net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   1
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102 };
 103
 104 /*
 105  * These LE scan and inquiry parameters were chosen according to LE General
 106  * Discovery Procedure specification.
 107  */
 108 #define LE_SCAN_TYPE                    0x01
 109 #define LE_SCAN_WIN                     0x12
 110 #define LE_SCAN_INT                     0x12
 111 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 112 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 113
 114 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 115 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 116
 117 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 118
 119 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 120                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 121
 122 struct pending_cmd {
 123         struct list_head list;
 124         u16 opcode;
 125         int index;
 126         void *param;
 127         struct sock *sk;
 128         void *user_data;
 129 };
 130
 131 /* HCI to MGMT error code conversion table */
 132 static u8 mgmt_status_table[] = {
 133         MGMT_STATUS_SUCCESS,
 134         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 135         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 136         MGMT_STATUS_FAILED,             /* Hardware Failure */
 137         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 138         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 139         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 140         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 141         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 142         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 144         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 145         MGMT_STATUS_BUSY,               /* Command Disallowed */
 146         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 147         MGMT_STATUS_REJECTED,           /* Rejected Security */
 148         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 149         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 150         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 151         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 152         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 153         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 154         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 155         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 156         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 157         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 158         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 159         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 160         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 161         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 162         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 163         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 164         MGMT_STATUS_FAILED,             /* Unspecified Error */
 165         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 166         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 167         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 168         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 169         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 170         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 171         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 172         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 173         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 175         MGMT_STATUS_FAILED,             /* Transaction Collision */
 176         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 177         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 178         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 179         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 180         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 181         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 182         MGMT_STATUS_FAILED,             /* Slot Violation */
 183         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 184         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 185         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 186         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 187         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 188         MGMT_STATUS_BUSY,               /* Controller Busy */
 189         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 190         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 191         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 192         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 193         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 194 };
 195
 196 static u8 mgmt_status(u8 hci_status)
 197 {
 198         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 199                 return mgmt_status_table[hci_status];
 200
 201         return MGMT_STATUS_FAILED;
 202 }
 203
 204 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 205 {
 206         struct sk_buff *skb;
 207         struct mgmt_hdr *hdr;
 208         struct mgmt_ev_cmd_status *ev;
 209         int err;
 210
 211         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 212
 213         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
 214         if (!skb)
 215                 return -ENOMEM;
 216
 217         hdr = (void *) skb_put(skb, sizeof(*hdr));
 218
 219         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 220         hdr->index = cpu_to_le16(index);
 221         hdr->len = cpu_to_le16(sizeof(*ev));
 222
 223         ev = (void *) skb_put(skb, sizeof(*ev));
 224         ev->status = status;
 225         ev->opcode = cpu_to_le16(cmd);
 226
 227         err = sock_queue_rcv_skb(sk, skb);
 228         if (err < 0)
 229                 kfree_skb(skb);
 230
 231         return err;
 232 }
 233
 234 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 235                         void *rp, size_t rp_len)
 236 {
 237         struct sk_buff *skb;
 238         struct mgmt_hdr *hdr;
 239         struct mgmt_ev_cmd_complete *ev;
 240         int err;
 241
 242         BT_DBG("sock %p", sk);
 243
 244         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
 245         if (!skb)
 246                 return -ENOMEM;
 247
 248         hdr = (void *) skb_put(skb, sizeof(*hdr));
 249
 250         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 251         hdr->index = cpu_to_le16(index);
 252         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 253
 254         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 255         ev->opcode = cpu_to_le16(cmd);
 256         ev->status = status;
 257
 258         if (rp)
 259                 memcpy(ev->data, rp, rp_len);
 260
 261         err = sock_queue_rcv_skb(sk, skb);
 262         if (err < 0)
 263                 kfree_skb(skb);
 264
 265         return err;
 266 }
 267
 268 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 269                         u16 data_len)
 270 {
 271         struct mgmt_rp_read_version rp;
 272
 273         BT_DBG("sock %p", sk);
 274
 275         rp.version = MGMT_VERSION;
 276         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 277
 278         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 279                             sizeof(rp));
 280 }
 281
 282 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 283                          u16 data_len)
 284 {
 285         struct mgmt_rp_read_commands *rp;
 286         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 287         const u16 num_events = ARRAY_SIZE(mgmt_events);
 288         __le16 *opcode;
 289         size_t rp_size;
 290         int i, err;
 291
 292         BT_DBG("sock %p", sk);
 293
 294         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 295
 296         rp = kmalloc(rp_size, GFP_KERNEL);
 297         if (!rp)
 298                 return -ENOMEM;
 299
 300         rp->num_commands = __constant_cpu_to_le16(num_commands);
 301         rp->num_events = __constant_cpu_to_le16(num_events);
 302
 303         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 304                 put_unaligned_le16(mgmt_commands[i], opcode);
 305
 306         for (i = 0; i < num_events; i++, opcode++)
 307                 put_unaligned_le16(mgmt_events[i], opcode);
 308
 309         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 310                            rp_size);
 311         kfree(rp);
 312
 313         return err;
 314 }
 315
 316 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 317                            u16 data_len)
 318 {
 319         struct mgmt_rp_read_index_list *rp;
 320         struct list_head *p;
 321         struct hci_dev *d;
 322         size_t rp_len;
 323         u16 count;
 324         int i, err;
 325
 326         BT_DBG("sock %p", sk);
 327
 328         read_lock(&hci_dev_list_lock);
 329
 330         count = 0;
 331         list_for_each(p, &hci_dev_list) {
 332                 count++;
 333         }
 334
 335         rp_len = sizeof(*rp) + (2 * count);
 336         rp = kmalloc(rp_len, GFP_ATOMIC);
 337         if (!rp) {
 338                 read_unlock(&hci_dev_list_lock);
 339                 return -ENOMEM;
 340         }
 341
 342         rp->num_controllers = cpu_to_le16(count);
 343
 344         i = 0;
 345         list_for_each_entry(d, &hci_dev_list, list) {
 346                 if (test_bit(HCI_SETUP, &d->dev_flags))
 347                         continue;
 348
 349                 rp->index[i++] = cpu_to_le16(d->id);
 350                 BT_DBG("Added hci%u", d->id);
 351         }
 352
 353         read_unlock(&hci_dev_list_lock);
 354
 355         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 356                            rp_len);
 357
 358         kfree(rp);
 359
 360         return err;
 361 }
 362
 363 static u32 get_supported_settings(struct hci_dev *hdev)
 364 {
 365         u32 settings = 0;
 366
 367         settings |= MGMT_SETTING_POWERED;
 368         settings |= MGMT_SETTING_CONNECTABLE;
 369         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 370         settings |= MGMT_SETTING_DISCOVERABLE;
 371         settings |= MGMT_SETTING_PAIRABLE;
 372
 373         if (hdev->features[6] & LMP_SIMPLE_PAIR)
 374                 settings |= MGMT_SETTING_SSP;
 375
 376         if (!(hdev->features[4] & LMP_NO_BREDR)) {
 377                 settings |= MGMT_SETTING_BREDR;
 378                 settings |= MGMT_SETTING_LINK_SECURITY;
 379         }
 380
 381         if (enable_hs)
 382                 settings |= MGMT_SETTING_HS;
 383
 384         if (hdev->features[4] & LMP_LE)
 385                 settings |= MGMT_SETTING_LE;
 386
 387         return settings;
 388 }
 389
 390 static u32 get_current_settings(struct hci_dev *hdev)
 391 {
 392         u32 settings = 0;
 393
 394         if (hdev_is_powered(hdev))
 395                 settings |= MGMT_SETTING_POWERED;
 396
 397         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 398                 settings |= MGMT_SETTING_CONNECTABLE;
 399
 400         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 401                 settings |= MGMT_SETTING_DISCOVERABLE;
 402
 403         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 404                 settings |= MGMT_SETTING_PAIRABLE;
 405
 406         if (!(hdev->features[4] & LMP_NO_BREDR))
 407                 settings |= MGMT_SETTING_BREDR;
 408
 409         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 410                 settings |= MGMT_SETTING_LE;
 411
 412         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 413                 settings |= MGMT_SETTING_LINK_SECURITY;
 414
 415         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 416                 settings |= MGMT_SETTING_SSP;
 417
 418         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 419                 settings |= MGMT_SETTING_HS;
 420
 421         return settings;
 422 }
 423
 424 #define PNP_INFO_SVCLASS_ID             0x1200
 425
 426 static u8 bluetooth_base_uuid[] = {
 427                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 428                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 429 };
 430
 431 static u16 get_uuid16(u8 *uuid128)
 432 {
 433         u32 val;
 434         int i;
 435
 436         for (i = 0; i < 12; i++) {
 437                 if (bluetooth_base_uuid[i] != uuid128[i])
 438                         return 0;
 439         }
 440
 441         val = get_unaligned_le32(&uuid128[12]);
 442         if (val > 0xffff)
 443                 return 0;
 444
 445         return (u16) val;
 446 }
 447
 448 static void create_eir(struct hci_dev *hdev, u8 *data)
 449 {
 450         u8 *ptr = data;
 451         u16 eir_len = 0;
 452         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 453         int i, truncated = 0;
 454         struct bt_uuid *uuid;
 455         size_t name_len;
 456
 457         name_len = strlen(hdev->dev_name);
 458
 459         if (name_len > 0) {
 460                 /* EIR Data type */
 461                 if (name_len > 48) {
 462                         name_len = 48;
 463                         ptr[1] = EIR_NAME_SHORT;
 464                 } else
 465                         ptr[1] = EIR_NAME_COMPLETE;
 466
 467                 /* EIR Data length */
 468                 ptr[0] = name_len + 1;
 469
 470                 memcpy(ptr + 2, hdev->dev_name, name_len);
 471
 472                 eir_len += (name_len + 2);
 473                 ptr += (name_len + 2);
 474         }
 475
 476         if (hdev->inq_tx_power) {
 477                 ptr[0] = 2;
 478                 ptr[1] = EIR_TX_POWER;
 479                 ptr[2] = (u8) hdev->inq_tx_power;
 480
 481                 eir_len += 3;
 482                 ptr += 3;
 483         }
 484
 485         if (hdev->devid_source > 0) {
 486                 ptr[0] = 9;
 487                 ptr[1] = EIR_DEVICE_ID;
 488
 489                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 490                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 491                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 492                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 493
 494                 eir_len += 10;
 495                 ptr += 10;
 496         }
 497
 498         memset(uuid16_list, 0, sizeof(uuid16_list));
 499
 500         /* Group all UUID16 types */
 501         list_for_each_entry(uuid, &hdev->uuids, list) {
 502                 u16 uuid16;
 503
 504                 uuid16 = get_uuid16(uuid->uuid);
 505                 if (uuid16 == 0)
 506                         return;
 507
 508                 if (uuid16 < 0x1100)
 509                         continue;
 510
 511                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 512                         continue;
