net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/kernel.h>
  28 #include <linux/uaccess.h>
  29 #include <linux/module.h>
  30 #include <asm/unaligned.h>
  31
  32 #include <net/bluetooth/bluetooth.h>
  33 #include <net/bluetooth/hci_core.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #include <net/bluetooth/smp.h>
  36
  37 bool enable_hs;
  38 bool enable_le;
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   1
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_PAIRABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81         MGMT_OP_SET_DEVICE_ID,
  82 };
  83
  84 static const u16 mgmt_events[] = {
  85         MGMT_EV_CONTROLLER_ERROR,
  86         MGMT_EV_INDEX_ADDED,
  87         MGMT_EV_INDEX_REMOVED,
  88         MGMT_EV_NEW_SETTINGS,
  89         MGMT_EV_CLASS_OF_DEV_CHANGED,
  90         MGMT_EV_LOCAL_NAME_CHANGED,
  91         MGMT_EV_NEW_LINK_KEY,
  92         MGMT_EV_NEW_LONG_TERM_KEY,
  93         MGMT_EV_DEVICE_CONNECTED,
  94         MGMT_EV_DEVICE_DISCONNECTED,
  95         MGMT_EV_CONNECT_FAILED,
  96         MGMT_EV_PIN_CODE_REQUEST,
  97         MGMT_EV_USER_CONFIRM_REQUEST,
  98         MGMT_EV_USER_PASSKEY_REQUEST,
  99         MGMT_EV_AUTH_FAILED,
 100         MGMT_EV_DEVICE_FOUND,
 101         MGMT_EV_DISCOVERING,
 102         MGMT_EV_DEVICE_BLOCKED,
 103         MGMT_EV_DEVICE_UNBLOCKED,
 104         MGMT_EV_DEVICE_UNPAIRED,
 105 };
 106
 107 /*
 108  * These LE scan and inquiry parameters were chosen according to LE General
 109  * Discovery Procedure specification.
 110  */
 111 #define LE_SCAN_TYPE                    0x01
 112 #define LE_SCAN_WIN                     0x12
 113 #define LE_SCAN_INT                     0x12
 114 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 115 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 116
 117 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 118 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 119
 120 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 121
 122 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 123                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 124
 125 struct pending_cmd {
 126         struct list_head list;
 127         u16 opcode;
 128         int index;
 129         void *param;
 130         struct sock *sk;
 131         void *user_data;
 132 };
 133
 134 /* HCI to MGMT error code conversion table */
 135 static u8 mgmt_status_table[] = {
 136         MGMT_STATUS_SUCCESS,
 137         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 138         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 139         MGMT_STATUS_FAILED,             /* Hardware Failure */
 140         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 141         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 142         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 143         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 144         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 145         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 146         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 147         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 148         MGMT_STATUS_BUSY,               /* Command Disallowed */
 149         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 150         MGMT_STATUS_REJECTED,           /* Rejected Security */
 151         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 152         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 153         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 154         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 155         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 156         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 157         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 158         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 159         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 160         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 161         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 162         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 163         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 164         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 165         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 166         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 167         MGMT_STATUS_FAILED,             /* Unspecified Error */
 168         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 169         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 170         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 171         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 172         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 173         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 174         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 176         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 177         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 178         MGMT_STATUS_FAILED,             /* Transaction Collision */
 179         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 180         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 181         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 182         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 183         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 184         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 185         MGMT_STATUS_FAILED,             /* Slot Violation */
 186         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 187         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 188         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 189         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 190         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 191         MGMT_STATUS_BUSY,               /* Controller Busy */
 192         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 193         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 194         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 195         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 196         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 197 };
 198
 199 static u8 mgmt_status(u8 hci_status)
 200 {
 201         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 202                 return mgmt_status_table[hci_status];
 203
 204         return MGMT_STATUS_FAILED;
 205 }
 206
 207 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 208 {
 209         struct sk_buff *skb;
 210         struct mgmt_hdr *hdr;
 211         struct mgmt_ev_cmd_status *ev;
 212         int err;
 213
 214         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 215
 216         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
 217         if (!skb)
 218                 return -ENOMEM;
 219
 220         hdr = (void *) skb_put(skb, sizeof(*hdr));
 221
 222         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 223         hdr->index = cpu_to_le16(index);
 224         hdr->len = cpu_to_le16(sizeof(*ev));
 225
 226         ev = (void *) skb_put(skb, sizeof(*ev));
 227         ev->status = status;
 228         ev->opcode = cpu_to_le16(cmd);
 229
 230         err = sock_queue_rcv_skb(sk, skb);
 231         if (err < 0)
 232                 kfree_skb(skb);
 233
 234         return err;
 235 }
 236
 237 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 238                         void *rp, size_t rp_len)
