net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   1
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102 };
 103
 104 /*
 105  * These LE scan and inquiry parameters were chosen according to LE General
 106  * Discovery Procedure specification.
 107  */
 108 #define LE_SCAN_TYPE                    0x01
 109 #define LE_SCAN_WIN                     0x12
 110 #define LE_SCAN_INT                     0x12
 111 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 112 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 113
 114 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 115 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 116
 117 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 118
 119 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 120                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 121
 122 struct pending_cmd {
 123         struct list_head list;
 124         u16 opcode;
 125         int index;
 126         void *param;
 127         struct sock *sk;
 128         void *user_data;
 129 };
 130
 131 /* HCI to MGMT error code conversion table */
 132 static u8 mgmt_status_table[] = {
 133         MGMT_STATUS_SUCCESS,
 134         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 135         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 136         MGMT_STATUS_FAILED,             /* Hardware Failure */
 137         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 138         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 139         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 140         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 141         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 142         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 144         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 145         MGMT_STATUS_BUSY,               /* Command Disallowed */
 146         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 147         MGMT_STATUS_REJECTED,           /* Rejected Security */
 148         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 149         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 150         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 151         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 152         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 153         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 154         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 155         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 156         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 157         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 158         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 159         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 160         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 161         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 162         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 163         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 164         MGMT_STATUS_FAILED,             /* Unspecified Error */
 165         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 166         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 167         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 168         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 169         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 170         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 171         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 172         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 173         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 175         MGMT_STATUS_FAILED,             /* Transaction Collision */
 176         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 177         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 178         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 179         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 180         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 181         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 182         MGMT_STATUS_FAILED,             /* Slot Violation */
 183         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 184         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 185         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 186         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 187         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 188         MGMT_STATUS_BUSY,               /* Controller Busy */
 189         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 190         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 191         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 192         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 193         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 194 };
 195
 196 static u8 mgmt_status(u8 hci_status)
 197 {
 198         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 199                 return mgmt_status_table[hci_status];
 200
 201         return MGMT_STATUS_FAILED;
 202 }
 203
 204 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 205 {
 206         struct sk_buff *skb;
 207         struct mgmt_hdr *hdr;
 208         struct mgmt_ev_cmd_status *ev;
 209         int err;
 210
 211         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 212
 213         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 214         if (!skb)
 215                 return -ENOMEM;
 216
 217         hdr = (void *) skb_put(skb, sizeof(*hdr));
 218
 219         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 220         hdr->index = cpu_to_le16(index);
 221         hdr->len = cpu_to_le16(sizeof(*ev));
 222
 223         ev = (void *) skb_put(skb, sizeof(*ev));
 224         ev->status = status;
 225         ev->opcode = cpu_to_le16(cmd);
 226
 227         err = sock_queue_rcv_skb(sk, skb);
 228         if (err < 0)
 229                 kfree_skb(skb);
 230
 231         return err;
 232 }
 233
 234 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 235                         void *rp, size_t rp_len)
 236 {
 237         struct sk_buff *skb;
 238         struct mgmt_hdr *hdr;
 239         struct mgmt_ev_cmd_complete *ev;
 240         int err;
 241
 242         BT_DBG("sock %p", sk);
 243
 244         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 245         if (!skb)
 246                 return -ENOMEM;
 247
 248         hdr = (void *) skb_put(skb, sizeof(*hdr));
 249
 250         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 251         hdr->index = cpu_to_le16(index);
 252         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 253
 254         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 255         ev->opcode = cpu_to_le16(cmd);
 256         ev->status = status;
 257
 258         if (rp)
 259                 memcpy(ev->data, rp, rp_len);
 260
 261         err = sock_queue_rcv_skb(sk, skb);
 262         if (err < 0)
 263                 kfree_skb(skb);
 264
 265         return err;
 266 }
 267
 268 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 269                         u16 data_len)
 270 {
 271         struct mgmt_rp_read_version rp;
 272
 273         BT_DBG("sock %p", sk);
 274
 275         rp.version = MGMT_VERSION;
 276         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 277
 278         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 279                             sizeof(rp));
 280 }
 281
 282 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 283                          u16 data_len)
 284 {
 285         struct mgmt_rp_read_commands *rp;
 286         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 287         const u16 num_events = ARRAY_SIZE(mgmt_events);
 288         __le16 *opcode;
 289         size_t rp_size;
 290         int i, err;
 291
 292         BT_DBG("sock %p", sk);
 293
 294         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 295
 296         rp = kmalloc(rp_size, GFP_KERNEL);
 297         if (!rp)
 298                 return -ENOMEM;
 299
 300         rp->num_commands = __constant_cpu_to_le16(num_commands);
 301         rp->num_events = __constant_cpu_to_le16(num_events);
 302
 303         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 304                 put_unaligned_le16(mgmt_commands[i], opcode);
 305
 306         for (i = 0; i < num_events; i++, opcode++)
 307                 put_unaligned_le16(mgmt_events[i], opcode);
 308
 309         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 310                            rp_size);
 311         kfree(rp);
 312
 313         return err;
 314 }
 315
 316 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 317                            u16 data_len)
 318 {
 319         struct mgmt_rp_read_index_list *rp;
 320         struct list_head *p;
 321         struct hci_dev *d;
 322         size_t rp_len;
 323         u16 count;
 324         int i, err;
 325
 326         BT_DBG("sock %p", sk);
 327
 328         read_lock(&hci_dev_list_lock);
 329
 330         count = 0;
 331         list_for_each(p, &hci_dev_list) {
 332                 count++;
 333         }
 334
 335         rp_len = sizeof(*rp) + (2 * count);
 336         rp = kmalloc(rp_len, GFP_ATOMIC);
 337         if (!rp) {
 338                 read_unlock(&hci_dev_list_lock);
 339                 return -ENOMEM;
 340         }
 341
 342         rp->num_controllers = cpu_to_le16(count);
 343
 344         i = 0;
 345         list_for_each_entry(d, &hci_dev_list, list) {
 346                 if (test_bit(HCI_SETUP, &d->dev_flags))
 347                         continue;
 348
 349                 rp->index[i++] = cpu_to_le16(d->id);
 350                 BT_DBG("Added hci%u", d->id);
 351         }
 352
 353         read_unlock(&hci_dev_list_lock);
 354
 355         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 356                            rp_len);
 357
 358         kfree(rp);
 359
 360         return err;
 361 }
 362
 363 static u32 get_supported_settings(struct hci_dev *hdev)
 364 {
 365         u32 settings = 0;
 366
 367         settings |= MGMT_SETTING_POWERED;
 368         settings |= MGMT_SETTING_CONNECTABLE;
 369         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 370         settings |= MGMT_SETTING_DISCOVERABLE;
 371         settings |= MGMT_SETTING_PAIRABLE;
 372
 373         if (hdev->features[6] & LMP_SIMPLE_PAIR)
 374                 settings |= MGMT_SETTING_SSP;
 375
 376         if (!(hdev->features[4] & LMP_NO_BREDR)) {
 377                 settings |= MGMT_SETTING_BREDR;
 378                 settings |= MGMT_SETTING_LINK_SECURITY;
 379         }
 380
 381         if (enable_hs)
 382                 settings |= MGMT_SETTING_HS;
 383
 384         if (hdev->features[4] & LMP_LE)
 385                 settings |= MGMT_SETTING_LE;
 386
 387         return settings;
 388 }
 389
 390 static u32 get_current_settings(struct hci_dev *hdev)
 391 {
 392         u32 settings = 0;
 393
 394         if (hdev_is_powered(hdev))
 395                 settings |= MGMT_SETTING_POWERED;
 396
 397         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 398                 settings |= MGMT_SETTING_CONNECTABLE;
 399
 400         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 401                 settings |= MGMT_SETTING_DISCOVERABLE;
 402
 403         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 404                 settings |= MGMT_SETTING_PAIRABLE;
 405
 406         if (!(hdev->features[4] & LMP_NO_BREDR))
 407                 settings |= MGMT_SETTING_BREDR;
 408
 409         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 410                 settings |= MGMT_SETTING_LE;
 411
 412         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 413                 settings |= MGMT_SETTING_LINK_SECURITY;
 414
 415         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 416                 settings |= MGMT_SETTING_SSP;
 417
 418         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 419                 settings |= MGMT_SETTING_HS;
 420
 421         return settings;
 422 }
 423
 424 #define PNP_INFO_SVCLASS_ID             0x1200
 425
 426 static u8 bluetooth_base_uuid[] = {
 427                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 428                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 429 };
 430
 431 static u16 get_uuid16(u8 *uuid128)
 432 {
 433         u32 val;
 434         int i;
 435
 436         for (i = 0; i < 12; i++) {
 437                 if (bluetooth_base_uuid[i] != uuid128[i])
 438                         return 0;
 439         }
 440
 441         val = get_unaligned_le32(&uuid128[12]);
 442         if (val > 0xffff)
 443                 return 0;
 444
 445         return (u16) val;
 446 }
 447
 448 static void create_eir(struct hci_dev *hdev, u8 *data)
 449 {
 450         u8 *ptr = data;
 451         u16 eir_len = 0;
 452         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 453         int i, truncated = 0;
 454         struct bt_uuid *uuid;
 455         size_t name_len;
 456
 457         name_len = strlen(hdev->dev_name);
 458
 459         if (name_len > 0) {
 460                 /* EIR Data type */
 461                 if (name_len > 48) {
 462                         name_len = 48;
 463                         ptr[1] = EIR_NAME_SHORT;
 464                 } else
 465                         ptr[1] = EIR_NAME_COMPLETE;
 466
 467                 /* EIR Data length */
 468                 ptr[0] = name_len + 1;
 469
 470                 memcpy(ptr + 2, hdev->dev_name, name_len);
 471
 472                 eir_len += (name_len + 2);
 473                 ptr += (name_len + 2);
 474         }
 475
 476         if (hdev->inq_tx_power) {
 477                 ptr[0] = 2;
 478                 ptr[1] = EIR_TX_POWER;
 479                 ptr[2] = (u8) hdev->inq_tx_power;
 480
 481                 eir_len += 3;
 482                 ptr += 3;
 483         }
 484
 485         if (hdev->devid_source > 0) {
 486                 ptr[0] = 9;
 487                 ptr[1] = EIR_DEVICE_ID;
 488
 489                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 490                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 491                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 492                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 493
 494                 eir_len += 10;
 495                 ptr += 10;
 496         }
 497
 498         memset(uuid16_list, 0, sizeof(uuid16_list));
 499
 500         /* Group all UUID16 types */
 501         list_for_each_entry(uuid, &hdev->uuids, list) {
 502                 u16 uuid16;
 503
 504                 uuid16 = get_uuid16(uuid->uuid);
 505                 if (uuid16 == 0)
 506                         return;
 507
 508                 if (uuid16 < 0x1100)
 509                         continue;
 510
