof(mgmt_cp->type));
2871                 goto unlock;
2872         }
2873
2874         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2875         if (!cmd) {
2876                 err = -ENOMEM;
2877                 goto unlock;
2878         }
2879
2880         hci_req_init(&req, hdev);
2881
2882         switch (hdev->discovery.state) {
2883         case DISCOVERY_FINDING:
2884                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2885                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2886                 } else {
2887                         cancel_delayed_work(&hdev->le_scan_disable);
2888
2889                         memset(&enable_cp, 0, sizeof(enable_cp));
2890                         enable_cp.enable = LE_SCAN_DISABLE;
2891                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
2892                                     sizeof(enable_cp), &enable_cp);
2893                 }
2894
2895                 break;
2896
2897         case DISCOVERY_RESOLVING:
2898                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2899                                                      NAME_PENDING);
2900                 if (!e) {
2901                         mgmt_pending_remove(cmd);
2902                         err = cmd_complete(sk, hdev->id,
2903                                            MGMT_OP_STOP_DISCOVERY, 0,
2904                                            &mgmt_cp->type,
2905                                            sizeof(mgmt_cp->type));
2906                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2907                         goto unlock;
2908                 }
2909
2910                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2911                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
2912                             &cp);
2913
2914                 break;
2915
2916         default:
2917                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2918
2919                 mgmt_pending_remove(cmd);
2920                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2921                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
2922                                    sizeof(mgmt_cp->type));
2923                 goto unlock;
2924         }
2925
2926         err = hci_req_run(&req, stop_discovery_complete);
2927         if (err < 0)
2928                 mgmt_pending_remove(cmd);
2929         else
2930                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2931
2932 unlock:
2933         hci_dev_unlock(hdev);
2934         return err;
2935 }
2936
2937 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2938                         u16 len)
2939 {
2940         struct mgmt_cp_confirm_name *cp = data;
2941         struct inquiry_entry *e;
2942         int err;
2943
2944         BT_DBG("%s", hdev->name);
2945
2946         hci_dev_lock(hdev);
2947
2948         if (!hci_discovery_active(hdev)) {
2949                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2950                                  MGMT_STATUS_FAILED);
2951                 goto failed;
2952         }
2953
2954         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2955         if (!e) {
2956                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2957                                  MGMT_STATUS_INVALID_PARAMS);
2958                 goto failed;
2959         }
2960
2961         if (cp->name_known) {
2962                 e->name_state = NAME_KNOWN;
2963                 list_del(&e->list);
2964         } else {
2965                 e->name_state = NAME_NEEDED;
2966                 hci_inquiry_cache_update_resolve(hdev, e);
2967         }
2968
2969         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
2970                            sizeof(cp->addr));
2971
2972 failed:
2973         hci_dev_unlock(hdev);
2974         return err;
2975 }
2976
2977 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2978                         u16 len)
2979 {
2980         struct mgmt_cp_block_device *cp = data;
2981         u8 status;
2982         int err;
2983
2984         BT_DBG("%s", hdev->name);
2985
2986         if (!bdaddr_type_is_valid(cp->addr.type))
2987                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
2988                                     MGMT_STATUS_INVALID_PARAMS,
2989                                     &cp->addr, sizeof(cp->addr));
2990
2991         hci_dev_lock(hdev);
2992
2993         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2994         if (err < 0)
2995                 status = MGMT_STATUS_FAILED;
2996         else
2997                 status = MGMT_STATUS_SUCCESS;
2998
2999         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3000                            &cp->addr, sizeof(cp->addr));
3001
3002         hci_dev_unlock(hdev);
3003
3004         return err;
3005 }
3006
3007 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3008                           u16 len)
3009 {
3010         struct mgmt_cp_unblock_device *cp = data;
3011         u8 status;
3012         int err;
3013
3014         BT_DBG("%s", hdev->name);
3015
3016         if (!bdaddr_type_is_valid(cp->addr.type))
3017                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3018                                     MGMT_STATUS_INVALID_PARAMS,
3019                                     &cp->addr, sizeof(cp->addr));
3020
3021         hci_dev_lock(hdev);
3022
3023         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3024         if (err < 0)
3025                 status = MGMT_STATUS_INVALID_PARAMS;
3026         else
3027                 status = MGMT_STATUS_SUCCESS;
3028
3029         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3030                            &cp->addr, sizeof(cp->addr));
3031
3032         hci_dev_unlock(hdev);
3033
3034         return err;
3035 }
3036
3037 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3038                          u16 len)
3039 {
3040         struct mgmt_cp_set_device_id *cp = data;
3041         struct hci_request req;
3042         int err;
