net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   3
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 /*
 106  * These LE scan and inquiry parameters were chosen according to LE General
 107  * Discovery Procedure specification.
 108  */
 109 #define LE_SCAN_WIN                     0x12
 110 #define LE_SCAN_INT                     0x12
 111 #define LE_SCAN_TIMEOUT_LE_ONLY         msecs_to_jiffies(10240)
 112 #define LE_SCAN_TIMEOUT_BREDR_LE        msecs_to_jiffies(5120)
 113
 114 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 115 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 116
 117 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 118
 119 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 120                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 121
 122 struct pending_cmd {
 123         struct list_head list;
 124         u16 opcode;
 125         int index;
 126         void *param;
 127         struct sock *sk;
 128         void *user_data;
 129 };
 130
 131 /* HCI to MGMT error code conversion table */
 132 static u8 mgmt_status_table[] = {
 133         MGMT_STATUS_SUCCESS,
 134         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 135         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 136         MGMT_STATUS_FAILED,             /* Hardware Failure */
 137         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 138         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 139         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 140         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 141         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 142         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 144         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 145         MGMT_STATUS_BUSY,               /* Command Disallowed */
 146         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 147         MGMT_STATUS_REJECTED,           /* Rejected Security */
 148         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 149         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 150         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 151         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 152         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 153         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 154         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 155         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 156         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 157         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 158         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 159         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 160         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 161         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 162         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 163         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 164         MGMT_STATUS_FAILED,             /* Unspecified Error */
 165         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 166         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 167         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 168         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 169         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 170         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 171         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 172         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 173         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 175         MGMT_STATUS_FAILED,             /* Transaction Collision */
 176         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 177         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 178         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 179         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 180         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 181         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 182         MGMT_STATUS_FAILED,             /* Slot Violation */
 183         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 184         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 185         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 186         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 187         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 188         MGMT_STATUS_BUSY,               /* Controller Busy */
 189         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 190         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 191         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 192         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 193         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 194 };
 195
 196 bool mgmt_valid_hdev(struct hci_dev *hdev)
 197 {
 198         return hdev->dev_type == HCI_BREDR;
 199 }
 200
 201 static u8 mgmt_status(u8 hci_status)
 202 {
 203         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 204                 return mgmt_status_table[hci_status];
 205
 206         return MGMT_STATUS_FAILED;
 207 }
 208
 209 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 210 {
 211         struct sk_buff *skb;
 212         struct mgmt_hdr *hdr;
 213         struct mgmt_ev_cmd_status *ev;
 214         int err;
 215
 216         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 217
 218         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 219         if (!skb)
 220                 return -ENOMEM;
 221
 222         hdr = (void *) skb_put(skb, sizeof(*hdr));
 223
 224         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 225         hdr->index = cpu_to_le16(index);
 226         hdr->len = cpu_to_le16(sizeof(*ev));
 227
 228         ev = (void *) skb_put(skb, sizeof(*ev));
 229         ev->status = status;
 230         ev->opcode = cpu_to_le16(cmd);
 231
 232         err = sock_queue_rcv_skb(sk, skb);
 233         if (err < 0)
 234                 kfree_skb(skb);
 235
 236         return err;
 237 }
 238
 239 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 240                         void *rp, size_t rp_len)
 241 {
 242         struct sk_buff *skb;
 243         struct mgmt_hdr *hdr;
 244         struct mgmt_ev_cmd_complete *ev;
 245         int err;
 246
 247         BT_DBG("sock %p", sk);
 248
 249         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 250         if (!skb)
 251                 return -ENOMEM;
 252
 253         hdr = (void *) skb_put(skb, sizeof(*hdr));
 254
 255         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 256         hdr->index = cpu_to_le16(index);
 257         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 258
 259         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 260         ev->opcode = cpu_to_le16(cmd);
 261         ev->status = status;
 262
 263         if (rp)
 264                 memcpy(ev->data, rp, rp_len);
 265
 266         err = sock_queue_rcv_skb(sk, skb);
 267         if (err < 0)
 268                 kfree_skb(skb);
 269
 270         return err;
 271 }
 272
 273 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 274                         u16 data_len)
 275 {
 276         struct mgmt_rp_read_version rp;
 277
 278         BT_DBG("sock %p", sk);
 279
 280         rp.version = MGMT_VERSION;
 281         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 282
 283         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 284                             sizeof(rp));
 285 }
 286
 287 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 288                          u16 data_len)
 289 {
 290         struct mgmt_rp_read_commands *rp;
 291         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 292         const u16 num_events = ARRAY_SIZE(mgmt_events);
 293         __le16 *opcode;
 294         size_t rp_size;
 295         int i, err;
 296
 297         BT_DBG("sock %p", sk);
 298
 299         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 300
 301         rp = kmalloc(rp_size, GFP_KERNEL);
 302         if (!rp)
 303                 return -ENOMEM;
 304
 305         rp->num_commands = __constant_cpu_to_le16(num_commands);
 306         rp->num_events = __constant_cpu_to_le16(num_events);
 307
 308         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 309                 put_unaligned_le16(mgmt_commands[i], opcode);
 310
 311         for (i = 0; i < num_events; i++, opcode++)
 312                 put_unaligned_le16(mgmt_events[i], opcode);
 313
 314         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 315                            rp_size);
 316         kfree(rp);
 317
 318         return err;
 319 }
 320
 321 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 322                            u16 data_len)
 323 {
 324         struct mgmt_rp_read_index_list *rp;
 325         struct hci_dev *d;
 326         size_t rp_len;
 327         u16 count;
 328         int err;
 329
 330         BT_DBG("sock %p", sk);
 331
 332         read_lock(&hci_dev_list_lock);
 333
 334         count = 0;
 335         list_for_each_entry(d, &hci_dev_list, list) {
 336                 if (!mgmt_valid_hdev(d))
 337                         continue;
 338
 339                 count++;
 340         }
 341
 342         rp_len = sizeof(*rp) + (2 * count);
 343         rp = kmalloc(rp_len, GFP_ATOMIC);
 344         if (!rp) {
 345                 read_unlock(&hci_dev_list_lock);
 346                 return -ENOMEM;
 347         }
 348
 349         count = 0;
 350         list_for_each_entry(d, &hci_dev_list, list) {
 351                 if (test_bit(HCI_SETUP, &d->dev_flags))
 352                         continue;
 353
 354                 if (!mgmt_valid_hdev(d))
 355                         continue;
 356
 357                 rp->index[count++] = cpu_to_le16(d->id);
 358                 BT_DBG("Added hci%u", d->id);
 359         }
 360
 361         rp->num_controllers = cpu_to_le16(count);
 362         rp_len = sizeof(*rp) + (2 * count);
 363
 364         read_unlock(&hci_dev_list_lock);
 365
 366         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 367                            rp_len);
 368
 369         kfree(rp);
 370
 371         return err;
 372 }
 373
 374 static u32 get_supported_settings(struct hci_dev *hdev)
 375 {
 376         u32 settings = 0;
 377
 378         settings |= MGMT_SETTING_POWERED;
 379         settings |= MGMT_SETTING_PAIRABLE;
 380
 381         if (lmp_ssp_capable(hdev))
 382                 settings |= MGMT_SETTING_SSP;
 383
 384         if (lmp_bredr_capable(hdev)) {
 385                 settings |= MGMT_SETTING_CONNECTABLE;
 386                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 387                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 388                 settings |= MGMT_SETTING_DISCOVERABLE;
 389                 settings |= MGMT_SETTING_BREDR;
 390                 settings |= MGMT_SETTING_LINK_SECURITY;
 391         }
 392
 393         if (enable_hs)
 394                 settings |= MGMT_SETTING_HS;
 395
 396         if (lmp_le_capable(hdev))
 397                 settings |= MGMT_SETTING_LE;
 398
 399         return settings;
 400 }
 401
 402 static u32 get_current_settings(struct hci_dev *hdev)
 403 {
 404         u32 settings = 0;
 405
 406         if (hdev_is_powered(hdev))
 407                 settings |= MGMT_SETTING_POWERED;
 408
 409         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 410                 settings |= MGMT_SETTING_CONNECTABLE;
 411
 412         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 413                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 414
 415         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 416                 settings |= MGMT_SETTING_DISCOVERABLE;
 417
 418         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 419                 settings |= MGMT_SETTING_PAIRABLE;
 420
 421         if (lmp_bredr_capable(hdev))
 422                 settings |= MGMT_SETTING_BREDR;
 423
 424         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 425                 settings |= MGMT_SETTING_LE;
 426
 427         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 428                 settings |= MGMT_SETTING_LINK_SECURITY;
 429
 430         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 431                 settings |= MGMT_SETTING_SSP;
 432
 433         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 434                 settings |= MGMT_SETTING_HS;
 435
 436         return settings;
 437 }
 438
 439 #define PNP_INFO_SVCLASS_ID             0x1200
 440
 441 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 442 {
 443         u8 *ptr = data, *uuids_start = NULL;
 444         struct bt_uuid *uuid;
 445
 446         if (len < 4)
 447                 return ptr;
 448
 449         list_for_each_entry(uuid, &hdev->uuids, list) {
 450                 u16 uuid16;
 451
 452                 if (uuid->size != 16)
 453                         continue;
 454
 455                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 456                 if (uuid16 < 0x1100)
 457                         continue;
 458
 459                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 460                         continue;
 461
 462                 if (!uuids_start) {
 463                         uuids_start = ptr;
 464                         uuids_start[0] = 1;
 465                         uuids_start[1] = EIR_UUID16_ALL;
 466                         ptr += 2;
 467                 }
 468
 469                 /* Stop if not enough space to put next UUID */
 470                 if ((ptr - data) + sizeof(u16) > len) {
 471                         uuids_start[1] = EIR_UUID16_SOME;
 472                         break;
 473                 }
 474
 475                 *ptr++ = (uuid16 & 0x00ff);
 476                 *ptr++ = (uuid16 & 0xff00) >> 8;
 477                 uuids_start[0] += sizeof(uuid16);
 478         }
 479
 480         return ptr;
 481 }
 482
 483 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 484 {
 485         u8 *ptr = data, *uuids_start = NULL;
 486         struct bt_uuid *uuid;
 487
 488         if (len < 6)
 489                 return ptr;
 490
 491         list_for_each_entry(uuid, &hdev->uuids, list) {
 492                 if (uuid->size != 32)
 493                         continue;
 494
 495                 if (!uuids_start) {
 496                         uuids_start = ptr;
 497                         uuids_start[0] = 1;
 498                         uuids_start[1] = EIR_UUID32_ALL;
 499                         ptr += 2;
 500                 }
 501
 502                 /* Stop if not enough space to put next UUID */
 503                 if ((ptr - data) + sizeof(u32) > len) {
 504                         uuids_start[1] = EIR_UUID32_SOME;
 505                         break;
 506                 }
 507
 508                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 509                 ptr += sizeof(u32);
 510                 uuids_start[0] += sizeof(u32);
 511         }
 512
 513         return ptr;
 514 }
 515
 516 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 517 {
 518         u8 *ptr = data, *uuids_start = NULL;
 519         struct bt_uuid *uuid;
 520
 521         if (len < 18)
 522                 return ptr;
 523
 524         list_for_each_entry(uuid, &hdev->uuids, list) {
 525                 if (uuid->size != 128)
 526                         continue;
 527
 528                 if (!uuids_start) {
 529                         uuids_start = ptr;
 530                         uuids_start[0] = 1;
 531                         uuids_start[1] = EIR_UUID128_ALL;
 532                         ptr += 2;
 533                 }
 534
 535                 /* Stop if not enough space to put next UUID */
 536                 if ((ptr - data) + 16 > len) {
 537                         uuids_start[1] = EIR_UUID128_SOME;
 538                         break;
 539                 }
 540
 541                 memcpy(ptr, uuid->uuid, 16);
 542                 ptr += 16;
 543                 uuids_start[0] += 16;
 544         }
 545
 546         return ptr;
 547 }
 548
 549 static void create_eir(struct hci_dev *hdev, u8 *data)
 550 {
 551         u8 *ptr = data;
 552         size_t name_len;
 553
 554         name_len = strlen(hdev->dev_name);
 555
 556         if (name_len > 0) {
 557                 /* EIR Data type */
 558                 if (name_len > 48) {
 559                         name_len = 48;
 560                         ptr[1] = EIR_NAME_SHORT;
 561                 } else
 562                         ptr[1] = EIR_NAME_COMPLETE;
 563
 564                 /* EIR Data length */
 565                 ptr[0] = name_len + 1;
 566
 567                 memcpy(ptr + 2, hdev->dev_name, name_len);
 568
 569                 ptr += (name_len + 2);
 570         }
 571
 572         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 573                 ptr[0] = 2;
 574                 ptr[1] = EIR_TX_POWER;
 575                 ptr[2] = (u8) hdev->inq_tx_power;
 576
 577                 ptr += 3;
 578         }
 579
 580         if (hdev->devid_source > 0) {
 581                 ptr[0] = 9;
 582                 ptr[1] = EIR_DEVICE_ID;
 583
 584                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 585                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 586                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 587                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 588
 589                 ptr += 10;
 590         }
 591