 513
 514                 /* Stop if not enough space to put next UUID */
 515                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 516                         truncated = 1;
 517                         break;
 518                 }
 519
 520                 /* Check for duplicates */
 521                 for (i = 0; uuid16_list[i] != 0; i++)
 522                         if (uuid16_list[i] == uuid16)
 523                                 break;
 524
 525                 if (uuid16_list[i] == 0) {
 526                         uuid16_list[i] = uuid16;
 527                         eir_len += sizeof(u16);
 528                 }
 529         }
 530
 531         if (uuid16_list[0] != 0) {
 532                 u8 *length = ptr;
 533
 534                 /* EIR Data type */
 535                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 536
 537                 ptr += 2;
 538                 eir_len += 2;
 539
 540                 for (i = 0; uuid16_list[i] != 0; i++) {
 541                         *ptr++ = (uuid16_list[i] & 0x00ff);
 542                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 543                 }
 544
 545                 /* EIR Data length */
 546                 *length = (i * sizeof(u16)) + 1;
 547         }
 548 }
 549
 550 static int update_eir(struct hci_dev *hdev)
 551 {
 552         struct hci_cp_write_eir cp;
 553
 554         if (!hdev_is_powered(hdev))
 555                 return 0;
 556
 557         if (!(hdev->features[6] & LMP_EXT_INQ))
 558                 return 0;
 559
 560         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 561                 return 0;
 562
 563         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 564                 return 0;
 565
 566         memset(&cp, 0, sizeof(cp));
 567
 568         create_eir(hdev, cp.data);
 569
 570         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 571                 return 0;
 572
 573         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 574
 575         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 576 }
 577
 578 static u8 get_service_classes(struct hci_dev *hdev)
 579 {
 580         struct bt_uuid *uuid;
 581         u8 val = 0;
 582
 583         list_for_each_entry(uuid, &hdev->uuids, list)
 584                 val |= uuid->svc_hint;
 585
 586         return val;
 587 }
 588
 589 static int update_class(struct hci_dev *hdev)
 590 {
 591         u8 cod[3];
 592         int err;
 593
 594         BT_DBG("%s", hdev->name);
 595
 596         if (!hdev_is_powered(hdev))
 597                 return 0;
 598
 599         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 600                 return 0;
 601
 602         cod[0] = hdev->minor_class;
 603         cod[1] = hdev->major_class;
 604         cod[2] = get_service_classes(hdev);
 605
 606         if (memcmp(cod, hdev->dev_class, 3) == 0)
 607                 return 0;
 608
 609         err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 610         if (err == 0)
 611                 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
 612
 613         return err;
 614 }
 615
 616 static void service_cache_off(struct work_struct *work)
 617 {
 618         struct hci_dev *hdev = container_of(work, struct hci_dev,
 619                                             service_cache.work);
 620
 621         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 622                 return;
 623
 624         hci_dev_lock(hdev);
 625
 626         update_eir(hdev);
 627         update_class(hdev);
 628
 629         hci_dev_unlock(hdev);
 630 }
 631
 632 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 633 {
 634         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 635                 return;
 636
 637         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 638
 639         /* Non-mgmt controlled devices get this bit set
 640          * implicitly so that pairing works for them, however
 641          * for mgmt we require user-space to explicitly enable
 642          * it
 643          */
 644         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 645 }
 646
 647 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 648                                 void *data, u16 data_len)
 649 {
 650         struct mgmt_rp_read_info rp;
 651
 652         BT_DBG("sock %p %s", sk, hdev->name);
 653
 654         hci_dev_lock(hdev);
 655
 656         memset(&rp, 0, sizeof(rp));
 657
 658         bacpy(&rp.bdaddr, &hdev->bdaddr);
 659
 660         rp.version = hdev->hci_ver;
 661         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 662
 663         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 664         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 665
 666         memcpy(rp.dev_class, hdev->dev_class, 3);
 667
 668         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 669         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 670
 671         hci_dev_unlock(hdev);
 672
 673         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 674                             sizeof(rp));
 675 }
 676
 677 static void mgmt_pending_free(struct pending_cmd *cmd)
 678 {
 679         sock_put(cmd->sk);
 680         kfree(cmd->param);
 681         kfree(cmd);
 682 }
 683
 684 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 685                                             struct hci_dev *hdev, void *data,
 686                                             u16 len)
 687 {
 688         struct pending_cmd *cmd;
 689
 690         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 691         if (!cmd)
 692                 return NULL;
 693
 694         cmd->opcode = opcode;
 695         cmd->index = hdev->id;
 696
 697         cmd->param = kmalloc(len, GFP_ATOMIC);
 698         if (!cmd->param) {
 699                 kfree(cmd);
 700                 return NULL;
 701         }
 702
 703         if (data)
 704                 memcpy(cmd->param, data, len);
 705
 706         cmd->sk = sk;
 707         sock_hold(sk);
 708
 709         list_add(&cmd->list, &hdev->mgmt_pending);
 710
 711         return cmd;
 712 }
 713
 714 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 715                                  void (*cb)(struct pending_cmd *cmd,
 716                                             void *data),
 717                                  void *data)
 718 {
 719         struct list_head *p, *n;
 720
 721         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 722                 struct pending_cmd *cmd;
 723
 724                 cmd = list_entry(p, struct pending_cmd, list);
 725
 726                 if (opcode > 0 && cmd->opcode != opcode)
 727                         continue;
 728
 729                 cb(cmd, data);
 730         }
 731 }
 732
 733 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 734 {
 735         struct pending_cmd *cmd;
 736
 737         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 738                 if (cmd->opcode == opcode)
 739                         return cmd;
 740         }
 741
 742         return NULL;
 743 }
 744
 745 static void mgmt_pending_remove(struct pending_cmd *cmd)
 746 {
 747         list_del(&cmd->list);
 748         mgmt_pending_free(cmd);
 749 }
 750
 751 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 752 {
 753         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 754
 755         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 756                             sizeof(settings));
 757 }
 758
 759 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 760                        u16 len)
 761 {
 762         struct mgmt_mode *cp = data;
 763         struct pending_cmd *cmd;
 764         int err;
 765
 766         BT_DBG("request for %s", hdev->name);
 767
 768         hci_dev_lock(hdev);
 769
 770         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 771                 cancel_delayed_work(&hdev->power_off);
 772
 773                 if (cp->val) {
 774                         err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 775                         mgmt_powered(hdev, 1);
 776                         goto failed;
 777                 }
 778         }
 779
 780         if (!!cp->val == hdev_is_powered(hdev)) {
 781                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 782                 goto failed;
 783         }
 784
 785         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 786                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 787                                  MGMT_STATUS_BUSY);
 788                 goto failed;
 789         }
 790
 791         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 792         if (!cmd) {
 793                 err = -ENOMEM;
 794                 goto failed;
 795         }
 796
 797         if (cp->val)
 798                 schedule_work(&hdev->power_on);
 799         else
 800                 schedule_work(&hdev->power_off.work);
 801
 802         err = 0;
 803
 804 failed:
 805         hci_dev_unlock(hdev);
 806         return err;
 807 }
 808
 809 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 810                       struct sock *skip_sk)
 811 {
 812         struct sk_buff *skb;
 813         struct mgmt_hdr *hdr;
 814
 815         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 816         if (!skb)
 817                 return -ENOMEM;
 818
 819         hdr = (void *) skb_put(skb, sizeof(*hdr));
 820         hdr->opcode = cpu_to_le16(event);
 821         if (hdev)
 822                 hdr->index = cpu_to_le16(hdev->id);
 823         else
 824                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 825         hdr->len = cpu_to_le16(data_len);
 826
 827         if (data)
 828                 memcpy(skb_put(skb, data_len), data, data_len);
 829
 830         /* Time stamp */
 831         __net_timestamp(skb);
 832
 833         hci_send_to_control(skb, skip_sk);
 834         kfree_skb(skb);
 835
 836         return 0;
 837 }
 838
 839 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 840 {
 841         __le32 ev;
 842
 843         ev = cpu_to_le32(get_current_settings(hdev));
 844
 845         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 846 }
 847
 848 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 849                             u16 len)
 850 {
 851         struct mgmt_cp_set_discoverable *cp = data;
 852         struct pending_cmd *cmd;
 853         u16 timeout;
 854         u8 scan;
 855         int err;
 856
 857         BT_DBG("request for %s", hdev->name);
 858
 859         timeout = __le16_to_cpu(cp->timeout);
 860         if (!cp->val && timeout > 0)
 861                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 862                                   MGMT_STATUS_INVALID_PARAMS);
 863
 864         hci_dev_lock(hdev);
 865
 866         if (!hdev_is_powered(hdev) && timeout > 0) {
 867                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 868                                  MGMT_STATUS_NOT_POWERED);
 869                 goto failed;
 870         }
 871
 872         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 873             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 874                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 875                                  MGMT_STATUS_BUSY);
 876                 goto failed;
 877         }
 878
 879         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 880                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 881                                  MGMT_STATUS_REJECTED);
 882                 goto failed;
 883         }
 884
 885         if (!hdev_is_powered(hdev)) {
 886                 bool changed = false;
 887
 888                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 889                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 890                         changed = true;
 891                 }
 892
 893                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 894                 if (err < 0)
 895                         goto failed;
 896
 897                 if (changed)
 898                         err = new_settings(hdev, sk);
 899
 900                 goto failed;
 901         }
 902
 903         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 904                 if (hdev->discov_timeout > 0) {
 905                         cancel_delayed_work(&hdev->discov_off);
 906                         hdev->discov_timeout = 0;
 907                 }
 908
 909                 if (cp->val && timeout > 0) {
 910                         hdev->discov_timeout = timeout;
 911                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 912                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 913                 }
 914
 915                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 916                 goto failed;
 917         }
 918
 919         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 920         if (!cmd) {
 921                 err = -ENOMEM;
 922                 goto failed;
 923         }
 924
 925         scan = SCAN_PAGE;
 926
 927         if (cp->val)
 928                 scan |= SCAN_INQUIRY;
 929         else
 930                 cancel_delayed_work(&hdev->discov_off);
 931
 932         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 933         if (err < 0)
 934                 mgmt_pending_remove(cmd);
 935
 936         if (cp->val)
 937                 hdev->discov_timeout = timeout;
 938
 939 failed:
 940         hci_dev_unlock(hdev);
 941         return err;
 942 }
 943
 944 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
 945                            u16 len)
 946 {
 947         struct mgmt_mode *cp = data;
 948         struct pending_cmd *cmd;
 949         u8 scan;
 950         int err;
 951
 952         BT_DBG("request for %s", hdev->name);
 953
 954         hci_dev_lock(hdev);
 955
 956         if (!hdev_is_powered(hdev)) {
 957                 bool changed = false;
 958
 959                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 960                         changed = true;
 961
 962                 if (cp->val) {
 963                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 964                 } else {
 965                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 966                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 967                 }
 968
 969                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 970                 if (err < 0)
 971                         goto failed;
 972
 973                 if (changed)
 974                         err = new_settings(hdev, sk);
 975
 976                 goto failed;
 977         }
 978
 979         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 980             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 981                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
 982                                  MGMT_STATUS_BUSY);
 983                 goto failed;
 984         }
 985