3043         __u16 source;
3044
3045         BT_DBG("%s", hdev->name);
3046
3047         source = __le16_to_cpu(cp->source);
3048
3049         if (source > 0x0002)
3050                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3051                                   MGMT_STATUS_INVALID_PARAMS);
3052
3053         hci_dev_lock(hdev);
3054
3055         hdev->devid_source = source;
3056         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3057         hdev->devid_product = __le16_to_cpu(cp->product);
3058         hdev->devid_version = __le16_to_cpu(cp->version);
3059
3060         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3061
3062         hci_req_init(&req, hdev);
3063         update_eir(&req);
3064         hci_req_run(&req, NULL);
3065
3066         hci_dev_unlock(hdev);
3067
3068         return err;
3069 }
3070
3071 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3072 {
3073         struct pending_cmd *cmd;
3074
3075         BT_DBG("status 0x%02x", status);
3076
3077         hci_dev_lock(hdev);
3078
3079         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3080         if (!cmd)
3081                 goto unlock;
3082
3083         if (status) {
3084                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3085                            mgmt_status(status));
3086         } else {
3087                 struct mgmt_mode *cp = cmd->param;
3088
3089                 if (cp->val)
3090                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3091                 else
3092                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3093
3094                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3095                 new_settings(hdev, cmd->sk);
3096         }
3097
3098         mgmt_pending_remove(cmd);
3099
3100 unlock:
3101         hci_dev_unlock(hdev);
3102 }
3103
3104 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3105                                 void *data, u16 len)
3106 {
3107         struct mgmt_mode *cp = data;
3108         struct pending_cmd *cmd;
3109         struct hci_request req;
3110         int err;
3111
3112         BT_DBG("%s", hdev->name);
3113
3114         if (!lmp_bredr_capable(hdev) || hdev->hci_ver < BLUETOOTH_VER_1_2)
3115                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3116                                   MGMT_STATUS_NOT_SUPPORTED);
3117
3118         if (cp->val != 0x00 && cp->val != 0x01)
3119                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3120                                   MGMT_STATUS_INVALID_PARAMS);
3121
3122         if (!hdev_is_powered(hdev))
3123                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3124                                   MGMT_STATUS_NOT_POWERED);
3125
3126         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3127                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3128                                   MGMT_STATUS_REJECTED);
3129
3130         hci_dev_lock(hdev);
3131
3132         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3133                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3134                                  MGMT_STATUS_BUSY);
3135                 goto unlock;
3136         }
3137
3138         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3139                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3140                                         hdev);
3141                 goto unlock;
3142         }
3143
3144         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3145                                data, len);
3146         if (!cmd) {
3147                 err = -ENOMEM;
3148                 goto unlock;
3149         }
3150
3151         hci_req_init(&req, hdev);
3152
3153         write_fast_connectable(&req, cp->val);
3154
3155         err = hci_req_run(&req, fast_connectable_complete);
3156         if (err < 0) {
3157                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3158                                  MGMT_STATUS_FAILED);
3159                 mgmt_pending_remove(cmd);
3160         }
3161
3162 unlock:
3163         hci_dev_unlock(hdev);
3164
3165         return err;
3166 }
3167
3168 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3169 {
3170         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3171                 return false;
3172         if (key->master != 0x00 && key->master != 0x01)
3173                 return false;
3174         if (!bdaddr_type_is_le(key->addr.type))
3175                 return false;
3176         return true;
3177 }
3178
3179 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3180                                void *cp_data, u16 len)
3181 {
3182         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3183         u16 key_count, expected_len;
3184         int i, err;
3185
3186         key_count = __le16_to_cpu(cp->key_count);
3187
3188         expected_len = sizeof(*cp) + key_count *
3189                                         sizeof(struct mgmt_ltk_info);
3190         if (expected_len != len) {
3191                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3192                        len, expected_len);
3193                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3194                                   MGMT_STATUS_INVALID_PARAMS);
3195         }
3196
3197         BT_DBG("%s key_count %u", hdev->name, key_count);
3198
3199         for (i = 0; i < key_count; i++) {
3200                 struct mgmt_ltk_info *key = &cp->keys[i];
3201
3202                 if (!ltk_is_valid(key))
3203                         return cmd_status(sk, hdev->id,
3204                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3205                                           MGMT_STATUS_INVALID_PARAMS);
3206         }
3207
3208         hci_dev_lock(hdev);
3209
3210         hci_smp_ltks_clear(hdev);
3211
3212         for (i = 0; i < key_count; i++) {
3213                 struct mgmt_ltk_info *key = &cp->keys[i];
3214                 u8 type;
3215
3216                 if (key->master)
3217                         type = HCI_SMP_LTK;