 592         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 593         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 594         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 595 }
 596
 597 static void update_eir(struct hci_request *req)
 598 {
 599         struct hci_dev *hdev = req->hdev;
 600         struct hci_cp_write_eir cp;
 601
 602         if (!hdev_is_powered(hdev))
 603                 return;
 604
 605         if (!lmp_ext_inq_capable(hdev))
 606                 return;
 607
 608         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 609                 return;
 610
 611         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 612                 return;
 613
 614         memset(&cp, 0, sizeof(cp));
 615
 616         create_eir(hdev, cp.data);
 617
 618         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 619                 return;
 620
 621         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 622
 623         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 624 }
 625
 626 static u8 get_service_classes(struct hci_dev *hdev)
 627 {
 628         struct bt_uuid *uuid;
 629         u8 val = 0;
 630
 631         list_for_each_entry(uuid, &hdev->uuids, list)
 632                 val |= uuid->svc_hint;
 633
 634         return val;
 635 }
 636
 637 static void update_class(struct hci_request *req)
 638 {
 639         struct hci_dev *hdev = req->hdev;
 640         u8 cod[3];
 641
 642         BT_DBG("%s", hdev->name);
 643
 644         if (!hdev_is_powered(hdev))
 645                 return;
 646
 647         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 648                 return;
 649
 650         cod[0] = hdev->minor_class;
 651         cod[1] = hdev->major_class;
 652         cod[2] = get_service_classes(hdev);
 653
 654         if (memcmp(cod, hdev->dev_class, 3) == 0)
 655                 return;
 656
 657         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 658 }
 659
 660 static void service_cache_off(struct work_struct *work)
 661 {
 662         struct hci_dev *hdev = container_of(work, struct hci_dev,
 663                                             service_cache.work);
 664         struct hci_request req;
 665
 666         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 667                 return;
 668
 669         hci_req_init(&req, hdev);
 670
 671         hci_dev_lock(hdev);
 672
 673         update_eir(&req);
 674         update_class(&req);
 675
 676         hci_dev_unlock(hdev);
 677
 678         hci_req_run(&req, NULL);
 679 }
 680
 681 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 682 {
 683         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 684                 return;
 685
 686         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 687
 688         /* Non-mgmt controlled devices get this bit set
 689          * implicitly so that pairing works for them, however
 690          * for mgmt we require user-space to explicitly enable
 691          * it
 692          */
 693         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 694 }
 695
 696 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 697                                 void *data, u16 data_len)
 698 {
 699         struct mgmt_rp_read_info rp;
 700
 701         BT_DBG("sock %p %s", sk, hdev->name);
 702
 703         hci_dev_lock(hdev);
 704
 705         memset(&rp, 0, sizeof(rp));
 706
 707         bacpy(&rp.bdaddr, &hdev->bdaddr);
 708
 709         rp.version = hdev->hci_ver;
 710         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 711
 712         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 713         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 714
 715         memcpy(rp.dev_class, hdev->dev_class, 3);
 716
 717         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 718         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 719
 720         hci_dev_unlock(hdev);
 721
 722         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 723                             sizeof(rp));
 724 }
 725
 726 static void mgmt_pending_free(struct pending_cmd *cmd)
 727 {
 728         sock_put(cmd->sk);
 729         kfree(cmd->param);
 730         kfree(cmd);
 731 }
 732
 733 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 734                                             struct hci_dev *hdev, void *data,
 735                                             u16 len)
 736 {
 737         struct pending_cmd *cmd;
 738
 739         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 740         if (!cmd)
 741                 return NULL;
 742
 743         cmd->opcode = opcode;
 744         cmd->index = hdev->id;
 745
 746         cmd->param = kmalloc(len, GFP_KERNEL);
 747         if (!cmd->param) {
 748                 kfree(cmd);
 749                 return NULL;
 750         }
 751
 752         if (data)
 753                 memcpy(cmd->param, data, len);
 754
 755         cmd->sk = sk;
 756         sock_hold(sk);
 757
 758         list_add(&cmd->list, &hdev->mgmt_pending);
 759
 760         return cmd;
 761 }
 762
 763 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 764                                  void (*cb)(struct pending_cmd *cmd,
 765                                             void *data),
 766                                  void *data)
 767 {
 768         struct pending_cmd *cmd, *tmp;
 769
 770         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 771                 if (opcode > 0 && cmd->opcode != opcode)
 772                         continue;
 773
 774                 cb(cmd, data);
 775         }
 776 }
 777
 778 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 779 {
 780         struct pending_cmd *cmd;
 781
 782         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 783                 if (cmd->opcode == opcode)
 784                         return cmd;
 785         }
 786
 787         return NULL;
 788 }
 789
 790 static void mgmt_pending_remove(struct pending_cmd *cmd)
 791 {
 792         list_del(&cmd->list);
 793         mgmt_pending_free(cmd);
 794 }
 795
 796 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 797 {
 798         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 799
 800         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 801                             sizeof(settings));
 802 }
 803
 804 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 805                        u16 len)
 806 {
 807         struct mgmt_mode *cp = data;
 808         struct pending_cmd *cmd;
 809         int err;
 810
 811         BT_DBG("request for %s", hdev->name);
 812
 813         if (cp->val != 0x00 && cp->val != 0x01)
 814                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 815                                   MGMT_STATUS_INVALID_PARAMS);
 816
 817         hci_dev_lock(hdev);
 818
 819         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 820                 cancel_delayed_work(&hdev->power_off);
 821
 822                 if (cp->val) {
 823                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 824                                          data, len);
 825                         err = mgmt_powered(hdev, 1);
 826                         goto failed;
 827                 }
 828         }
 829
 830         if (!!cp->val == hdev_is_powered(hdev)) {
 831                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 832                 goto failed;
 833         }
 834
 835         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 836                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 837                                  MGMT_STATUS_BUSY);
 838                 goto failed;
 839         }
 840
 841         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 842         if (!cmd) {
 843                 err = -ENOMEM;
 844                 goto failed;
 845         }
 846
 847         if (cp->val)
 848                 queue_work(hdev->req_workqueue, &hdev->power_on);
 849         else
 850                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 851
 852         err = 0;
 853
 854 failed:
 855         hci_dev_unlock(hdev);
 856         return err;
 857 }
 858
 859 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 860                       struct sock *skip_sk)
 861 {
 862         struct sk_buff *skb;
 863         struct mgmt_hdr *hdr;
 864
 865         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 866         if (!skb)
 867                 return -ENOMEM;
 868
 869         hdr = (void *) skb_put(skb, sizeof(*hdr));
 870         hdr->opcode = cpu_to_le16(event);
 871         if (hdev)
 872                 hdr->index = cpu_to_le16(hdev->id);
 873         else
 874                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 875         hdr->len = cpu_to_le16(data_len);
 876
 877         if (data)
 878                 memcpy(skb_put(skb, data_len), data, data_len);
 879
 880         /* Time stamp */
 881         __net_timestamp(skb);
 882
 883         hci_send_to_control(skb, skip_sk);
 884         kfree_skb(skb);
 885
 886         return 0;
 887 }
 888
 889 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 890 {
 891         __le32 ev;
 892
 893         ev = cpu_to_le32(get_current_settings(hdev));
 894
 895         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 896 }
 897
 898 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 899                             u16 len)
 900 {
 901         struct mgmt_cp_set_discoverable *cp = data;
 902         struct pending_cmd *cmd;
 903         u16 timeout;
 904         u8 scan;
 905         int err;
 906
 907         BT_DBG("request for %s", hdev->name);
 908
 909         if (!lmp_bredr_capable(hdev))
 910                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 911                                  MGMT_STATUS_NOT_SUPPORTED);
 912
 913         if (cp->val != 0x00 && cp->val != 0x01)
 914                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 915                                   MGMT_STATUS_INVALID_PARAMS);
 916
 917         timeout = __le16_to_cpu(cp->timeout);
 918         if (!cp->val && timeout > 0)
 919                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 920                                   MGMT_STATUS_INVALID_PARAMS);
 921
 922         hci_dev_lock(hdev);
 923
 924         if (!hdev_is_powered(hdev) && timeout > 0) {
 925                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 926                                  MGMT_STATUS_NOT_POWERED);
 927                 goto failed;
 928         }
 929
 930         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 931             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 932                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 933                                  MGMT_STATUS_BUSY);
 934                 goto failed;
 935         }
 936
 937         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 938                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 939                                  MGMT_STATUS_REJECTED);
 940                 goto failed;
 941         }
 942
 943         if (!hdev_is_powered(hdev)) {
 944                 bool changed = false;
 945
 946                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 947                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 948                         changed = true;
 949                 }
 950
 951                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 952                 if (err < 0)
 953                         goto failed;
 954
 955                 if (changed)
 956                         err = new_settings(hdev, sk);
 957
 958                 goto failed;
 959         }
 960
 961         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 962                 if (hdev->discov_timeout > 0) {
 963                         cancel_delayed_work(&hdev->discov_off);
 964                         hdev->discov_timeout = 0;
 965                 }
 966
 967                 if (cp->val && timeout > 0) {
 968                         hdev->discov_timeout = timeout;
 969                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 970                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 971                 }
 972
 973                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 974                 goto failed;
 975         }
 976
 977         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 978         if (!cmd) {
 979                 err = -ENOMEM;
 980                 goto failed;
 981         }
 982
 983         scan = SCAN_PAGE;
 984
 985         if (cp->val)
 986                 scan |= SCAN_INQUIRY;
 987         else
 988                 cancel_delayed_work(&hdev->discov_off);
 989
 990         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 991         if (err < 0)
 992                 mgmt_pending_remove(cmd);
 993
 994         if (cp->val)
 995                 hdev->discov_timeout = timeout;
 996
 997 failed:
 998         hci_dev_unlock(hdev);
 999         return err;
1000 }
1001
1002 static void write_fast_connectable(struct hci_request *req, bool enable)
1003 {
1004         struct hci_dev *hdev = req->hdev;
1005         struct hci_cp_write_page_scan_activity acp;
1006         u8 type;
1007
1008         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1009                 return;
1010
1011         if (enable) {
1012                 type = PAGE_SCAN_TYPE_INTERLACED;
1013
1014                 /* 160 msec page scan interval */
1015                 acp.interval = __constant_cpu_to_le16(0x0100);
1016         } else {
1017                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1018
1019                 /* default 1.28 sec page scan */
1020                 acp.interval = __constant_cpu_to_le16(0x0800);
1021         }
1022
1023         acp.window = __constant_cpu_to_le16(0x0012);
1024
1025         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1026             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1027                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1028                             sizeof(acp), &acp);
1029
1030         if (hdev->page_scan_type != type)
1031                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1032 }
1033
1034 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1035 {
1036         struct pending_cmd *cmd;
1037
1038         BT_DBG("status 0x%02x", status);
1039
1040         hci_dev_lock(hdev);
1041
1042         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1043         if (!cmd)
1044                 goto unlock;
1045
1046         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1047
1048         mgmt_pending_remove(cmd);
1049
1050 unlock:
1051         hci_dev_unlock(hdev);
1052 }
1053
1054 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1055                            u16 len)
1056 {
1057         struct mgmt_mode *cp = data;
1058         struct pending_cmd *cmd;
1059         struct hci_request req;
1060         u8 scan;
1061         int err;
1062
1063         BT_DBG("request for %s", hdev->name);
1064
1065         if (!lmp_bredr_capable(hdev))
1066                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1067                                   MGMT_STATUS_NOT_SUPPORTED);
1068
1069         if (cp->val != 0x00 && cp->val != 0x01)
1070                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1071                                   MGMT_STATUS_INVALID_PARAMS);
1072
1073         hci_dev_lock(hdev);
1074
1075         if (!hdev_is_powered(hdev)) {
1076                 bool changed = false;
1077
1078                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1079                         changed = true;
1080
1081                 if (cp->val) {
1082                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1083                 } else {
1084                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1085                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1086                 }
1087
1088                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1089                 if (err < 0)
1090                         goto failed;
1091
1092                 if (changed)
1093                         err = new_settings(hdev, sk);
1094
1095                 goto failed;
1096         }
1097
1098         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1099             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1100                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1101                                  MGMT_STATUS_BUSY);
1102                 goto failed;
1103         }
1104
1105         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1106                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1107                 goto failed;
1108         }
1109
1110         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1111         if (!cmd) {
1112                 err = -ENOMEM;
1113                 goto failed;
1114         }
1115
1116         if (cp->val) {
1117                 scan = SCAN_PAGE;
1118         } else {
1119                 scan = 0;
1120
1121                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1122                     hdev->discov_timeout > 0)
1123                         cancel_delayed_work(&hdev->discov_off);
1124         }
1125
1126         hci_req_init(&req, hdev);
1127
1128         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1129
1130         /* If we're going from non-connectable to connectable or
1131          * vice-versa when fast connectable is enabled ensure that fast
1132          * connectable gets disabled. write_fast_connectable won't do
1133          * anything if the page scan parameters are already what they
1134          * should be.