 511                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 512                         continue;
 513
 514                 /* Stop if not enough space to put next UUID */
 515                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 516                         truncated = 1;
 517                         break;
 518                 }
 519
 520                 /* Check for duplicates */
 521                 for (i = 0; uuid16_list[i] != 0; i++)
 522                         if (uuid16_list[i] == uuid16)
 523                                 break;
 524
 525                 if (uuid16_list[i] == 0) {
 526                         uuid16_list[i] = uuid16;
 527                         eir_len += sizeof(u16);
 528                 }
 529         }
 530
 531         if (uuid16_list[0] != 0) {
 532                 u8 *length = ptr;
 533
 534                 /* EIR Data type */
 535                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 536
 537                 ptr += 2;
 538                 eir_len += 2;
 539
 540                 for (i = 0; uuid16_list[i] != 0; i++) {
 541                         *ptr++ = (uuid16_list[i] & 0x00ff);
 542                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 543                 }
 544
 545                 /* EIR Data length */
 546                 *length = (i * sizeof(u16)) + 1;
 547         }
 548 }
 549
 550 static int update_eir(struct hci_dev *hdev)
 551 {
 552         struct hci_cp_write_eir cp;
 553
 554         if (!hdev_is_powered(hdev))
 555                 return 0;
 556
 557         if (!(hdev->features[6] & LMP_EXT_INQ))
 558                 return 0;
 559
 560         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 561                 return 0;
 562
 563         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 564                 return 0;
 565
 566         memset(&cp, 0, sizeof(cp));
 567
 568         create_eir(hdev, cp.data);
 569
 570         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 571                 return 0;
 572
 573         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 574
 575         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 576 }
 577
 578 static u8 get_service_classes(struct hci_dev *hdev)
 579 {
 580         struct bt_uuid *uuid;
 581         u8 val = 0;
 582
 583         list_for_each_entry(uuid, &hdev->uuids, list)
 584                 val |= uuid->svc_hint;
 585
 586         return val;
 587 }
 588
 589 static int update_class(struct hci_dev *hdev)
 590 {
 591         u8 cod[3];
 592         int err;
 593
 594         BT_DBG("%s", hdev->name);
 595
 596         if (!hdev_is_powered(hdev))
 597                 return 0;
 598
 599         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 600                 return 0;
 601
 602         cod[0] = hdev->minor_class;
 603         cod[1] = hdev->major_class;
 604         cod[2] = get_service_classes(hdev);
 605
 606         if (memcmp(cod, hdev->dev_class, 3) == 0)
 607                 return 0;
 608
 609         err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 610         if (err == 0)
 611                 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
 612
 613         return err;
 614 }
 615
 616 static void service_cache_off(struct work_struct *work)
 617 {
 618         struct hci_dev *hdev = container_of(work, struct hci_dev,
 619                                             service_cache.work);
 620
 621         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 622                 return;
 623
 624         hci_dev_lock(hdev);
 625
 626         update_eir(hdev);
 627         update_class(hdev);
 628
 629         hci_dev_unlock(hdev);
 630 }
 631
 632 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 633 {
 634         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 635                 return;
 636
 637         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 638
 639         /* Non-mgmt controlled devices get this bit set
 640          * implicitly so that pairing works for them, however
 641          * for mgmt we require user-space to explicitly enable
 642          * it
 643          */
 644         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 645 }
 646
 647 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 648                                 void *data, u16 data_len)
 649 {
 650         struct mgmt_rp_read_info rp;
 651
 652         BT_DBG("sock %p %s", sk, hdev->name);
 653
 654         hci_dev_lock(hdev);
 655
 656         memset(&rp, 0, sizeof(rp));
 657
 658         bacpy(&rp.bdaddr, &hdev->bdaddr);
 659
 660         rp.version = hdev->hci_ver;
 661         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 662
 663         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 664         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 665
 666         memcpy(rp.dev_class, hdev->dev_class, 3);
 667
 668         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 669         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 670
 671         hci_dev_unlock(hdev);
 672
 673         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 674                             sizeof(rp));
 675 }
 676
 677 static void mgmt_pending_free(struct pending_cmd *cmd)
 678 {
 679         sock_put(cmd->sk);
 680         kfree(cmd->param);
 681         kfree(cmd);
 682 }
 683
 684 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 685                                             struct hci_dev *hdev, void *data,
 686                                             u16 len)
 687 {
 688         struct pending_cmd *cmd;
 689
 690         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 691         if (!cmd)
 692                 return NULL;
 693
 694         cmd->opcode = opcode;
 695         cmd->index = hdev->id;
 696
 697         cmd->param = kmalloc(len, GFP_KERNEL);
 698         if (!cmd->param) {
 699                 kfree(cmd);
 700                 return NULL;
 701         }
 702
 703         if (data)
 704                 memcpy(cmd->param, data, len);
 705
 706         cmd->sk = sk;
 707         sock_hold(sk);
 708
 709         list_add(&cmd->list, &hdev->mgmt_pending);
 710
 711         return cmd;
 712 }
 713
 714 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 715                                  void (*cb)(struct pending_cmd *cmd,
 716                                             void *data),
 717                                  void *data)
 718 {
 719         struct list_head *p, *n;
 720
 721         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 722                 struct pending_cmd *cmd;
 723
 724                 cmd = list_entry(p, struct pending_cmd, list);
 725
 726                 if (opcode > 0 && cmd->opcode != opcode)
 727                         continue;
 728
 729                 cb(cmd, data);
 730         }
 731 }
 732
 733 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 734 {
 735         struct pending_cmd *cmd;
 736
 737         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 738                 if (cmd->opcode == opcode)
 739                         return cmd;
 740         }
 741
 742         return NULL;
 743 }
 744
 745 static void mgmt_pending_remove(struct pending_cmd *cmd)
 746 {
 747         list_del(&cmd->list);
 748         mgmt_pending_free(cmd);
 749 }
 750
 751 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 752 {
 753         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 754
 755         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 756                             sizeof(settings));
 757 }
 758
 759 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 760                        u16 len)
 761 {
 762         struct mgmt_mode *cp = data;
 763         struct pending_cmd *cmd;
 764         int err;
 765
 766         BT_DBG("request for %s", hdev->name);
 767
 768         hci_dev_lock(hdev);
 769
 770         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 771                 cancel_delayed_work(&hdev->power_off);
 772
 773                 if (cp->val) {
 774                         err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 775                         mgmt_powered(hdev, 1);
 776                         goto failed;
 777                 }
 778         }
 779
 780         if (!!cp->val == hdev_is_powered(hdev)) {
 781                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 782                 goto failed;
 783         }
 784
 785         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 786                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 787                                  MGMT_STATUS_BUSY);
 788                 goto failed;
 789         }
 790
 791         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 792         if (!cmd) {
 793                 err = -ENOMEM;
 794                 goto failed;
 795         }
 796
 797         if (cp->val)
 798                 schedule_work(&hdev->power_on);
 799         else
 800                 schedule_work(&hdev->power_off.work);
 801
 802         err = 0;
 803
 804 failed:
 805         hci_dev_unlock(hdev);
 806         return err;
 807 }
 808
 809 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 810                       struct sock *skip_sk)
 811 {
 812         struct sk_buff *skb;
 813         struct mgmt_hdr *hdr;
 814
 815         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 816         if (!skb)
 817                 return -ENOMEM;
 818
 819         hdr = (void *) skb_put(skb, sizeof(*hdr));
 820         hdr->opcode = cpu_to_le16(event);
 821         if (hdev)
 822                 hdr->index = cpu_to_le16(hdev->id);
 823         else
 824                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 825         hdr->len = cpu_to_le16(data_len);
 826
 827         if (data)
 828                 memcpy(skb_put(skb, data_len), data, data_len);
 829
 830         /* Time stamp */
 831         __net_timestamp(skb);
 832
 833         hci_send_to_control(skb, skip_sk);
 834         kfree_skb(skb);
 835
 836         return 0;
 837 }
 838
 839 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 840 {
 841         __le32 ev;
 842
 843         ev = cpu_to_le32(get_current_settings(hdev));
 844
 845         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 846 }
 847
 848 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 849                             u16 len)
 850 {
 851         struct mgmt_cp_set_discoverable *cp = data;
 852         struct pending_cmd *cmd;
 853         u16 timeout;
 854         u8 scan;
 855         int err;
 856
 857         BT_DBG("request for %s", hdev->name);
 858
 859         timeout = __le16_to_cpu(cp->timeout);
 860         if (!cp->val && timeout > 0)
 861                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 862                                   MGMT_STATUS_INVALID_PARAMS);
 863
 864         hci_dev_lock(hdev);
 865
 866         if (!hdev_is_powered(hdev) && timeout > 0) {
 867                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 868                                  MGMT_STATUS_NOT_POWERED);
 869                 goto failed;
 870         }
 871
 872         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 873             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 874                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 875                                  MGMT_STATUS_BUSY);
 876                 goto failed;
 877         }
 878
 879         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 880                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 881                                  MGMT_STATUS_REJECTED);
 882                 goto failed;
 883         }
 884
 885         if (!hdev_is_powered(hdev)) {
 886                 bool changed = false;
 887
 888                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 889                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 890                         changed = true;
 891                 }
 892
 893                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 894                 if (err < 0)
 895                         goto failed;
 896
 897                 if (changed)
 898                         err = new_settings(hdev, sk);
 899
 900                 goto failed;
 901         }
 902
 903         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 904                 if (hdev->discov_timeout > 0) {
 905                         cancel_delayed_work(&hdev->discov_off);
 906                         hdev->discov_timeout = 0;
 907                 }
 908
 909                 if (cp->val && timeout > 0) {
 910                         hdev->discov_timeout = timeout;
 911                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 912                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 913                 }
 914
 915                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 916                 goto failed;
 917         }
 918
 919         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 920         if (!cmd) {
 921                 err = -ENOMEM;
 922                 goto failed;
 923         }
 924
 925         scan = SCAN_PAGE;
 926
 927         if (cp->val)
 928                 scan |= SCAN_INQUIRY;
 929         else
 930                 cancel_delayed_work(&hdev->discov_off);
 931
 932         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 933         if (err < 0)
 934                 mgmt_pending_remove(cmd);
 935
 936         if (cp->val)
 937                 hdev->discov_timeout = timeout;
 938
 939 failed:
 940         hci_dev_unlock(hdev);
 941         return err;
 942 }
 943
 944 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
 945                            u16 len)
 946 {
 947         struct mgmt_mode *cp = data;
 948         struct pending_cmd *cmd;
 949         u8 scan;
 950         int err;
 951
 952         BT_DBG("request for %s", hdev->name);
 953
 954         hci_dev_lock(hdev);
 955
 956         if (!hdev_is_powered(hdev)) {
 957                 bool changed = false;
 958
 959                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 960                         changed = true;
 961
 962                 if (cp->val) {
 963                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 964                 } else {
 965                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 966                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 967                 }
 968
 969                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 970                 if (err < 0)
 971                         goto failed;
 972
 973                 if (changed)
 974                         err = new_settings(hdev, sk);
 975
 976                 goto failed;
 977         }
 978
 979         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 980             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 981                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
 982                                  MGMT_STATUS_BUSY);