3218                 else
3219                         type = HCI_SMP_LTK_SLAVE;
3220
3221                 hci_add_ltk(hdev, &key->addr.bdaddr,
3222                             bdaddr_to_le(key->addr.type),
3223                             type, 0, key->authenticated, key->val,
3224                             key->enc_size, key->ediv, key->rand);
3225         }
3226
3227         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3228                            NULL, 0);
3229
3230         hci_dev_unlock(hdev);
3231
3232         return err;
3233 }
3234
3235 static const struct mgmt_handler {
3236         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3237                      u16 data_len);
3238         bool var_len;
3239         size_t data_len;
3240 } mgmt_handlers[] = {
3241         { NULL }, /* 0x0000 (no command) */
3242         { read_version,           false, MGMT_READ_VERSION_SIZE },
3243         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3244         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3245         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3246         { set_powered,            false, MGMT_SETTING_SIZE },
3247         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3248         { set_connectable,        false, MGMT_SETTING_SIZE },
3249         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3250         { set_pairable,           false, MGMT_SETTING_SIZE },
3251         { set_link_security,      false, MGMT_SETTING_SIZE },
3252         { set_ssp,                false, MGMT_SETTING_SIZE },
3253         { set_hs,                 false, MGMT_SETTING_SIZE },
3254         { set_le,                 false, MGMT_SETTING_SIZE },
3255         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3256         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3257         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3258         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3259         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3260         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3261         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3262         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3263         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3264         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3265         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3266         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3267         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3268         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3269         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3270         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3271         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3272         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3273         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3274         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3275         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3276         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3277         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3278         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3279         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3280         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3281         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3282 };
3283
3284
3285 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3286 {
3287         void *buf;
3288         u8 *cp;
3289         struct mgmt_hdr *hdr;
3290         u16 opcode, index, len;
3291         struct hci_dev *hdev = NULL;
3292         const struct mgmt_handler *handler;
3293         int err;
3294
3295         BT_DBG("got %zu bytes", msglen);
3296
3297         if (msglen < sizeof(*hdr))
3298                 return -EINVAL;
3299
3300         buf = kmalloc(msglen, GFP_KERNEL);
3301         if (!buf)
3302                 return -ENOMEM;
3303
3304         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3305                 err = -EFAULT;
3306                 goto done;
3307         }
3308
3309         hdr = buf;
3310         opcode = __le16_to_cpu(hdr->opcode);
3311         index = __le16_to_cpu(hdr->index);
3312         len = __le16_to_cpu(hdr->len);
3313
3314         if (len != msglen - sizeof(*hdr)) {
3315                 err = -EINVAL;
3316                 goto done;
3317         }
3318
3319         if (index != MGMT_INDEX_NONE) {
3320                 hdev = hci_dev_get(index);
3321                 if (!hdev) {
3322                         err = cmd_status(sk, index, opcode,
3323                                          MGMT_STATUS_INVALID_INDEX);
3324                         goto done;
3325                 }
3326
3327                 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
3328                         err = cmd_status(sk, index, opcode,
3329                                          MGMT_STATUS_INVALID_INDEX);
3330                         goto done;
3331                 }
3332         }
3333
3334         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3335             mgmt_handlers[opcode].func == NULL) {
3336                 BT_DBG("Unknown op %u", opcode);
3337                 err = cmd_status(sk, index, opcode,
3338                                  MGMT_STATUS_UNKNOWN_COMMAND);
3339                 goto done;
3340         }
3341
3342         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3343             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3344                 err = cmd_status(sk, index, opcode,
3345                                  MGMT_STATUS_INVALID_INDEX);
3346                 goto done;
3347         }
3348
3349         handler = &mgmt_handlers[opcode];
3350
3351         if ((handler->var_len && len < handler->data_len) ||
3352             (!handler->var_len && len != handler->data_len)) {
3353                 err = cmd_status(sk, index, opcode,
3354                                  MGMT_STATUS_INVALID_PARAMS);