1135          */
1136         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1137                 write_fast_connectable(&req, false);
1138
1139         err = hci_req_run(&req, set_connectable_complete);
1140         if (err < 0)
1141                 mgmt_pending_remove(cmd);
1142
1143 failed:
1144         hci_dev_unlock(hdev);
1145         return err;
1146 }
1147
1148 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1149                         u16 len)
1150 {
1151         struct mgmt_mode *cp = data;
1152         int err;
1153
1154         BT_DBG("request for %s", hdev->name);
1155
1156         if (cp->val != 0x00 && cp->val != 0x01)
1157                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1158                                   MGMT_STATUS_INVALID_PARAMS);
1159
1160         hci_dev_lock(hdev);
1161
1162         if (cp->val)
1163                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1164         else
1165                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1166
1167         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1168         if (err < 0)
1169                 goto failed;
1170
1171         err = new_settings(hdev, sk);
1172
1173 failed:
1174         hci_dev_unlock(hdev);
1175         return err;
1176 }
1177
1178 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1179                              u16 len)
1180 {
1181         struct mgmt_mode *cp = data;
1182         struct pending_cmd *cmd;
1183         u8 val;
1184         int err;
1185
1186         BT_DBG("request for %s", hdev->name);
1187
1188         if (!lmp_bredr_capable(hdev))
1189                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1190                                   MGMT_STATUS_NOT_SUPPORTED);
1191
1192         if (cp->val != 0x00 && cp->val != 0x01)
1193                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1194                                   MGMT_STATUS_INVALID_PARAMS);
1195
1196         hci_dev_lock(hdev);
1197
1198         if (!hdev_is_powered(hdev)) {
1199                 bool changed = false;
1200
1201                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1202                                           &hdev->dev_flags)) {
1203                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1204                         changed = true;
1205                 }
1206
1207                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1208                 if (err < 0)
1209                         goto failed;
1210
1211                 if (changed)
1212                         err = new_settings(hdev, sk);
1213
1214                 goto failed;
1215         }
1216
1217         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1218                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1219                                  MGMT_STATUS_BUSY);
1220                 goto failed;
1221         }
1222
1223         val = !!cp->val;
1224
1225         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1226                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1227                 goto failed;
1228         }
1229
1230         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1231         if (!cmd) {
1232                 err = -ENOMEM;
1233                 goto failed;
1234         }
1235
1236         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1237         if (err < 0) {
1238                 mgmt_pending_remove(cmd);
1239                 goto failed;
1240         }
1241
1242 failed:
1243         hci_dev_unlock(hdev);
1244         return err;
1245 }
1246
1247 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1248 {
1249         struct mgmt_mode *cp = data;
1250         struct pending_cmd *cmd;
1251         u8 val;
1252         int err;
1253
1254         BT_DBG("request for %s", hdev->name);
1255
1256         if (!lmp_ssp_capable(hdev))
1257                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1258                                   MGMT_STATUS_NOT_SUPPORTED);
1259
1260         if (cp->val != 0x00 && cp->val != 0x01)
1261                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1262                                   MGMT_STATUS_INVALID_PARAMS);
1263
1264         hci_dev_lock(hdev);
1265
1266         val = !!cp->val;
1267
1268         if (!hdev_is_powered(hdev)) {
1269                 bool changed = false;
1270
1271                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1272                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1273                         changed = true;
1274                 }
1275
1276                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1277                 if (err < 0)
1278                         goto failed;
1279
1280                 if (changed)
1281                         err = new_settings(hdev, sk);
1282
1283                 goto failed;
1284         }
1285
1286         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1287                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1288                                  MGMT_STATUS_BUSY);
1289                 goto failed;
1290         }
1291
1292         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1293                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1294                 goto failed;
1295         }
1296
1297         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1298         if (!cmd) {
1299                 err = -ENOMEM;
1300                 goto failed;
1301         }
1302
1303         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1304         if (err < 0) {
1305                 mgmt_pending_remove(cmd);
1306                 goto failed;
1307         }
1308
1309 failed:
1310         hci_dev_unlock(hdev);
1311         return err;
1312 }
1313
1314 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1315 {
1316         struct mgmt_mode *cp = data;
1317
1318         BT_DBG("request for %s", hdev->name);
1319
1320         if (!enable_hs)
1321                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1322                                   MGMT_STATUS_NOT_SUPPORTED);
1323
1324         if (cp->val != 0x00 && cp->val != 0x01)
1325                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1326                                   MGMT_STATUS_INVALID_PARAMS);
1327
1328         if (cp->val)
1329                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1330         else
1331                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1332
1333         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1334 }
1335
1336 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1337 {
1338         struct mgmt_mode *cp = data;
1339         struct hci_cp_write_le_host_supported hci_cp;
1340         struct pending_cmd *cmd;
1341         int err;
1342         u8 val, enabled;
1343
1344         BT_DBG("request for %s", hdev->name);
1345
1346         if (!lmp_le_capable(hdev))
1347                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1348                                   MGMT_STATUS_NOT_SUPPORTED);
1349
1350         if (cp->val != 0x00 && cp->val != 0x01)
1351                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1352                                   MGMT_STATUS_INVALID_PARAMS);
1353
1354         /* LE-only devices do not allow toggling LE on/off */
1355         if (!lmp_bredr_capable(hdev))
1356                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1357                                   MGMT_STATUS_REJECTED);
1358
1359         hci_dev_lock(hdev);
1360
1361         val = !!cp->val;
1362         enabled = lmp_host_le_capable(hdev);
1363
1364         if (!hdev_is_powered(hdev) || val == enabled) {
1365                 bool changed = false;
1366
1367                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1368                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1369                         changed = true;
1370                 }
1371
1372                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1373                 if (err < 0)
1374                         goto unlock;
1375
1376                 if (changed)
1377                         err = new_settings(hdev, sk);
1378
1379                 goto unlock;
1380         }
1381
1382         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1383                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1384                                  MGMT_STATUS_BUSY);
1385                 goto unlock;
1386         }
1387
1388         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1389         if (!cmd) {
1390                 err = -ENOMEM;
1391                 goto unlock;
1392         }
1393
1394         memset(&hci_cp, 0, sizeof(hci_cp));
1395
1396         if (val) {
1397                 hci_cp.le = val;
1398                 hci_cp.simul = lmp_le_br_capable(hdev);
1399         }
1400
1401         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1402                            &hci_cp);
1403         if (err < 0)
1404                 mgmt_pending_remove(cmd);
1405
1406 unlock:
1407         hci_dev_unlock(hdev);
1408         return err;
1409 }
1410
1411 /* This is a helper function to test for pending mgmt commands that can
1412  * cause CoD or EIR HCI commands. We can only allow one such pending
1413  * mgmt command at a time since otherwise we cannot easily track what
1414  * the current values are, will be, and based on that calculate if a new
1415  * HCI command needs to be sent and if yes with what value.
1416  */
1417 static bool pending_eir_or_class(struct hci_dev *hdev)
1418 {
1419         struct pending_cmd *cmd;
1420
1421         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1422                 switch (cmd->opcode) {
1423                 case MGMT_OP_ADD_UUID:
1424                 case MGMT_OP_REMOVE_UUID:
1425                 case MGMT_OP_SET_DEV_CLASS:
1426                 case MGMT_OP_SET_POWERED:
1427                         return true;
1428                 }
1429         }
1430
1431         return false;
1432 }
1433
1434 static const u8 bluetooth_base_uuid[] = {
1435                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1436                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1437 };
1438
1439 static u8 get_uuid_size(const u8 *uuid)
1440 {
1441         u32 val;
1442
1443         if (memcmp(uuid, bluetooth_base_uuid, 12))
1444                 return 128;
1445
1446         val = get_unaligned_le32(&uuid[12]);
1447         if (val > 0xffff)
1448                 return 32;
1449
1450         return 16;
1451 }
1452
1453 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1454 {
1455         struct pending_cmd *cmd;
1456
1457         hci_dev_lock(hdev);
1458
1459         cmd = mgmt_pending_find(mgmt_op, hdev);
1460         if (!cmd)
1461                 goto unlock;
1462
1463         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1464                      hdev->dev_class, 3);
1465
1466         mgmt_pending_remove(cmd);
1467
1468 unlock:
1469         hci_dev_unlock(hdev);
1470 }
1471
1472 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1473 {
1474         BT_DBG("status 0x%02x", status);
1475
1476         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1477 }
1478
1479 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1480 {
1481         struct mgmt_cp_add_uuid *cp = data;
1482         struct pending_cmd *cmd;
1483         struct hci_request req;
1484         struct bt_uuid *uuid;
1485         int err;
1486
1487         BT_DBG("request for %s", hdev->name);
1488
1489         hci_dev_lock(hdev);
1490
1491         if (pending_eir_or_class(hdev)) {
1492                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1493                                  MGMT_STATUS_BUSY);
1494                 goto failed;
1495         }
1496
1497         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1498         if (!uuid) {
1499                 err = -ENOMEM;
1500                 goto failed;
1501         }
1502
1503         memcpy(uuid->uuid, cp->uuid, 16);
1504         uuid->svc_hint = cp->svc_hint;
1505         uuid->size = get_uuid_size(cp->uuid);
1506
1507         list_add_tail(&uuid->list, &hdev->uuids);
1508
1509         hci_req_init(&req, hdev);
1510
1511         update_class(&req);
1512         update_eir(&req);
1513
1514         err = hci_req_run(&req, add_uuid_complete);
1515         if (err < 0) {
1516                 if (err != -ENODATA)
1517                         goto failed;
1518
1519                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1520                                    hdev->dev_class, 3);
1521                 goto failed;
1522         }
1523
1524         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1525         if (!cmd) {
1526                 err = -ENOMEM;
1527                 goto failed;
1528         }
1529
1530         err = 0;
1531
1532 failed:
1533         hci_dev_unlock(hdev);
1534         return err;
1535 }
1536
1537 static bool enable_service_cache(struct hci_dev *hdev)
1538 {
1539         if (!hdev_is_powered(hdev))
1540                 return false;
1541
1542         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1543                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1544                                    CACHE_TIMEOUT);
1545                 return true;
1546         }
1547
1548         return false;
1549 }
1550
1551 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1552 {
1553         BT_DBG("status 0x%02x", status);
1554
1555         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1556 }
1557
1558 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1559                        u16 len)
1560 {
1561         struct mgmt_cp_remove_uuid *cp = data;
1562         struct pending_cmd *cmd;
1563         struct bt_uuid *match, *tmp;
1564         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1565         struct hci_request req;
1566         int err, found;
1567
1568         BT_DBG("request for %s", hdev->name);
1569
1570         hci_dev_lock(hdev);
1571
1572         if (pending_eir_or_class(hdev)) {
1573                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1574                                  MGMT_STATUS_BUSY);
1575                 goto unlock;
1576         }
1577
1578         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1579                 err = hci_uuids_clear(hdev);
1580
1581                 if (enable_service_cache(hdev)) {
1582                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1583                                            0, hdev->dev_class, 3);
1584                         goto unlock;
1585                 }
1586
1587                 goto update_class;
1588         }
1589
1590         found = 0;
1591
1592         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1593                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1594                         continue;
1595
1596                 list_del(&match->list);
1597                 kfree(match);
1598                 found++;
1599         }
1600
1601         if (found == 0) {
1602                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1603                                  MGMT_STATUS_INVALID_PARAMS);
1604                 goto unlock;
1605         }
1606
1607 update_class:
1608         hci_req_init(&req, hdev);
1609
1610         update_class(&req);
1611         update_eir(&req);
1612
1613         err = hci_req_run(&req, remove_uuid_complete);
1614         if (err < 0) {
1615                 if (err != -ENODATA)
1616                         goto unlock;
1617
1618                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1619                                    hdev->dev_class, 3);
1620                 goto unlock;
1621         }
1622
1623         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1624         if (!cmd) {
1625                 err = -ENOMEM;
1626                 goto unlock;
1627         }
1628
1629         err = 0;
1630
1631 unlock:
1632         hci_dev_unlock(hdev);
1633         return err;
1634 }
1635
1636 static void set_class_complete(struct hci_dev *hdev, u8 status)
1637 {
1638         BT_DBG("status 0x%02x", status);
1639
1640         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1641 }
1642
1643 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1644                          u16 len)
1645 {
1646         struct mgmt_cp_set_dev_class *cp = data;
1647         struct pending_cmd *cmd;
1648         struct hci_request req;
1649         int err;
1650
1651         BT_DBG("request for %s", hdev->name);
1652
1653         if (!lmp_bredr_capable(hdev))
1654                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1655                                   MGMT_STATUS_NOT_SUPPORTED);
1656
1657         hci_dev_lock(hdev);
1658
1659         if (pending_eir_or_class(hdev)) {
1660                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1661                                  MGMT_STATUS_BUSY);
1662                 goto unlock;
1663         }
1664
1665         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1666                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1667                                  MGMT_STATUS_INVALID_PARAMS);
1668                 goto unlock;
1669         }
1670
1671         hdev->major_class = cp->major;
1672         hdev->minor_class = cp->minor;
1673
1674         if (!hdev_is_powered(hdev)) {