 983                 goto failed;
 984         }
 985
 986         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 987                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 988                 goto failed;
 989         }
 990
 991         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
 992         if (!cmd) {
 993                 err = -ENOMEM;
 994                 goto failed;
 995         }
 996
 997         if (cp->val) {
 998                 scan = SCAN_PAGE;
 999         } else {
1000                 scan = 0;
1001
1002                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1003                     hdev->discov_timeout > 0)
1004                         cancel_delayed_work(&hdev->discov_off);
1005         }
1006
1007         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1008         if (err < 0)
1009                 mgmt_pending_remove(cmd);
1010
1011 failed:
1012         hci_dev_unlock(hdev);
1013         return err;
1014 }
1015
1016 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1017                         u16 len)
1018 {
1019         struct mgmt_mode *cp = data;
1020         int err;
1021
1022         BT_DBG("request for %s", hdev->name);
1023
1024         hci_dev_lock(hdev);
1025
1026         if (cp->val)
1027                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1028         else
1029                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1030
1031         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1032         if (err < 0)
1033                 goto failed;
1034
1035         err = new_settings(hdev, sk);
1036
1037 failed:
1038         hci_dev_unlock(hdev);
1039         return err;
1040 }
1041
1042 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1043                              u16 len)
1044 {
1045         struct mgmt_mode *cp = data;
1046         struct pending_cmd *cmd;
1047         u8 val;
1048         int err;
1049
1050         BT_DBG("request for %s", hdev->name);
1051
1052         hci_dev_lock(hdev);
1053
1054         if (!hdev_is_powered(hdev)) {
1055                 bool changed = false;
1056
1057                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1058                                           &hdev->dev_flags)) {
1059                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1060                         changed = true;
1061                 }
1062
1063                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1064                 if (err < 0)
1065                         goto failed;
1066
1067                 if (changed)
1068                         err = new_settings(hdev, sk);
1069
1070                 goto failed;
1071         }
1072
1073         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1074                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1075                                  MGMT_STATUS_BUSY);
1076                 goto failed;
1077         }
1078
1079         val = !!cp->val;
1080
1081         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1082                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1083                 goto failed;
1084         }
1085
1086         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1087         if (!cmd) {
1088                 err = -ENOMEM;
1089                 goto failed;
1090         }
1091
1092         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1093         if (err < 0) {
1094                 mgmt_pending_remove(cmd);
1095                 goto failed;
1096         }
1097
1098 failed:
1099         hci_dev_unlock(hdev);
1100         return err;
1101 }
1102
1103 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1104 {
1105         struct mgmt_mode *cp = data;
1106         struct pending_cmd *cmd;
1107         u8 val;
1108         int err;
1109
1110         BT_DBG("request for %s", hdev->name);
1111
1112         hci_dev_lock(hdev);
1113
1114         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1115                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1116                                  MGMT_STATUS_NOT_SUPPORTED);
1117                 goto failed;
1118         }
1119
1120         val = !!cp->val;
1121
1122         if (!hdev_is_powered(hdev)) {
1123                 bool changed = false;
1124
1125                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1126                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1127                         changed = true;
1128                 }
1129
1130                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1131                 if (err < 0)
1132                         goto failed;
1133
1134                 if (changed)
1135                         err = new_settings(hdev, sk);
1136
1137                 goto failed;
1138         }
1139
1140         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1141                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1142                                  MGMT_STATUS_BUSY);
1143                 goto failed;
1144         }
1145
1146         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1147                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1148                 goto failed;
1149         }
1150
1151         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1152         if (!cmd) {
1153                 err = -ENOMEM;
1154                 goto failed;
1155         }
1156
1157         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1158         if (err < 0) {
1159                 mgmt_pending_remove(cmd);
1160                 goto failed;
1161         }
1162
1163 failed:
1164         hci_dev_unlock(hdev);
1165         return err;
1166 }
1167
1168 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1169 {
1170         struct mgmt_mode *cp = data;
1171
1172         BT_DBG("request for %s", hdev->name);
1173
1174         if (!enable_hs)
1175                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1176                                   MGMT_STATUS_NOT_SUPPORTED);
1177
1178         if (cp->val)
1179                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1180         else
1181                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1182
1183         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1184 }
1185
1186 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1187 {
1188         struct mgmt_mode *cp = data;
1189         struct hci_cp_write_le_host_supported hci_cp;
1190         struct pending_cmd *cmd;
1191         int err;
1192         u8 val, enabled;
1193
1194         BT_DBG("request for %s", hdev->name);
1195
1196         hci_dev_lock(hdev);
1197
1198         if (!(hdev->features[4] & LMP_LE)) {
1199                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1200                                  MGMT_STATUS_NOT_SUPPORTED);
1201                 goto unlock;
1202         }
1203
1204         val = !!cp->val;
1205         enabled = !!(hdev->host_features[0] & LMP_HOST_LE);
1206
1207         if (!hdev_is_powered(hdev) || val == enabled) {
1208                 bool changed = false;
1209
1210                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1211                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1212                         changed = true;
1213                 }
1214
1215                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1216                 if (err < 0)
1217                         goto unlock;
1218
1219                 if (changed)
1220                         err = new_settings(hdev, sk);
1221
1222                 goto unlock;
1223         }
1224
1225         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1226                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1227                                  MGMT_STATUS_BUSY);
1228                 goto unlock;
1229         }
1230
1231         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1232         if (!cmd) {
1233                 err = -ENOMEM;
1234                 goto unlock;
1235         }
1236
1237         memset(&hci_cp, 0, sizeof(hci_cp));
1238
1239         if (val) {
1240                 hci_cp.le = val;
1241                 hci_cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
1242         }
1243
1244         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1245                            &hci_cp);
1246         if (err < 0)
1247                 mgmt_pending_remove(cmd);
1248
1249 unlock:
1250         hci_dev_unlock(hdev);
1251         return err;
1252 }
1253
1254 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1255 {
1256         struct mgmt_cp_add_uuid *cp = data;
1257         struct pending_cmd *cmd;
1258         struct bt_uuid *uuid;
1259         int err;
1260
1261         BT_DBG("request for %s", hdev->name);
1262
1263         hci_dev_lock(hdev);
1264
1265         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1266                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1267                                  MGMT_STATUS_BUSY);
1268                 goto failed;
1269         }
1270
1271         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1272         if (!uuid) {
1273                 err = -ENOMEM;
1274                 goto failed;
1275         }
1276
1277         memcpy(uuid->uuid, cp->uuid, 16);
1278         uuid->svc_hint = cp->svc_hint;
1279
1280         list_add(&uuid->list, &hdev->uuids);
1281
1282         err = update_class(hdev);
1283         if (err < 0)
1284                 goto failed;
1285
1286         err = update_eir(hdev);
1287         if (err < 0)
1288                 goto failed;
1289
1290         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1291                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1292                                    hdev->dev_class, 3);
1293                 goto failed;
1294         }
1295
1296         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1297         if (!cmd)
1298                 err = -ENOMEM;
1299
1300 failed:
1301         hci_dev_unlock(hdev);
1302         return err;
1303 }
1304
1305 static bool enable_service_cache(struct hci_dev *hdev)
1306 {
1307         if (!hdev_is_powered(hdev))
1308                 return false;
1309
1310         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1311                 schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
1312                 return true;
1313         }
1314
1315         return false;
1316 }
1317
1318 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1319                        u16 len)
1320 {
1321         struct mgmt_cp_remove_uuid *cp = data;
1322         struct pending_cmd *cmd;
1323         struct list_head *p, *n;
1324         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1325         int err, found;
1326
1327         BT_DBG("request for %s", hdev->name);
1328
1329         hci_dev_lock(hdev);
1330
1331         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1332                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1333                                  MGMT_STATUS_BUSY);
1334                 goto unlock;
1335         }
1336
1337         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1338                 err = hci_uuids_clear(hdev);
1339
1340                 if (enable_service_cache(hdev)) {
1341                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1342                                            0, hdev->dev_class, 3);
1343                         goto unlock;
1344                 }
1345
1346                 goto update_class;
1347         }
1348
1349         found = 0;
1350
1351         list_for_each_safe(p, n, &hdev->uuids) {
1352                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1353
1354                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1355                         continue;
1356
1357                 list_del(&match->list);
1358                 found++;
1359         }
1360
1361         if (found == 0) {
1362                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1363                                  MGMT_STATUS_INVALID_PARAMS);
1364                 goto unlock;
1365         }
1366
1367 update_class:
1368         err = update_class(hdev);
1369         if (err < 0)
1370                 goto unlock;
1371
1372         err = update_eir(hdev);
1373         if (err < 0)
1374                 goto unlock;
1375
1376         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1377                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1378                                    hdev->dev_class, 3);
1379                 goto unlock;
1380         }
1381
1382         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1383         if (!cmd)
1384                 err = -ENOMEM;
1385
1386 unlock:
1387         hci_dev_unlock(hdev);
1388         return err;
1389 }
1390
1391 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1392                          u16 len)
1393 {
1394         struct mgmt_cp_set_dev_class *cp = data;
1395         struct pending_cmd *cmd;
1396         int err;
1397
1398         BT_DBG("request for %s", hdev->name);
1399
1400         hci_dev_lock(hdev);
1401
1402         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1403                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1404                                  MGMT_STATUS_BUSY);
1405                 goto unlock;
1406         }
1407
1408         hdev->major_class = cp->major;
1409         hdev->minor_class = cp->minor;
1410
1411         if (!hdev_is_powered(hdev)) {
1412                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1413                                    hdev->dev_class, 3);
1414                 goto unlock;
1415         }
1416
1417         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1418                 hci_dev_unlock(hdev);
1419                 cancel_delayed_work_sync(&hdev->service_cache);
1420                 hci_dev_lock(hdev);
1421                 update_eir(hdev);
1422         }
1423
1424         err = update_class(hdev);
1425         if (err < 0)
1426                 goto unlock;
1427
1428         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1429                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1430                                    hdev->dev_class, 3);
1431                 goto unlock;
1432         }
1433
1434         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1435         if (!cmd)
1436                 err = -ENOMEM;
1437
1438 unlock:
1439         hci_dev_unlock(hdev);
1440         return err;
1441 }
1442
1443 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1444                           u16 len)
1445 {
1446         struct mgmt_cp_load_link_keys *cp = data;
1447         u16 key_count, expected_len;
1448         int i;
1449
1450         key_count = __le16_to_cpu(cp->key_count);
1451
1452         expected_len = sizeof(*cp) + key_count *
1453                                         sizeof(struct mgmt_link_key_info);
1454         if (expected_len != len) {