 239 {
 240         struct sk_buff *skb;
 241         struct mgmt_hdr *hdr;
 242         struct mgmt_ev_cmd_complete *ev;
 243         int err;
 244
 245         BT_DBG("sock %p", sk);
 246
 247         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
 248         if (!skb)
 249                 return -ENOMEM;
 250
 251         hdr = (void *) skb_put(skb, sizeof(*hdr));
 252
 253         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 254         hdr->index = cpu_to_le16(index);
 255         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 256
 257         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 258         ev->opcode = cpu_to_le16(cmd);
 259         ev->status = status;
 260
 261         if (rp)
 262                 memcpy(ev->data, rp, rp_len);
 263
 264         err = sock_queue_rcv_skb(sk, skb);
 265         if (err < 0)
 266                 kfree_skb(skb);
 267
 268         return err;
 269 }
 270
 271 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 272                         u16 data_len)
 273 {
 274         struct mgmt_rp_read_version rp;
 275
 276         BT_DBG("sock %p", sk);
 277
 278         rp.version = MGMT_VERSION;
 279         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 280
 281         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 282                             sizeof(rp));
 283 }
 284
 285 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 286                          u16 data_len)
 287 {
 288         struct mgmt_rp_read_commands *rp;
 289         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 290         const u16 num_events = ARRAY_SIZE(mgmt_events);
 291         __le16 *opcode;
 292         size_t rp_size;
 293         int i, err;
 294
 295         BT_DBG("sock %p", sk);
 296
 297         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 298
 299         rp = kmalloc(rp_size, GFP_KERNEL);
 300         if (!rp)
 301                 return -ENOMEM;
 302
 303         rp->num_commands = __constant_cpu_to_le16(num_commands);
 304         rp->num_events = __constant_cpu_to_le16(num_events);
 305
 306         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 307                 put_unaligned_le16(mgmt_commands[i], opcode);
 308
 309         for (i = 0; i < num_events; i++, opcode++)
 310                 put_unaligned_le16(mgmt_events[i], opcode);
 311
 312         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 313                            rp_size);
 314         kfree(rp);
 315
 316         return err;
 317 }
 318
 319 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 320                            u16 data_len)
 321 {
 322         struct mgmt_rp_read_index_list *rp;
 323         struct list_head *p;
 324         struct hci_dev *d;
 325         size_t rp_len;
 326         u16 count;
 327         int i, err;
 328
 329         BT_DBG("sock %p", sk);
 330
 331         read_lock(&hci_dev_list_lock);
 332
 333         count = 0;
 334         list_for_each(p, &hci_dev_list) {
 335                 count++;
 336         }
 337
 338         rp_len = sizeof(*rp) + (2 * count);
 339         rp = kmalloc(rp_len, GFP_ATOMIC);
 340         if (!rp) {
 341                 read_unlock(&hci_dev_list_lock);
 342                 return -ENOMEM;
 343         }
 344
 345         rp->num_controllers = cpu_to_le16(count);
 346
 347         i = 0;
 348         list_for_each_entry(d, &hci_dev_list, list) {
 349                 if (test_bit(HCI_SETUP, &d->dev_flags))
 350                         continue;
 351
 352                 rp->index[i++] = cpu_to_le16(d->id);
 353                 BT_DBG("Added hci%u", d->id);
 354         }
 355
 356         read_unlock(&hci_dev_list_lock);
 357
 358         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 359                            rp_len);
 360
 361         kfree(rp);
 362
 363         return err;
 364 }
 365
 366 static u32 get_supported_settings(struct hci_dev *hdev)
 367 {
 368         u32 settings = 0;
 369
 370         settings |= MGMT_SETTING_POWERED;
 371         settings |= MGMT_SETTING_CONNECTABLE;
 372         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 373         settings |= MGMT_SETTING_DISCOVERABLE;
 374         settings |= MGMT_SETTING_PAIRABLE;
 375
 376         if (hdev->features[6] & LMP_SIMPLE_PAIR)
 377                 settings |= MGMT_SETTING_SSP;
 378
 379         if (!(hdev->features[4] & LMP_NO_BREDR)) {
 380                 settings |= MGMT_SETTING_BREDR;
 381                 settings |= MGMT_SETTING_LINK_SECURITY;
 382         }
 383
 384         if (enable_hs)
 385                 settings |= MGMT_SETTING_HS;
 386
 387         if (enable_le) {
 388                 if (hdev->features[4] & LMP_LE)
 389                         settings |= MGMT_SETTING_LE;
 390         }
 391
 392         return settings;
 393 }
 394
 395 static u32 get_current_settings(struct hci_dev *hdev)
 396 {
 397         u32 settings = 0;
 398
 399         if (hdev_is_powered(hdev))
 400                 settings |= MGMT_SETTING_POWERED;
 401
 402         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 403                 settings |= MGMT_SETTING_CONNECTABLE;
 404
 405         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 406                 settings |= MGMT_SETTING_DISCOVERABLE;
 407
 408         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 409                 settings |= MGMT_SETTING_PAIRABLE;
 410
 411         if (!(hdev->features[4] & LMP_NO_BREDR))
 412                 settings |= MGMT_SETTING_BREDR;
 413
 414         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 415                 settings |= MGMT_SETTING_LE;
 416
 417         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 418                 settings |= MGMT_SETTING_LINK_SECURITY;
 419
 420         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 421                 settings |= MGMT_SETTING_SSP;
 422
 423         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 424                 settings |= MGMT_SETTING_HS;
 425
 426         return settings;
 427 }
 428
 429 #define PNP_INFO_SVCLASS_ID             0x1200
 430
 431 static u8 bluetooth_base_uuid[] = {
 432                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 433                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 434 };
 435
 436 static u16 get_uuid16(u8 *uuid128)
 437 {
 438         u32 val;
 439         int i;
 440
 441         for (i = 0; i < 12; i++) {
 442                 if (bluetooth_base_uuid[i] != uuid128[i])
 443                         return 0;
 444         }
 445
 446         val = get_unaligned_le32(&uuid128[12]);
 447         if (val > 0xffff)
 448                 return 0;
 449
 450         return (u16) val;
 451 }
 452
 453 static void create_eir(struct hci_dev *hdev, u8 *data)
 454 {
 455         u8 *ptr = data;
 456         u16 eir_len = 0;
 457         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 458         int i, truncated = 0;
 459         struct bt_uuid *uuid;
 460         size_t name_len;
 461
 462         name_len = strlen(hdev->dev_name);
 463
 464         if (name_len > 0) {
 465                 /* EIR Data type */
 466                 if (name_len > 48) {
 467                         name_len = 48;
 468                         ptr[1] = EIR_NAME_SHORT;
 469                 } else
 470                         ptr[1] = EIR_NAME_COMPLETE;
 471
 472                 /* EIR Data length */
 473                 ptr[0] = name_len + 1;
 474
 475                 memcpy(ptr + 2, hdev->dev_name, name_len);
 476
 477                 eir_len += (name_len + 2);