1675                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1676                                    hdev->dev_class, 3);
1677                 goto unlock;
1678         }
1679
1680         hci_req_init(&req, hdev);
1681
1682         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1683                 hci_dev_unlock(hdev);
1684                 cancel_delayed_work_sync(&hdev->service_cache);
1685                 hci_dev_lock(hdev);
1686                 update_eir(&req);
1687         }
1688
1689         update_class(&req);
1690
1691         err = hci_req_run(&req, set_class_complete);
1692         if (err < 0) {
1693                 if (err != -ENODATA)
1694                         goto unlock;
1695
1696                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1697                                    hdev->dev_class, 3);
1698                 goto unlock;
1699         }
1700
1701         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1702         if (!cmd) {
1703                 err = -ENOMEM;
1704                 goto unlock;
1705         }
1706
1707         err = 0;
1708
1709 unlock:
1710         hci_dev_unlock(hdev);
1711         return err;
1712 }
1713
1714 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1715                           u16 len)
1716 {
1717         struct mgmt_cp_load_link_keys *cp = data;
1718         u16 key_count, expected_len;
1719         int i;
1720
1721         key_count = __le16_to_cpu(cp->key_count);
1722
1723         expected_len = sizeof(*cp) + key_count *
1724                                         sizeof(struct mgmt_link_key_info);
1725         if (expected_len != len) {
1726                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1727                        len, expected_len);
1728                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1729                                   MGMT_STATUS_INVALID_PARAMS);
1730         }
1731
1732         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1733                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1734                                   MGMT_STATUS_INVALID_PARAMS);
1735
1736         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1737                key_count);
1738
1739         for (i = 0; i < key_count; i++) {
1740                 struct mgmt_link_key_info *key = &cp->keys[i];
1741
1742                 if (key->addr.type != BDADDR_BREDR)
1743                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1744                                           MGMT_STATUS_INVALID_PARAMS);
1745         }
1746
1747         hci_dev_lock(hdev);
1748
1749         hci_link_keys_clear(hdev);
1750
1751         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1752
1753         if (cp->debug_keys)
1754                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1755         else
1756                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1757
1758         for (i = 0; i < key_count; i++) {
1759                 struct mgmt_link_key_info *key = &cp->keys[i];
1760
1761                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1762                                  key->type, key->pin_len);
1763         }
1764
1765         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1766
1767         hci_dev_unlock(hdev);
1768
1769         return 0;
1770 }
1771
1772 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1773                            u8 addr_type, struct sock *skip_sk)
1774 {
1775         struct mgmt_ev_device_unpaired ev;
1776
1777         bacpy(&ev.addr.bdaddr, bdaddr);
1778         ev.addr.type = addr_type;
1779
1780         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1781                           skip_sk);
1782 }
1783
1784 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1785                          u16 len)
1786 {
1787         struct mgmt_cp_unpair_device *cp = data;
1788         struct mgmt_rp_unpair_device rp;
1789         struct hci_cp_disconnect dc;
1790         struct pending_cmd *cmd;
1791         struct hci_conn *conn;
1792         int err;
1793
1794         memset(&rp, 0, sizeof(rp));
1795         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1796         rp.addr.type = cp->addr.type;
1797
1798         if (!bdaddr_type_is_valid(cp->addr.type))
1799                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1800                                     MGMT_STATUS_INVALID_PARAMS,
1801                                     &rp, sizeof(rp));
1802
1803         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1804                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1805                                     MGMT_STATUS_INVALID_PARAMS,
1806                                     &rp, sizeof(rp));
1807
1808         hci_dev_lock(hdev);
1809
1810         if (!hdev_is_powered(hdev)) {
1811                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1812                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1813                 goto unlock;
1814         }
1815
1816         if (cp->addr.type == BDADDR_BREDR)
1817                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1818         else
1819                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1820
1821         if (err < 0) {
1822                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1823                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1824                 goto unlock;
1825         }
1826
1827         if (cp->disconnect) {
1828                 if (cp->addr.type == BDADDR_BREDR)
1829                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1830                                                        &cp->addr.bdaddr);
1831                 else
1832                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1833                                                        &cp->addr.bdaddr);
1834         } else {
1835                 conn = NULL;
1836         }
1837
1838         if (!conn) {
1839                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1840                                    &rp, sizeof(rp));
1841                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1842                 goto unlock;
1843         }
1844
1845         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1846                                sizeof(*cp));
1847         if (!cmd) {
1848                 err = -ENOMEM;
1849                 goto unlock;
1850         }
1851
1852         dc.handle = cpu_to_le16(conn->handle);
1853         dc.reason = 0x13; /* Remote User Terminated Connection */
1854         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1855         if (err < 0)
1856                 mgmt_pending_remove(cmd);
1857
1858 unlock:
1859         hci_dev_unlock(hdev);
1860         return err;
1861 }
1862
1863 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1864                       u16 len)
1865 {
1866         struct mgmt_cp_disconnect *cp = data;
1867         struct mgmt_rp_disconnect rp;
1868         struct hci_cp_disconnect dc;
1869         struct pending_cmd *cmd;
1870         struct hci_conn *conn;
1871         int err;
1872
1873         BT_DBG("");
1874
1875         memset(&rp, 0, sizeof(rp));
1876         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1877         rp.addr.type = cp->addr.type;
1878
1879         if (!bdaddr_type_is_valid(cp->addr.type))
1880                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1881                                     MGMT_STATUS_INVALID_PARAMS,
1882                                     &rp, sizeof(rp));
1883
1884         hci_dev_lock(hdev);
1885
1886         if (!test_bit(HCI_UP, &hdev->flags)) {
1887                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1888                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1889                 goto failed;
1890         }
1891
1892         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1893                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1894                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1895                 goto failed;
1896         }
1897
1898         if (cp->addr.type == BDADDR_BREDR)
1899                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1900                                                &cp->addr.bdaddr);
1901         else
1902                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1903
1904         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1905                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1906                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1907                 goto failed;
1908         }
1909
1910         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1911         if (!cmd) {
1912                 err = -ENOMEM;
1913                 goto failed;
1914         }
1915
1916         dc.handle = cpu_to_le16(conn->handle);
1917         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1918
1919         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1920         if (err < 0)
1921                 mgmt_pending_remove(cmd);
1922
1923 failed:
1924         hci_dev_unlock(hdev);
1925         return err;
1926 }
1927
1928 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1929 {
1930         switch (link_type) {
1931         case LE_LINK:
1932                 switch (addr_type) {
1933                 case ADDR_LE_DEV_PUBLIC:
1934                         return BDADDR_LE_PUBLIC;
1935
1936                 default:
1937                         /* Fallback to LE Random address type */
1938                         return BDADDR_LE_RANDOM;
1939                 }
1940
1941         default:
1942                 /* Fallback to BR/EDR type */
1943                 return BDADDR_BREDR;
1944         }
1945 }
1946
1947 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1948                            u16 data_len)
1949 {
1950         struct mgmt_rp_get_connections *rp;
1951         struct hci_conn *c;
1952         size_t rp_len;
1953         int err;
1954         u16 i;
1955
1956         BT_DBG("");
1957
1958         hci_dev_lock(hdev);
1959
1960         if (!hdev_is_powered(hdev)) {
1961                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1962                                  MGMT_STATUS_NOT_POWERED);
1963                 goto unlock;
1964         }
1965
1966         i = 0;
1967         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1968                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1969                         i++;
1970         }
1971
1972         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1973         rp = kmalloc(rp_len, GFP_KERNEL);
1974         if (!rp) {
1975                 err = -ENOMEM;
1976                 goto unlock;
1977         }
1978
1979         i = 0;
1980         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1981                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1982                         continue;
1983                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1984                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1985                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1986                         continue;
1987                 i++;
1988         }
1989
1990         rp->conn_count = cpu_to_le16(i);
1991
1992         /* Recalculate length in case of filtered SCO connections, etc */
1993         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1994
1995         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1996                            rp_len);
1997
1998         kfree(rp);
1999
2000 unlock:
2001         hci_dev_unlock(hdev);
2002         return err;
2003 }
2004
2005 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2006                                    struct mgmt_cp_pin_code_neg_reply *cp)
2007 {
2008         struct pending_cmd *cmd;
2009         int err;
2010
2011         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2012                                sizeof(*cp));
2013         if (!cmd)
2014                 return -ENOMEM;
2015
2016         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2017                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2018         if (err < 0)
2019                 mgmt_pending_remove(cmd);
2020
2021         return err;
2022 }
2023
2024 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2025                           u16 len)
2026 {
2027         struct hci_conn *conn;
2028         struct mgmt_cp_pin_code_reply *cp = data;
2029         struct hci_cp_pin_code_reply reply;
2030         struct pending_cmd *cmd;
2031         int err;
2032
2033         BT_DBG("");
2034
2035         hci_dev_lock(hdev);
2036
2037         if (!hdev_is_powered(hdev)) {
2038                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2039                                  MGMT_STATUS_NOT_POWERED);
2040                 goto failed;
2041         }
2042
2043         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2044         if (!conn) {
2045                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2046                                  MGMT_STATUS_NOT_CONNECTED);
2047                 goto failed;
2048         }
2049
2050         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2051                 struct mgmt_cp_pin_code_neg_reply ncp;
2052
2053                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2054
2055                 BT_ERR("PIN code is not 16 bytes long");
2056
2057                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2058                 if (err >= 0)
2059                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2060                                          MGMT_STATUS_INVALID_PARAMS);
2061
2062                 goto failed;
2063         }
2064
2065         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2066         if (!cmd) {
2067                 err = -ENOMEM;
2068                 goto failed;
2069         }
2070
2071         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2072         reply.pin_len = cp->pin_len;
2073         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2074
2075         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2076         if (err < 0)
2077                 mgmt_pending_remove(cmd);
2078
2079 failed:
2080         hci_dev_unlock(hdev);
2081         return err;
2082 }
2083
2084 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2085                              u16 len)
2086 {
2087         struct mgmt_cp_set_io_capability *cp = data;
2088
2089         BT_DBG("");
2090
2091         hci_dev_lock(hdev);
2092
2093         hdev->io_capability = cp->io_capability;
2094
2095         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2096                hdev->io_capability);
2097
2098         hci_dev_unlock(hdev);
2099
2100         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2101                             0);
2102 }
2103
2104 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2105 {
2106         struct hci_dev *hdev = conn->hdev;
2107         struct pending_cmd *cmd;
2108
2109         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2110                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2111                         continue;
2112
2113                 if (cmd->user_data != conn)
2114                         continue;
2115
2116                 return cmd;
2117         }
2118
2119         return NULL;
2120 }
2121
2122 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2123 {
2124         struct mgmt_rp_pair_device rp;
2125         struct hci_conn *conn = cmd->user_data;
2126
2127         bacpy(&rp.addr.bdaddr, &conn->dst);
2128         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2129
2130         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2131                      &rp, sizeof(rp));
2132
2133         /* So we don't get further callbacks for this connection */
2134         conn->connect_cfm_cb = NULL;
2135         conn->security_cfm_cb = NULL;
2136         conn->disconn_cfm_cb = NULL;
2137
2138         hci_conn_drop(conn);
2139
2140         mgmt_pending_remove(cmd);
2141 }
2142
2143 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2144 {
2145         struct pending_cmd *cmd;
2146
2147         BT_DBG("status %u", status);
2148
2149         cmd = find_pairing(conn);
2150         if (!cmd)
2151                 BT_DBG("Unable to find a pending command");
2152         else
2153                 pairing_complete(cmd, mgmt_status(status));
2154 }
2155
2156 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2157 {
2158         struct pending_cmd *cmd;
2159
2160         BT_DBG("status %u", status);
2161
2162         if (!status)
2163                 return;
2164
2165         cmd = find_pairing(conn);
2166         if (!cmd)
2167                 BT_DBG("Unable to find a pending command");
2168         else
2169                 pairing_complete(cmd, mgmt_status(status));
2170 }
2171
2172 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2173                        u16 len)
2174 {
2175         struct mgmt_cp_pair_device *cp = data;
2176         struct mgmt_rp_pair_device rp;
2177         struct pending_cmd *cmd;
2178         u8 sec_level, auth_type;
2179         struct hci_conn *conn;
2180         int err;
2181
2182         BT_DBG("");
2183
2184         memset(&rp, 0, sizeof(rp));
2185         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2186         rp.addr.type = cp->addr.type;