1455                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1456                        len, expected_len);
1457                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1458                                   MGMT_STATUS_INVALID_PARAMS);
1459         }
1460
1461         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1462                key_count);
1463
1464         hci_dev_lock(hdev);
1465
1466         hci_link_keys_clear(hdev);
1467
1468         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1469
1470         if (cp->debug_keys)
1471                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1472         else
1473                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1474
1475         for (i = 0; i < key_count; i++) {
1476                 struct mgmt_link_key_info *key = &cp->keys[i];
1477
1478                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1479                                  key->type, key->pin_len);
1480         }
1481
1482         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1483
1484         hci_dev_unlock(hdev);
1485
1486         return 0;
1487 }
1488
1489 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1490                            u8 addr_type, struct sock *skip_sk)
1491 {
1492         struct mgmt_ev_device_unpaired ev;
1493
1494         bacpy(&ev.addr.bdaddr, bdaddr);
1495         ev.addr.type = addr_type;
1496
1497         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1498                           skip_sk);
1499 }
1500
1501 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1502                          u16 len)
1503 {
1504         struct mgmt_cp_unpair_device *cp = data;
1505         struct mgmt_rp_unpair_device rp;
1506         struct hci_cp_disconnect dc;
1507         struct pending_cmd *cmd;
1508         struct hci_conn *conn;
1509         int err;
1510
1511         hci_dev_lock(hdev);
1512
1513         memset(&rp, 0, sizeof(rp));
1514         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1515         rp.addr.type = cp->addr.type;
1516
1517         if (!hdev_is_powered(hdev)) {
1518                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1519                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1520                 goto unlock;
1521         }
1522
1523         if (cp->addr.type == BDADDR_BREDR)
1524                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1525         else
1526                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1527
1528         if (err < 0) {
1529                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1530                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1531                 goto unlock;
1532         }
1533
1534         if (cp->disconnect) {
1535                 if (cp->addr.type == BDADDR_BREDR)
1536                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1537                                                        &cp->addr.bdaddr);
1538                 else
1539                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1540                                                        &cp->addr.bdaddr);
1541         } else {
1542                 conn = NULL;
1543         }
1544
1545         if (!conn) {
1546                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1547                                    &rp, sizeof(rp));
1548                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1549                 goto unlock;
1550         }
1551
1552         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1553                                sizeof(*cp));
1554         if (!cmd) {
1555                 err = -ENOMEM;
1556                 goto unlock;
1557         }
1558
1559         dc.handle = cpu_to_le16(conn->handle);
1560         dc.reason = 0x13; /* Remote User Terminated Connection */
1561         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1562         if (err < 0)
1563                 mgmt_pending_remove(cmd);
1564
1565 unlock:
1566         hci_dev_unlock(hdev);
1567         return err;
1568 }
1569
1570 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1571                       u16 len)
1572 {
1573         struct mgmt_cp_disconnect *cp = data;
1574         struct hci_cp_disconnect dc;
1575         struct pending_cmd *cmd;
1576         struct hci_conn *conn;
1577         int err;
1578
1579         BT_DBG("");
1580
1581         hci_dev_lock(hdev);
1582
1583         if (!test_bit(HCI_UP, &hdev->flags)) {
1584                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1585                                  MGMT_STATUS_NOT_POWERED);
1586                 goto failed;
1587         }
1588
1589         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1590                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1591                                  MGMT_STATUS_BUSY);
1592                 goto failed;
1593         }
1594
1595         if (cp->addr.type == BDADDR_BREDR)
1596                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1597                                                &cp->addr.bdaddr);
1598         else
1599                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1600
1601         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1602                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1603                                  MGMT_STATUS_NOT_CONNECTED);
1604                 goto failed;
1605         }
1606
1607         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1608         if (!cmd) {
1609                 err = -ENOMEM;
1610                 goto failed;
1611         }
1612
1613         dc.handle = cpu_to_le16(conn->handle);
1614         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1615
1616         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1617         if (err < 0)
1618                 mgmt_pending_remove(cmd);
1619
1620 failed:
1621         hci_dev_unlock(hdev);
1622         return err;
1623 }
1624
1625 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1626 {
1627         switch (link_type) {
1628         case LE_LINK:
1629                 switch (addr_type) {
1630                 case ADDR_LE_DEV_PUBLIC:
1631                         return BDADDR_LE_PUBLIC;
1632
1633                 default:
1634                         /* Fallback to LE Random address type */
1635                         return BDADDR_LE_RANDOM;
1636                 }
1637
1638         default:
1639                 /* Fallback to BR/EDR type */
1640                 return BDADDR_BREDR;
1641         }
1642 }
1643
1644 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1645                            u16 data_len)
1646 {
1647         struct mgmt_rp_get_connections *rp;
1648         struct hci_conn *c;
1649         size_t rp_len;
1650         int err;
1651         u16 i;
1652
1653         BT_DBG("");
1654
1655         hci_dev_lock(hdev);
1656
1657         if (!hdev_is_powered(hdev)) {
1658                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1659                                  MGMT_STATUS_NOT_POWERED);
1660                 goto unlock;
1661         }
1662
1663         i = 0;
1664         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1665                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1666                         i++;
1667         }
1668
1669         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1670         rp = kmalloc(rp_len, GFP_KERNEL);
1671         if (!rp) {
1672                 err = -ENOMEM;
1673                 goto unlock;
1674         }
1675
1676         i = 0;
1677         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1678                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1679                         continue;
1680                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1681                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1682                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1683                         continue;
1684                 i++;
1685         }
1686
1687         rp->conn_count = cpu_to_le16(i);
1688
1689         /* Recalculate length in case of filtered SCO connections, etc */
1690         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1691
1692         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1693                            rp_len);
1694
1695         kfree(rp);
1696
1697 unlock:
1698         hci_dev_unlock(hdev);
1699         return err;
1700 }
1701
1702 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1703                                    struct mgmt_cp_pin_code_neg_reply *cp)
1704 {
1705         struct pending_cmd *cmd;
1706         int err;
1707
1708         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1709                                sizeof(*cp));
1710         if (!cmd)
1711                 return -ENOMEM;
1712
1713         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1714                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1715         if (err < 0)
1716                 mgmt_pending_remove(cmd);
1717
1718         return err;
1719 }
1720
1721 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1722                           u16 len)
1723 {
1724         struct hci_conn *conn;
1725         struct mgmt_cp_pin_code_reply *cp = data;
1726         struct hci_cp_pin_code_reply reply;
1727         struct pending_cmd *cmd;
1728         int err;
1729
1730         BT_DBG("");
1731
1732         hci_dev_lock(hdev);
1733
1734         if (!hdev_is_powered(hdev)) {
1735                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1736                                  MGMT_STATUS_NOT_POWERED);
1737                 goto failed;
1738         }
1739
1740         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1741         if (!conn) {
1742                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1743                                  MGMT_STATUS_NOT_CONNECTED);
1744                 goto failed;
1745         }
1746
1747         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1748                 struct mgmt_cp_pin_code_neg_reply ncp;
1749
1750                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1751
1752                 BT_ERR("PIN code is not 16 bytes long");
1753
1754                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1755                 if (err >= 0)
1756                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1757                                          MGMT_STATUS_INVALID_PARAMS);
1758
1759                 goto failed;
1760         }
1761
1762         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1763         if (!cmd) {
1764                 err = -ENOMEM;
1765                 goto failed;
1766         }
1767
1768         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1769         reply.pin_len = cp->pin_len;
1770         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1771
1772         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1773         if (err < 0)
1774                 mgmt_pending_remove(cmd);
1775
1776 failed:
1777         hci_dev_unlock(hdev);
1778         return err;
1779 }
1780
1781 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1782                              u16 len)
1783 {
1784         struct mgmt_cp_set_io_capability *cp = data;
1785
1786         BT_DBG("");
1787
1788         hci_dev_lock(hdev);
1789
1790         hdev->io_capability = cp->io_capability;
1791
1792         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1793                hdev->io_capability);
1794
1795         hci_dev_unlock(hdev);
1796
1797         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1798                             0);
1799 }
1800
1801 static struct pending_cmd *find_pairing(struct hci_conn *conn)
1802 {
1803         struct hci_dev *hdev = conn->hdev;
1804         struct pending_cmd *cmd;
1805
1806         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1807                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1808                         continue;
1809
1810                 if (cmd->user_data != conn)
1811                         continue;
1812
1813                 return cmd;
1814         }
1815
1816         return NULL;
1817 }
1818
1819 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1820 {
1821         struct mgmt_rp_pair_device rp;
1822         struct hci_conn *conn = cmd->user_data;
1823
1824         bacpy(&rp.addr.bdaddr, &conn->dst);
1825         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
1826
1827         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1828                      &rp, sizeof(rp));
1829
1830         /* So we don't get further callbacks for this connection */
1831         conn->connect_cfm_cb = NULL;
1832         conn->security_cfm_cb = NULL;
1833         conn->disconn_cfm_cb = NULL;
1834
1835         hci_conn_put(conn);
1836
1837         mgmt_pending_remove(cmd);
1838 }
1839
1840 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1841 {
1842         struct pending_cmd *cmd;
1843
1844         BT_DBG("status %u", status);
1845
1846         cmd = find_pairing(conn);
1847         if (!cmd)
1848                 BT_DBG("Unable to find a pending command");
1849         else
1850                 pairing_complete(cmd, mgmt_status(status));
1851 }
1852
1853 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
1854 {
1855         struct pending_cmd *cmd;
1856
1857         BT_DBG("status %u", status);
1858
1859         if (!status)
1860                 return;
1861
1862         cmd = find_pairing(conn);
1863         if (!cmd)
1864                 BT_DBG("Unable to find a pending command");
1865         else
1866                 pairing_complete(cmd, mgmt_status(status));
1867 }
1868
1869 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1870                        u16 len)
1871 {
1872         struct mgmt_cp_pair_device *cp = data;
1873         struct mgmt_rp_pair_device rp;
1874         struct pending_cmd *cmd;
1875         u8 sec_level, auth_type;
1876         struct hci_conn *conn;
1877         int err;
1878
1879         BT_DBG("");
1880
1881         hci_dev_lock(hdev);
1882
1883         if (!hdev_is_powered(hdev)) {
1884                 err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1885                                  MGMT_STATUS_NOT_POWERED);
1886                 goto unlock;
1887         }
1888
1889         sec_level = BT_SECURITY_MEDIUM;
1890         if (cp->io_cap == 0x03)
1891                 auth_type = HCI_AT_DEDICATED_BONDING;
1892         else
1893                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1894
1895         if (cp->addr.type == BDADDR_BREDR)
1896                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
1897                                    cp->addr.type, sec_level, auth_type);
1898         else
1899                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
1900                                    cp->addr.type, sec_level, auth_type);
1901
1902         memset(&rp, 0, sizeof(rp));