3355                 goto done;
3356         }
3357
3358         if (hdev)
3359                 mgmt_init_hdev(sk, hdev);
3360
3361         cp = buf + sizeof(*hdr);
3362
3363         err = handler->func(sk, hdev, cp, len);
3364         if (err < 0)
3365                 goto done;
3366
3367         err = msglen;
3368
3369 done:
3370         if (hdev)
3371                 hci_dev_put(hdev);
3372
3373         kfree(buf);
3374         return err;
3375 }
3376
3377 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
3378 {
3379         u8 *status = data;
3380
3381         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
3382         mgmt_pending_remove(cmd);
3383 }
3384
3385 int mgmt_index_added(struct hci_dev *hdev)
3386 {
3387         if (!mgmt_valid_hdev(hdev))
3388                 return -ENOTSUPP;
3389
3390         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3391 }
3392
3393 int mgmt_index_removed(struct hci_dev *hdev)
3394 {
3395         u8 status = MGMT_STATUS_INVALID_INDEX;
3396
3397         if (!mgmt_valid_hdev(hdev))
3398                 return -ENOTSUPP;
3399
3400         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3401
3402         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3403 }
3404
3405 struct cmd_lookup {
3406         struct sock *sk;
3407         struct hci_dev *hdev;
3408         u8 mgmt_status;
3409 };
3410
3411 static void settings_rsp(struct pending_cmd *cmd, void *data)
3412 {
3413         struct cmd_lookup *match = data;
3414
3415         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
3416
3417         list_del(&cmd->list);
3418
3419         if (match->sk == NULL) {
3420                 match->sk = cmd->sk;
3421                 sock_hold(match->sk);
3422         }
3423
3424         mgmt_pending_free(cmd);
3425 }
3426
3427 static void set_bredr_scan(struct hci_request *req)
3428 {
3429         struct hci_dev *hdev = req->hdev;
3430         u8 scan = 0;
3431
3432         /* Ensure that fast connectable is disabled. This function will
3433          * not do anything if the page scan parameters are already what
3434          * they should be.
3435          */
3436         write_fast_connectable(req, false);
3437
3438         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3439                 scan |= SCAN_PAGE;
3440         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3441                 scan |= SCAN_INQUIRY;
3442
3443         if (scan)
3444                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3445 }
3446
3447 static void powered_complete(struct hci_dev *hdev, u8 status)
3448 {
3449         struct cmd_lookup match = { NULL, hdev };
3450
3451         BT_DBG("status 0x%02x", status);
3452
3453         hci_dev_lock(hdev);
3454
3455         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3456
3457         new_settings(hdev, match.sk);
3458
3459         hci_dev_unlock(hdev);
3460
3461         if (match.sk)
3462                 sock_put(match.sk);
3463 }
3464
3465 static int powered_update_hci(struct hci_dev *hdev)
3466 {
3467         struct hci_request req;
3468         u8 link_sec;
3469
3470         hci_req_init(&req, hdev);
3471
3472         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3473             !lmp_host_ssp_capable(hdev)) {
3474                 u8 ssp = 1;
3475
3476                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3477         }
3478
3479         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
3480             lmp_bredr_capable(hdev)) {
3481                 struct hci_cp_write_le_host_supported cp;
3482
3483                 cp.le = 1;
3484                 cp.simul = lmp_le_br_capable(hdev);
3485
3486                 /* Check first if we already have the right
3487                  * host state (host features set)
3488                  */
3489                 if (cp.le != lmp_host_le_capable(hdev) ||
3490                     cp.simul != lmp_host_le_br_capable(hdev))
3491                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3492                                     sizeof(cp), &cp);
3493         }
3494
3495         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3496         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3497                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3498                             sizeof(link_sec), &link_sec);
3499
3500         if (lmp_bredr_capable(hdev)) {
3501                 set_bredr_scan(&req);
3502                 update_class(&req);
3503                 update_name(&req);
3504                 update_eir(&req);
3505         }
3506
3507         return hci_req_run(&req, powered_complete);
3508 }
3509
3510 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3511 {
3512         struct cmd_lookup match = { NULL, hdev };
3513         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3514         u8 zero_cod[] = { 0, 0, 0 };
3515         int err;
3516
3517         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3518                 return 0;
3519
3520         if (powered) {
3521                 if (powered_update_hci(hdev) == 0)
3522                         return 0;
3523
3524                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3525                                      &match);
3526                 goto new_settings;
3527         }
3528
3529         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3530         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3531
3532         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3533                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3534                            zero_cod, sizeof(zero_cod), NULL);
3535
3536 new_settings:
3537         err = new_settings(hdev, match.sk);
3538
3539         if (match.sk)
3540                 sock_put(match.sk);
3541
3542         return err;
3543 }
3544
3545 int mgmt_set_powered_failed(struct hci_dev *hdev, int err)
3546 {
3547         struct pending_cmd *cmd;
3548         u8 status;
3549
3550         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
3551         if (!cmd)
3552                 return -ENOENT;
3553