 478                 ptr += (name_len + 2);
 479         }
 480
 481         if (hdev->inq_tx_power) {
 482                 ptr[0] = 2;
 483                 ptr[1] = EIR_TX_POWER;
 484                 ptr[2] = (u8) hdev->inq_tx_power;
 485
 486                 eir_len += 3;
 487                 ptr += 3;
 488         }
 489
 490         if (hdev->devid_source > 0) {
 491                 ptr[0] = 9;
 492                 ptr[1] = EIR_DEVICE_ID;
 493
 494                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 495                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 496                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 497                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 498
 499                 eir_len += 10;
 500                 ptr += 10;
 501         }
 502
 503         memset(uuid16_list, 0, sizeof(uuid16_list));
 504
 505         /* Group all UUID16 types */
 506         list_for_each_entry(uuid, &hdev->uuids, list) {
 507                 u16 uuid16;
 508
 509                 uuid16 = get_uuid16(uuid->uuid);
 510                 if (uuid16 == 0)
 511                         return;
 512
 513                 if (uuid16 < 0x1100)
 514                         continue;
 515
 516                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 517                         continue;
 518
 519                 /* Stop if not enough space to put next UUID */
 520                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 521                         truncated = 1;
 522                         break;
 523                 }
 524
 525                 /* Check for duplicates */
 526                 for (i = 0; uuid16_list[i] != 0; i++)
 527                         if (uuid16_list[i] == uuid16)
 528                                 break;
 529
 530                 if (uuid16_list[i] == 0) {
 531                         uuid16_list[i] = uuid16;
 532                         eir_len += sizeof(u16);
 533                 }
 534         }
 535
 536         if (uuid16_list[0] != 0) {
 537                 u8 *length = ptr;
 538
 539                 /* EIR Data type */
 540                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 541
 542                 ptr += 2;
 543                 eir_len += 2;
 544
 545                 for (i = 0; uuid16_list[i] != 0; i++) {
 546                         *ptr++ = (uuid16_list[i] & 0x00ff);
 547                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 548                 }
 549
 550                 /* EIR Data length */
 551                 *length = (i * sizeof(u16)) + 1;
 552         }
 553 }
 554
 555 static int update_eir(struct hci_dev *hdev)
 556 {
 557         struct hci_cp_write_eir cp;
 558
 559         if (!hdev_is_powered(hdev))
 560                 return 0;
 561
 562         if (!(hdev->features[6] & LMP_EXT_INQ))
 563                 return 0;
 564
 565         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 566                 return 0;
 567
 568         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 569                 return 0;
 570
 571         memset(&cp, 0, sizeof(cp));
 572
 573         create_eir(hdev, cp.data);
 574
 575         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 576                 return 0;
 577
 578         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 579
 580         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 581 }
 582
 583 static u8 get_service_classes(struct hci_dev *hdev)
 584 {
 585         struct bt_uuid *uuid;
 586         u8 val = 0;
 587
 588         list_for_each_entry(uuid, &hdev->uuids, list)
 589                 val |= uuid->svc_hint;
 590
 591         return val;
 592 }
 593
 594 static int update_class(struct hci_dev *hdev)
 595 {
 596         u8 cod[3];
 597         int err;
 598
 599         BT_DBG("%s", hdev->name);
 600
 601         if (!hdev_is_powered(hdev))
 602                 return 0;
 603
 604         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 605                 return 0;
 606
 607         cod[0] = hdev->minor_class;
 608         cod[1] = hdev->major_class;
 609         cod[2] = get_service_classes(hdev);
 610
 611         if (memcmp(cod, hdev->dev_class, 3) == 0)
 612                 return 0;
 613
 614         err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 615         if (err == 0)
 616                 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
 617
 618         return err;
 619 }
 620
 621 static void service_cache_off(struct work_struct *work)
 622 {
 623         struct hci_dev *hdev = container_of(work, struct hci_dev,
 624                                             service_cache.work);
 625
 626         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 627                 return;
 628
 629         hci_dev_lock(hdev);
 630
 631         update_eir(hdev);
 632         update_class(hdev);
 633
 634         hci_dev_unlock(hdev);
 635 }
 636
 637 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 638 {
 639         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 640                 return;
 641
 642         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 643
 644         /* Non-mgmt controlled devices get this bit set
 645          * implicitly so that pairing works for them, however
 646          * for mgmt we require user-space to explicitly enable
 647          * it
 648          */
 649         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 650 }
 651
 652 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 653                                 void *data, u16 data_len)
 654 {
 655         struct mgmt_rp_read_info rp;
 656
 657         BT_DBG("sock %p %s", sk, hdev->name);
 658
 659         hci_dev_lock(hdev);
 660
 661         memset(&rp, 0, sizeof(rp));
 662
 663         bacpy(&rp.bdaddr, &hdev->bdaddr);
 664
 665         rp.version = hdev->hci_ver;
 666         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 667
 668         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 669         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 670
 671         memcpy(rp.dev_class, hdev->dev_class, 3);
 672
 673         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 674         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 675
 676         hci_dev_unlock(hdev);
 677
 678         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 679                             sizeof(rp));
 680 }
 681
 682 static void mgmt_pending_free(struct pending_cmd *cmd)
 683 {
 684         sock_put(cmd->sk);
 685         kfree(cmd->param);
 686         kfree(cmd);
 687 }
 688
 689 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 690                                             struct hci_dev *hdev, void *data,
 691                                             u16 len)
 692 {
 693         struct pending_cmd *cmd;
 694
 695         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 696         if (!cmd)
 697                 return NULL;
 698
 699         cmd->opcode = opcode;
 700         cmd->index = hdev->id;
 701
 702         cmd->param = kmalloc(len, GFP_ATOMIC);
 703         if (!cmd->param) {
 704                 kfree(cmd);
 705                 return NULL;
 706         }
 707
 708         if (data)
 709                 memcpy(cmd->param, data, len);
 710
 711         cmd->sk = sk;
 712         sock_hold(sk);
 713
 714         list_add(&cmd->list, &hdev->mgmt_pending);
 715
 716         return cmd;
 717 }
 718
 719 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 720                                  void (*cb)(struct pending_cmd *cmd, void *data),