 986         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 987                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 988                 goto failed;
 989         }
 990
 991         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
 992         if (!cmd) {
 993                 err = -ENOMEM;
 994                 goto failed;
 995         }
 996
 997         if (cp->val) {
 998                 scan = SCAN_PAGE;
 999         } else {
1000                 scan = 0;
1001
1002                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1003                     hdev->discov_timeout > 0)
1004                         cancel_delayed_work(&hdev->discov_off);
1005         }
1006
1007         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1008         if (err < 0)
1009                 mgmt_pending_remove(cmd);
1010
1011 failed:
1012         hci_dev_unlock(hdev);
1013         return err;
1014 }
1015
1016 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1017                         u16 len)
1018 {
1019         struct mgmt_mode *cp = data;
1020         int err;
1021
1022         BT_DBG("request for %s", hdev->name);
1023
1024         hci_dev_lock(hdev);
1025
1026         if (cp->val)
1027                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1028         else
1029                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1030
1031         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1032         if (err < 0)
1033                 goto failed;
1034
1035         err = new_settings(hdev, sk);
1036
1037 failed:
1038         hci_dev_unlock(hdev);
1039         return err;
1040 }
1041
1042 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1043                              u16 len)
1044 {
1045         struct mgmt_mode *cp = data;
1046         struct pending_cmd *cmd;
1047         u8 val;
1048         int err;
1049
1050         BT_DBG("request for %s", hdev->name);
1051
1052         hci_dev_lock(hdev);
1053
1054         if (!hdev_is_powered(hdev)) {
1055                 bool changed = false;
1056
1057                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1058                                           &hdev->dev_flags)) {
1059                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1060                         changed = true;
1061                 }
1062
1063                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1064                 if (err < 0)
1065                         goto failed;
1066
1067                 if (changed)
1068                         err = new_settings(hdev, sk);
1069
1070                 goto failed;
1071         }
1072
1073         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1074                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1075                                  MGMT_STATUS_BUSY);
1076                 goto failed;
1077         }
1078
1079         val = !!cp->val;
1080
1081         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1082                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1083                 goto failed;
1084         }
1085
1086         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1087         if (!cmd) {
1088                 err = -ENOMEM;
1089                 goto failed;
1090         }
1091
1092         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1093         if (err < 0) {
1094                 mgmt_pending_remove(cmd);
1095                 goto failed;
1096         }
1097
1098 failed:
1099         hci_dev_unlock(hdev);
1100         return err;
1101 }
1102
1103 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1104 {
1105         struct mgmt_mode *cp = data;
1106         struct pending_cmd *cmd;
1107         u8 val;
1108         int err;
1109
1110         BT_DBG("request for %s", hdev->name);
1111
1112         hci_dev_lock(hdev);
1113
1114         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1115                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1116                                  MGMT_STATUS_NOT_SUPPORTED);
1117                 goto failed;
1118         }
1119
1120         val = !!cp->val;
1121
1122         if (!hdev_is_powered(hdev)) {
1123                 bool changed = false;
1124
1125                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1126                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1127                         changed = true;
1128                 }
1129
1130                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1131                 if (err < 0)
1132                         goto failed;
1133
1134                 if (changed)
1135                         err = new_settings(hdev, sk);
1136
1137                 goto failed;
1138         }
1139
1140         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1141                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1142                                  MGMT_STATUS_BUSY);
1143                 goto failed;
1144         }
1145
1146         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1147                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1148                 goto failed;
1149         }
1150
1151         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1152         if (!cmd) {
1153                 err = -ENOMEM;
1154                 goto failed;
1155         }
1156
1157         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1158         if (err < 0) {
1159                 mgmt_pending_remove(cmd);
1160                 goto failed;
1161         }
1162
1163 failed:
1164         hci_dev_unlock(hdev);
1165         return err;
1166 }
1167
1168 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1169 {
1170         struct mgmt_mode *cp = data;
1171
1172         BT_DBG("request for %s", hdev->name);
1173
1174         if (!enable_hs)
1175                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1176                                   MGMT_STATUS_NOT_SUPPORTED);
1177
1178         if (cp->val)
1179                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1180         else
1181                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1182
1183         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1184 }
1185
1186 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1187 {
1188         struct mgmt_mode *cp = data;
1189         struct hci_cp_write_le_host_supported hci_cp;
1190         struct pending_cmd *cmd;
1191         int err;
1192         u8 val, enabled;
1193
1194         BT_DBG("request for %s", hdev->name);
1195
1196         hci_dev_lock(hdev);
1197
1198         if (!(hdev->features[4] & LMP_LE)) {
1199                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1200                                  MGMT_STATUS_NOT_SUPPORTED);
1201                 goto unlock;
1202         }
1203
1204         val = !!cp->val;
1205         enabled = !!(hdev->host_features[0] & LMP_HOST_LE);
1206
1207         if (!hdev_is_powered(hdev) || val == enabled) {
1208                 bool changed = false;
1209
1210                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1211                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1212                         changed = true;
1213                 }
1214
1215                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1216                 if (err < 0)
1217                         goto unlock;
1218
1219                 if (changed)
1220                         err = new_settings(hdev, sk);
1221
1222                 goto unlock;
1223         }
1224
1225         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1226                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1227                                  MGMT_STATUS_BUSY);
1228                 goto unlock;
1229         }
1230
1231         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1232         if (!cmd) {
1233                 err = -ENOMEM;
1234                 goto unlock;
1235         }
1236
1237         memset(&hci_cp, 0, sizeof(hci_cp));
1238
1239         if (val) {
1240                 hci_cp.le = val;
1241                 hci_cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
1242         }
1243
1244         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1245                            &hci_cp);
1246         if (err < 0)
1247                 mgmt_pending_remove(cmd);
1248
1249 unlock:
1250         hci_dev_unlock(hdev);
1251         return err;
1252 }
1253
1254 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1255 {
1256         struct mgmt_cp_add_uuid *cp = data;
1257         struct pending_cmd *cmd;
1258         struct bt_uuid *uuid;
1259         int err;
1260
1261         BT_DBG("request for %s", hdev->name);
1262
1263         hci_dev_lock(hdev);
1264
1265         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1266                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1267                                  MGMT_STATUS_BUSY);
1268                 goto failed;
1269         }
1270
1271         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
1272         if (!uuid) {
1273                 err = -ENOMEM;
1274                 goto failed;
1275         }
1276
1277         memcpy(uuid->uuid, cp->uuid, 16);
1278         uuid->svc_hint = cp->svc_hint;
1279
1280         list_add(&uuid->list, &hdev->uuids);
1281
1282         err = update_class(hdev);
1283         if (err < 0)
1284                 goto failed;
1285
1286         err = update_eir(hdev);
1287         if (err < 0)
1288                 goto failed;
1289
1290         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1291                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1292                                    hdev->dev_class, 3);
1293                 goto failed;
1294         }
1295
1296         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1297         if (!cmd)
1298                 err = -ENOMEM;
1299
1300 failed:
1301         hci_dev_unlock(hdev);
1302         return err;
1303 }
1304
1305 static bool enable_service_cache(struct hci_dev *hdev)
1306 {
1307         if (!hdev_is_powered(hdev))
1308                 return false;
1309
1310         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1311                 schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
1312                 return true;
1313         }
1314
1315         return false;
1316 }
1317
1318 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1319                        u16 len)
1320 {
1321         struct mgmt_cp_remove_uuid *cp = data;
1322         struct pending_cmd *cmd;
1323         struct list_head *p, *n;
1324         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1325         int err, found;
1326
1327         BT_DBG("request for %s", hdev->name);
1328
1329         hci_dev_lock(hdev);
1330
1331         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1332                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1333                                  MGMT_STATUS_BUSY);
1334                 goto unlock;
1335         }
1336
1337         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1338                 err = hci_uuids_clear(hdev);
1339
1340                 if (enable_service_cache(hdev)) {
1341                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1342                                            0, hdev->dev_class, 3);
1343                         goto unlock;
1344                 }
1345
1346                 goto update_class;
1347         }
1348
1349         found = 0;
1350
1351         list_for_each_safe(p, n, &hdev->uuids) {
1352                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1353
1354                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1355                         continue;
1356
1357                 list_del(&match->list);
1358                 found++;
1359         }
1360
1361         if (found == 0) {
1362                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1363                                  MGMT_STATUS_INVALID_PARAMS);
1364                 goto unlock;
1365         }
1366
1367 update_class:
1368         err = update_class(hdev);
1369         if (err < 0)
1370                 goto unlock;
1371
1372         err = update_eir(hdev);
1373         if (err < 0)
1374                 goto unlock;
1375
1376         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1377                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1378                                    hdev->dev_class, 3);
1379                 goto unlock;
1380         }
1381
1382         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1383         if (!cmd)
1384                 err = -ENOMEM;
1385
1386 unlock:
1387         hci_dev_unlock(hdev);
1388         return err;
1389 }
1390
1391 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1392                          u16 len)
1393 {
1394         struct mgmt_cp_set_dev_class *cp = data;
1395         struct pending_cmd *cmd;
1396         int err;
1397
1398         BT_DBG("request for %s", hdev->name);
1399
1400         hci_dev_lock(hdev);
1401
1402         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1403                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1404                                  MGMT_STATUS_BUSY);
1405                 goto unlock;
1406         }
1407
1408         hdev->major_class = cp->major;
1409         hdev->minor_class = cp->minor;
1410
1411         if (!hdev_is_powered(hdev)) {
1412                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1413                                    hdev->dev_class, 3);
1414                 goto unlock;
1415         }
1416
1417         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1418                 hci_dev_unlock(hdev);
1419                 cancel_delayed_work_sync(&hdev->service_cache);
1420                 hci_dev_lock(hdev);
1421                 update_eir(hdev);
1422         }
1423
1424         err = update_class(hdev);
1425         if (err < 0)
1426                 goto unlock;
1427
1428         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1429                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1430                                    hdev->dev_class, 3);
1431                 goto unlock;
1432         }
1433
1434         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1435         if (!cmd)
1436                 err = -ENOMEM;
1437
1438 unlock:
1439         hci_dev_unlock(hdev);
1440         return err;
1441 }
1442
1443 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1444                           u16 len)
1445 {
1446         struct mgmt_cp_load_link_keys *cp = data;
1447         u16 key_count, expected_len;
1448         int i;
1449
1450         key_count = __le16_to_cpu(cp->key_count);
1451
1452         expected_len = sizeof(*cp) + key_count *
1453                                         sizeof(struct mgmt_link_key_info);
1454         if (expected_len != len) {
1455                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1456                        len, expected_len);