2187
2188         if (!bdaddr_type_is_valid(cp->addr.type))
2189                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2190                                     MGMT_STATUS_INVALID_PARAMS,
2191                                     &rp, sizeof(rp));
2192
2193         hci_dev_lock(hdev);
2194
2195         if (!hdev_is_powered(hdev)) {
2196                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2197                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2198                 goto unlock;
2199         }
2200
2201         sec_level = BT_SECURITY_MEDIUM;
2202         if (cp->io_cap == 0x03)
2203                 auth_type = HCI_AT_DEDICATED_BONDING;
2204         else
2205                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2206
2207         if (cp->addr.type == BDADDR_BREDR)
2208                 conn = hci_connect(hdev, ACL_LINK, 0, &cp->addr.bdaddr,
2209                                    cp->addr.type, sec_level, auth_type);
2210         else
2211                 conn = hci_connect(hdev, LE_LINK, 0, &cp->addr.bdaddr,
2212                                    cp->addr.type, sec_level, auth_type);
2213
2214         if (IS_ERR(conn)) {
2215                 int status;
2216
2217                 if (PTR_ERR(conn) == -EBUSY)
2218                         status = MGMT_STATUS_BUSY;
2219                 else
2220                         status = MGMT_STATUS_CONNECT_FAILED;
2221
2222                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2223                                    status, &rp,
2224                                    sizeof(rp));
2225                 goto unlock;
2226         }
2227
2228         if (conn->connect_cfm_cb) {
2229                 hci_conn_drop(conn);
2230                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2231                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2232                 goto unlock;
2233         }
2234
2235         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2236         if (!cmd) {
2237                 err = -ENOMEM;
2238                 hci_conn_drop(conn);
2239                 goto unlock;
2240         }
2241
2242         /* For LE, just connecting isn't a proof that the pairing finished */
2243         if (cp->addr.type == BDADDR_BREDR)
2244                 conn->connect_cfm_cb = pairing_complete_cb;
2245         else
2246                 conn->connect_cfm_cb = le_connect_complete_cb;
2247
2248         conn->security_cfm_cb = pairing_complete_cb;
2249         conn->disconn_cfm_cb = pairing_complete_cb;
2250         conn->io_capability = cp->io_cap;
2251         cmd->user_data = conn;
2252
2253         if (conn->state == BT_CONNECTED &&
2254             hci_conn_security(conn, sec_level, auth_type))
2255                 pairing_complete(cmd, 0);
2256
2257         err = 0;
2258
2259 unlock:
2260         hci_dev_unlock(hdev);
2261         return err;
2262 }
2263
2264 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2265                               u16 len)
2266 {
2267         struct mgmt_addr_info *addr = data;
2268         struct pending_cmd *cmd;
2269         struct hci_conn *conn;
2270         int err;
2271
2272         BT_DBG("");
2273
2274         hci_dev_lock(hdev);
2275
2276         if (!hdev_is_powered(hdev)) {
2277                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2278                                  MGMT_STATUS_NOT_POWERED);
2279                 goto unlock;
2280         }
2281
2282         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2283         if (!cmd) {
2284                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2285                                  MGMT_STATUS_INVALID_PARAMS);
2286                 goto unlock;
2287         }
2288
2289         conn = cmd->user_data;
2290
2291         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2292                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2293                                  MGMT_STATUS_INVALID_PARAMS);
2294                 goto unlock;
2295         }
2296
2297         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2298
2299         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2300                            addr, sizeof(*addr));
2301 unlock:
2302         hci_dev_unlock(hdev);
2303         return err;
2304 }
2305
2306 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2307                              struct mgmt_addr_info *addr, u16 mgmt_op,
2308                              u16 hci_op, __le32 passkey)
2309 {
2310         struct pending_cmd *cmd;
2311         struct hci_conn *conn;
2312         int err;
2313
2314         hci_dev_lock(hdev);
2315
2316         if (!hdev_is_powered(hdev)) {
2317                 err = cmd_complete(sk, hdev->id, mgmt_op,
2318                                    MGMT_STATUS_NOT_POWERED, addr,
2319                                    sizeof(*addr));
2320                 goto done;
2321         }
2322
2323         if (addr->type == BDADDR_BREDR)
2324                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2325         else
2326                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2327
2328         if (!conn) {
2329                 err = cmd_complete(sk, hdev->id, mgmt_op,
2330                                    MGMT_STATUS_NOT_CONNECTED, addr,
2331                                    sizeof(*addr));
2332                 goto done;
2333         }
2334
2335         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2336                 /* Continue with pairing via SMP. The hdev lock must be
2337                  * released as SMP may try to recquire it for crypto
2338                  * purposes.
2339                  */
2340                 hci_dev_unlock(hdev);
2341                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2342                 hci_dev_lock(hdev);
2343
2344                 if (!err)
2345                         err = cmd_complete(sk, hdev->id, mgmt_op,
2346                                            MGMT_STATUS_SUCCESS, addr,
2347                                            sizeof(*addr));
2348                 else
2349                         err = cmd_complete(sk, hdev->id, mgmt_op,
2350                                            MGMT_STATUS_FAILED, addr,
2351                                            sizeof(*addr));
2352
2353                 goto done;
2354         }
2355
2356         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2357         if (!cmd) {
2358                 err = -ENOMEM;
2359                 goto done;
2360         }
2361
2362         /* Continue with pairing via HCI */
2363         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2364                 struct hci_cp_user_passkey_reply cp;
2365
2366                 bacpy(&cp.bdaddr, &addr->bdaddr);
2367                 cp.passkey = passkey;
2368                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2369         } else
2370                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2371                                    &addr->bdaddr);
2372
2373         if (err < 0)
2374                 mgmt_pending_remove(cmd);
2375
2376 done:
2377         hci_dev_unlock(hdev);
2378         return err;
2379 }
2380
2381 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2382                               void *data, u16 len)
2383 {
2384         struct mgmt_cp_pin_code_neg_reply *cp = data;
2385
2386         BT_DBG("");
2387
2388         return user_pairing_resp(sk, hdev, &cp->addr,
2389                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2390                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2391 }
2392
2393 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2394                               u16 len)
2395 {
2396         struct mgmt_cp_user_confirm_reply *cp = data;
2397
2398         BT_DBG("");
2399
2400         if (len != sizeof(*cp))
2401                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2402                                   MGMT_STATUS_INVALID_PARAMS);
2403
2404         return user_pairing_resp(sk, hdev, &cp->addr,
2405                                  MGMT_OP_USER_CONFIRM_REPLY,
2406                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2407 }
2408
2409 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2410                                   void *data, u16 len)
2411 {
2412         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2413
2414         BT_DBG("");
2415
2416         return user_pairing_resp(sk, hdev, &cp->addr,
2417                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2418                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2419 }
2420
2421 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2422                               u16 len)
2423 {
2424         struct mgmt_cp_user_passkey_reply *cp = data;
2425
2426         BT_DBG("");
2427
2428         return user_pairing_resp(sk, hdev, &cp->addr,
2429                                  MGMT_OP_USER_PASSKEY_REPLY,
2430                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2431 }
2432
2433 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2434                                   void *data, u16 len)
2435 {
2436         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2437
2438         BT_DBG("");
2439
2440         return user_pairing_resp(sk, hdev, &cp->addr,
2441                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2442                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2443 }
2444
2445 static void update_name(struct hci_request *req)
2446 {
2447         struct hci_dev *hdev = req->hdev;
2448         struct hci_cp_write_local_name cp;
2449
2450         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2451
2452         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2453 }
2454
2455 static void set_name_complete(struct hci_dev *hdev, u8 status)
2456 {
2457         struct mgmt_cp_set_local_name *cp;
2458         struct pending_cmd *cmd;
2459
2460         BT_DBG("status 0x%02x", status);
2461
2462         hci_dev_lock(hdev);
2463
2464         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2465         if (!cmd)
2466                 goto unlock;
2467
2468         cp = cmd->param;
2469
2470         if (status)
2471                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2472                            mgmt_status(status));
2473         else
2474                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2475                              cp, sizeof(*cp));
2476
2477         mgmt_pending_remove(cmd);
2478
2479 unlock:
2480         hci_dev_unlock(hdev);
2481 }
2482
2483 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2484                           u16 len)
2485 {
2486         struct mgmt_cp_set_local_name *cp = data;
2487         struct pending_cmd *cmd;
2488         struct hci_request req;
2489         int err;
2490
2491         BT_DBG("");
2492
2493         hci_dev_lock(hdev);
2494
2495         /* If the old values are the same as the new ones just return a
2496          * direct command complete event.
2497          */
2498         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2499             !memcmp(hdev->short_name, cp->short_name,
2500                     sizeof(hdev->short_name))) {
2501                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2502                                    data, len);
2503                 goto failed;
2504         }
2505
2506         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2507
2508         if (!hdev_is_powered(hdev)) {
2509                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2510
2511                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2512                                    data, len);
2513                 if (err < 0)
2514                         goto failed;
2515
2516                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2517                                  sk);
2518
2519                 goto failed;
2520         }
2521
2522         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2523         if (!cmd) {
2524                 err = -ENOMEM;
2525                 goto failed;
2526         }
2527
2528         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2529
2530         hci_req_init(&req, hdev);
2531
2532         if (lmp_bredr_capable(hdev)) {
2533                 update_name(&req);
2534                 update_eir(&req);
2535         }
2536
2537         if (lmp_le_capable(hdev))
2538                 hci_update_ad(&req);
2539
2540         err = hci_req_run(&req, set_name_complete);
2541         if (err < 0)
2542                 mgmt_pending_remove(cmd);
2543
2544 failed:
2545         hci_dev_unlock(hdev);
2546         return err;
2547 }
2548
2549 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2550                                void *data, u16 data_len)
2551 {
2552         struct pending_cmd *cmd;
2553         int err;
2554
2555         BT_DBG("%s", hdev->name);
2556
2557         hci_dev_lock(hdev);
2558
2559         if (!hdev_is_powered(hdev)) {
2560                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2561                                  MGMT_STATUS_NOT_POWERED);
2562                 goto unlock;
2563         }
2564
2565         if (!lmp_ssp_capable(hdev)) {
2566                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2567                                  MGMT_STATUS_NOT_SUPPORTED);
2568                 goto unlock;
2569         }
2570
2571         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2572                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2573                                  MGMT_STATUS_BUSY);
2574                 goto unlock;
2575         }
2576
2577         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2578         if (!cmd) {
2579                 err = -ENOMEM;
2580                 goto unlock;
2581         }
2582
2583         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2584         if (err < 0)
2585                 mgmt_pending_remove(cmd);
2586
2587 unlock:
2588         hci_dev_unlock(hdev);
2589         return err;
2590 }
2591
2592 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2593                                void *data, u16 len)
2594 {
2595         struct mgmt_cp_add_remote_oob_data *cp = data;
2596         u8 status;
2597         int err;
2598
2599         BT_DBG("%s ", hdev->name);
2600
2601         hci_dev_lock(hdev);
2602
2603         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2604                                       cp->randomizer);
2605         if (err < 0)
2606                 status = MGMT_STATUS_FAILED;
2607         else
2608                 status = MGMT_STATUS_SUCCESS;
2609
2610         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2611                            &cp->addr, sizeof(cp->addr));
2612
2613         hci_dev_unlock(hdev);
2614         return err;
2615 }
2616
2617 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2618                                   void *data, u16 len)
2619 {
2620         struct mgmt_cp_remove_remote_oob_data *cp = data;
2621         u8 status;
2622         int err;
2623
2624         BT_DBG("%s", hdev->name);
2625
2626         hci_dev_lock(hdev);
2627
2628         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2629         if (err < 0)
2630                 status = MGMT_STATUS_INVALID_PARAMS;
2631         else
2632                 status = MGMT_STATUS_SUCCESS;
2633
2634         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2635                            status, &cp->addr, sizeof(cp->addr));
2636
2637         hci_dev_unlock(hdev);
2638         return err;
2639 }
2640
2641 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2642 {
2643         int err;
2644
2645         BT_DBG("%s", hdev->name);
2646
2647         hci_dev_lock(hdev);
2648
2649         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2650         if (err < 0)
2651                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2652
2653         hci_dev_unlock(hdev);
2654
2655         return err;
2656 }
2657
2658 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2659                            void *data, u16 len)
2660 {
2661         struct mgmt_cp_start_discovery *cp = data;
2662         struct pending_cmd *cmd;
2663         int err;
2664
2665         BT_DBG("%s", hdev->name);
2666
2667         hci_dev_lock(hdev);
2668
2669         if (!hdev_is_powered(hdev)) {
2670                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2671                                  MGMT_STATUS_NOT_POWERED);
2672                 goto failed;
2673         }
2674
2675         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2676                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2677                                  MGMT_STATUS_BUSY);
2678                 goto failed;
2679         }
2680
2681         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2682                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2683                                  MGMT_STATUS_BUSY);
2684                 goto failed;
2685         }
2686
2687         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2688         if (!cmd) {
2689                 err = -ENOMEM;
2690                 goto failed;
2691         }
2692
2693         hdev->discovery.type = cp->type;
2694
2695         switch (hdev->discovery.type) {