 721                                  void *data)
 722 {
 723         struct list_head *p, *n;
 724
 725         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 726                 struct pending_cmd *cmd;
 727
 728                 cmd = list_entry(p, struct pending_cmd, list);
 729
 730                 if (opcode > 0 && cmd->opcode != opcode)
 731                         continue;
 732
 733                 cb(cmd, data);
 734         }
 735 }
 736
 737 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 738 {
 739         struct pending_cmd *cmd;
 740
 741         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 742                 if (cmd->opcode == opcode)
 743                         return cmd;
 744         }
 745
 746         return NULL;
 747 }
 748
 749 static void mgmt_pending_remove(struct pending_cmd *cmd)
 750 {
 751         list_del(&cmd->list);
 752         mgmt_pending_free(cmd);
 753 }
 754
 755 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 756 {
 757         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 758
 759         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 760                             sizeof(settings));
 761 }
 762
 763 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 764                        u16 len)
 765 {
 766         struct mgmt_mode *cp = data;
 767         struct pending_cmd *cmd;
 768         int err;
 769
 770         BT_DBG("request for %s", hdev->name);
 771
 772         hci_dev_lock(hdev);
 773
 774         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 775                 cancel_delayed_work(&hdev->power_off);
 776
 777                 if (cp->val) {
 778                         err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 779                         mgmt_powered(hdev, 1);
 780                         goto failed;
 781                 }
 782         }
 783
 784         if (!!cp->val == hdev_is_powered(hdev)) {
 785                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 786                 goto failed;
 787         }
 788
 789         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 790                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 791                                  MGMT_STATUS_BUSY);
 792                 goto failed;
 793         }
 794
 795         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 796         if (!cmd) {
 797                 err = -ENOMEM;
 798                 goto failed;
 799         }
 800
 801         if (cp->val)
 802                 schedule_work(&hdev->power_on);
 803         else
 804                 schedule_work(&hdev->power_off.work);
 805
 806         err = 0;
 807
 808 failed:
 809         hci_dev_unlock(hdev);
 810         return err;
 811 }
 812
 813 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 814                       struct sock *skip_sk)
 815 {
 816         struct sk_buff *skb;
 817         struct mgmt_hdr *hdr;
 818
 819         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 820         if (!skb)
 821                 return -ENOMEM;
 822
 823         hdr = (void *) skb_put(skb, sizeof(*hdr));
 824         hdr->opcode = cpu_to_le16(event);
 825         if (hdev)
 826                 hdr->index = cpu_to_le16(hdev->id);
 827         else
 828                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 829         hdr->len = cpu_to_le16(data_len);
 830
 831         if (data)
 832                 memcpy(skb_put(skb, data_len), data, data_len);
 833
 834         /* Time stamp */
 835         __net_timestamp(skb);
 836
 837         hci_send_to_control(skb, skip_sk);
 838         kfree_skb(skb);
 839
 840         return 0;
 841 }
 842
 843 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 844 {
 845         __le32 ev;
 846
 847         ev = cpu_to_le32(get_current_settings(hdev));
 848
 849         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 850 }
 851
 852 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 853                             u16 len)
 854 {
 855         struct mgmt_cp_set_discoverable *cp = data;
 856         struct pending_cmd *cmd;
 857         u16 timeout;
 858         u8 scan;
 859         int err;
 860
 861         BT_DBG("request for %s", hdev->name);
 862
 863         timeout = __le16_to_cpu(cp->timeout);
 864         if (!cp->val && timeout > 0)
 865                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 866                                   MGMT_STATUS_INVALID_PARAMS);
 867
 868         hci_dev_lock(hdev);
 869
 870         if (!hdev_is_powered(hdev) && timeout > 0) {
 871                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 872                                  MGMT_STATUS_NOT_POWERED);
 873                 goto failed;
 874         }
 875
 876         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 877                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 878                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 879                                  MGMT_STATUS_BUSY);
 880                 goto failed;
 881         }
 882
 883         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 884                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 885                                  MGMT_STATUS_REJECTED);
 886                 goto failed;
 887         }
 888
 889         if (!hdev_is_powered(hdev)) {
 890                 bool changed = false;
 891
 892                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 893                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 894                         changed = true;
 895                 }
 896
 897                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 898                 if (err < 0)
 899                         goto failed;
 900
 901                 if (changed)
 902                         err = new_settings(hdev, sk);
 903
 904                 goto failed;
 905         }
 906
 907         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 908                 if (hdev->discov_timeout > 0) {
 909                         cancel_delayed_work(&hdev->discov_off);
 910                         hdev->discov_timeout = 0;
 911                 }
 912
 913                 if (cp->val && timeout > 0) {
 914                         hdev->discov_timeout = timeout;
 915                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 916                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 917                 }
 918
 919                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 920                 goto failed;
 921         }
 922
 923         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 924         if (!cmd) {
 925                 err = -ENOMEM;
 926                 goto failed;
 927         }
 928
 929         scan = SCAN_PAGE;
 930
 931         if (cp->val)
 932                 scan |= SCAN_INQUIRY;
 933         else
 934                 cancel_delayed_work(&hdev->discov_off);
 935
 936         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 937         if (err < 0)
 938                 mgmt_pending_remove(cmd);
 939
 940         if (cp->val)
 941                 hdev->discov_timeout = timeout;
 942
 943 failed:
 944         hci_dev_unlock(hdev);
 945         return err;
 946 }
 947
 948 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
 949                            u16 len)
 950 {
 951         struct mgmt_mode *cp = data;
 952         struct pending_cmd *cmd;
 953         u8 scan;
 954         int err;
 955