1457                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1458                                   MGMT_STATUS_INVALID_PARAMS);
1459         }
1460
1461         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1462                key_count);
1463
1464         hci_dev_lock(hdev);
1465
1466         hci_link_keys_clear(hdev);
1467
1468         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1469
1470         if (cp->debug_keys)
1471                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1472         else
1473                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1474
1475         for (i = 0; i < key_count; i++) {
1476                 struct mgmt_link_key_info *key = &cp->keys[i];
1477
1478                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1479                                  key->type, key->pin_len);
1480         }
1481
1482         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1483
1484         hci_dev_unlock(hdev);
1485
1486         return 0;
1487 }
1488
1489 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1490                            u8 addr_type, struct sock *skip_sk)
1491 {
1492         struct mgmt_ev_device_unpaired ev;
1493
1494         bacpy(&ev.addr.bdaddr, bdaddr);
1495         ev.addr.type = addr_type;
1496
1497         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1498                           skip_sk);
1499 }
1500
1501 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1502                          u16 len)
1503 {
1504         struct mgmt_cp_unpair_device *cp = data;
1505         struct mgmt_rp_unpair_device rp;
1506         struct hci_cp_disconnect dc;
1507         struct pending_cmd *cmd;
1508         struct hci_conn *conn;
1509         int err;
1510
1511         hci_dev_lock(hdev);
1512
1513         memset(&rp, 0, sizeof(rp));
1514         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1515         rp.addr.type = cp->addr.type;
1516
1517         if (!hdev_is_powered(hdev)) {
1518                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1519                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1520                 goto unlock;
1521         }
1522
1523         if (cp->addr.type == BDADDR_BREDR)
1524                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1525         else
1526                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1527
1528         if (err < 0) {
1529                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1530                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1531                 goto unlock;
1532         }
1533
1534         if (cp->disconnect) {
1535                 if (cp->addr.type == BDADDR_BREDR)
1536                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1537                                                        &cp->addr.bdaddr);
1538                 else
1539                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1540                                                        &cp->addr.bdaddr);
1541         } else {
1542                 conn = NULL;
1543         }
1544
1545         if (!conn) {
1546                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1547                                    &rp, sizeof(rp));
1548                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1549                 goto unlock;
1550         }
1551
1552         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1553                                sizeof(*cp));
1554         if (!cmd) {
1555                 err = -ENOMEM;
1556                 goto unlock;
1557         }
1558
1559         dc.handle = cpu_to_le16(conn->handle);
1560         dc.reason = 0x13; /* Remote User Terminated Connection */
1561         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1562         if (err < 0)
1563                 mgmt_pending_remove(cmd);
1564
1565 unlock:
1566         hci_dev_unlock(hdev);
1567         return err;
1568 }
1569
1570 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1571                       u16 len)
1572 {
1573         struct mgmt_cp_disconnect *cp = data;
1574         struct hci_cp_disconnect dc;
1575         struct pending_cmd *cmd;
1576         struct hci_conn *conn;
1577         int err;
1578
1579         BT_DBG("");
1580
1581         hci_dev_lock(hdev);
1582
1583         if (!test_bit(HCI_UP, &hdev->flags)) {
1584                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1585                                  MGMT_STATUS_NOT_POWERED);
1586                 goto failed;
1587         }
1588
1589         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1590                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1591                                  MGMT_STATUS_BUSY);
1592                 goto failed;
1593         }
1594
1595         if (cp->addr.type == BDADDR_BREDR)
1596                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1597                                                &cp->addr.bdaddr);
1598         else
1599                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1600
1601         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1602                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1603                                  MGMT_STATUS_NOT_CONNECTED);
1604                 goto failed;
1605         }
1606
1607         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1608         if (!cmd) {
1609                 err = -ENOMEM;
1610                 goto failed;
1611         }
1612
1613         dc.handle = cpu_to_le16(conn->handle);
1614         dc.reason = 0x13; /* Remote User Terminated Connection */
1615
1616         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1617         if (err < 0)
1618                 mgmt_pending_remove(cmd);
1619
1620 failed:
1621         hci_dev_unlock(hdev);
1622         return err;
1623 }
1624
1625 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1626 {
1627         switch (link_type) {
1628         case LE_LINK:
1629                 switch (addr_type) {
1630                 case ADDR_LE_DEV_PUBLIC:
1631                         return BDADDR_LE_PUBLIC;
1632
1633                 default:
1634                         /* Fallback to LE Random address type */
1635                         return BDADDR_LE_RANDOM;
1636                 }
1637
1638         default:
1639                 /* Fallback to BR/EDR type */
1640                 return BDADDR_BREDR;
1641         }
1642 }
1643
1644 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1645                            u16 data_len)
1646 {
1647         struct mgmt_rp_get_connections *rp;
1648         struct hci_conn *c;
1649         size_t rp_len;
1650         int err;
1651         u16 i;
1652
1653         BT_DBG("");
1654
1655         hci_dev_lock(hdev);
1656
1657         if (!hdev_is_powered(hdev)) {
1658                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1659                                  MGMT_STATUS_NOT_POWERED);
1660                 goto unlock;
1661         }
1662
1663         i = 0;
1664         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1665                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1666                         i++;
1667         }
1668
1669         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1670         rp = kmalloc(rp_len, GFP_ATOMIC);
1671         if (!rp) {
1672                 err = -ENOMEM;
1673                 goto unlock;
1674         }
1675
1676         i = 0;
1677         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1678                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1679                         continue;
1680                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1681                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1682                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1683                         continue;
1684                 i++;
1685         }
1686
1687         rp->conn_count = cpu_to_le16(i);
1688
1689         /* Recalculate length in case of filtered SCO connections, etc */
1690         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1691
1692         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1693                            rp_len);
1694
1695         kfree(rp);
1696
1697 unlock:
1698         hci_dev_unlock(hdev);
1699         return err;
1700 }
1701
1702 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1703                                    struct mgmt_cp_pin_code_neg_reply *cp)
1704 {
1705         struct pending_cmd *cmd;
1706         int err;
1707
1708         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1709                                sizeof(*cp));
1710         if (!cmd)
1711                 return -ENOMEM;
1712
1713         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1714                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1715         if (err < 0)
1716                 mgmt_pending_remove(cmd);
1717
1718         return err;
1719 }
1720
1721 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1722                           u16 len)
1723 {
1724         struct hci_conn *conn;
1725         struct mgmt_cp_pin_code_reply *cp = data;
1726         struct hci_cp_pin_code_reply reply;
1727         struct pending_cmd *cmd;
1728         int err;
1729
1730         BT_DBG("");
1731
1732         hci_dev_lock(hdev);
1733
1734         if (!hdev_is_powered(hdev)) {
1735                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1736                                  MGMT_STATUS_NOT_POWERED);
1737                 goto failed;
1738         }
1739
1740         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1741         if (!conn) {
1742                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1743                                  MGMT_STATUS_NOT_CONNECTED);
1744                 goto failed;
1745         }
1746
1747         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1748                 struct mgmt_cp_pin_code_neg_reply ncp;
1749
1750                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1751
1752                 BT_ERR("PIN code is not 16 bytes long");
1753
1754                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1755                 if (err >= 0)
1756                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1757                                          MGMT_STATUS_INVALID_PARAMS);
1758
1759                 goto failed;
1760         }
1761
1762         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1763         if (!cmd) {
1764                 err = -ENOMEM;
1765                 goto failed;
1766         }
1767
1768         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1769         reply.pin_len = cp->pin_len;
1770         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1771
1772         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1773         if (err < 0)
1774                 mgmt_pending_remove(cmd);
1775
1776 failed:
1777         hci_dev_unlock(hdev);
1778         return err;
1779 }
1780
1781 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1782                               void *data, u16 len)
1783 {
1784         struct mgmt_cp_pin_code_neg_reply *cp = data;
1785         int err;
1786
1787         BT_DBG("");
1788
1789         hci_dev_lock(hdev);
1790
1791         if (!hdev_is_powered(hdev)) {
1792                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
1793                                  MGMT_STATUS_NOT_POWERED);
1794                 goto failed;
1795         }
1796
1797         err = send_pin_code_neg_reply(sk, hdev, cp);
1798
1799 failed:
1800         hci_dev_unlock(hdev);
1801         return err;
1802 }
1803
1804 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1805                              u16 len)
1806 {
1807         struct mgmt_cp_set_io_capability *cp = data;
1808
1809         BT_DBG("");
1810
1811         hci_dev_lock(hdev);
1812
1813         hdev->io_capability = cp->io_capability;
1814
1815         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1816                hdev->io_capability);
1817
1818         hci_dev_unlock(hdev);
1819
1820         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1821                             0);
1822 }
1823
1824 static struct pending_cmd *find_pairing(struct hci_conn *conn)
1825 {
1826         struct hci_dev *hdev = conn->hdev;
1827         struct pending_cmd *cmd;
1828
1829         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1830                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1831                         continue;
1832
1833                 if (cmd->user_data != conn)
1834                         continue;
1835
1836                 return cmd;
1837         }
1838
1839         return NULL;
1840 }
1841
1842 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1843 {
1844         struct mgmt_rp_pair_device rp;
1845         struct hci_conn *conn = cmd->user_data;
1846
1847         bacpy(&rp.addr.bdaddr, &conn->dst);
1848         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
1849
1850         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1851                      &rp, sizeof(rp));
1852
1853         /* So we don't get further callbacks for this connection */
1854         conn->connect_cfm_cb = NULL;
1855         conn->security_cfm_cb = NULL;
1856         conn->disconn_cfm_cb = NULL;
1857
1858         hci_conn_put(conn);
1859
1860         mgmt_pending_remove(cmd);
1861 }
1862
1863 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1864 {
1865         struct pending_cmd *cmd;
1866
1867         BT_DBG("status %u", status);
1868
1869         cmd = find_pairing(conn);
1870         if (!cmd)
1871                 BT_DBG("Unable to find a pending command");
1872         else
1873                 pairing_complete(cmd, mgmt_status(status));
1874 }
1875
1876 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
1877 {
1878         struct pending_cmd *cmd;
1879
1880         BT_DBG("status %u", status);
1881
1882         if (!status)
1883                 return;
1884
1885         cmd = find_pairing(conn);
1886         if (!cmd)
1887                 BT_DBG("Unable to find a pending command");
1888         else
1889                 pairing_complete(cmd, mgmt_status(status));
1890 }
1891
1892 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1893                        u16 len)
1894 {
1895         struct mgmt_cp_pair_device *cp = data;
1896         struct mgmt_rp_pair_device rp;
1897         struct pending_cmd *cmd;
1898         u8 sec_level, auth_type;
1899         struct hci_conn *conn;
1900         int err;
1901
1902         BT_DBG("");
1903
1904         hci_dev_lock(hdev);
1905
1906         if (!hdev_is_powered(hdev)) {
1907                 err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1908                                  MGMT_STATUS_NOT_POWERED);
1909                 goto unlock;
1910         }
1911
1912         sec_level = BT_SECURITY_MEDIUM;
1913         if (cp->io_cap == 0x03)