3554         if (err == -ERFKILL)
3555                 status = MGMT_STATUS_RFKILLED;
3556         else
3557                 status = MGMT_STATUS_FAILED;
3558
3559         err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
3560
3561         mgmt_pending_remove(cmd);
3562
3563         return err;
3564 }
3565
3566 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3567 {
3568         struct cmd_lookup match = { NULL, hdev };
3569         bool changed = false;
3570         int err = 0;
3571
3572         if (discoverable) {
3573                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3574                         changed = true;
3575         } else {
3576                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3577                         changed = true;
3578         }
3579
3580         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3581                              &match);
3582
3583         if (changed)
3584                 err = new_settings(hdev, match.sk);
3585
3586         if (match.sk)
3587                 sock_put(match.sk);
3588
3589         return err;
3590 }
3591
3592 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3593 {
3594         struct pending_cmd *cmd;
3595         bool changed = false;
3596         int err = 0;
3597
3598         if (connectable) {
3599                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3600                         changed = true;
3601         } else {
3602                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3603                         changed = true;
3604         }
3605
3606         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
3607
3608         if (changed)
3609                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
3610
3611         return err;
3612 }
3613
3614 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3615 {
3616         u8 mgmt_err = mgmt_status(status);
3617
3618         if (scan & SCAN_PAGE)
3619                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3620                                      cmd_status_rsp, &mgmt_err);
3621
3622         if (scan & SCAN_INQUIRY)
3623                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3624                                      cmd_status_rsp, &mgmt_err);
3625
3626         return 0;
3627 }
3628
3629 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3630                       bool persistent)
3631 {
3632         struct mgmt_ev_new_link_key ev;
3633
3634         memset(&ev, 0, sizeof(ev));
3635
3636         ev.store_hint = persistent;
3637         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3638         ev.key.addr.type = BDADDR_BREDR;
3639         ev.key.type = key->type;
3640         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3641         ev.key.pin_len = key->pin_len;
3642
3643         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3644 }
3645
3646 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3647 {
3648         struct mgmt_ev_new_long_term_key ev;
3649
3650         memset(&ev, 0, sizeof(ev));
3651
3652         ev.store_hint = persistent;
3653         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3654         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3655         ev.key.authenticated = key->authenticated;
3656         ev.key.enc_size = key->enc_size;
3657         ev.key.ediv = key->ediv;
3658
3659         if (key->type == HCI_SMP_LTK)
3660                 ev.key.master = 1;
3661
3662         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3663         memcpy(ev.key.val, key->val, sizeof(key->val));
3664
3665         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3666                           NULL);
3667 }
3668
3669 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3670                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3671                           u8 *dev_class)
3672 {
3673         char buf[512];
3674         struct mgmt_ev_device_connected *ev = (void *) buf;
3675         u16 eir_len = 0;
3676
3677         bacpy(&ev->addr.bdaddr, bdaddr);
3678         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3679
3680         ev->flags = __cpu_to_le32(flags);
3681
3682         if (name_len > 0)
3683                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3684                                           name, name_len);
3685
3686         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3687                 eir_len = eir_append_data(ev->eir, eir_len,
3688                                           EIR_CLASS_OF_DEV, dev_class, 3);
3689
3690         ev->eir_len = cpu_to_le16(eir_len);
3691
3692         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3693                           sizeof(*ev) + eir_len, NULL);
3694 }
3695
3696 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3697 {
3698         struct mgmt_cp_disconnect *cp = cmd->param;
3699         struct sock **sk = data;
3700         struct mgmt_rp_disconnect rp;
3701
3702         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3703         rp.addr.type = cp->addr.type;
3704
3705         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3706                      sizeof(rp));
3707
3708         *sk = cmd->sk;
3709         sock_hold(*sk);
3710
3711         mgmt_pending_remove(cmd);
3712 }
3713
3714 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3715 {
3716         struct hci_dev *hdev = data;
3717         struct mgmt_cp_unpair_device *cp = cmd->param;
3718         struct mgmt_rp_unpair_device rp;
3719
3720         memset(&rp, 0, sizeof(rp));
3721         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3722         rp.addr.type = cp->addr.type;
3723
3724         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3725
3726         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3727
3728         mgmt_pending_remove(cmd);
3729 }
3730
3731 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3732                              u8 link_type, u8 addr_type, u8 reason)
3733 {
3734         struct mgmt_ev_device_disconnected ev;
3735         struct sock *sk = NULL;