 956         BT_DBG("request for %s", hdev->name);
 957
 958         hci_dev_lock(hdev);
 959
 960         if (!hdev_is_powered(hdev)) {
 961                 bool changed = false;
 962
 963                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 964                         changed = true;
 965
 966                 if (cp->val) {
 967                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 968                 } else {
 969                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 970                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 971                 }
 972
 973                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 974                 if (err < 0)
 975                         goto failed;
 976
 977                 if (changed)
 978                         err = new_settings(hdev, sk);
 979
 980                 goto failed;
 981         }
 982
 983         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 984                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 985                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
 986                                  MGMT_STATUS_BUSY);
 987                 goto failed;
 988         }
 989
 990         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 991                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 992                 goto failed;
 993         }
 994
 995         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
 996         if (!cmd) {
 997                 err = -ENOMEM;
 998                 goto failed;
 999         }
1000
1001         if (cp->val) {
1002                 scan = SCAN_PAGE;
1003         } else {
1004                 scan = 0;
1005
1006                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1007                                                 hdev->discov_timeout > 0)
1008                         cancel_delayed_work(&hdev->discov_off);
1009         }
1010
1011         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1012         if (err < 0)
1013                 mgmt_pending_remove(cmd);
1014
1015 failed:
1016         hci_dev_unlock(hdev);
1017         return err;
1018 }
1019
1020 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1021                         u16 len)
1022 {
1023         struct mgmt_mode *cp = data;
1024         int err;
1025
1026         BT_DBG("request for %s", hdev->name);
1027
1028         hci_dev_lock(hdev);
1029
1030         if (cp->val)
1031                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1032         else
1033                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1034
1035         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1036         if (err < 0)
1037                 goto failed;
1038
1039         err = new_settings(hdev, sk);
1040
1041 failed:
1042         hci_dev_unlock(hdev);
1043         return err;
1044 }
1045
1046 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1047                              u16 len)
1048 {
1049         struct mgmt_mode *cp = data;
1050         struct pending_cmd *cmd;
1051         u8 val;
1052         int err;
1053
1054         BT_DBG("request for %s", hdev->name);
1055
1056         hci_dev_lock(hdev);
1057
1058         if (!hdev_is_powered(hdev)) {
1059                 bool changed = false;
1060
1061                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1062                                                         &hdev->dev_flags)) {
1063                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1064                         changed = true;
1065                 }
1066
1067                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1068                 if (err < 0)
1069                         goto failed;
1070
1071                 if (changed)
1072                         err = new_settings(hdev, sk);
1073
1074                 goto failed;
1075         }
1076
1077         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1078                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1079                                  MGMT_STATUS_BUSY);
1080                 goto failed;
1081         }
1082
1083         val = !!cp->val;
1084
1085         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1086                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1087                 goto failed;
1088         }
1089
1090         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1091         if (!cmd) {
1092                 err = -ENOMEM;
1093                 goto failed;
1094         }
1095
1096         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1097         if (err < 0) {
1098                 mgmt_pending_remove(cmd);
1099                 goto failed;
1100         }
1101
1102 failed:
1103         hci_dev_unlock(hdev);
1104         return err;
1105 }
1106
1107 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1108 {
1109         struct mgmt_mode *cp = data;
1110         struct pending_cmd *cmd;
1111         u8 val;
1112         int err;
1113
1114         BT_DBG("request for %s", hdev->name);
1115
1116         hci_dev_lock(hdev);
1117
1118         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1119                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1120                                  MGMT_STATUS_NOT_SUPPORTED);
1121                 goto failed;
1122         }
1123
1124         val = !!cp->val;
1125
1126         if (!hdev_is_powered(hdev)) {
1127                 bool changed = false;
1128
1129                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1130                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1131                         changed = true;
1132                 }
1133
1134                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1135                 if (err < 0)
1136                         goto failed;
1137
1138                 if (changed)
1139                         err = new_settings(hdev, sk);
1140
1141                 goto failed;
1142         }
1143
1144         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1145                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1146                                  MGMT_STATUS_BUSY);
1147                 goto failed;
1148         }
1149
1150         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1151                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1152                 goto failed;
1153         }
1154
1155         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1156         if (!cmd) {
1157                 err = -ENOMEM;
1158                 goto failed;
1159         }
1160
1161         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1162         if (err < 0) {
1163                 mgmt_pending_remove(cmd);
1164                 goto failed;
1165         }
1166
1167 failed:
1168         hci_dev_unlock(hdev);
1169         return err;
1170 }
1171
1172 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1173 {
1174         struct mgmt_mode *cp = data;
1175
1176         BT_DBG("request for %s", hdev->name);
1177
1178         if (!enable_hs)
1179                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1180                                   MGMT_STATUS_NOT_SUPPORTED);
1181
1182         if (cp->val)
1183                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1184         else
1185                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1186
1187         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1188 }
1189