1914                 auth_type = HCI_AT_DEDICATED_BONDING;
1915         else
1916                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1917
1918         if (cp->addr.type == BDADDR_BREDR)
1919                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
1920                                    cp->addr.type, sec_level, auth_type);
1921         else
1922                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
1923                                    cp->addr.type, sec_level, auth_type);
1924
1925         memset(&rp, 0, sizeof(rp));
1926         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1927         rp.addr.type = cp->addr.type;
1928
1929         if (IS_ERR(conn)) {
1930                 int status;
1931
1932                 if (PTR_ERR(conn) == -EBUSY)
1933                         status = MGMT_STATUS_BUSY;
1934                 else
1935                         status = MGMT_STATUS_CONNECT_FAILED;
1936
1937                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1938                                    status, &rp,
1939                                    sizeof(rp));
1940                 goto unlock;
1941         }
1942
1943         if (conn->connect_cfm_cb) {
1944                 hci_conn_put(conn);
1945                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1946                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1947                 goto unlock;
1948         }
1949
1950         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1951         if (!cmd) {
1952                 err = -ENOMEM;
1953                 hci_conn_put(conn);
1954                 goto unlock;
1955         }
1956
1957         /* For LE, just connecting isn't a proof that the pairing finished */
1958         if (cp->addr.type == BDADDR_BREDR)
1959                 conn->connect_cfm_cb = pairing_complete_cb;
1960         else
1961                 conn->connect_cfm_cb = le_connect_complete_cb;
1962
1963         conn->security_cfm_cb = pairing_complete_cb;
1964         conn->disconn_cfm_cb = pairing_complete_cb;
1965         conn->io_capability = cp->io_cap;
1966         cmd->user_data = conn;
1967
1968         if (conn->state == BT_CONNECTED &&
1969             hci_conn_security(conn, sec_level, auth_type))
1970                 pairing_complete(cmd, 0);
1971
1972         err = 0;
1973
1974 unlock:
1975         hci_dev_unlock(hdev);
1976         return err;
1977 }
1978
1979 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1980                               u16 len)
1981 {
1982         struct mgmt_addr_info *addr = data;
1983         struct pending_cmd *cmd;
1984         struct hci_conn *conn;
1985         int err;
1986
1987         BT_DBG("");
1988
1989         hci_dev_lock(hdev);
1990
1991         if (!hdev_is_powered(hdev)) {
1992                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1993                                  MGMT_STATUS_NOT_POWERED);
1994                 goto unlock;
1995         }
1996
1997         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
1998         if (!cmd) {
1999                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2000                                  MGMT_STATUS_INVALID_PARAMS);
2001                 goto unlock;
2002         }
2003
2004         conn = cmd->user_data;
2005
2006         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2007                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2008                                  MGMT_STATUS_INVALID_PARAMS);
2009                 goto unlock;
2010         }
2011
2012         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2013
2014         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2015                            addr, sizeof(*addr));
2016 unlock:
2017         hci_dev_unlock(hdev);
2018         return err;
2019 }
2020
2021 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2022                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2023                              u16 hci_op, __le32 passkey)
2024 {
2025         struct pending_cmd *cmd;
2026         struct hci_conn *conn;
2027         int err;
2028
2029         hci_dev_lock(hdev);
2030
2031         if (!hdev_is_powered(hdev)) {
2032                 err = cmd_status(sk, hdev->id, mgmt_op,
2033                                  MGMT_STATUS_NOT_POWERED);
2034                 goto done;
2035         }
2036
2037         if (type == BDADDR_BREDR)
2038                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2039         else
2040                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2041
2042         if (!conn) {
2043                 err = cmd_status(sk, hdev->id, mgmt_op,
2044                                  MGMT_STATUS_NOT_CONNECTED);
2045                 goto done;
2046         }
2047
2048         if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2049                 /* Continue with pairing via SMP */
2050                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2051
2052                 if (!err)
2053                         err = cmd_status(sk, hdev->id, mgmt_op,
2054                                          MGMT_STATUS_SUCCESS);
2055                 else
2056                         err = cmd_status(sk, hdev->id, mgmt_op,
2057                                          MGMT_STATUS_FAILED);
2058
2059                 goto done;
2060         }
2061
2062         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2063         if (!cmd) {
2064                 err = -ENOMEM;
2065                 goto done;
2066         }
2067
2068         /* Continue with pairing via HCI */
2069         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2070                 struct hci_cp_user_passkey_reply cp;
2071
2072                 bacpy(&cp.bdaddr, bdaddr);
2073                 cp.passkey = passkey;
2074                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2075         } else
2076                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2077
2078         if (err < 0)
2079                 mgmt_pending_remove(cmd);
2080
2081 done:
2082         hci_dev_unlock(hdev);
2083         return err;
2084 }
2085
2086 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2087                               u16 len)
2088 {
2089         struct mgmt_cp_user_confirm_reply *cp = data;
2090
2091         BT_DBG("");
2092
2093         if (len != sizeof(*cp))
2094                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2095                                   MGMT_STATUS_INVALID_PARAMS);
2096
2097         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2098                                  MGMT_OP_USER_CONFIRM_REPLY,
2099                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2100 }
2101
2102 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2103                                   void *data, u16 len)
2104 {
2105         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2106
2107         BT_DBG("");
2108
2109         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2110                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2111                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2112 }
2113
2114 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2115                               u16 len)
2116 {
2117         struct mgmt_cp_user_passkey_reply *cp = data;
2118
2119         BT_DBG("");
2120
2121         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2122                                  MGMT_OP_USER_PASSKEY_REPLY,
2123                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2124 }
2125
2126 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2127                                   void *data, u16 len)
2128 {
2129         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2130
2131         BT_DBG("");
2132
2133         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2134                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2135                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2136 }
2137
2138 static int update_name(struct hci_dev *hdev, const char *name)
2139 {
2140         struct hci_cp_write_local_name cp;
2141
2142         memcpy(cp.name, name, sizeof(cp.name));
2143
2144         return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2145 }
2146
2147 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2148                           u16 len)
2149 {
2150         struct mgmt_cp_set_local_name *cp = data;
2151         struct pending_cmd *cmd;
2152         int err;
2153
2154         BT_DBG("");
2155
2156         hci_dev_lock(hdev);
2157
2158         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2159
2160         if (!hdev_is_powered(hdev)) {
2161                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2162
2163                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2164                                    data, len);
2165                 if (err < 0)
2166                         goto failed;
2167
2168                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2169                                  sk);
2170
2171                 goto failed;
2172         }
2173
2174         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2175         if (!cmd) {
2176                 err = -ENOMEM;
2177                 goto failed;
2178         }
2179
2180         err = update_name(hdev, cp->name);
2181         if (err < 0)
2182                 mgmt_pending_remove(cmd);
2183
2184 failed:
2185         hci_dev_unlock(hdev);
2186         return err;
2187 }
2188
2189 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2190                                void *data, u16 data_len)
2191 {
2192         struct pending_cmd *cmd;
2193         int err;
2194
2195         BT_DBG("%s", hdev->name);
2196
2197         hci_dev_lock(hdev);
2198
2199         if (!hdev_is_powered(hdev)) {
2200                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2201                                  MGMT_STATUS_NOT_POWERED);
2202                 goto unlock;
2203         }
2204
2205         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
2206                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2207                                  MGMT_STATUS_NOT_SUPPORTED);
2208                 goto unlock;
2209         }
2210
2211         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2212                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2213                                  MGMT_STATUS_BUSY);
2214                 goto unlock;
2215         }
2216
2217         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2218         if (!cmd) {
2219                 err = -ENOMEM;
2220                 goto unlock;
2221         }
2222
2223         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2224         if (err < 0)
2225                 mgmt_pending_remove(cmd);
2226
2227 unlock:
2228         hci_dev_unlock(hdev);
2229         return err;
2230 }
2231
2232 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2233                                void *data, u16 len)
2234 {
2235         struct mgmt_cp_add_remote_oob_data *cp = data;
2236         u8 status;
2237         int err;
2238
2239         BT_DBG("%s ", hdev->name);
2240
2241         hci_dev_lock(hdev);
2242
2243         if (!hdev_is_powered(hdev)) {
2244                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
2245                                    MGMT_STATUS_NOT_POWERED, &cp->addr,
2246                                    sizeof(cp->addr));
2247                 goto unlock;
2248         }
2249
2250         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2251                                       cp->randomizer);
2252         if (err < 0)
2253                 status = MGMT_STATUS_FAILED;
2254         else
2255                 status = 0;
2256
2257         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2258                            &cp->addr, sizeof(cp->addr));
2259
2260 unlock:
2261         hci_dev_unlock(hdev);
2262         return err;
2263 }
2264
2265 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2266                                   void *data, u16 len)
2267 {
2268         struct mgmt_cp_remove_remote_oob_data *cp = data;
2269         u8 status;
2270         int err;
2271
2272         BT_DBG("%s", hdev->name);
2273
2274         hci_dev_lock(hdev);
2275
2276         if (!hdev_is_powered(hdev)) {
2277                 err = cmd_complete(sk, hdev->id,
2278                                    MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2279                                    MGMT_STATUS_NOT_POWERED, &cp->addr,
2280                                    sizeof(cp->addr));
2281                 goto unlock;
2282         }
2283
2284         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2285         if (err < 0)
2286                 status = MGMT_STATUS_INVALID_PARAMS;
2287         else
2288                 status = 0;
2289
2290         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2291                            status, &cp->addr, sizeof(cp->addr));
2292
2293 unlock:
2294         hci_dev_unlock(hdev);
2295         return err;
2296 }
2297
2298 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2299 {
2300         int err;
2301
2302         BT_DBG("%s", hdev->name);
2303
2304         hci_dev_lock(hdev);
2305
2306         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2307         if (err < 0)
2308                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2309
2310         hci_dev_unlock(hdev);
2311
2312         return err;
2313 }
2314
2315 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2316                            void *data, u16 len)
2317 {
2318         struct mgmt_cp_start_discovery *cp = data;
2319         struct pending_cmd *cmd;
2320         int err;
2321
2322         BT_DBG("%s", hdev->name);
2323
2324         hci_dev_lock(hdev);
2325
2326         if (!hdev_is_powered(hdev)) {
2327                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2328                                  MGMT_STATUS_NOT_POWERED);
2329                 goto failed;
2330         }
2331
2332         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2333                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2334                                  MGMT_STATUS_BUSY);
2335                 goto failed;
2336         }
2337
2338         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2339                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2340                                  MGMT_STATUS_BUSY);
2341                 goto failed;
2342         }
2343
2344         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2345         if (!cmd) {
2346                 err = -ENOMEM;
2347                 goto failed;
2348         }
2349
2350         hdev->discovery.type = cp->type;
2351
2352         switch (hdev->discovery.type) {
2353         case DISCOV_TYPE_BREDR:
2354                 if (lmp_bredr_capable(hdev))
2355                         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2356                 else