2696         case DISCOV_TYPE_BREDR:
2697                 if (!lmp_bredr_capable(hdev)) {
2698                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2699                                          MGMT_STATUS_NOT_SUPPORTED);
2700                         mgmt_pending_remove(cmd);
2701                         goto failed;
2702                 }
2703
2704                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2705                 break;
2706
2707         case DISCOV_TYPE_LE:
2708                 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2709                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2710                                          MGMT_STATUS_NOT_SUPPORTED);
2711                         mgmt_pending_remove(cmd);
2712                         goto failed;
2713                 }
2714
2715                 err = hci_le_scan(hdev, LE_SCAN_ACTIVE, LE_SCAN_INT,
2716                                   LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2717                 break;
2718
2719         case DISCOV_TYPE_INTERLEAVED:
2720                 if (!lmp_host_le_capable(hdev) || !lmp_bredr_capable(hdev)) {
2721                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2722                                          MGMT_STATUS_NOT_SUPPORTED);
2723                         mgmt_pending_remove(cmd);
2724                         goto failed;
2725                 }
2726
2727                 err = hci_le_scan(hdev, LE_SCAN_ACTIVE, LE_SCAN_INT,
2728                                   LE_SCAN_WIN, LE_SCAN_TIMEOUT_BREDR_LE);
2729                 break;
2730
2731         default:
2732                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2733                                  MGMT_STATUS_INVALID_PARAMS);
2734                 mgmt_pending_remove(cmd);
2735                 goto failed;
2736         }
2737
2738         if (err < 0)
2739                 mgmt_pending_remove(cmd);
2740         else
2741                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2742
2743 failed:
2744         hci_dev_unlock(hdev);
2745         return err;
2746 }
2747
2748 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2749                           u16 len)
2750 {
2751         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2752         struct pending_cmd *cmd;
2753         struct hci_cp_remote_name_req_cancel cp;
2754         struct inquiry_entry *e;
2755         int err;
2756
2757         BT_DBG("%s", hdev->name);
2758
2759         hci_dev_lock(hdev);
2760
2761         if (!hci_discovery_active(hdev)) {
2762                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2763                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2764                                    sizeof(mgmt_cp->type));
2765                 goto unlock;
2766         }
2767
2768         if (hdev->discovery.type != mgmt_cp->type) {
2769                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2770                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2771                                    sizeof(mgmt_cp->type));
2772                 goto unlock;
2773         }
2774
2775         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2776         if (!cmd) {
2777                 err = -ENOMEM;
2778                 goto unlock;
2779         }
2780
2781         switch (hdev->discovery.state) {
2782         case DISCOVERY_FINDING:
2783                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2784                         err = hci_cancel_inquiry(hdev);
2785                 else
2786                         err = hci_cancel_le_scan(hdev);
2787
2788                 break;
2789
2790         case DISCOVERY_RESOLVING:
2791                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2792                                                      NAME_PENDING);
2793                 if (!e) {
2794                         mgmt_pending_remove(cmd);
2795                         err = cmd_complete(sk, hdev->id,
2796                                            MGMT_OP_STOP_DISCOVERY, 0,
2797                                            &mgmt_cp->type,
2798                                            sizeof(mgmt_cp->type));
2799                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2800                         goto unlock;
2801                 }
2802
2803                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2804                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2805                                    sizeof(cp), &cp);
2806
2807                 break;
2808
2809         default:
2810                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2811                 err = -EFAULT;
2812         }
2813
2814         if (err < 0)
2815                 mgmt_pending_remove(cmd);
2816         else
2817                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2818
2819 unlock:
2820         hci_dev_unlock(hdev);
2821         return err;
2822 }
2823
2824 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2825                         u16 len)
2826 {
2827         struct mgmt_cp_confirm_name *cp = data;
2828         struct inquiry_entry *e;
2829         int err;
2830
2831         BT_DBG("%s", hdev->name);
2832
2833         hci_dev_lock(hdev);
2834
2835         if (!hci_discovery_active(hdev)) {
2836                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2837                                  MGMT_STATUS_FAILED);
2838                 goto failed;
2839         }
2840
2841         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2842         if (!e) {
2843                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2844                                  MGMT_STATUS_INVALID_PARAMS);
2845                 goto failed;
2846         }
2847
2848         if (cp->name_known) {
2849                 e->name_state = NAME_KNOWN;
2850                 list_del(&e->list);
2851         } else {
2852                 e->name_state = NAME_NEEDED;
2853                 hci_inquiry_cache_update_resolve(hdev, e);
2854         }
2855
2856         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
2857                            sizeof(cp->addr));
2858
2859 failed:
2860         hci_dev_unlock(hdev);
2861         return err;
2862 }
2863
2864 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2865                         u16 len)
2866 {
2867         struct mgmt_cp_block_device *cp = data;
2868         u8 status;
2869         int err;
2870
2871         BT_DBG("%s", hdev->name);
2872
2873         if (!bdaddr_type_is_valid(cp->addr.type))
2874                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
2875                                     MGMT_STATUS_INVALID_PARAMS,
2876                                     &cp->addr, sizeof(cp->addr));
2877
2878         hci_dev_lock(hdev);
2879
2880         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2881         if (err < 0)
2882                 status = MGMT_STATUS_FAILED;
2883         else
2884                 status = MGMT_STATUS_SUCCESS;
2885
2886         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2887                            &cp->addr, sizeof(cp->addr));
2888
2889         hci_dev_unlock(hdev);
2890
2891         return err;
2892 }
2893
2894 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2895                           u16 len)
2896 {
2897         struct mgmt_cp_unblock_device *cp = data;
2898         u8 status;
2899         int err;
2900
2901         BT_DBG("%s", hdev->name);
2902
2903         if (!bdaddr_type_is_valid(cp->addr.type))
2904                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
2905                                     MGMT_STATUS_INVALID_PARAMS,
2906                                     &cp->addr, sizeof(cp->addr));
2907
2908         hci_dev_lock(hdev);
2909
2910         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2911         if (err < 0)
2912                 status = MGMT_STATUS_INVALID_PARAMS;
2913         else
2914                 status = MGMT_STATUS_SUCCESS;
2915
2916         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2917                            &cp->addr, sizeof(cp->addr));
2918
2919         hci_dev_unlock(hdev);
2920
2921         return err;
2922 }
2923
2924 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2925                          u16 len)
2926 {
2927         struct mgmt_cp_set_device_id *cp = data;
2928         struct hci_request req;
2929         int err;
2930         __u16 source;
2931
2932         BT_DBG("%s", hdev->name);
2933
2934         source = __le16_to_cpu(cp->source);
2935
2936         if (source > 0x0002)
2937                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2938                                   MGMT_STATUS_INVALID_PARAMS);
2939
2940         hci_dev_lock(hdev);
2941
2942         hdev->devid_source = source;
2943         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2944         hdev->devid_product = __le16_to_cpu(cp->product);
2945         hdev->devid_version = __le16_to_cpu(cp->version);
2946
2947         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2948
2949         hci_req_init(&req, hdev);
2950         update_eir(&req);
2951         hci_req_run(&req, NULL);
2952
2953         hci_dev_unlock(hdev);
2954
2955         return err;
2956 }
2957
2958 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
2959 {
2960         struct pending_cmd *cmd;
2961
2962         BT_DBG("status 0x%02x", status);
2963
2964         hci_dev_lock(hdev);
2965
2966         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
2967         if (!cmd)
2968                 goto unlock;
2969
2970         if (status) {
2971                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2972                            mgmt_status(status));
2973         } else {
2974                 struct mgmt_mode *cp = cmd->param;
2975
2976                 if (cp->val)
2977                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
2978                 else
2979                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
2980
2981                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
2982                 new_settings(hdev, cmd->sk);
2983         }
2984
2985         mgmt_pending_remove(cmd);
2986
2987 unlock:
2988         hci_dev_unlock(hdev);
2989 }
2990
2991 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2992                                 void *data, u16 len)
2993 {
2994         struct mgmt_mode *cp = data;
2995         struct pending_cmd *cmd;
2996         struct hci_request req;
2997         int err;
2998
2999         BT_DBG("%s", hdev->name);
3000
3001         if (!lmp_bredr_capable(hdev) || hdev->hci_ver < BLUETOOTH_VER_1_2)
3002                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3003                                   MGMT_STATUS_NOT_SUPPORTED);
3004
3005         if (cp->val != 0x00 && cp->val != 0x01)
3006                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3007                                   MGMT_STATUS_INVALID_PARAMS);
3008
3009         if (!hdev_is_powered(hdev))
3010                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3011                                   MGMT_STATUS_NOT_POWERED);
3012
3013         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3014                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3015                                   MGMT_STATUS_REJECTED);
3016
3017         hci_dev_lock(hdev);
3018
3019         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3020                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3021                                  MGMT_STATUS_BUSY);
3022                 goto unlock;
3023         }
3024
3025         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3026                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3027                                         hdev);
3028                 goto unlock;
3029         }
3030
3031         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3032                                data, len);
3033         if (!cmd) {
3034                 err = -ENOMEM;
3035                 goto unlock;
3036         }
3037
3038         hci_req_init(&req, hdev);
3039
3040         write_fast_connectable(&req, cp->val);
3041
3042         err = hci_req_run(&req, fast_connectable_complete);
3043         if (err < 0) {
3044                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3045                                  MGMT_STATUS_FAILED);
3046                 mgmt_pending_remove(cmd);
3047         }
3048
3049 unlock:
3050         hci_dev_unlock(hdev);
3051
3052         return err;
3053 }
3054
3055 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3056 {
3057         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3058                 return false;
3059         if (key->master != 0x00 && key->master != 0x01)
3060                 return false;
3061         if (!bdaddr_type_is_le(key->addr.type))
3062                 return false;
3063         return true;
3064 }
3065
3066 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3067                                void *cp_data, u16 len)
3068 {
3069         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3070         u16 key_count, expected_len;
3071         int i, err;
3072
3073         key_count = __le16_to_cpu(cp->key_count);
3074
3075         expected_len = sizeof(*cp) + key_count *
3076                                         sizeof(struct mgmt_ltk_info);
3077         if (expected_len != len) {
3078                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3079                        len, expected_len);
3080                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3081                                   MGMT_STATUS_INVALID_PARAMS);
3082         }
3083
3084         BT_DBG("%s key_count %u", hdev->name, key_count);
3085
3086         for (i = 0; i < key_count; i++) {
3087                 struct mgmt_ltk_info *key = &cp->keys[i];
3088
3089                 if (!ltk_is_valid(key))
3090                         return cmd_status(sk, hdev->id,
3091                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3092                                           MGMT_STATUS_INVALID_PARAMS);
3093         }
3094
3095         hci_dev_lock(hdev);
3096
3097         hci_smp_ltks_clear(hdev);
3098
3099         for (i = 0; i < key_count; i++) {
3100                 struct mgmt_ltk_info *key = &cp->keys[i];
3101                 u8 type;
3102
3103                 if (key->master)
3104                         type = HCI_SMP_LTK;
3105                 else
3106                         type = HCI_SMP_LTK_SLAVE;
3107
3108                 hci_add_ltk(hdev, &key->addr.bdaddr,
3109                             bdaddr_to_le(key->addr.type),
3110                             type, 0, key->authenticated, key->val,
3111                             key->enc_size, key->ediv, key->rand);
3112         }
3113
3114         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3115                            NULL, 0);
3116
3117         hci_dev_unlock(hdev);
3118
3119         return err;
3120 }
3121
3122 static const struct mgmt_handler {
3123         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3124                      u16 data_len);
3125         bool var_len;
3126         size_t data_len;
3127 } mgmt_handlers[] = {
3128         { NULL }, /* 0x0000 (no command) */
3129         { read_version,           false, MGMT_READ_VERSION_SIZE },
3130         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3131         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3132         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3133         { set_powered,            false, MGMT_SETTING_SIZE },
3134         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3135         { set_connectable,        false, MGMT_SETTING_SIZE },
3136         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3137         { set_pairable,           false, MGMT_SETTING_SIZE },
3138         { set_link_security,      false, MGMT_SETTING_SIZE },
3139         { set_ssp,                false, MGMT_SETTING_SIZE },
3140         { set_hs,                 false, MGMT_SETTING_SIZE },
3141         { set_le,                 false, MGMT_SETTING_SIZE },
3142         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3143         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3144         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3145         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3146         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3147         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3148         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3149         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3150         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3151         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3152         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3153         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3154         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3155         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3156         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3157         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3158         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3159         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3160         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3161         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3162         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3163         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3164         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3165         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3166         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3167         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3168         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3169 };