1903         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1904         rp.addr.type = cp->addr.type;
1905
1906         if (IS_ERR(conn)) {
1907                 int status;
1908
1909                 if (PTR_ERR(conn) == -EBUSY)
1910                         status = MGMT_STATUS_BUSY;
1911                 else
1912                         status = MGMT_STATUS_CONNECT_FAILED;
1913
1914                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1915                                    status, &rp,
1916                                    sizeof(rp));
1917                 goto unlock;
1918         }
1919
1920         if (conn->connect_cfm_cb) {
1921                 hci_conn_put(conn);
1922                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1923                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1924                 goto unlock;
1925         }
1926
1927         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1928         if (!cmd) {
1929                 err = -ENOMEM;
1930                 hci_conn_put(conn);
1931                 goto unlock;
1932         }
1933
1934         /* For LE, just connecting isn't a proof that the pairing finished */
1935         if (cp->addr.type == BDADDR_BREDR)
1936                 conn->connect_cfm_cb = pairing_complete_cb;
1937         else
1938                 conn->connect_cfm_cb = le_connect_complete_cb;
1939
1940         conn->security_cfm_cb = pairing_complete_cb;
1941         conn->disconn_cfm_cb = pairing_complete_cb;
1942         conn->io_capability = cp->io_cap;
1943         cmd->user_data = conn;
1944
1945         if (conn->state == BT_CONNECTED &&
1946             hci_conn_security(conn, sec_level, auth_type))
1947                 pairing_complete(cmd, 0);
1948
1949         err = 0;
1950
1951 unlock:
1952         hci_dev_unlock(hdev);
1953         return err;
1954 }
1955
1956 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1957                               u16 len)
1958 {
1959         struct mgmt_addr_info *addr = data;
1960         struct pending_cmd *cmd;
1961         struct hci_conn *conn;
1962         int err;
1963
1964         BT_DBG("");
1965
1966         hci_dev_lock(hdev);
1967
1968         if (!hdev_is_powered(hdev)) {
1969                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1970                                  MGMT_STATUS_NOT_POWERED);
1971                 goto unlock;
1972         }
1973
1974         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
1975         if (!cmd) {
1976                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1977                                  MGMT_STATUS_INVALID_PARAMS);
1978                 goto unlock;
1979         }
1980
1981         conn = cmd->user_data;
1982
1983         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
1984                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1985                                  MGMT_STATUS_INVALID_PARAMS);
1986                 goto unlock;
1987         }
1988
1989         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
1990
1991         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
1992                            addr, sizeof(*addr));
1993 unlock:
1994         hci_dev_unlock(hdev);
1995         return err;
1996 }
1997
1998 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
1999                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2000                              u16 hci_op, __le32 passkey)
2001 {
2002         struct pending_cmd *cmd;
2003         struct hci_conn *conn;
2004         int err;
2005
2006         hci_dev_lock(hdev);
2007
2008         if (!hdev_is_powered(hdev)) {
2009                 err = cmd_status(sk, hdev->id, mgmt_op,
2010                                  MGMT_STATUS_NOT_POWERED);
2011                 goto done;
2012         }
2013
2014         if (type == BDADDR_BREDR)
2015                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2016         else
2017                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2018
2019         if (!conn) {
2020                 err = cmd_status(sk, hdev->id, mgmt_op,
2021                                  MGMT_STATUS_NOT_CONNECTED);
2022                 goto done;
2023         }
2024
2025         if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2026                 /* Continue with pairing via SMP */
2027                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2028
2029                 if (!err)
2030                         err = cmd_status(sk, hdev->id, mgmt_op,
2031                                          MGMT_STATUS_SUCCESS);
2032                 else
2033                         err = cmd_status(sk, hdev->id, mgmt_op,
2034                                          MGMT_STATUS_FAILED);
2035
2036                 goto done;
2037         }
2038
2039         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2040         if (!cmd) {
2041                 err = -ENOMEM;
2042                 goto done;
2043         }
2044
2045         /* Continue with pairing via HCI */
2046         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2047                 struct hci_cp_user_passkey_reply cp;
2048
2049                 bacpy(&cp.bdaddr, bdaddr);
2050                 cp.passkey = passkey;
2051                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2052         } else
2053                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2054
2055         if (err < 0)
2056                 mgmt_pending_remove(cmd);
2057
2058 done:
2059         hci_dev_unlock(hdev);
2060         return err;
2061 }
2062
2063 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2064                               void *data, u16 len)
2065 {
2066         struct mgmt_cp_pin_code_neg_reply *cp = data;
2067
2068         BT_DBG("");
2069
2070         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2071                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2072                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2073 }
2074
2075 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2076                               u16 len)
2077 {
2078         struct mgmt_cp_user_confirm_reply *cp = data;
2079
2080         BT_DBG("");
2081
2082         if (len != sizeof(*cp))
2083                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2084                                   MGMT_STATUS_INVALID_PARAMS);
2085
2086         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2087                                  MGMT_OP_USER_CONFIRM_REPLY,
2088                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2089 }
2090
2091 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2092                                   void *data, u16 len)
2093 {
2094         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2095
2096         BT_DBG("");
2097
2098         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2099                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2100                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2101 }
2102
2103 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2104                               u16 len)
2105 {
2106         struct mgmt_cp_user_passkey_reply *cp = data;
2107
2108         BT_DBG("");
2109
2110         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2111                                  MGMT_OP_USER_PASSKEY_REPLY,
2112                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2113 }
2114
2115 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2116                                   void *data, u16 len)
2117 {
2118         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2119
2120         BT_DBG("");
2121
2122         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2123                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2124                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2125 }
2126
2127 static int update_name(struct hci_dev *hdev, const char *name)
2128 {
2129         struct hci_cp_write_local_name cp;
2130
2131         memcpy(cp.name, name, sizeof(cp.name));
2132
2133         return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2134 }
2135
2136 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2137                           u16 len)
2138 {
2139         struct mgmt_cp_set_local_name *cp = data;
2140         struct pending_cmd *cmd;
2141         int err;
2142
2143         BT_DBG("");
2144
2145         hci_dev_lock(hdev);
2146
2147         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2148
2149         if (!hdev_is_powered(hdev)) {
2150                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2151
2152                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2153                                    data, len);
2154                 if (err < 0)
2155                         goto failed;
2156
2157                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2158                                  sk);
2159
2160                 goto failed;
2161         }
2162
2163         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2164         if (!cmd) {
2165                 err = -ENOMEM;
2166                 goto failed;
2167         }
2168
2169         err = update_name(hdev, cp->name);
2170         if (err < 0)
2171                 mgmt_pending_remove(cmd);
2172
2173 failed:
2174         hci_dev_unlock(hdev);
2175         return err;
2176 }
2177
2178 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2179                                void *data, u16 data_len)
2180 {
2181         struct pending_cmd *cmd;
2182         int err;
2183
2184         BT_DBG("%s", hdev->name);
2185
2186         hci_dev_lock(hdev);
2187
2188         if (!hdev_is_powered(hdev)) {
2189                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2190                                  MGMT_STATUS_NOT_POWERED);
2191                 goto unlock;
2192         }
2193
2194         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
2195                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2196                                  MGMT_STATUS_NOT_SUPPORTED);
2197                 goto unlock;
2198         }
2199
2200         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2201                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2202                                  MGMT_STATUS_BUSY);
2203                 goto unlock;
2204         }
2205
2206         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2207         if (!cmd) {
2208                 err = -ENOMEM;
2209                 goto unlock;
2210         }
2211
2212         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2213         if (err < 0)
2214                 mgmt_pending_remove(cmd);
2215
2216 unlock:
2217         hci_dev_unlock(hdev);
2218         return err;
2219 }
2220
2221 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2222                                void *data, u16 len)
2223 {
2224         struct mgmt_cp_add_remote_oob_data *cp = data;
2225         u8 status;
2226         int err;
2227
2228         BT_DBG("%s ", hdev->name);
2229
2230         hci_dev_lock(hdev);
2231
2232         if (!hdev_is_powered(hdev)) {
2233                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
2234                                    MGMT_STATUS_NOT_POWERED, &cp->addr,
2235                                    sizeof(cp->addr));
2236                 goto unlock;
2237         }
2238
2239         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2240                                       cp->randomizer);
2241         if (err < 0)
2242                 status = MGMT_STATUS_FAILED;
2243         else
2244                 status = 0;
2245
2246         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2247                            &cp->addr, sizeof(cp->addr));
2248
2249 unlock:
2250         hci_dev_unlock(hdev);
2251         return err;
2252 }
2253
2254 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2255                                   void *data, u16 len)
2256 {
2257         struct mgmt_cp_remove_remote_oob_data *cp = data;
2258         u8 status;
2259         int err;
2260
2261         BT_DBG("%s", hdev->name);
2262
2263         hci_dev_lock(hdev);
2264
2265         if (!hdev_is_powered(hdev)) {
2266                 err = cmd_complete(sk, hdev->id,
2267                                    MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2268                                    MGMT_STATUS_NOT_POWERED, &cp->addr,
2269                                    sizeof(cp->addr));
2270                 goto unlock;
2271         }
2272
2273         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2274         if (err < 0)
2275                 status = MGMT_STATUS_INVALID_PARAMS;
2276         else
2277                 status = 0;
2278
2279         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2280                            status, &cp->addr, sizeof(cp->addr));
2281
2282 unlock:
2283         hci_dev_unlock(hdev);
2284         return err;
2285 }
2286
2287 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2288 {
2289         int err;
2290
2291         BT_DBG("%s", hdev->name);
2292
2293         hci_dev_lock(hdev);
2294
2295         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2296         if (err < 0)
2297                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2298
2299         hci_dev_unlock(hdev);
2300
2301         return err;
2302 }
2303
2304 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2305                            void *data, u16 len)
2306 {
2307         struct mgmt_cp_start_discovery *cp = data;
2308         struct pending_cmd *cmd;
2309         int err;
2310
2311         BT_DBG("%s", hdev->name);
2312
2313         hci_dev_lock(hdev);
2314
2315         if (!hdev_is_powered(hdev)) {
2316                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2317                                  MGMT_STATUS_NOT_POWERED);
2318                 goto failed;
2319         }
2320
2321         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2322                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2323                                  MGMT_STATUS_BUSY);
2324                 goto failed;
2325         }
2326
2327         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2328                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2329                                  MGMT_STATUS_BUSY);
2330                 goto failed;
2331         }
2332
2333         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2334         if (!cmd) {
2335                 err = -ENOMEM;
2336                 goto failed;
2337         }
2338
2339         hdev->discovery.type = cp->type;
2340
2341         switch (hdev->discovery.type) {
2342         case DISCOV_TYPE_BREDR:
2343                 if (lmp_bredr_capable(hdev))
2344                         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2345                 else
2346                         err = -ENOTSUPP;