1190 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1191 {
1192         struct mgmt_mode *cp = data;
1193         struct hci_cp_write_le_host_supported hci_cp;
1194         struct pending_cmd *cmd;
1195         int err;
1196         u8 val, enabled;
1197
1198         BT_DBG("request for %s", hdev->name);
1199
1200         hci_dev_lock(hdev);
1201
1202         if (!enable_le || !(hdev->features[4] & LMP_LE)) {
1203                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1204                                  MGMT_STATUS_NOT_SUPPORTED);
1205                 goto unlock;
1206         }
1207
1208         val = !!cp->val;
1209         enabled = !!(hdev->host_features[0] & LMP_HOST_LE);
1210
1211         if (!hdev_is_powered(hdev) || val == enabled) {
1212                 bool changed = false;
1213
1214                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1215                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1216                         changed = true;
1217                 }
1218
1219                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1220                 if (err < 0)
1221                         goto unlock;
1222
1223                 if (changed)
1224                         err = new_settings(hdev, sk);
1225
1226                 goto unlock;
1227         }
1228
1229         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1230                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1231                                  MGMT_STATUS_BUSY);
1232                 goto unlock;
1233         }
1234
1235         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1236         if (!cmd) {
1237                 err = -ENOMEM;
1238                 goto unlock;
1239         }
1240
1241         memset(&hci_cp, 0, sizeof(hci_cp));
1242
1243         if (val) {
1244                 hci_cp.le = val;
1245                 hci_cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
1246         }
1247
1248         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1249                            &hci_cp);
1250         if (err < 0) {
1251                 mgmt_pending_remove(cmd);
1252                 goto unlock;
1253         }
1254
1255 unlock:
1256         hci_dev_unlock(hdev);
1257         return err;
1258 }
1259
1260 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1261 {
1262         struct mgmt_cp_add_uuid *cp = data;
1263         struct pending_cmd *cmd;
1264         struct bt_uuid *uuid;
1265         int err;
1266
1267         BT_DBG("request for %s", hdev->name);
1268
1269         hci_dev_lock(hdev);
1270
1271         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1272                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1273                                  MGMT_STATUS_BUSY);
1274                 goto failed;
1275         }
1276
1277         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
1278         if (!uuid) {
1279                 err = -ENOMEM;
1280                 goto failed;
1281         }
1282
1283         memcpy(uuid->uuid, cp->uuid, 16);
1284         uuid->svc_hint = cp->svc_hint;
1285
1286         list_add(&uuid->list, &hdev->uuids);
1287
1288         err = update_class(hdev);
1289         if (err < 0)
1290                 goto failed;
1291
1292         err = update_eir(hdev);
1293         if (err < 0)
1294                 goto failed;
1295
1296         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1297                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1298                                    hdev->dev_class, 3);
1299                 goto failed;
1300         }
1301
1302         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1303         if (!cmd) {
1304                 err = -ENOMEM;
1305                 goto failed;
1306         }
1307
1308 failed:
1309         hci_dev_unlock(hdev);
1310         return err;
1311 }
1312
1313 static bool enable_service_cache(struct hci_dev *hdev)
1314 {
1315         if (!hdev_is_powered(hdev))
1316                 return false;
1317
1318         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1319                 schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
1320                 return true;
1321         }
1322
1323         return false;
1324 }
1325
1326 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1327                                                                 u16 len)
1328 {
1329         struct mgmt_cp_remove_uuid *cp = data;
1330         struct pending_cmd *cmd;
1331         struct list_head *p, *n;
1332         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1333         int err, found;
1334
1335         BT_DBG("request for %s", hdev->name);
1336
1337         hci_dev_lock(hdev);
1338
1339         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1340                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1341                                  MGMT_STATUS_BUSY);
1342                 goto unlock;
1343         }
1344
1345         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1346                 err = hci_uuids_clear(hdev);
1347
1348                 if (enable_service_cache(hdev)) {
1349                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1350                                            0, hdev->dev_class, 3);
1351                         goto unlock;
1352                 }
1353
1354                 goto update_class;
1355         }
1356
1357         found = 0;
1358
1359         list_for_each_safe(p, n, &hdev->uuids) {
1360                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1361
1362                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1363                         continue;
1364
1365                 list_del(&match->list);
1366                 found++;
1367         }
1368
1369         if (found == 0) {
1370                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1371                                  MGMT_STATUS_INVALID_PARAMS);
1372                 goto unlock;
1373         }
1374
1375 update_class:
1376         err = update_class(hdev);
1377         if (err < 0)
1378                 goto unlock;
1379
1380         err = update_eir(hdev);
1381         if (err < 0)
1382                 goto unlock;
1383
1384         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1385                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1386                                    hdev->dev_class, 3);
1387                 goto unlock;
1388         }
1389
1390         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1391         if (!cmd) {
1392                 err = -ENOMEM;
1393                 goto unlock;
1394         }
1395
1396 unlock:
1397         hci_dev_unlock(hdev);
1398         return err;
1399 }
1400
1401 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1402                          u16 len)
1403 {
1404         struct mgmt_cp_set_dev_class *cp = data;
1405         struct pending_cmd *cmd;
1406         int err;
1407
1408         BT_DBG("request for %s", hdev->name);
1409
1410         hci_dev_lock(hdev);
1411
1412         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1413                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1414                                  MGMT_STATUS_BUSY);
1415                 goto unlock;
1416         }
1417
1418         hdev->major_class = cp->major;
1419         hdev->minor_class = cp->minor;
1420
1421         if (!hdev_is_powered(hdev)) {
1422                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1423                                    hdev->dev_class, 3);