3170
3171
3172 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3173 {
3174         void *buf;
3175         u8 *cp;
3176         struct mgmt_hdr *hdr;
3177         u16 opcode, index, len;
3178         struct hci_dev *hdev = NULL;
3179         const struct mgmt_handler *handler;
3180         int err;
3181
3182         BT_DBG("got %zu bytes", msglen);
3183
3184         if (msglen < sizeof(*hdr))
3185                 return -EINVAL;
3186
3187         buf = kmalloc(msglen, GFP_KERNEL);
3188         if (!buf)
3189                 return -ENOMEM;
3190
3191         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3192                 err = -EFAULT;
3193                 goto done;
3194         }
3195
3196         hdr = buf;
3197         opcode = __le16_to_cpu(hdr->opcode);
3198         index = __le16_to_cpu(hdr->index);
3199         len = __le16_to_cpu(hdr->len);
3200
3201         if (len != msglen - sizeof(*hdr)) {
3202                 err = -EINVAL;
3203                 goto done;
3204         }
3205
3206         if (index != MGMT_INDEX_NONE) {
3207                 hdev = hci_dev_get(index);
3208                 if (!hdev) {
3209                         err = cmd_status(sk, index, opcode,
3210                                          MGMT_STATUS_INVALID_INDEX);
3211                         goto done;
3212                 }
3213         }
3214
3215         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3216             mgmt_handlers[opcode].func == NULL) {
3217                 BT_DBG("Unknown op %u", opcode);
3218                 err = cmd_status(sk, index, opcode,
3219                                  MGMT_STATUS_UNKNOWN_COMMAND);
3220                 goto done;
3221         }
3222
3223         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3224             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3225                 err = cmd_status(sk, index, opcode,
3226                                  MGMT_STATUS_INVALID_INDEX);
3227                 goto done;
3228         }
3229
3230         handler = &mgmt_handlers[opcode];
3231
3232         if ((handler->var_len && len < handler->data_len) ||
3233             (!handler->var_len && len != handler->data_len)) {
3234                 err = cmd_status(sk, index, opcode,
3235                                  MGMT_STATUS_INVALID_PARAMS);
3236                 goto done;
3237         }
3238
3239         if (hdev)
3240                 mgmt_init_hdev(sk, hdev);
3241
3242         cp = buf + sizeof(*hdr);
3243
3244         err = handler->func(sk, hdev, cp, len);
3245         if (err < 0)
3246                 goto done;
3247
3248         err = msglen;
3249
3250 done:
3251         if (hdev)
3252                 hci_dev_put(hdev);
3253
3254         kfree(buf);
3255         return err;
3256 }
3257
3258 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
3259 {
3260         u8 *status = data;
3261
3262         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
3263         mgmt_pending_remove(cmd);
3264 }
3265
3266 int mgmt_index_added(struct hci_dev *hdev)
3267 {
3268         if (!mgmt_valid_hdev(hdev))
3269                 return -ENOTSUPP;
3270
3271         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3272 }
3273
3274 int mgmt_index_removed(struct hci_dev *hdev)
3275 {
3276         u8 status = MGMT_STATUS_INVALID_INDEX;
3277
3278         if (!mgmt_valid_hdev(hdev))
3279                 return -ENOTSUPP;
3280
3281         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3282
3283         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3284 }
3285
3286 struct cmd_lookup {
3287         struct sock *sk;
3288         struct hci_dev *hdev;
3289         u8 mgmt_status;
3290 };
3291
3292 static void settings_rsp(struct pending_cmd *cmd, void *data)
3293 {
3294         struct cmd_lookup *match = data;
3295
3296         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
3297
3298         list_del(&cmd->list);
3299
3300         if (match->sk == NULL) {
3301                 match->sk = cmd->sk;
3302                 sock_hold(match->sk);
3303         }
3304
3305         mgmt_pending_free(cmd);
3306 }
3307
3308 static void set_bredr_scan(struct hci_request *req)
3309 {
3310         struct hci_dev *hdev = req->hdev;
3311         u8 scan = 0;
3312
3313         /* Ensure that fast connectable is disabled. This function will
3314          * not do anything if the page scan parameters are already what
3315          * they should be.
3316          */
3317         write_fast_connectable(req, false);
3318
3319         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3320                 scan |= SCAN_PAGE;
3321         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3322                 scan |= SCAN_INQUIRY;
3323
3324         if (scan)
3325                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3326 }
3327
3328 static void powered_complete(struct hci_dev *hdev, u8 status)
3329 {
3330         struct cmd_lookup match = { NULL, hdev };
3331
3332         BT_DBG("status 0x%02x", status);
3333
3334         hci_dev_lock(hdev);
3335
3336         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3337
3338         new_settings(hdev, match.sk);
3339
3340         hci_dev_unlock(hdev);
3341
3342         if (match.sk)
3343                 sock_put(match.sk);
3344 }
3345
3346 static int powered_update_hci(struct hci_dev *hdev)
3347 {
3348         struct hci_request req;
3349         u8 link_sec;
3350
3351         hci_req_init(&req, hdev);
3352
3353         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3354             !lmp_host_ssp_capable(hdev)) {
3355                 u8 ssp = 1;
3356
3357                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3358         }
3359
3360         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
3361             lmp_bredr_capable(hdev)) {
3362                 struct hci_cp_write_le_host_supported cp;
3363
3364                 cp.le = 1;
3365                 cp.simul = lmp_le_br_capable(hdev);
3366
3367                 /* Check first if we already have the right
3368                  * host state (host features set)
3369                  */
3370                 if (cp.le != lmp_host_le_capable(hdev) ||
3371                     cp.simul != lmp_host_le_br_capable(hdev))
3372                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3373                                     sizeof(cp), &cp);
3374         }
3375
3376         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3377         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3378                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3379                             sizeof(link_sec), &link_sec);
3380
3381         if (lmp_bredr_capable(hdev)) {
3382                 set_bredr_scan(&req);
3383                 update_class(&req);
3384                 update_name(&req);
3385                 update_eir(&req);
3386         }
3387
3388         return hci_req_run(&req, powered_complete);
3389 }
3390
3391 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3392 {
3393         struct cmd_lookup match = { NULL, hdev };
3394         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3395         u8 zero_cod[] = { 0, 0, 0 };
3396         int err;
3397
3398         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3399                 return 0;
3400
3401         if (powered) {
3402                 if (powered_update_hci(hdev) == 0)
3403                         return 0;
3404
3405                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3406                                      &match);
3407                 goto new_settings;
3408         }
3409
3410         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3411         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3412
3413         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3414                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3415                            zero_cod, sizeof(zero_cod), NULL);
3416
3417 new_settings:
3418         err = new_settings(hdev, match.sk);
3419
3420         if (match.sk)
3421                 sock_put(match.sk);
3422
3423         return err;
3424 }
3425
3426 int mgmt_set_powered_failed(struct hci_dev *hdev, int err)
3427 {
3428         struct pending_cmd *cmd;
3429         u8 status;
3430
3431         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
3432         if (!cmd)
3433                 return -ENOENT;
3434
3435         if (err == -ERFKILL)
3436                 status = MGMT_STATUS_RFKILLED;
3437         else
3438                 status = MGMT_STATUS_FAILED;
3439
3440         err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
3441
3442         mgmt_pending_remove(cmd);
3443
3444         return err;
3445 }
3446
3447 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3448 {
3449         struct cmd_lookup match = { NULL, hdev };
3450         bool changed = false;
3451         int err = 0;
3452
3453         if (discoverable) {
3454                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3455                         changed = true;
3456         } else {
3457                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3458                         changed = true;
3459         }
3460
3461         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3462                              &match);
3463
3464         if (changed)
3465                 err = new_settings(hdev, match.sk);
3466
3467         if (match.sk)
3468                 sock_put(match.sk);
3469
3470         return err;
3471 }
3472
3473 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3474 {
3475         struct pending_cmd *cmd;
3476         bool changed = false;
3477         int err = 0;
3478
3479         if (connectable) {
3480                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3481                         changed = true;
3482         } else {
3483                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3484                         changed = true;
3485         }
3486
3487         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
3488
3489         if (changed)
3490                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
3491
3492         return err;
3493 }
3494
3495 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3496 {
3497         u8 mgmt_err = mgmt_status(status);
3498
3499         if (scan & SCAN_PAGE)
3500                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3501                                      cmd_status_rsp, &mgmt_err);
3502
3503         if (scan & SCAN_INQUIRY)
3504                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3505                                      cmd_status_rsp, &mgmt_err);
3506
3507         return 0;
3508 }
3509
3510 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3511                       bool persistent)
3512 {
3513         struct mgmt_ev_new_link_key ev;
3514
3515         memset(&ev, 0, sizeof(ev));
3516
3517         ev.store_hint = persistent;
3518         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3519         ev.key.addr.type = BDADDR_BREDR;
3520         ev.key.type = key->type;
3521         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3522         ev.key.pin_len = key->pin_len;
3523
3524         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3525 }
3526
3527 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3528 {
3529         struct mgmt_ev_new_long_term_key ev;
3530
3531         memset(&ev, 0, sizeof(ev));
3532
3533         ev.store_hint = persistent;
3534         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3535         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3536         ev.key.authenticated = key->authenticated;
3537         ev.key.enc_size = key->enc_size;
3538         ev.key.ediv = key->ediv;
3539
3540         if (key->type == HCI_SMP_LTK)
3541                 ev.key.master = 1;
3542
3543         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3544         memcpy(ev.key.val, key->val, sizeof(key->val));
3545
3546         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3547                           NULL);
3548 }
3549
3550 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3551                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3552                           u8 *dev_class)
3553 {
3554         char buf[512];
3555         struct mgmt_ev_device_connected *ev = (void *) buf;
3556         u16 eir_len = 0;
3557
3558         bacpy(&ev->addr.bdaddr, bdaddr);
3559         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3560
3561         ev->flags = __cpu_to_le32(flags);
3562
3563         if (name_len > 0)
3564                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3565                                           name, name_len);
3566
3567         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3568                 eir_len = eir_append_data(ev->eir, eir_len,
3569                                           EIR_CLASS_OF_DEV, dev_class, 3);
3570
3571         ev->eir_len = cpu_to_le16(eir_len);
3572
3573         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3574                           sizeof(*ev) + eir_len, NULL);
3575 }
3576
3577 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3578 {
3579         struct mgmt_cp_disconnect *cp = cmd->param;
3580         struct sock **sk = data;
3581         struct mgmt_rp_disconnect rp;
3582
3583         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3584         rp.addr.type = cp->addr.type;
3585
3586         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3587                      sizeof(rp));
3588
3589         *sk = cmd->sk;
3590         sock_hold(*sk);
3591
3592         mgmt_pending_remove(cmd);
3593 }
3594
3595 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3596 {
3597         struct hci_dev *hdev = data;
3598         struct mgmt_cp_unpair_device *cp = cmd->param;
3599         struct mgmt_rp_unpair_device rp;
3600
3601         memset(&rp, 0, sizeof(rp));
3602         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3603         rp.addr.type = cp->addr.type;
3604
3605         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3606
3607         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3608
3609         mgmt_pending_remove(cmd);
3610 }
3611
3612 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3613                              u8 link_type, u8 addr_type, u8 reason)
3614 {
3615         struct mgmt_ev_device_disconnected ev;
3616         struct sock *sk = NULL;
3617         int err;
3618
3619         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3620
3621         bacpy(&ev.addr.bdaddr, bdaddr);
3622         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3623         ev.reason = reason;
3624
3625         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3626                          sk);
3627
3628         if (sk)
3629                 sock_put(sk);
3630
3631         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3632                              hdev);
3633
3634         return err;
3635 }
3636
3637 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3638                            u8 link_type, u8 addr_type, u8 status)
3639 {
3640         struct mgmt_rp_disconnect rp;
3641         struct pending_cmd *cmd;
3642         int err;
3643
3644         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3645                              hdev);
3646
3647         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3648         if (!cmd)
3649                 return -ENOENT;
3650
3651         bacpy(&rp.addr.bdaddr, bdaddr);
3652         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3653
3654         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3655                            mgmt_status(status), &rp, sizeof(rp));
3656
3657         mgmt_pending_remove(cmd);
3658
3659         return err;
3660 }
3661
3662 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3663                         u8 addr_type, u8 status)
3664 {
3665         struct mgmt_ev_connect_failed ev;
3666
3667         bacpy(&ev.addr.bdaddr, bdaddr);
3668         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3669         ev.status = mgmt_status(status);
3670
3671         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3672 }
3673
3674 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3675 {
3676         struct mgmt_ev_pin_code_request ev;
3677
3678         bacpy(&ev.addr.bdaddr, bdaddr);
3679         ev.addr.type = BDADDR_BREDR;
3680         ev.secure = secure;
3681
3682         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3683                           NULL);
3684 }
3685
3686 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3687                                  u8 status)
3688 {
3689         struct pending_cmd *cmd;
3690         struct mgmt_rp_pin_code_reply rp;
3691         int err;
3692
3693         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3694         if (!cmd)