2347                 break;
2348
2349         case DISCOV_TYPE_LE:
2350                 if (lmp_host_le_capable(hdev))
2351                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2352                                           LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2353                 else
2354                         err = -ENOTSUPP;
2355                 break;
2356
2357         case DISCOV_TYPE_INTERLEAVED:
2358                 if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
2359                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2360                                           LE_SCAN_WIN,
2361                                           LE_SCAN_TIMEOUT_BREDR_LE);
2362                 else
2363                         err = -ENOTSUPP;
2364                 break;
2365
2366         default:
2367                 err = -EINVAL;
2368         }
2369
2370         if (err < 0)
2371                 mgmt_pending_remove(cmd);
2372         else
2373                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2374
2375 failed:
2376         hci_dev_unlock(hdev);
2377         return err;
2378 }
2379
2380 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2381                           u16 len)
2382 {
2383         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2384         struct pending_cmd *cmd;
2385         struct hci_cp_remote_name_req_cancel cp;
2386         struct inquiry_entry *e;
2387         int err;
2388
2389         BT_DBG("%s", hdev->name);
2390
2391         hci_dev_lock(hdev);
2392
2393         if (!hci_discovery_active(hdev)) {
2394                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2395                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2396                                    sizeof(mgmt_cp->type));
2397                 goto unlock;
2398         }
2399
2400         if (hdev->discovery.type != mgmt_cp->type) {
2401                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2402                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2403                                    sizeof(mgmt_cp->type));
2404                 goto unlock;
2405         }
2406
2407         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2408         if (!cmd) {
2409                 err = -ENOMEM;
2410                 goto unlock;
2411         }
2412
2413         switch (hdev->discovery.state) {
2414         case DISCOVERY_FINDING:
2415                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2416                         err = hci_cancel_inquiry(hdev);
2417                 else
2418                         err = hci_cancel_le_scan(hdev);
2419
2420                 break;
2421
2422         case DISCOVERY_RESOLVING:
2423                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2424                                                      NAME_PENDING);
2425                 if (!e) {
2426                         mgmt_pending_remove(cmd);
2427                         err = cmd_complete(sk, hdev->id,
2428                                            MGMT_OP_STOP_DISCOVERY, 0,
2429                                            &mgmt_cp->type,
2430                                            sizeof(mgmt_cp->type));
2431                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2432                         goto unlock;
2433                 }
2434
2435                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2436                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2437                                    sizeof(cp), &cp);
2438
2439                 break;
2440
2441         default:
2442                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2443                 err = -EFAULT;
2444         }
2445
2446         if (err < 0)
2447                 mgmt_pending_remove(cmd);
2448         else
2449                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2450
2451 unlock:
2452         hci_dev_unlock(hdev);
2453         return err;
2454 }
2455
2456 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2457                         u16 len)
2458 {
2459         struct mgmt_cp_confirm_name *cp = data;
2460         struct inquiry_entry *e;
2461         int err;
2462
2463         BT_DBG("%s", hdev->name);
2464
2465         hci_dev_lock(hdev);
2466
2467         if (!hci_discovery_active(hdev)) {
2468                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2469                                  MGMT_STATUS_FAILED);
2470                 goto failed;
2471         }
2472
2473         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2474         if (!e) {
2475                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2476                                  MGMT_STATUS_INVALID_PARAMS);
2477                 goto failed;
2478         }
2479
2480         if (cp->name_known) {
2481                 e->name_state = NAME_KNOWN;
2482                 list_del(&e->list);
2483         } else {
2484                 e->name_state = NAME_NEEDED;
2485                 hci_inquiry_cache_update_resolve(hdev, e);
2486         }
2487
2488         err = 0;
2489
2490 failed:
2491         hci_dev_unlock(hdev);
2492         return err;
2493 }
2494
2495 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2496                         u16 len)
2497 {
2498         struct mgmt_cp_block_device *cp = data;
2499         u8 status;
2500         int err;
2501
2502         BT_DBG("%s", hdev->name);
2503
2504         hci_dev_lock(hdev);
2505
2506         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2507         if (err < 0)
2508                 status = MGMT_STATUS_FAILED;
2509         else
2510                 status = 0;
2511
2512         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2513                            &cp->addr, sizeof(cp->addr));
2514
2515         hci_dev_unlock(hdev);
2516
2517         return err;
2518 }
2519
2520 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2521                           u16 len)
2522 {
2523         struct mgmt_cp_unblock_device *cp = data;
2524         u8 status;
2525         int err;
2526
2527         BT_DBG("%s", hdev->name);
2528
2529         hci_dev_lock(hdev);
2530
2531         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2532         if (err < 0)
2533                 status = MGMT_STATUS_INVALID_PARAMS;
2534         else
2535                 status = 0;
2536
2537         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2538                            &cp->addr, sizeof(cp->addr));
2539
2540         hci_dev_unlock(hdev);
2541
2542         return err;
2543 }
2544
2545 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2546                          u16 len)
2547 {
2548         struct mgmt_cp_set_device_id *cp = data;
2549         int err;
2550         __u16 source;
2551
2552         BT_DBG("%s", hdev->name);
2553
2554         source = __le16_to_cpu(cp->source);
2555
2556         if (source > 0x0002)
2557                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2558                                   MGMT_STATUS_INVALID_PARAMS);
2559
2560         hci_dev_lock(hdev);
2561
2562         hdev->devid_source = source;
2563         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2564         hdev->devid_product = __le16_to_cpu(cp->product);
2565         hdev->devid_version = __le16_to_cpu(cp->version);
2566
2567         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2568
2569         update_eir(hdev);
2570
2571         hci_dev_unlock(hdev);
2572
2573         return err;
2574 }
2575
2576 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2577                                 void *data, u16 len)
2578 {
2579         struct mgmt_mode *cp = data;
2580         struct hci_cp_write_page_scan_activity acp;
2581         u8 type;
2582         int err;
2583
2584         BT_DBG("%s", hdev->name);
2585
2586         if (!hdev_is_powered(hdev))
2587                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2588                                   MGMT_STATUS_NOT_POWERED);
2589
2590         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2591                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2592                                   MGMT_STATUS_REJECTED);
2593
2594         hci_dev_lock(hdev);
2595
2596         if (cp->val) {
2597                 type = PAGE_SCAN_TYPE_INTERLACED;
2598
2599                 /* 160 msec page scan interval */
2600                 acp.interval = __constant_cpu_to_le16(0x0100);
2601         } else {
2602                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2603
2604                 /* default 1.28 sec page scan */
2605                 acp.interval = __constant_cpu_to_le16(0x0800);
2606         }
2607
2608         /* default 11.25 msec page scan window */
2609         acp.window = __constant_cpu_to_le16(0x0012);
2610
2611         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2612                            &acp);
2613         if (err < 0) {
2614                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2615                                  MGMT_STATUS_FAILED);
2616                 goto done;
2617         }
2618
2619         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2620         if (err < 0) {
2621                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2622                                  MGMT_STATUS_FAILED);
2623                 goto done;
2624         }
2625
2626         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2627                            NULL, 0);
2628 done:
2629         hci_dev_unlock(hdev);
2630         return err;
2631 }
2632
2633 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2634                                void *cp_data, u16 len)
2635 {
2636         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2637         u16 key_count, expected_len;
2638         int i;
2639
2640         key_count = __le16_to_cpu(cp->key_count);
2641
2642         expected_len = sizeof(*cp) + key_count *
2643                                         sizeof(struct mgmt_ltk_info);
2644         if (expected_len != len) {
2645                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2646                        len, expected_len);
2647                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2648                                   EINVAL);
2649         }
2650
2651         BT_DBG("%s key_count %u", hdev->name, key_count);
2652
2653         hci_dev_lock(hdev);
2654
2655         hci_smp_ltks_clear(hdev);
2656
2657         for (i = 0; i < key_count; i++) {
2658                 struct mgmt_ltk_info *key = &cp->keys[i];
2659                 u8 type;
2660
2661                 if (key->master)
2662                         type = HCI_SMP_LTK;
2663                 else
2664                         type = HCI_SMP_LTK_SLAVE;
2665
2666                 hci_add_ltk(hdev, &key->addr.bdaddr,
2667                             bdaddr_to_le(key->addr.type),
2668                             type, 0, key->authenticated, key->val,
2669                             key->enc_size, key->ediv, key->rand);
2670         }
2671
2672         hci_dev_unlock(hdev);
2673
2674         return 0;
2675 }
2676
2677 static const struct mgmt_handler {
2678         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2679                      u16 data_len);
2680         bool var_len;
2681         size_t data_len;
2682 } mgmt_handlers[] = {
2683         { NULL }, /* 0x0000 (no command) */
2684         { read_version,           false, MGMT_READ_VERSION_SIZE },
2685         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
2686         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
2687         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
2688         { set_powered,            false, MGMT_SETTING_SIZE },
2689         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
2690         { set_connectable,        false, MGMT_SETTING_SIZE },
2691         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
2692         { set_pairable,           false, MGMT_SETTING_SIZE },
2693         { set_link_security,      false, MGMT_SETTING_SIZE },
2694         { set_ssp,                false, MGMT_SETTING_SIZE },
2695         { set_hs,                 false, MGMT_SETTING_SIZE },
2696         { set_le,                 false, MGMT_SETTING_SIZE },
2697         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
2698         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
2699         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
2700         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
2701         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
2702         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2703         { disconnect,             false, MGMT_DISCONNECT_SIZE },
2704         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
2705         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
2706         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2707         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
2708         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
2709         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2710         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
2711         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
2712         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2713         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
2714         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2715         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2716         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2717         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2718         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
2719         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
2720         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
2721         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
2722         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
2723         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
2724 };
2725
2726
2727 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2728 {
2729         void *buf;
2730         u8 *cp;
2731         struct mgmt_hdr *hdr;
2732         u16 opcode, index, len;
2733         struct hci_dev *hdev = NULL;
2734         const struct mgmt_handler *handler;
2735         int err;
2736
2737         BT_DBG("got %zu bytes", msglen);
2738
2739         if (msglen < sizeof(*hdr))
2740                 return -EINVAL;
2741
2742         buf = kmalloc(msglen, GFP_KERNEL);
2743         if (!buf)
2744                 return -ENOMEM;
2745
2746         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2747                 err = -EFAULT;
2748                 goto done;
2749         }
2750
2751         hdr = buf;
2752         opcode = __le16_to_cpu(hdr->opcode);
2753         index = __le16_to_cpu(hdr->index);
2754         len = __le16_to_cpu(hdr->len);
2755
2756         if (len != msglen - sizeof(*hdr)) {