2357                         err = -ENOTSUPP;
2358                 break;
2359
2360         case DISCOV_TYPE_LE:
2361                 if (lmp_host_le_capable(hdev))
2362                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2363                                           LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2364                 else
2365                         err = -ENOTSUPP;
2366                 break;
2367
2368         case DISCOV_TYPE_INTERLEAVED:
2369                 if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
2370                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2371                                           LE_SCAN_WIN,
2372                                           LE_SCAN_TIMEOUT_BREDR_LE);
2373                 else
2374                         err = -ENOTSUPP;
2375                 break;
2376
2377         default:
2378                 err = -EINVAL;
2379         }
2380
2381         if (err < 0)
2382                 mgmt_pending_remove(cmd);
2383         else
2384                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2385
2386 failed:
2387         hci_dev_unlock(hdev);
2388         return err;
2389 }
2390
2391 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2392                           u16 len)
2393 {
2394         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2395         struct pending_cmd *cmd;
2396         struct hci_cp_remote_name_req_cancel cp;
2397         struct inquiry_entry *e;
2398         int err;
2399
2400         BT_DBG("%s", hdev->name);
2401
2402         hci_dev_lock(hdev);
2403
2404         if (!hci_discovery_active(hdev)) {
2405                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2406                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2407                                    sizeof(mgmt_cp->type));
2408                 goto unlock;
2409         }
2410
2411         if (hdev->discovery.type != mgmt_cp->type) {
2412                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2413                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2414                                    sizeof(mgmt_cp->type));
2415                 goto unlock;
2416         }
2417
2418         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2419         if (!cmd) {
2420                 err = -ENOMEM;
2421                 goto unlock;
2422         }
2423
2424         switch (hdev->discovery.state) {
2425         case DISCOVERY_FINDING:
2426                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2427                         err = hci_cancel_inquiry(hdev);
2428                 else
2429                         err = hci_cancel_le_scan(hdev);
2430
2431                 break;
2432
2433         case DISCOVERY_RESOLVING:
2434                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2435                                                      NAME_PENDING);
2436                 if (!e) {
2437                         mgmt_pending_remove(cmd);
2438                         err = cmd_complete(sk, hdev->id,
2439                                            MGMT_OP_STOP_DISCOVERY, 0,
2440                                            &mgmt_cp->type,
2441                                            sizeof(mgmt_cp->type));
2442                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2443                         goto unlock;
2444                 }
2445
2446                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2447                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2448                                    sizeof(cp), &cp);
2449
2450                 break;
2451
2452         default:
2453                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2454                 err = -EFAULT;
2455         }
2456
2457         if (err < 0)
2458                 mgmt_pending_remove(cmd);
2459         else
2460                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2461
2462 unlock:
2463         hci_dev_unlock(hdev);
2464         return err;
2465 }
2466
2467 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2468                         u16 len)
2469 {
2470         struct mgmt_cp_confirm_name *cp = data;
2471         struct inquiry_entry *e;
2472         int err;
2473
2474         BT_DBG("%s", hdev->name);
2475
2476         hci_dev_lock(hdev);
2477
2478         if (!hci_discovery_active(hdev)) {
2479                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2480                                  MGMT_STATUS_FAILED);
2481                 goto failed;
2482         }
2483
2484         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2485         if (!e) {
2486                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2487                                  MGMT_STATUS_INVALID_PARAMS);
2488                 goto failed;
2489         }
2490
2491         if (cp->name_known) {
2492                 e->name_state = NAME_KNOWN;
2493                 list_del(&e->list);
2494         } else {
2495                 e->name_state = NAME_NEEDED;
2496                 hci_inquiry_cache_update_resolve(hdev, e);
2497         }
2498
2499         err = 0;
2500
2501 failed:
2502         hci_dev_unlock(hdev);
2503         return err;
2504 }
2505
2506 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2507                         u16 len)
2508 {
2509         struct mgmt_cp_block_device *cp = data;
2510         u8 status;
2511         int err;
2512
2513         BT_DBG("%s", hdev->name);
2514
2515         hci_dev_lock(hdev);
2516
2517         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2518         if (err < 0)
2519                 status = MGMT_STATUS_FAILED;
2520         else
2521                 status = 0;
2522
2523         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2524                            &cp->addr, sizeof(cp->addr));
2525
2526         hci_dev_unlock(hdev);
2527
2528         return err;
2529 }
2530
2531 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2532                           u16 len)
2533 {
2534         struct mgmt_cp_unblock_device *cp = data;
2535         u8 status;
2536         int err;
2537
2538         BT_DBG("%s", hdev->name);
2539
2540         hci_dev_lock(hdev);
2541
2542         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2543         if (err < 0)
2544                 status = MGMT_STATUS_INVALID_PARAMS;
2545         else
2546                 status = 0;
2547
2548         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2549                            &cp->addr, sizeof(cp->addr));
2550
2551         hci_dev_unlock(hdev);
2552
2553         return err;
2554 }
2555
2556 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2557                          u16 len)
2558 {
2559         struct mgmt_cp_set_device_id *cp = data;
2560         int err;
2561         __u16 source;
2562
2563         BT_DBG("%s", hdev->name);
2564
2565         source = __le16_to_cpu(cp->source);
2566
2567         if (source > 0x0002)
2568                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2569                                   MGMT_STATUS_INVALID_PARAMS);
2570
2571         hci_dev_lock(hdev);
2572
2573         hdev->devid_source = source;
2574         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2575         hdev->devid_product = __le16_to_cpu(cp->product);
2576         hdev->devid_version = __le16_to_cpu(cp->version);
2577
2578         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2579
2580         update_eir(hdev);
2581
2582         hci_dev_unlock(hdev);
2583
2584         return err;
2585 }
2586
2587 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2588                                 void *data, u16 len)
2589 {
2590         struct mgmt_mode *cp = data;
2591         struct hci_cp_write_page_scan_activity acp;
2592         u8 type;
2593         int err;
2594
2595         BT_DBG("%s", hdev->name);
2596
2597         if (!hdev_is_powered(hdev))
2598                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2599                                   MGMT_STATUS_NOT_POWERED);
2600
2601         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2602                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2603                                   MGMT_STATUS_REJECTED);
2604
2605         hci_dev_lock(hdev);
2606
2607         if (cp->val) {
2608                 type = PAGE_SCAN_TYPE_INTERLACED;
2609
2610                 /* 22.5 msec page scan interval */
2611                 acp.interval = __constant_cpu_to_le16(0x0024);
2612         } else {
2613                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2614
2615                 /* default 1.28 sec page scan */
2616                 acp.interval = __constant_cpu_to_le16(0x0800);
2617         }
2618
2619         /* default 11.25 msec page scan window */
2620         acp.window = __constant_cpu_to_le16(0x0012);
2621
2622         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2623                            &acp);
2624         if (err < 0) {
2625                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2626                                  MGMT_STATUS_FAILED);
2627                 goto done;
2628         }
2629
2630         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2631         if (err < 0) {
2632                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2633                                  MGMT_STATUS_FAILED);
2634                 goto done;
2635         }
2636
2637         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2638                            NULL, 0);
2639 done:
2640         hci_dev_unlock(hdev);
2641         return err;
2642 }
2643
2644 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2645                                void *cp_data, u16 len)
2646 {
2647         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2648         u16 key_count, expected_len;
2649         int i;
2650
2651         key_count = __le16_to_cpu(cp->key_count);
2652
2653         expected_len = sizeof(*cp) + key_count *
2654                                         sizeof(struct mgmt_ltk_info);
2655         if (expected_len != len) {
2656                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2657                        len, expected_len);
2658                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2659                                   EINVAL);
2660         }
2661
2662         BT_DBG("%s key_count %u", hdev->name, key_count);
2663
2664         hci_dev_lock(hdev);
2665
2666         hci_smp_ltks_clear(hdev);
2667
2668         for (i = 0; i < key_count; i++) {
2669                 struct mgmt_ltk_info *key = &cp->keys[i];
2670                 u8 type;
2671
2672                 if (key->master)
2673                         type = HCI_SMP_LTK;
2674                 else
2675                         type = HCI_SMP_LTK_SLAVE;
2676
2677                 hci_add_ltk(hdev, &key->addr.bdaddr,
2678                             bdaddr_to_le(key->addr.type),
2679                             type, 0, key->authenticated, key->val,
2680                             key->enc_size, key->ediv, key->rand);
2681         }
2682
2683         hci_dev_unlock(hdev);
2684
2685         return 0;
2686 }
2687
2688 static const struct mgmt_handler {
2689         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2690                      u16 data_len);
2691         bool var_len;
2692         size_t data_len;
2693 } mgmt_handlers[] = {
2694         { NULL }, /* 0x0000 (no command) */
2695         { read_version,           false, MGMT_READ_VERSION_SIZE },
2696         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
2697         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
2698         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
2699         { set_powered,            false, MGMT_SETTING_SIZE },
2700         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
2701         { set_connectable,        false, MGMT_SETTING_SIZE },
2702         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
2703         { set_pairable,           false, MGMT_SETTING_SIZE },
2704         { set_link_security,      false, MGMT_SETTING_SIZE },
2705         { set_ssp,                false, MGMT_SETTING_SIZE },
2706         { set_hs,                 false, MGMT_SETTING_SIZE },
2707         { set_le,                 false, MGMT_SETTING_SIZE },
2708         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
2709         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
2710         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
2711         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
2712         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
2713         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2714         { disconnect,             false, MGMT_DISCONNECT_SIZE },
2715         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
2716         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
2717         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2718         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
2719         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
2720         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2721         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
2722         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
2723         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2724         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
2725         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2726         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2727         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2728         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2729         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
2730         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
2731         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
2732         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
2733         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
2734         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
2735 };
2736
2737
2738 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2739 {
2740         void *buf;
2741         u8 *cp;
2742         struct mgmt_hdr *hdr;
2743         u16 opcode, index, len;
2744         struct hci_dev *hdev = NULL;
2745         const struct mgmt_handler *handler;
2746         int err;
2747
2748         BT_DBG("got %zu bytes", msglen);
2749
2750         if (msglen < sizeof(*hdr))
2751                 return -EINVAL;
2752
2753         buf = kmalloc(msglen, GFP_KERNEL);
2754         if (!buf)
2755                 return -ENOMEM;
2756
2757         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2758                 err = -EFAULT;
2759                 goto done;
2760         }
2761
2762         hdr = buf;
2763         opcode = __le16_to_cpu(hdr->opcode);
2764         index = __le16_to_cpu(hdr->index);
2765         len = __le16_to_cpu(hdr->len);