3695                 return -ENOENT;
3696
3697         bacpy(&rp.addr.bdaddr, bdaddr);
3698         rp.addr.type = BDADDR_BREDR;
3699
3700         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3701                            mgmt_status(status), &rp, sizeof(rp));
3702
3703         mgmt_pending_remove(cmd);
3704
3705         return err;
3706 }
3707
3708 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3709                                      u8 status)
3710 {
3711         struct pending_cmd *cmd;
3712         struct mgmt_rp_pin_code_reply rp;
3713         int err;
3714
3715         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3716         if (!cmd)
3717                 return -ENOENT;
3718
3719         bacpy(&rp.addr.bdaddr, bdaddr);
3720         rp.addr.type = BDADDR_BREDR;
3721
3722         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3723                            mgmt_status(status), &rp, sizeof(rp));
3724
3725         mgmt_pending_remove(cmd);
3726
3727         return err;
3728 }
3729
3730 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3731                               u8 link_type, u8 addr_type, __le32 value,
3732                               u8 confirm_hint)
3733 {
3734         struct mgmt_ev_user_confirm_request ev;
3735
3736         BT_DBG("%s", hdev->name);
3737
3738         bacpy(&ev.addr.bdaddr, bdaddr);
3739         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3740         ev.confirm_hint = confirm_hint;
3741         ev.value = value;
3742
3743         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3744                           NULL);
3745 }
3746
3747 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3748                               u8 link_type, u8 addr_type)
3749 {
3750         struct mgmt_ev_user_passkey_request ev;
3751
3752         BT_DBG("%s", hdev->name);
3753
3754         bacpy(&ev.addr.bdaddr, bdaddr);
3755         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3756
3757         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3758                           NULL);
3759 }
3760
3761 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3762                                       u8 link_type, u8 addr_type, u8 status,
3763                                       u8 opcode)
3764 {
3765         struct pending_cmd *cmd;
3766         struct mgmt_rp_user_confirm_reply rp;
3767         int err;
3768
3769         cmd = mgmt_pending_find(opcode, hdev);
3770         if (!cmd)
3771                 return -ENOENT;
3772
3773         bacpy(&rp.addr.bdaddr, bdaddr);
3774         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3775         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3776                            &rp, sizeof(rp));
3777
3778         mgmt_pending_remove(cmd);
3779
3780         return err;
3781 }
3782
3783 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3784                                      u8 link_type, u8 addr_type, u8 status)
3785 {
3786         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3787                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3788 }
3789
3790 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3791                                          u8 link_type, u8 addr_type, u8 status)
3792 {
3793         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3794                                           status,
3795                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3796 }
3797
3798 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3799                                      u8 link_type, u8 addr_type, u8 status)
3800 {
3801         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3802                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3803 }
3804
3805 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3806                                          u8 link_type, u8 addr_type, u8 status)
3807 {
3808         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3809                                           status,
3810                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3811 }
3812
3813 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3814                              u8 link_type, u8 addr_type, u32 passkey,
3815                              u8 entered)
3816 {
3817         struct mgmt_ev_passkey_notify ev;
3818
3819         BT_DBG("%s", hdev->name);
3820
3821         bacpy(&ev.addr.bdaddr, bdaddr);
3822         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3823         ev.passkey = __cpu_to_le32(passkey);
3824         ev.entered = entered;
3825
3826         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3827 }
3828
3829 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3830                      u8 addr_type, u8 status)
3831 {
3832         struct mgmt_ev_auth_failed ev;
3833
3834         bacpy(&ev.addr.bdaddr, bdaddr);
3835         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3836         ev.status = mgmt_status(status);
3837
3838         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3839 }
3840
3841 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3842 {
3843         struct cmd_lookup match = { NULL, hdev };
3844         bool changed = false;
3845         int err = 0;
3846
3847         if (status) {
3848                 u8 mgmt_err = mgmt_status(status);
3849                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3850                                      cmd_status_rsp, &mgmt_err);
3851                 return 0;
3852         }
3853
3854         if (test_bit(HCI_AUTH, &hdev->flags)) {
3855                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3856                         changed = true;
3857         } else {
3858                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3859                         changed = true;
3860         }
3861
3862         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3863                              &match);
3864
3865         if (changed)
3866                 err = new_settings(hdev, match.sk);
3867
3868         if (match.sk)
3869                 sock_put(match.sk);
3870
3871         return err;
3872 }
3873
3874 static void clear_eir(struct hci_request *req)
3875 {
3876         struct hci_dev *hdev = req->hdev;
3877         struct hci_cp_write_eir cp;
3878
3879         if (!lmp_ext_inq_capable(hdev))
3880                 return;
3881
3882         memset(hdev->eir, 0, sizeof(hdev->eir));
3883
3884         memset(&cp, 0, sizeof(cp));
3885
3886         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3887 }
3888
3889 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3890 {
3891         struct cmd_lookup match = { NULL, hdev };
3892         struct hci_request req;
3893         bool changed = false;
3894         int err = 0;
3895
3896         if (status) {
3897                 u8 mgmt_err = mgmt_status(status);
3898
3899                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3900                                                  &hdev->dev_flags))
3901                         err = new_settings(hdev, NULL);
3902
3903                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3904                                      &mgmt_err);
3905
3906                 return err;
3907         }
3908
3909         if (enable) {
3910                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3911                         changed = true;
3912         } else {
3913                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3914                         changed = true;
3915         }
3916
3917         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3918
3919         if (changed)
3920                 err = new_settings(hdev, match.sk);
3921
3922         if (match.sk)
3923                 sock_put(match.sk);
3924
3925         hci_req_init(&req, hdev);
3926
3927         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3928                 update_eir(&req);
3929         else
3930                 clear_eir(&req);
3931
3932         hci_req_run(&req, NULL);
3933
3934         return err;
3935 }
3936
3937 static void sk_lookup(struct pending_cmd *cmd, void *data)
3938 {
3939         struct cmd_lookup *match = data;
3940
3941         if (match->sk == NULL) {
3942                 match->sk = cmd->sk;
3943                 sock_hold(match->sk);
3944         }
3945 }
3946
3947 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3948                                    u8 status)
3949 {
3950         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3951         int err = 0;
3952
3953         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
3954         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
3955         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
3956
3957         if (!status)
3958                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3959                                  3, NULL);
3960
3961         if (match.sk)
3962                 sock_put(match.sk);
3963
3964         return err;
3965 }
3966
3967 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3968 {
3969         struct mgmt_cp_set_local_name ev;
3970         struct pending_cmd *cmd;
3971
3972         if (status)
3973                 return 0;
3974
3975         memset(&ev, 0, sizeof(ev));
3976         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3977         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3978
3979         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3980         if (!cmd) {
3981                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3982
3983                 /* If this is a HCI command related to powering on the
3984                  * HCI dev don't send any mgmt signals.
3985                  */
3986                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
3987                         return 0;
3988         }
3989
3990         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
3991                           cmd ? cmd->sk : NULL);
3992 }
3993
3994 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3995                                             u8 *randomizer, u8 status)
3996 {
3997         struct pending_cmd *cmd;
3998         int err;
3999
4000         BT_DBG("%s status %u", hdev->name, status);
4001
4002         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4003         if (!cmd)
4004                 return -ENOENT;
4005
4006         if (status) {
4007                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4008                                  mgmt_status(status));
4009         } else {
4010                 struct mgmt_rp_read_local_oob_data rp;
4011
4012                 memcpy(rp.hash, hash, sizeof(rp.hash));
4013                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4014
4015                 err = cmd_complete(cmd->sk, hdev->id,
4016                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4017                                    sizeof(rp));
4018         }
4019
4020         mgmt_pending_remove(cmd);
4021
4022         return err;
4023 }
4024
4025 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4026 {
4027         struct cmd_lookup match = { NULL, hdev };
4028         bool changed = false;
4029         int err = 0;
4030
4031         if (status) {
4032                 u8 mgmt_err = mgmt_status(status);
4033
4034                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
4035                                                  &hdev->dev_flags))
4036                         err = new_settings(hdev, NULL);
4037
4038                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
4039                                      &mgmt_err);
4040
4041                 return err;
4042         }
4043
4044         if (enable) {
4045                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4046                         changed = true;
4047         } else {
4048                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4049                         changed = true;
4050         }
4051
4052         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
4053
4054         if (changed)
4055                 err = new_settings(hdev, match.sk);
4056
4057         if (match.sk)
4058                 sock_put(match.sk);
4059
4060         return err;
4061 }
4062
4063 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4064                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4065                       ssp, u8 *eir, u16 eir_len)
4066 {
4067         char buf[512];
4068         struct mgmt_ev_device_found *ev = (void *) buf;
4069         size_t ev_size;
4070
4071         /* Leave 5 bytes for a potential CoD field */
4072         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4073                 return -EINVAL;
4074
4075         memset(buf, 0, sizeof(buf));
4076
4077         bacpy(&ev->addr.bdaddr, bdaddr);
4078         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4079         ev->rssi = rssi;
4080         if (cfm_name)
4081                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4082         if (!ssp)
4083                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4084
4085         if (eir_len > 0)
4086                 memcpy(ev->eir, eir, eir_len);
4087
4088         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4089                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4090                                           dev_class, 3);
4091
4092         ev->eir_len = cpu_to_le16(eir_len);
4093         ev_size = sizeof(*ev) + eir_len;
4094
4095         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4096 }
4097
4098 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4099                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4100 {
4101         struct mgmt_ev_device_found *ev;
4102         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4103         u16 eir_len;
4104
4105         ev = (struct mgmt_ev_device_found *) buf;
4106
4107         memset(buf, 0, sizeof(buf));
4108
4109         bacpy(&ev->addr.bdaddr, bdaddr);
4110         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4111         ev->rssi = rssi;
4112
4113         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4114                                   name_len);
4115
4116         ev->eir_len = cpu_to_le16(eir_len);
4117
4118         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4119                           sizeof(*ev) + eir_len, NULL);
4120 }
4121
4122 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
4123 {
4124         struct pending_cmd *cmd;
4125         u8 type;
4126         int err;
4127
4128         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4129
4130         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4131         if (!cmd)
4132                 return -ENOENT;
4133
4134         type = hdev->discovery.type;
4135
4136         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
4137                            &type, sizeof(type));
4138         mgmt_pending_remove(cmd);
4139
4140         return err;
4141 }
4142
4143 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
4144 {
4145         struct pending_cmd *cmd;
4146         int err;
4147
4148         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4149         if (!cmd)
4150                 return -ENOENT;
4151
4152         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
4153                            &hdev->discovery.type, sizeof(hdev->discovery.type));
4154         mgmt_pending_remove(cmd);
4155
4156         return err;
4157 }
4158
4159 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4160 {
4161         struct mgmt_ev_discovering ev;
4162         struct pending_cmd *cmd;
4163
4164         BT_DBG("%s discovering %u", hdev->name, discovering);
4165
4166         if (discovering)
4167                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4168         else
4169                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4170
4171         if (cmd != NULL) {
4172                 u8 type = hdev->discovery.type;
4173
4174                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4175                              sizeof(type));
4176                 mgmt_pending_remove(cmd);
4177         }
4178
4179         memset(&ev, 0, sizeof(ev));
4180         ev.type = hdev->discovery.type;
4181         ev.discovering = discovering;
4182
4183         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4184 }
4185
4186 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4187 {
4188         struct pending_cmd *cmd;
4189         struct mgmt_ev_device_blocked ev;
4190
4191         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4192
4193         bacpy(&ev.addr.bdaddr, bdaddr);
4194         ev.addr.type = type;
4195
4196         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4197                           cmd ? cmd->sk : NULL);
4198 }
4199
4200 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4201 {
4202         struct pending_cmd *cmd;
4203         struct mgmt_ev_device_unblocked ev;
4204
4205         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4206
4207         bacpy(&ev.addr.bdaddr, bdaddr);
4208         ev.addr.type = type;
4209
4210         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4211                           cmd ? cmd->sk : NULL);
4212 }
4213
4214 module_param(enable_hs, bool, 0644);
4215 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");