2757                 err = -EINVAL;
2758                 goto done;
2759         }
2760
2761         if (index != MGMT_INDEX_NONE) {
2762                 hdev = hci_dev_get(index);
2763                 if (!hdev) {
2764                         err = cmd_status(sk, index, opcode,
2765                                          MGMT_STATUS_INVALID_INDEX);
2766                         goto done;
2767                 }
2768         }
2769
2770         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2771             mgmt_handlers[opcode].func == NULL) {
2772                 BT_DBG("Unknown op %u", opcode);
2773                 err = cmd_status(sk, index, opcode,
2774                                  MGMT_STATUS_UNKNOWN_COMMAND);
2775                 goto done;
2776         }
2777
2778         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2779             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2780                 err = cmd_status(sk, index, opcode,
2781                                  MGMT_STATUS_INVALID_INDEX);
2782                 goto done;
2783         }
2784
2785         handler = &mgmt_handlers[opcode];
2786
2787         if ((handler->var_len && len < handler->data_len) ||
2788             (!handler->var_len && len != handler->data_len)) {
2789                 err = cmd_status(sk, index, opcode,
2790                                  MGMT_STATUS_INVALID_PARAMS);
2791                 goto done;
2792         }
2793
2794         if (hdev)
2795                 mgmt_init_hdev(sk, hdev);
2796
2797         cp = buf + sizeof(*hdr);
2798
2799         err = handler->func(sk, hdev, cp, len);
2800         if (err < 0)
2801                 goto done;
2802
2803         err = msglen;
2804
2805 done:
2806         if (hdev)
2807                 hci_dev_put(hdev);
2808
2809         kfree(buf);
2810         return err;
2811 }
2812
2813 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2814 {
2815         u8 *status = data;
2816
2817         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2818         mgmt_pending_remove(cmd);
2819 }
2820
2821 int mgmt_index_added(struct hci_dev *hdev)
2822 {
2823         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2824 }
2825
2826 int mgmt_index_removed(struct hci_dev *hdev)
2827 {
2828         u8 status = MGMT_STATUS_INVALID_INDEX;
2829
2830         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2831
2832         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2833 }
2834
2835 struct cmd_lookup {
2836         struct sock *sk;
2837         struct hci_dev *hdev;
2838         u8 mgmt_status;
2839 };
2840
2841 static void settings_rsp(struct pending_cmd *cmd, void *data)
2842 {
2843         struct cmd_lookup *match = data;
2844
2845         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2846
2847         list_del(&cmd->list);
2848
2849         if (match->sk == NULL) {
2850                 match->sk = cmd->sk;
2851                 sock_hold(match->sk);
2852         }
2853
2854         mgmt_pending_free(cmd);
2855 }
2856
2857 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2858 {
2859         struct cmd_lookup match = { NULL, hdev };
2860         int err;
2861
2862         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2863                 return 0;
2864
2865         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2866
2867         if (powered) {
2868                 u8 scan = 0;
2869
2870                 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2871                         scan |= SCAN_PAGE;
2872                 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2873                         scan |= SCAN_INQUIRY;
2874
2875                 if (scan)
2876                         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2877
2878                 update_class(hdev);
2879                 update_name(hdev, hdev->dev_name);
2880                 update_eir(hdev);
2881         } else {
2882                 u8 status = MGMT_STATUS_NOT_POWERED;
2883                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2884         }
2885
2886         err = new_settings(hdev, match.sk);
2887
2888         if (match.sk)
2889                 sock_put(match.sk);
2890
2891         return err;
2892 }
2893
2894 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2895 {
2896         struct cmd_lookup match = { NULL, hdev };
2897         bool changed = false;
2898         int err = 0;
2899
2900         if (discoverable) {
2901                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2902                         changed = true;
2903         } else {
2904                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2905                         changed = true;
2906         }
2907
2908         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
2909                              &match);
2910
2911         if (changed)
2912                 err = new_settings(hdev, match.sk);
2913
2914         if (match.sk)
2915                 sock_put(match.sk);
2916
2917         return err;
2918 }
2919
2920 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2921 {
2922         struct cmd_lookup match = { NULL, hdev };
2923         bool changed = false;
2924         int err = 0;
2925
2926         if (connectable) {
2927                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2928                         changed = true;
2929         } else {
2930                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2931                         changed = true;
2932         }
2933
2934         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
2935                              &match);
2936
2937         if (changed)
2938                 err = new_settings(hdev, match.sk);
2939
2940         if (match.sk)
2941                 sock_put(match.sk);
2942
2943         return err;
2944 }
2945
2946 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2947 {
2948         u8 mgmt_err = mgmt_status(status);
2949
2950         if (scan & SCAN_PAGE)
2951                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2952                                      cmd_status_rsp, &mgmt_err);
2953
2954         if (scan & SCAN_INQUIRY)
2955                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2956                                      cmd_status_rsp, &mgmt_err);
2957
2958         return 0;
2959 }
2960
2961 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
2962                       bool persistent)
2963 {
2964         struct mgmt_ev_new_link_key ev;
2965
2966         memset(&ev, 0, sizeof(ev));
2967
2968         ev.store_hint = persistent;
2969         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2970         ev.key.addr.type = BDADDR_BREDR;
2971         ev.key.type = key->type;
2972         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
2973         ev.key.pin_len = key->pin_len;
2974
2975         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2976 }
2977
2978 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
2979 {
2980         struct mgmt_ev_new_long_term_key ev;
2981
2982         memset(&ev, 0, sizeof(ev));
2983
2984         ev.store_hint = persistent;
2985         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2986         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
2987         ev.key.authenticated = key->authenticated;
2988         ev.key.enc_size = key->enc_size;
2989         ev.key.ediv = key->ediv;
2990
2991         if (key->type == HCI_SMP_LTK)
2992                 ev.key.master = 1;
2993
2994         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
2995         memcpy(ev.key.val, key->val, sizeof(key->val));
2996
2997         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
2998                           NULL);
2999 }
3000
3001 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3002                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3003                           u8 *dev_class)
3004 {
3005         char buf[512];
3006         struct mgmt_ev_device_connected *ev = (void *) buf;
3007         u16 eir_len = 0;
3008
3009         bacpy(&ev->addr.bdaddr, bdaddr);
3010         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3011
3012         ev->flags = __cpu_to_le32(flags);
3013
3014         if (name_len > 0)
3015                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3016                                           name, name_len);
3017
3018         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3019                 eir_len = eir_append_data(ev->eir, eir_len,
3020                                           EIR_CLASS_OF_DEV, dev_class, 3);
3021
3022         ev->eir_len = cpu_to_le16(eir_len);
3023
3024         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3025                           sizeof(*ev) + eir_len, NULL);
3026 }
3027
3028 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3029 {
3030         struct mgmt_cp_disconnect *cp = cmd->param;
3031         struct sock **sk = data;
3032         struct mgmt_rp_disconnect rp;
3033
3034         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3035         rp.addr.type = cp->addr.type;
3036
3037         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3038                      sizeof(rp));
3039
3040         *sk = cmd->sk;
3041         sock_hold(*sk);
3042
3043         mgmt_pending_remove(cmd);
3044 }
3045
3046 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3047 {
3048         struct hci_dev *hdev = data;
3049         struct mgmt_cp_unpair_device *cp = cmd->param;
3050         struct mgmt_rp_unpair_device rp;
3051
3052         memset(&rp, 0, sizeof(rp));
3053         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3054         rp.addr.type = cp->addr.type;
3055
3056         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3057
3058         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3059
3060         mgmt_pending_remove(cmd);
3061 }
3062
3063 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3064                              u8 link_type, u8 addr_type)
3065 {
3066         struct mgmt_addr_info ev;
3067         struct sock *sk = NULL;
3068         int err;
3069
3070         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3071
3072         bacpy(&ev.bdaddr, bdaddr);
3073         ev.type = link_to_bdaddr(link_type, addr_type);
3074
3075         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3076                          sk);
3077
3078         if (sk)
3079                 sock_put(sk);
3080
3081         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3082                              hdev);
3083
3084         return err;
3085 }
3086
3087 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3088                            u8 link_type, u8 addr_type, u8 status)
3089 {
3090         struct mgmt_rp_disconnect rp;
3091         struct pending_cmd *cmd;
3092         int err;
3093
3094         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3095         if (!cmd)
3096                 return -ENOENT;
3097
3098         bacpy(&rp.addr.bdaddr, bdaddr);
3099         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3100
3101         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3102                            mgmt_status(status), &rp, sizeof(rp));
3103
3104         mgmt_pending_remove(cmd);
3105
3106         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3107                              hdev);
3108         return err;
3109 }
3110
3111 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3112                         u8 addr_type, u8 status)
3113 {
3114         struct mgmt_ev_connect_failed ev;
3115
3116         bacpy(&ev.addr.bdaddr, bdaddr);
3117         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3118         ev.status = mgmt_status(status);
3119
3120         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3121 }
3122
3123 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3124 {
3125         struct mgmt_ev_pin_code_request ev;
3126
3127         bacpy(&ev.addr.bdaddr, bdaddr);
3128         ev.addr.type = BDADDR_BREDR;
3129         ev.secure = secure;
3130
3131         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3132                           NULL);
3133 }
3134
3135 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3136                                  u8 status)
3137 {
3138         struct pending_cmd *cmd;
3139         struct mgmt_rp_pin_code_reply rp;
3140         int err;
3141
3142         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3143         if (!cmd)
3144                 return -ENOENT;
3145
3146         bacpy(&rp.addr.bdaddr, bdaddr);
3147         rp.addr.type = BDADDR_BREDR;
3148
3149         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3150                            mgmt_status(status), &rp, sizeof(rp));
3151
3152         mgmt_pending_remove(cmd);
3153
3154         return err;
3155 }
3156
3157 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3158                                      u8 status)
3159 {
3160         struct pending_cmd *cmd;
3161         struct mgmt_rp_pin_code_reply rp;
3162         int err;
3163
3164         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3165         if (!cmd)
3166                 return -ENOENT;
3167
3168         bacpy(&rp.addr.bdaddr, bdaddr);
3169         rp.addr.type = BDADDR_BREDR;
3170
3171         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3172                            mgmt_status(status), &rp, sizeof(rp));
3173
3174         mgmt_pending_remove(cmd);
3175
3176         return err;
3177 }
3178
3179 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3180                               u8 link_type, u8 addr_type, __le32 value,
3181                               u8 confirm_hint)
3182 {
3183         struct mgmt_ev_user_confirm_request ev;
3184
3185         BT_DBG("%s", hdev->name);
3186
3187         bacpy(&ev.addr.bdaddr, bdaddr);
3188         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3189         ev.confirm_hint = confirm_hint;
3190         ev.value = value;
3191
3192         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3193                           NULL);
3194 }
3195
3196 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3197                               u8 link_type, u8 addr_type)
3198 {
3199         struct mgmt_ev_user_passkey_request ev;
3200
3201         BT_DBG("%s", hdev->name);
3202
3203         bacpy(&ev.addr.bdaddr, bdaddr);
3204         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3205
3206         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3207                           NULL);
3208 }
3209
3210 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3211                                       u8 link_type, u8 addr_type, u8 status,
3212                                       u8 opcode)
3213 {
3214         struct pending_cmd *cmd;
3215         struct mgmt_rp_user_confirm_reply rp;
3216         int err;
3217
3218         cmd = mgmt_pending_find(opcode, hdev);
3219         if (!cmd)
3220                 return -ENOENT;
3221
3222         bacpy(&rp.addr.bdaddr, bdaddr);