3736         int err;
3737
3738         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3739
3740         bacpy(&ev.addr.bdaddr, bdaddr);
3741         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3742         ev.reason = reason;
3743
3744         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3745                          sk);
3746
3747         if (sk)
3748                 sock_put(sk);
3749
3750         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3751                              hdev);
3752
3753         return err;
3754 }
3755
3756 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3757                            u8 link_type, u8 addr_type, u8 status)
3758 {
3759         struct mgmt_rp_disconnect rp;
3760         struct pending_cmd *cmd;
3761         int err;
3762
3763         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3764                              hdev);
3765
3766         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3767         if (!cmd)
3768                 return -ENOENT;
3769
3770         bacpy(&rp.addr.bdaddr, bdaddr);
3771         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3772
3773         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3774                            mgmt_status(status), &rp, sizeof(rp));
3775
3776         mgmt_pending_remove(cmd);
3777
3778         return err;
3779 }
3780
3781 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3782                         u8 addr_type, u8 status)
3783 {
3784         struct mgmt_ev_connect_failed ev;
3785
3786         bacpy(&ev.addr.bdaddr, bdaddr);
3787         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3788         ev.status = mgmt_status(status);
3789
3790         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3791 }
3792
3793 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3794 {
3795         struct mgmt_ev_pin_code_request ev;
3796
3797         bacpy(&ev.addr.bdaddr, bdaddr);
3798         ev.addr.type = BDADDR_BREDR;
3799         ev.secure = secure;
3800
3801         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3802                           NULL);
3803 }
3804
3805 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3806                                  u8 status)
3807 {
3808         struct pending_cmd *cmd;
3809         struct mgmt_rp_pin_code_reply rp;
3810         int err;
3811
3812         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3813         if (!cmd)
3814                 return -ENOENT;
3815
3816         bacpy(&rp.addr.bdaddr, bdaddr);
3817         rp.addr.type = BDADDR_BREDR;
3818
3819         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3820                            mgmt_status(status), &rp, sizeof(rp));
3821
3822         mgmt_pending_remove(cmd);
3823
3824         return err;
3825 }
3826
3827 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3828                                      u8 status)
3829 {
3830         struct pending_cmd *cmd;
3831         struct mgmt_rp_pin_code_reply rp;
3832         int err;
3833
3834         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3835         if (!cmd)
3836                 return -ENOENT;
3837
3838         bacpy(&rp.addr.bdaddr, bdaddr);
3839         rp.addr.type = BDADDR_BREDR;
3840
3841         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3842                            mgmt_status(status), &rp, sizeof(rp));
3843
3844         mgmt_pending_remove(cmd);
3845
3846         return err;
3847 }
3848
3849 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3850                               u8 link_type, u8 addr_type, __le32 value,
3851                               u8 confirm_hint)
3852 {
3853         struct mgmt_ev_user_confirm_request ev;
3854
3855         BT_DBG("%s", hdev->name);
3856
3857         bacpy(&ev.addr.bdaddr, bdaddr);
3858         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3859         ev.confirm_hint = confirm_hint;
3860         ev.value = value;
3861
3862         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3863                           NULL);
3864 }
3865
3866 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3867                               u8 link_type, u8 addr_type)
3868 {
3869         struct mgmt_ev_user_passkey_request ev;
3870
3871         BT_DBG("%s", hdev->name);
3872
3873         bacpy(&ev.addr.bdaddr, bdaddr);
3874         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3875
3876         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3877                           NULL);
3878 }
3879
3880 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3881                                       u8 link_type, u8 addr_type, u8 status,
3882                                       u8 opcode)
3883 {
3884         struct pending_cmd *cmd;
3885         struct mgmt_rp_user_confirm_reply rp;
3886         int err;
3887
3888         cmd = mgmt_pending_find(opcode, hdev);
3889         if (!cmd)
3890                 return -ENOENT;
3891
3892         bacpy(&rp.addr.bdaddr, bdaddr);
3893         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3894         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3895                            &rp, sizeof(rp));
3896
3897         mgmt_pending_remove(cmd);
3898
3899         return err;
3900 }
3901
3902 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3903                                      u8 link_type, u8 addr_type, u8 status)
3904 {
3905         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3906                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3907 }
3908
3909 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3910                                          u8 link_type, u8 addr_type, u8 status)
3911 {
3912         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3913                                           status,
3914                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3915 }
3916
3917 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3918                                      u8 link_type, u8 addr_type, u8 status)
3919 {