2766
2767         if (len != msglen - sizeof(*hdr)) {
2768                 err = -EINVAL;
2769                 goto done;
2770         }
2771
2772         if (index != MGMT_INDEX_NONE) {
2773                 hdev = hci_dev_get(index);
2774                 if (!hdev) {
2775                         err = cmd_status(sk, index, opcode,
2776                                          MGMT_STATUS_INVALID_INDEX);
2777                         goto done;
2778                 }
2779         }
2780
2781         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2782             mgmt_handlers[opcode].func == NULL) {
2783                 BT_DBG("Unknown op %u", opcode);
2784                 err = cmd_status(sk, index, opcode,
2785                                  MGMT_STATUS_UNKNOWN_COMMAND);
2786                 goto done;
2787         }
2788
2789         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2790             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2791                 err = cmd_status(sk, index, opcode,
2792                                  MGMT_STATUS_INVALID_INDEX);
2793                 goto done;
2794         }
2795
2796         handler = &mgmt_handlers[opcode];
2797
2798         if ((handler->var_len && len < handler->data_len) ||
2799             (!handler->var_len && len != handler->data_len)) {
2800                 err = cmd_status(sk, index, opcode,
2801                                  MGMT_STATUS_INVALID_PARAMS);
2802                 goto done;
2803         }
2804
2805         if (hdev)
2806                 mgmt_init_hdev(sk, hdev);
2807
2808         cp = buf + sizeof(*hdr);
2809
2810         err = handler->func(sk, hdev, cp, len);
2811         if (err < 0)
2812                 goto done;
2813
2814         err = msglen;
2815
2816 done:
2817         if (hdev)
2818                 hci_dev_put(hdev);
2819
2820         kfree(buf);
2821         return err;
2822 }
2823
2824 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2825 {
2826         u8 *status = data;
2827
2828         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2829         mgmt_pending_remove(cmd);
2830 }
2831
2832 int mgmt_index_added(struct hci_dev *hdev)
2833 {
2834         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2835 }
2836
2837 int mgmt_index_removed(struct hci_dev *hdev)
2838 {
2839         u8 status = MGMT_STATUS_INVALID_INDEX;
2840
2841         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2842
2843         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2844 }
2845
2846 struct cmd_lookup {
2847         struct sock *sk;
2848         struct hci_dev *hdev;
2849         u8 mgmt_status;
2850 };
2851
2852 static void settings_rsp(struct pending_cmd *cmd, void *data)
2853 {
2854         struct cmd_lookup *match = data;
2855
2856         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2857
2858         list_del(&cmd->list);
2859
2860         if (match->sk == NULL) {
2861                 match->sk = cmd->sk;
2862                 sock_hold(match->sk);
2863         }
2864
2865         mgmt_pending_free(cmd);
2866 }
2867
2868 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2869 {
2870         struct cmd_lookup match = { NULL, hdev };
2871         int err;
2872
2873         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2874                 return 0;
2875
2876         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2877
2878         if (powered) {
2879                 u8 scan = 0;
2880
2881                 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2882                         scan |= SCAN_PAGE;
2883                 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2884                         scan |= SCAN_INQUIRY;
2885
2886                 if (scan)
2887                         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2888
2889                 update_class(hdev);
2890                 update_name(hdev, hdev->dev_name);
2891                 update_eir(hdev);
2892         } else {
2893                 u8 status = MGMT_STATUS_NOT_POWERED;
2894                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2895         }
2896
2897         err = new_settings(hdev, match.sk);
2898
2899         if (match.sk)
2900                 sock_put(match.sk);
2901
2902         return err;
2903 }
2904
2905 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2906 {
2907         struct cmd_lookup match = { NULL, hdev };
2908         bool changed = false;
2909         int err = 0;
2910
2911         if (discoverable) {
2912                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2913                         changed = true;
2914         } else {
2915                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2916                         changed = true;
2917         }
2918
2919         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
2920                              &match);
2921
2922         if (changed)
2923                 err = new_settings(hdev, match.sk);
2924
2925         if (match.sk)
2926                 sock_put(match.sk);
2927
2928         return err;
2929 }
2930
2931 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2932 {
2933         struct cmd_lookup match = { NULL, hdev };
2934         bool changed = false;
2935         int err = 0;
2936
2937         if (connectable) {
2938                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2939                         changed = true;
2940         } else {
2941                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2942                         changed = true;
2943         }
2944
2945         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
2946                              &match);
2947
2948         if (changed)
2949                 err = new_settings(hdev, match.sk);
2950
2951         if (match.sk)
2952                 sock_put(match.sk);
2953
2954         return err;
2955 }
2956
2957 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2958 {
2959         u8 mgmt_err = mgmt_status(status);
2960
2961         if (scan & SCAN_PAGE)
2962                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2963                                      cmd_status_rsp, &mgmt_err);
2964
2965         if (scan & SCAN_INQUIRY)
2966                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2967                                      cmd_status_rsp, &mgmt_err);
2968
2969         return 0;
2970 }
2971
2972 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
2973                       bool persistent)
2974 {
2975         struct mgmt_ev_new_link_key ev;
2976
2977         memset(&ev, 0, sizeof(ev));
2978
2979         ev.store_hint = persistent;
2980         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2981         ev.key.addr.type = BDADDR_BREDR;
2982         ev.key.type = key->type;
2983         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
2984         ev.key.pin_len = key->pin_len;
2985
2986         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2987 }
2988
2989 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
2990 {
2991         struct mgmt_ev_new_long_term_key ev;
2992
2993         memset(&ev, 0, sizeof(ev));
2994
2995         ev.store_hint = persistent;
2996         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2997         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
2998         ev.key.authenticated = key->authenticated;
2999         ev.key.enc_size = key->enc_size;
3000         ev.key.ediv = key->ediv;
3001
3002         if (key->type == HCI_SMP_LTK)
3003                 ev.key.master = 1;
3004
3005         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3006         memcpy(ev.key.val, key->val, sizeof(key->val));
3007
3008         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3009                           NULL);
3010 }
3011
3012 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3013                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3014                           u8 *dev_class)
3015 {
3016         char buf[512];
3017         struct mgmt_ev_device_connected *ev = (void *) buf;
3018         u16 eir_len = 0;
3019
3020         bacpy(&ev->addr.bdaddr, bdaddr);
3021         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3022
3023         ev->flags = __cpu_to_le32(flags);
3024
3025         if (name_len > 0)
3026                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3027                                           name, name_len);
3028
3029         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3030                 eir_len = eir_append_data(ev->eir, eir_len,
3031                                           EIR_CLASS_OF_DEV, dev_class, 3);
3032
3033         ev->eir_len = cpu_to_le16(eir_len);
3034
3035         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3036                           sizeof(*ev) + eir_len, NULL);
3037 }
3038
3039 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3040 {
3041         struct mgmt_cp_disconnect *cp = cmd->param;
3042         struct sock **sk = data;
3043         struct mgmt_rp_disconnect rp;
3044
3045         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3046         rp.addr.type = cp->addr.type;
3047
3048         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3049                      sizeof(rp));
3050
3051         *sk = cmd->sk;
3052         sock_hold(*sk);
3053
3054         mgmt_pending_remove(cmd);
3055 }
3056
3057 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3058 {
3059         struct hci_dev *hdev = data;
3060         struct mgmt_cp_unpair_device *cp = cmd->param;
3061         struct mgmt_rp_unpair_device rp;
3062
3063         memset(&rp, 0, sizeof(rp));
3064         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3065         rp.addr.type = cp->addr.type;
3066
3067         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3068
3069         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3070
3071         mgmt_pending_remove(cmd);
3072 }
3073
3074 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3075                              u8 link_type, u8 addr_type)
3076 {
3077         struct mgmt_addr_info ev;
3078         struct sock *sk = NULL;
3079         int err;
3080
3081         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3082
3083         bacpy(&ev.bdaddr, bdaddr);
3084         ev.type = link_to_bdaddr(link_type, addr_type);
3085
3086         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3087                          sk);
3088
3089         if (sk)
3090                 sock_put(sk);
3091
3092         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3093                              hdev);
3094
3095         return err;
3096 }
3097
3098 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3099                            u8 link_type, u8 addr_type, u8 status)
3100 {
3101         struct mgmt_rp_disconnect rp;
3102         struct pending_cmd *cmd;
3103         int err;
3104
3105         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3106         if (!cmd)
3107                 return -ENOENT;
3108
3109         bacpy(&rp.addr.bdaddr, bdaddr);
3110         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3111
3112         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3113                            mgmt_status(status), &rp, sizeof(rp));
3114
3115         mgmt_pending_remove(cmd);
3116
3117         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3118                              hdev);
3119         return err;
3120 }
3121
3122 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3123                         u8 addr_type, u8 status)
3124 {
3125         struct mgmt_ev_connect_failed ev;
3126
3127         bacpy(&ev.addr.bdaddr, bdaddr);
3128         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3129         ev.status = mgmt_status(status);
3130
3131         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3132 }
3133
3134 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3135 {
3136         struct mgmt_ev_pin_code_request ev;
3137
3138         bacpy(&ev.addr.bdaddr, bdaddr);
3139         ev.addr.type = BDADDR_BREDR;
3140         ev.secure = secure;
3141
3142         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3143                           NULL);
3144 }
3145
3146 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3147                                  u8 status)
3148 {
3149         struct pending_cmd *cmd;
3150         struct mgmt_rp_pin_code_reply rp;
3151         int err;
3152
3153         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3154         if (!cmd)
3155                 return -ENOENT;
3156
3157         bacpy(&rp.addr.bdaddr, bdaddr);
3158         rp.addr.type = BDADDR_BREDR;
3159
3160         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3161                            mgmt_status(status), &rp, sizeof(rp));
3162
3163         mgmt_pending_remove(cmd);
3164
3165         return err;
3166 }
3167
3168 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3169                                      u8 status)
3170 {
3171         struct pending_cmd *cmd;
3172         struct mgmt_rp_pin_code_reply rp;
3173         int err;
3174
3175         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3176         if (!cmd)
3177                 return -ENOENT;
3178
3179         bacpy(&rp.addr.bdaddr, bdaddr);
3180         rp.addr.type = BDADDR_BREDR;
3181
3182         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3183                            mgmt_status(status), &rp, sizeof(rp));
3184
3185         mgmt_pending_remove(cmd);
3186
3187         return err;
3188 }
3189
3190 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3191                               u8 link_type, u8 addr_type, __le32 value,
3192                               u8 confirm_hint)
3193 {
3194         struct mgmt_ev_user_confirm_request ev;
3195
3196         BT_DBG("%s", hdev->name);
3197
3198         bacpy(&ev.addr.bdaddr, bdaddr);
3199         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3200         ev.confirm_hint = confirm_hint;
3201         ev.value = value;
3202
3203         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3204                           NULL);
3205 }
3206
3207 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3208                               u8 link_type, u8 addr_type)
3209 {
3210         struct mgmt_ev_user_passkey_request ev;
3211
3212         BT_DBG("%s", hdev->name);
3213
3214         bacpy(&ev.addr.bdaddr, bdaddr);
3215         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3216
3217         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3218                           NULL);
3219 }
3220
3221 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3222                                       u8 link_type, u8 addr_type, u8 status,
3223                                       u8 opcode)
3224 {
3225         struct pending_cmd *cmd;
3226         struct mgmt_rp_user_confirm_reply rp;
3227         int err;
3228
3229         cmd = mgmt_pending_find(opcode, hdev);
3230         if (!cmd)
3231                 return -ENOENT;
3232
3233         bacpy(&rp.addr.bdaddr, bdaddr);