3223         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3224         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3225                            &rp, sizeof(rp));
3226
3227         mgmt_pending_remove(cmd);
3228
3229         return err;
3230 }
3231
3232 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3233                                      u8 link_type, u8 addr_type, u8 status)
3234 {
3235         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3236                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3237 }
3238
3239 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3240                                          u8 link_type, u8 addr_type, u8 status)
3241 {
3242         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3243                                           status,
3244                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3245 }
3246
3247 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3248                                      u8 link_type, u8 addr_type, u8 status)
3249 {
3250         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3251                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3252 }
3253
3254 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3255                                          u8 link_type, u8 addr_type, u8 status)
3256 {
3257         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3258                                           status,
3259                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3260 }
3261
3262 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3263                      u8 addr_type, u8 status)
3264 {
3265         struct mgmt_ev_auth_failed ev;
3266
3267         bacpy(&ev.addr.bdaddr, bdaddr);
3268         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3269         ev.status = mgmt_status(status);
3270
3271         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3272 }
3273
3274 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3275 {
3276         struct cmd_lookup match = { NULL, hdev };
3277         bool changed = false;
3278         int err = 0;
3279
3280         if (status) {
3281                 u8 mgmt_err = mgmt_status(status);
3282                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3283                                      cmd_status_rsp, &mgmt_err);
3284                 return 0;
3285         }
3286
3287         if (test_bit(HCI_AUTH, &hdev->flags)) {
3288                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3289                         changed = true;
3290         } else {
3291                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3292                         changed = true;
3293         }
3294
3295         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3296                              &match);
3297
3298         if (changed)
3299                 err = new_settings(hdev, match.sk);
3300
3301         if (match.sk)
3302                 sock_put(match.sk);
3303
3304         return err;
3305 }
3306
3307 static int clear_eir(struct hci_dev *hdev)
3308 {
3309         struct hci_cp_write_eir cp;
3310
3311         if (!(hdev->features[6] & LMP_EXT_INQ))
3312                 return 0;
3313
3314         memset(hdev->eir, 0, sizeof(hdev->eir));
3315
3316         memset(&cp, 0, sizeof(cp));
3317
3318         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3319 }
3320
3321 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3322 {
3323         struct cmd_lookup match = { NULL, hdev };
3324         bool changed = false;
3325         int err = 0;
3326
3327         if (status) {
3328                 u8 mgmt_err = mgmt_status(status);
3329
3330                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3331                                                  &hdev->dev_flags))
3332                         err = new_settings(hdev, NULL);
3333
3334                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3335                                      &mgmt_err);
3336
3337                 return err;
3338         }
3339
3340         if (enable) {
3341                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3342                         changed = true;
3343         } else {
3344                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3345                         changed = true;
3346         }
3347
3348         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3349
3350         if (changed)
3351                 err = new_settings(hdev, match.sk);
3352
3353         if (match.sk)
3354                 sock_put(match.sk);
3355
3356         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3357                 update_eir(hdev);
3358         else
3359                 clear_eir(hdev);
3360
3361         return err;
3362 }
3363
3364 static void class_rsp(struct pending_cmd *cmd, void *data)
3365 {
3366         struct cmd_lookup *match = data;
3367
3368         cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3369                      match->hdev->dev_class, 3);
3370
3371         list_del(&cmd->list);
3372
3373         if (match->sk == NULL) {
3374                 match->sk = cmd->sk;
3375                 sock_hold(match->sk);
3376         }
3377
3378         mgmt_pending_free(cmd);
3379 }
3380
3381 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3382                                    u8 status)
3383 {
3384         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3385         int err = 0;
3386
3387         clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3388
3389         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3390         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3391         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3392
3393         if (!status)
3394                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3395                                  3, NULL);
3396
3397         if (match.sk)
3398                 sock_put(match.sk);
3399
3400         return err;
3401 }
3402
3403 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3404 {
3405         struct pending_cmd *cmd;
3406         struct mgmt_cp_set_local_name ev;
3407         bool changed = false;
3408         int err = 0;
3409
3410         if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3411                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3412                 changed = true;
3413         }
3414
3415         memset(&ev, 0, sizeof(ev));
3416         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3417         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3418
3419         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3420         if (!cmd)
3421                 goto send_event;
3422
3423         /* Always assume that either the short or the complete name has
3424          * changed if there was a pending mgmt command */
3425         changed = true;
3426
3427         if (status) {
3428                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3429                                  mgmt_status(status));
3430                 goto failed;
3431         }
3432
3433         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3434                            sizeof(ev));
3435         if (err < 0)
3436                 goto failed;
3437
3438 send_event:
3439         if (changed)
3440                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3441                                  sizeof(ev), cmd ? cmd->sk : NULL);
3442
3443         update_eir(hdev);
3444
3445 failed:
3446         if (cmd)
3447                 mgmt_pending_remove(cmd);
3448         return err;
3449 }
3450
3451 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3452                                             u8 *randomizer, u8 status)
3453 {
3454         struct pending_cmd *cmd;
3455         int err;
3456
3457         BT_DBG("%s status %u", hdev->name, status);
3458
3459         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3460         if (!cmd)
3461                 return -ENOENT;
3462
3463         if (status) {
3464                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3465                                  mgmt_status(status));
3466         } else {
3467                 struct mgmt_rp_read_local_oob_data rp;
3468
3469                 memcpy(rp.hash, hash, sizeof(rp.hash));
3470                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3471
3472                 err = cmd_complete(cmd->sk, hdev->id,
3473                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3474                                    sizeof(rp));
3475         }
3476
3477         mgmt_pending_remove(cmd);
3478
3479         return err;
3480 }
3481
3482 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3483 {
3484         struct cmd_lookup match = { NULL, hdev };
3485         bool changed = false;
3486         int err = 0;
3487
3488         if (status) {
3489                 u8 mgmt_err = mgmt_status(status);
3490
3491                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3492                                                  &hdev->dev_flags))
3493                         err = new_settings(hdev, NULL);
3494
3495                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3496                                      &mgmt_err);
3497
3498                 return err;
3499         }
3500
3501         if (enable) {
3502                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3503                         changed = true;
3504         } else {
3505                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3506                         changed = true;
3507         }
3508
3509         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3510
3511         if (changed)
3512                 err = new_settings(hdev, match.sk);
3513
3514         if (match.sk)
3515                 sock_put(match.sk);
3516
3517         return err;
3518 }
3519
3520 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3521                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3522                       ssp, u8 *eir, u16 eir_len)
3523 {
3524         char buf[512];
3525         struct mgmt_ev_device_found *ev = (void *) buf;
3526         size_t ev_size;
3527
3528         /* Leave 5 bytes for a potential CoD field */
3529         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3530                 return -EINVAL;
3531
3532         memset(buf, 0, sizeof(buf));
3533
3534         bacpy(&ev->addr.bdaddr, bdaddr);
3535         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3536         ev->rssi = rssi;
3537         if (cfm_name)
3538                 ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
3539         if (!ssp)
3540                 ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
3541
3542         if (eir_len > 0)
3543                 memcpy(ev->eir, eir, eir_len);
3544
3545         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3546                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3547                                           dev_class, 3);
3548
3549         ev->eir_len = cpu_to_le16(eir_len);
3550         ev_size = sizeof(*ev) + eir_len;
3551
3552         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3553 }
3554
3555 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3556                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3557 {
3558         struct mgmt_ev_device_found *ev;
3559         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3560         u16 eir_len;
3561
3562         ev = (struct mgmt_ev_device_found *) buf;
3563
3564         memset(buf, 0, sizeof(buf));
3565
3566         bacpy(&ev->addr.bdaddr, bdaddr);
3567         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3568         ev->rssi = rssi;
3569
3570         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3571                                   name_len);
3572
3573         ev->eir_len = cpu_to_le16(eir_len);
3574
3575         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3576                           sizeof(*ev) + eir_len, NULL);
3577 }
3578
3579 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3580 {
3581         struct pending_cmd *cmd;
3582         u8 type;
3583         int err;
3584
3585         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3586
3587         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3588         if (!cmd)
3589                 return -ENOENT;
3590
3591         type = hdev->discovery.type;
3592
3593         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3594                            &type, sizeof(type));
3595         mgmt_pending_remove(cmd);
3596
3597         return err;
3598 }
3599
3600 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3601 {
3602         struct pending_cmd *cmd;
3603         int err;
3604
3605         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3606         if (!cmd)
3607                 return -ENOENT;
3608
3609         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3610                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3611         mgmt_pending_remove(cmd);
3612
3613         return err;
3614 }
3615
3616 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3617 {
3618         struct mgmt_ev_discovering ev;
3619         struct pending_cmd *cmd;
3620
3621         BT_DBG("%s discovering %u", hdev->name, discovering);
3622
3623         if (discovering)
3624                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3625         else
3626                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3627
3628         if (cmd != NULL) {
3629                 u8 type = hdev->discovery.type;
3630
3631                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3632                              sizeof(type));
3633                 mgmt_pending_remove(cmd);
3634         }
3635
3636         memset(&ev, 0, sizeof(ev));
3637         ev.type = hdev->discovery.type;
3638         ev.discovering = discovering;
3639
3640         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3641 }
3642
3643 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3644 {
3645         struct pending_cmd *cmd;
3646         struct mgmt_ev_device_blocked ev;
3647
3648         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3649
3650         bacpy(&ev.addr.bdaddr, bdaddr);
3651         ev.addr.type = type;
3652
3653         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3654                           cmd ? cmd->sk : NULL);
3655 }
3656
3657 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3658 {
3659         struct pending_cmd *cmd;
3660         struct mgmt_ev_device_unblocked ev;
3661
3662         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3663
3664         bacpy(&ev.addr.bdaddr, bdaddr);
3665         ev.addr.type = type;
3666
3667         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3668                           cmd ? cmd->sk : NULL);
3669 }
3670
3671 module_param(enable_hs, bool, 0644);
3672 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");