3920         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3921                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3922 }
3923
3924 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3925                                          u8 link_type, u8 addr_type, u8 status)
3926 {
3927         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3928                                           status,
3929                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3930 }
3931
3932 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3933                              u8 link_type, u8 addr_type, u32 passkey,
3934                              u8 entered)
3935 {
3936         struct mgmt_ev_passkey_notify ev;
3937
3938         BT_DBG("%s", hdev->name);
3939
3940         bacpy(&ev.addr.bdaddr, bdaddr);
3941         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3942         ev.passkey = __cpu_to_le32(passkey);
3943         ev.entered = entered;
3944
3945         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3946 }
3947
3948 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3949                      u8 addr_type, u8 status)
3950 {
3951         struct mgmt_ev_auth_failed ev;
3952
3953         bacpy(&ev.addr.bdaddr, bdaddr);
3954         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3955         ev.status = mgmt_status(status);
3956
3957         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3958 }
3959
3960 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3961 {
3962         struct cmd_lookup match = { NULL, hdev };
3963         bool changed = false;
3964         int err = 0;
3965
3966         if (status) {
3967                 u8 mgmt_err = mgmt_status(status);
3968                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3969                                      cmd_status_rsp, &mgmt_err);
3970                 return 0;
3971         }
3972
3973         if (test_bit(HCI_AUTH, &hdev->flags)) {
3974                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3975                         changed = true;
3976         } else {
3977                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3978                         changed = true;
3979         }
3980
3981         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3982                              &match);
3983
3984         if (changed)
3985                 err = new_settings(hdev, match.sk);
3986
3987         if (match.sk)
3988                 sock_put(match.sk);
3989
3990         return err;
3991 }
3992
3993 static void clear_eir(struct hci_request *req)
3994 {
3995         struct hci_dev *hdev = req->hdev;
3996         struct hci_cp_write_eir cp;
3997
3998         if (!lmp_ext_inq_capable(hdev))
3999                 return;
4000
4001         memset(hdev->eir, 0, sizeof(hdev->eir));
4002
4003         memset(&cp, 0, sizeof(cp));
4004
4005         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4006 }
4007
4008 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4009 {
4010         struct cmd_lookup match = { NULL, hdev };
4011         struct hci_request req;
4012         bool changed = false;
4013         int err = 0;
4014
4015         if (status) {
4016                 u8 mgmt_err = mgmt_status(status);
4017
4018                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4019                                                  &hdev->dev_flags))
4020                         err = new_settings(hdev, NULL);
4021
4022                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4023                                      &mgmt_err);
4024
4025                 return err;
4026         }
4027
4028         if (enable) {
4029                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4030                         changed = true;
4031         } else {
4032                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4033                         changed = true;
4034         }
4035
4036         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4037
4038         if (changed)
4039                 err = new_settings(hdev, match.sk);
4040
4041         if (match.sk)
4042                 sock_put(match.sk);
4043
4044         hci_req_init(&req, hdev);
4045
4046         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4047                 update_eir(&req);
4048         else
4049                 clear_eir(&req);
4050
4051         hci_req_run(&req, NULL);
4052
4053         return err;
4054 }
4055
4056 static void sk_lookup(struct pending_cmd *cmd, void *data)
4057 {
4058         struct cmd_lookup *match = data;
4059
4060         if (match->sk == NULL) {
4061                 match->sk = cmd->sk;
4062                 sock_hold(match->sk);
4063         }
4064 }
4065
4066 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4067                                    u8 status)
4068 {
4069         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4070         int err = 0;
4071
4072         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4073         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4074         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4075
4076         if (!status)
4077                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4078                                  3, NULL);
4079
4080         if (match.sk)
4081                 sock_put(match.sk);
4082
4083         return err;
4084 }
4085
4086 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4087 {
4088         struct mgmt_cp_set_local_name ev;
4089         struct pending_cmd *cmd;
4090
4091         if (status)
4092                 return 0;
4093
4094         memset(&ev, 0, sizeof(ev));
4095         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4096         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4097
4098         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4099         if (!cmd) {
4100                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4101
4102                 /* If this is a HCI command related to powering on the
4103                  * HCI dev don't send any mgmt signals.