3234         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3235         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3236                            &rp, sizeof(rp));
3237
3238         mgmt_pending_remove(cmd);
3239
3240         return err;
3241 }
3242
3243 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3244                                      u8 link_type, u8 addr_type, u8 status)
3245 {
3246         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3247                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3248 }
3249
3250 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3251                                          u8 link_type, u8 addr_type, u8 status)
3252 {
3253         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3254                                           status,
3255                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3256 }
3257
3258 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3259                                      u8 link_type, u8 addr_type, u8 status)
3260 {
3261         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3262                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3263 }
3264
3265 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3266                                          u8 link_type, u8 addr_type, u8 status)
3267 {
3268         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3269                                           status,
3270                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3271 }
3272
3273 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3274                      u8 addr_type, u8 status)
3275 {
3276         struct mgmt_ev_auth_failed ev;
3277
3278         bacpy(&ev.addr.bdaddr, bdaddr);
3279         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3280         ev.status = mgmt_status(status);
3281
3282         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3283 }
3284
3285 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3286 {
3287         struct cmd_lookup match = { NULL, hdev };
3288         bool changed = false;
3289         int err = 0;
3290
3291         if (status) {
3292                 u8 mgmt_err = mgmt_status(status);
3293                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3294                                      cmd_status_rsp, &mgmt_err);
3295                 return 0;
3296         }
3297
3298         if (test_bit(HCI_AUTH, &hdev->flags)) {
3299                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3300                         changed = true;
3301         } else {
3302                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3303                         changed = true;
3304         }
3305
3306         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3307                              &match);
3308
3309         if (changed)
3310                 err = new_settings(hdev, match.sk);
3311
3312         if (match.sk)
3313                 sock_put(match.sk);
3314
3315         return err;
3316 }
3317
3318 static int clear_eir(struct hci_dev *hdev)
3319 {
3320         struct hci_cp_write_eir cp;
3321
3322         if (!(hdev->features[6] & LMP_EXT_INQ))
3323                 return 0;
3324
3325         memset(hdev->eir, 0, sizeof(hdev->eir));
3326
3327         memset(&cp, 0, sizeof(cp));
3328
3329         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3330 }
3331
3332 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3333 {
3334         struct cmd_lookup match = { NULL, hdev };
3335         bool changed = false;
3336         int err = 0;
3337
3338         if (status) {
3339                 u8 mgmt_err = mgmt_status(status);
3340
3341                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3342                                                  &hdev->dev_flags))
3343                         err = new_settings(hdev, NULL);
3344
3345                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3346                                      &mgmt_err);
3347
3348                 return err;
3349         }
3350
3351         if (enable) {
3352                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3353                         changed = true;
3354         } else {
3355                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3356                         changed = true;
3357         }
3358
3359         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3360
3361         if (changed)
3362                 err = new_settings(hdev, match.sk);
3363
3364         if (match.sk)
3365                 sock_put(match.sk);
3366
3367         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3368                 update_eir(hdev);
3369         else
3370                 clear_eir(hdev);
3371
3372         return err;
3373 }
3374
3375 static void class_rsp(struct pending_cmd *cmd, void *data)
3376 {
3377         struct cmd_lookup *match = data;
3378
3379         cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3380                      match->hdev->dev_class, 3);
3381
3382         list_del(&cmd->list);
3383
3384         if (match->sk == NULL) {
3385                 match->sk = cmd->sk;
3386                 sock_hold(match->sk);
3387         }
3388
3389         mgmt_pending_free(cmd);
3390 }
3391
3392 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3393                                    u8 status)
3394 {
3395         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3396         int err = 0;
3397
3398         clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3399
3400         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3401         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3402         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3403
3404         if (!status)
3405                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3406                                  3, NULL);
3407
3408         if (match.sk)
3409                 sock_put(match.sk);
3410
3411         return err;
3412 }
3413
3414 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3415 {
3416         struct pending_cmd *cmd;
3417         struct mgmt_cp_set_local_name ev;
3418         bool changed = false;
3419         int err = 0;
3420
3421         if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3422                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3423                 changed = true;
3424         }
3425
3426         memset(&ev, 0, sizeof(ev));
3427         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3428         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3429
3430         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3431         if (!cmd)
3432                 goto send_event;
3433
3434         /* Always assume that either the short or the complete name has
3435          * changed if there was a pending mgmt command */
3436         changed = true;
3437
3438         if (status) {
3439                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3440                                  mgmt_status(status));
3441                 goto failed;
3442         }
3443
3444         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3445                            sizeof(ev));
3446         if (err < 0)
3447                 goto failed;
3448
3449 send_event:
3450         if (changed)
3451                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3452                                  sizeof(ev), cmd ? cmd->sk : NULL);
3453
3454         update_eir(hdev);
3455
3456 failed:
3457         if (cmd)
3458                 mgmt_pending_remove(cmd);
3459         return err;
3460 }
3461
3462 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3463                                             u8 *randomizer, u8 status)
3464 {
3465         struct pending_cmd *cmd;
3466         int err;
3467
3468         BT_DBG("%s status %u", hdev->name, status);
3469
3470         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3471         if (!cmd)
3472                 return -ENOENT;
3473
3474         if (status) {
3475                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3476                                  mgmt_status(status));
3477         } else {
3478                 struct mgmt_rp_read_local_oob_data rp;
3479
3480                 memcpy(rp.hash, hash, sizeof(rp.hash));
3481                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3482
3483                 err = cmd_complete(cmd->sk, hdev->id,
3484                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3485                                    sizeof(rp));
3486         }
3487
3488         mgmt_pending_remove(cmd);
3489
3490         return err;
3491 }
3492
3493 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3494 {
3495         struct cmd_lookup match = { NULL, hdev };
3496         bool changed = false;
3497         int err = 0;
3498
3499         if (status) {
3500                 u8 mgmt_err = mgmt_status(status);
3501
3502                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3503                                                  &hdev->dev_flags))
3504                         err = new_settings(hdev, NULL);
3505
3506                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3507                                      &mgmt_err);
3508
3509                 return err;
3510         }
3511
3512         if (enable) {
3513                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3514                         changed = true;
3515         } else {
3516                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3517                         changed = true;
3518         }
3519
3520         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3521
3522         if (changed)
3523                 err = new_settings(hdev, match.sk);
3524
3525         if (match.sk)
3526                 sock_put(match.sk);
3527
3528         return err;
3529 }
3530
3531 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3532                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3533                       ssp, u8 *eir, u16 eir_len)
3534 {
3535         char buf[512];
3536         struct mgmt_ev_device_found *ev = (void *) buf;
3537         size_t ev_size;
3538
3539         /* Leave 5 bytes for a potential CoD field */
3540         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3541                 return -EINVAL;
3542
3543         memset(buf, 0, sizeof(buf));
3544
3545         bacpy(&ev->addr.bdaddr, bdaddr);
3546         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3547         ev->rssi = rssi;
3548         if (cfm_name)
3549                 ev->flags[0] |= MGMT_DEV_FOUND_CONFIRM_NAME;
3550         if (!ssp)
3551                 ev->flags[0] |= MGMT_DEV_FOUND_LEGACY_PAIRING;
3552
3553         if (eir_len > 0)
3554                 memcpy(ev->eir, eir, eir_len);
3555
3556         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3557                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3558                                           dev_class, 3);
3559
3560         ev->eir_len = cpu_to_le16(eir_len);
3561
3562         ev_size = sizeof(*ev) + eir_len;
3563
3564         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3565 }
3566
3567 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3568                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3569 {
3570         struct mgmt_ev_device_found *ev;
3571         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3572         u16 eir_len;
3573
3574         ev = (struct mgmt_ev_device_found *) buf;
3575
3576         memset(buf, 0, sizeof(buf));
3577
3578         bacpy(&ev->addr.bdaddr, bdaddr);
3579         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3580         ev->rssi = rssi;
3581
3582         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3583                                   name_len);
3584
3585         ev->eir_len = cpu_to_le16(eir_len);
3586
3587         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3588                           sizeof(*ev) + eir_len, NULL);
3589 }
3590
3591 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3592 {
3593         struct pending_cmd *cmd;
3594         u8 type;
3595         int err;
3596
3597         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3598
3599         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3600         if (!cmd)
3601                 return -ENOENT;
3602
3603         type = hdev->discovery.type;
3604
3605         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3606                            &type, sizeof(type));
3607         mgmt_pending_remove(cmd);
3608
3609         return err;
3610 }
3611
3612 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3613 {
3614         struct pending_cmd *cmd;
3615         int err;
3616
3617         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3618         if (!cmd)
3619                 return -ENOENT;
3620
3621         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3622                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3623         mgmt_pending_remove(cmd);
3624
3625         return err;
3626 }
3627
3628 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3629 {
3630         struct mgmt_ev_discovering ev;
3631         struct pending_cmd *cmd;
3632
3633         BT_DBG("%s discovering %u", hdev->name, discovering);
3634
3635         if (discovering)
3636                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3637         else
3638                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3639
3640         if (cmd != NULL) {
3641                 u8 type = hdev->discovery.type;
3642
3643                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3644                              sizeof(type));
3645                 mgmt_pending_remove(cmd);
3646         }
3647
3648         memset(&ev, 0, sizeof(ev));
3649         ev.type = hdev->discovery.type;
3650         ev.discovering = discovering;
3651
3652         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3653 }
3654
3655 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3656 {
3657         struct pending_cmd *cmd;
3658         struct mgmt_ev_device_blocked ev;
3659
3660         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3661
3662         bacpy(&ev.addr.bdaddr, bdaddr);
3663         ev.addr.type = type;
3664
3665         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3666                           cmd ? cmd->sk : NULL);
3667 }
3668
3669 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3670 {
3671         struct pending_cmd *cmd;
3672         struct mgmt_ev_device_unblocked ev;
3673
3674         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3675
3676         bacpy(&ev.addr.bdaddr, bdaddr);
3677         ev.addr.type = type;
3678
3679         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3680                           cmd ? cmd->sk : NULL);
3681 }
3682
3683 module_param(enable_hs, bool, 0644);
3684 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");