4104                  */
4105                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4106                         return 0;
4107         }
4108
4109         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4110                           cmd ? cmd->sk : NULL);
4111 }
4112
4113 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4114                                             u8 *randomizer, u8 status)
4115 {
4116         struct pending_cmd *cmd;
4117         int err;
4118
4119         BT_DBG("%s status %u", hdev->name, status);
4120
4121         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4122         if (!cmd)
4123                 return -ENOENT;
4124
4125         if (status) {
4126                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4127                                  mgmt_status(status));
4128         } else {
4129                 struct mgmt_rp_read_local_oob_data rp;
4130
4131                 memcpy(rp.hash, hash, sizeof(rp.hash));
4132                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4133
4134                 err = cmd_complete(cmd->sk, hdev->id,
4135                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4136                                    sizeof(rp));
4137         }
4138
4139         mgmt_pending_remove(cmd);
4140
4141         return err;
4142 }
4143
4144 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4145 {
4146         struct cmd_lookup match = { NULL, hdev };
4147         bool changed = false;
4148         int err = 0;
4149
4150         if (status) {
4151                 u8 mgmt_err = mgmt_status(status);
4152
4153                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
4154                                                  &hdev->dev_flags))
4155                         err = new_settings(hdev, NULL);
4156
4157                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
4158                                      &mgmt_err);
4159
4160                 return err;
4161         }
4162
4163         if (enable) {
4164                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4165                         changed = true;
4166         } else {
4167                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4168                         changed = true;
4169         }
4170
4171         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
4172
4173         if (changed)
4174                 err = new_settings(hdev, match.sk);
4175
4176         if (match.sk)
4177                 sock_put(match.sk);
4178
4179         return err;
4180 }
4181
4182 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4183                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4184                       ssp, u8 *eir, u16 eir_len)
4185 {
4186         char buf[512];
4187         struct mgmt_ev_device_found *ev = (void *) buf;
4188         size_t ev_size;
4189
4190         if (!hci_discovery_active(hdev))
4191                 return -EPERM;
4192
4193         /* Leave 5 bytes for a potential CoD field */
4194         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4195                 return -EINVAL;
4196
4197         memset(buf, 0, sizeof(buf));
4198
4199         bacpy(&ev->addr.bdaddr, bdaddr);
4200         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4201         ev->rssi = rssi;
4202         if (cfm_name)
4203                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4204         if (!ssp)
4205                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4206
4207         if (eir_len > 0)
4208                 memcpy(ev->eir, eir, eir_len);
4209
4210         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4211                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4212                                           dev_class, 3);
4213
4214         ev->eir_len = cpu_to_le16(eir_len);
4215         ev_size = sizeof(*ev) + eir_len;
4216
4217         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4218 }
4219
4220 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4221                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4222 {
4223         struct mgmt_ev_device_found *ev;
4224         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4225         u16 eir_len;
4226
4227         ev = (struct mgmt_ev_device_found *) buf;
4228
4229         memset(buf, 0, sizeof(buf));
4230
4231         bacpy(&ev->addr.bdaddr, bdaddr);
4232         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4233         ev->rssi = rssi;
4234
4235         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4236                                   name_len);
4237
4238         ev->eir_len = cpu_to_le16(eir_len);
4239
4240         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4241                           sizeof(*ev) + eir_len, NULL);
4242 }
4243
4244 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4245 {
4246         struct mgmt_ev_discovering ev;
4247         struct pending_cmd *cmd;
4248
4249         BT_DBG("%s discovering %u", hdev->name, discovering);
4250
4251         if (discovering)
4252                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4253         else
4254                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4255
4256         if (cmd != NULL) {
4257                 u8 type = hdev->discovery.type;
4258
4259                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4260                              sizeof(type));
4261                 mgmt_pending_remove(cmd);
4262         }
4263
4264         memset(&ev, 0, sizeof(ev));
4265         ev.type = hdev->discovery.type;
4266         ev.discovering = discovering;
4267
4268         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4269 }
4270
4271 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4272 {
4273         struct pending_cmd *cmd;
4274         struct mgmt_ev_device_blocked ev;
4275
4276         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4277
4278         bacpy(&ev.addr.bdaddr, bdaddr);
4279         ev.addr.type = type;
4280
4281         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4282                           cmd ? cmd->sk : NULL);
4283 }
4284
4285 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4286 {
4287         struct pending_cmd *cmd;
4288         struct mgmt_ev_device_unblocked ev;
4289
4290         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4291
4292         bacpy(&ev.addr.bdaddr, bdaddr);
4293         ev.addr.type = type;
4294
4295         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4296                           cmd ? cmd->sk : NULL);
4297 }
4298
4299 module_param(enable_hs, bool, 0644);
4300 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");