1424                 goto unlock;
1425         }
1426
1427         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1428                 hci_dev_unlock(hdev);
1429                 cancel_delayed_work_sync(&hdev->service_cache);
1430                 hci_dev_lock(hdev);
1431                 update_eir(hdev);
1432         }
1433
1434         err = update_class(hdev);
1435         if (err < 0)
1436                 goto unlock;
1437
1438         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1439                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1440                                    hdev->dev_class, 3);
1441                 goto unlock;
1442         }
1443
1444         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1445         if (!cmd) {
1446                 err = -ENOMEM;
1447                 goto unlock;
1448         }
1449
1450 unlock:
1451         hci_dev_unlock(hdev);
1452         return err;
1453 }
1454
1455 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1456                                                                 u16 len)
1457 {
1458         struct mgmt_cp_load_link_keys *cp = data;
1459         u16 key_count, expected_len;
1460         int i;
1461
1462         key_count = __le16_to_cpu(cp->key_count);
1463
1464         expected_len = sizeof(*cp) + key_count *
1465                                         sizeof(struct mgmt_link_key_info);
1466         if (expected_len != len) {
1467                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1468                                                         len, expected_len);
1469                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1470                                   MGMT_STATUS_INVALID_PARAMS);
1471         }
1472
1473         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1474                                                                 key_count);
1475
1476         hci_dev_lock(hdev);
1477
1478         hci_link_keys_clear(hdev);
1479
1480         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1481
1482         if (cp->debug_keys)
1483                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1484         else
1485                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1486
1487         for (i = 0; i < key_count; i++) {
1488                 struct mgmt_link_key_info *key = &cp->keys[i];
1489
1490                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1491                                  key->type, key->pin_len);
1492         }
1493
1494         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1495
1496         hci_dev_unlock(hdev);
1497
1498         return 0;
1499 }
1500
1501 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1502                            u8 addr_type, struct sock *skip_sk)
1503 {
1504         struct mgmt_ev_device_unpaired ev;
1505
1506         bacpy(&ev.addr.bdaddr, bdaddr);
1507         ev.addr.type = addr_type;
1508
1509         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1510                           skip_sk);
1511 }
1512
1513 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1514                          u16 len)
1515 {
1516         struct mgmt_cp_unpair_device *cp = data;
1517         struct mgmt_rp_unpair_device rp;
1518         struct hci_cp_disconnect dc;
1519         struct pending_cmd *cmd;
1520         struct hci_conn *conn;
1521         int err;
1522
1523         hci_dev_lock(hdev);
1524
1525         memset(&rp, 0, sizeof(rp));
1526         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1527         rp.addr.type = cp->addr.type;
1528
1529         if (!hdev_is_powered(hdev)) {
1530                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1531                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1532                 goto unlock;
1533         }
1534
1535         if (cp->addr.type == MGMT_ADDR_BREDR)
1536                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1537         else
1538                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1539
1540         if (err < 0) {
1541                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1542                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1543                 goto unlock;
1544         }
1545
1546         if (cp->disconnect) {
1547                 if (cp->addr.type == MGMT_ADDR_BREDR)
1548                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1549                                                         &cp->addr.bdaddr);
1550                 else
1551                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1552                                                         &cp->addr.bdaddr);
1553         } else {
1554                 conn = NULL;
1555         }
1556
1557         if (!conn) {
1558                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1559                                    &rp, sizeof(rp));
1560                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1561                 goto unlock;
1562         }
1563
1564         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1565                                sizeof(*cp));
1566         if (!cmd) {
1567                 err = -ENOMEM;
1568                 goto unlock;
1569         }
1570
1571         dc.handle = cpu_to_le16(conn->handle);
1572         dc.reason = 0x13; /* Remote User Terminated Connection */
1573         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1574         if (err < 0)
1575                 mgmt_pending_remove(cmd);
1576
1577 unlock:
1578         hci_dev_unlock(hdev);
1579         return err;
1580 }
1581
1582 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1583                       u16 len)
1584 {
1585         struct mgmt_cp_disconnect *cp = data;
1586         struct hci_cp_disconnect dc;
1587         struct pending_cmd *cmd;
1588         struct hci_conn *conn;
1589         int err;
1590
1591         BT_DBG("");
1592
1593         hci_dev_lock(hdev);
1594
1595         if (!test_bit(HCI_UP, &hdev->flags)) {
1596                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1597                                  MGMT_STATUS_NOT_POWERED);
1598                 goto failed;
1599         }
1600
1601         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1602                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1603                                  MGMT_STATUS_BUSY);
1604                 goto failed;
1605         }
1606
1607         if (cp->addr.type == MGMT_ADDR_BREDR)
1608                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1609         else
1610                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1611
1612         if (!conn) {
1613                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1614                                  MGMT_STATUS_NOT_CONNECTED);
1615                 goto failed;
1616         }
1617
1618         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1619         if (!cmd) {
1620                 err = -ENOMEM;
1621                 goto failed;
1622         }
1623
1624         dc.handle = cpu_to_le16(conn->handle);
1625         dc.reason = 0x13; /* Remote User Terminated Connection */
1626
1627         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1628         if (err < 0)
1629                 mgmt_pending_remove(cmd);
1630
1631 failed:
1632         hci_dev_unlock(hdev);
1633         return err;
1634 }
1635
1636 static u8 link_to_mgmt(u8 link_type, u8 addr_type)
1637 {
1638         switch (link_type) {
1639         case LE_LINK:
1640                 switch (addr_type) {
1641                 case ADDR_LE_DEV_PUBLIC:
1642                         return MGMT_ADDR_LE_PUBLIC;
1643                 case ADDR_LE_DEV_RANDOM:
1644                         return MGMT_ADDR_LE_RANDOM;
1645                 default:
1646                         return MGMT_ADDR_INVALID;
1647                 }
1648         case ACL_LINK:
1649                 return MGMT_ADDR_BREDR;
1650         default:
1651                 return MGMT_ADDR_INVALID;
1652         }
1653 }
1654
1655 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1656                            u16 data_len)
1657 {
1658         struct mgmt_rp_get_connections *rp;
1659         struct hci_conn *c;
1660         size_t rp_len;
1661         int err;
1662         u16 i;
1663
1664         BT_DBG("");
1665
1666         hci_dev_lock(hdev);
1667
1668         if (!hdev_is_powered(hdev)) {
1669                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1670                                  MGMT_STATUS_NOT_POWERED);
1671                 goto unlock;
1672         }
1673
1674         i = 0;
1675         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1676                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1677                         i++;
1678         }
1679
1680         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1681         rp = kmalloc(rp_len, GFP_ATOMIC);
1682         if (!rp) {
1683                 err = -ENOMEM;
1684                 goto unlock;
1685         }
1686
1687         i = 0;
1688         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1689                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1690                         continue;
1691                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1692                 rp->addr[i].type = link_to_mgmt(c->type, c->dst_type);
1693                 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1694                         continue;
1695                 i++;
1696         }
1697
1698         rp->conn_count = cpu_to_le16(i);
1699
1700         /* Recalculate length in case of filtered SCO connections, etc */
1701         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1702
1703         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1704                            rp_len);
1705
1706         kfree(rp);
1707
1708 unlock:
1709         hci_dev_unlock(hdev);
1710         return err;
1711 }
1712
1713 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1714                                    struct mgmt_cp_pin_code_neg_reply *cp)
1715 {
1716         struct pending_cmd *cmd;
1717         int err;
1718
1719         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1720                                sizeof(*cp));
1721         if (!cmd)
1722                 return -ENOMEM;
1723
1724         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1725                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1726         if (err < 0)
1727                 mgmt_pending_remove(cmd);
1728
1729         return err;
1730 }
1731
1732 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1733                           u16 len)
1734 {
1735         struct hci_conn *conn;
1736         struct mgmt_cp_pin_code_reply *cp = data;
1737         struct hci_cp_pin_code_reply reply;
1738         struct pending_cmd *cmd;
1739         int err;
1740
1741         BT_DBG("");
1742
1743         hci_dev_lock(hdev);
1744
1745         if (!hdev_is_powered(hdev)) {
1746                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1747                                  MGMT_STATUS_NOT_POWERED);
1748                 goto failed;
1749         }
1750
1751         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1752         if (!conn) {
1753                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1754                                  MGMT_STATUS_NOT_CONNECTED);
1755                 goto failed;
1756         }
1757
1758         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1759                 struct mgmt_cp_pin_code_neg_reply ncp;
1760
1761                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1762
1763                 BT_ERR("PIN code is not 16 bytes long");
1764
1765                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1766                 if (err >= 0)
1767                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1768                                          MGMT_STATUS_INVALID_PARAMS);
1769
1770                 goto failed;
1771         }
1772
1773         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1774         if (!cmd) {
1775                 err = -ENOMEM;
1776                 goto failed;
1777         }
1778
1779         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1780         reply.pin_len = cp->pin_len;
1781         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1782
1783         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1784         if (err < 0)
1785                 mgmt_pending_remove(cmd);
1786
1787 failed:
1788         hci_dev_unlock(hdev);
1789         return err;
1790 }
1791
1792 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1793                               void *data, u16 len)
1794 {
1795         struct mgmt_cp_pin_code_neg_reply *cp = data;
1796         int err;
1797
1798         BT_DBG("");
1799
1800         hci_dev_lock(hdev);
1801
1802         if (!hdev_is_powered(hdev)) {
1803                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
1804                                  MGMT_STATUS_NOT_POWERED);
1805                 goto failed;
1806         }
1807
1808         err = send_pin_code_neg_reply(sk, hdev, cp);
1809
1810 failed:
1811         hci_dev_unlock(hdev);
1812         return err;
1813 }
1814
1815 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1816                              u16 len)
1817 {
1818         struct mgmt_cp_set_io_capability *cp = data;
1819
1820         BT_DBG("");
1821
1822         hci_dev_lock(hdev);
1823
1824         hdev->io_capability = cp->io_capability;
1825
1826         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1827                                                         hdev->io_capability);
1828
1829         hci_dev_unlock(hdev);
1830
1831         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1832                             0);
1833 }
1834
1835 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1836 {
1837         struct hci_dev *hdev = conn->hdev;
1838         struct pending_cmd *cmd;
1839
1840         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1841                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1842                         continue;
1843
1844                 if (cmd->user_data != conn)
1845                         continue;
1846
1847                 return cmd;
1848         }
1849
1850         return NULL;
1851 }
1852
1853 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1854 {
1855         struct mgmt_rp_pair_device rp;
1856         struct hci_conn *conn = cmd->user_data;
1857
1858         bacpy(&rp.addr.bdaddr, &conn->dst);
1859         rp.addr.type = link_to_mgmt(conn->type, conn->dst_type);
1860
1861         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1862                      &rp, sizeof(rp));
1863
1864         /* So we don't get further callbacks for this connection */
1865         conn->connect_cfm_cb = NULL;
1866         conn->security_cfm_cb = NULL;
1867         conn->disconn_cfm_cb = NULL;
1868
1869         hci_conn_put(conn);
1870
1871         mgmt_pending_remove(cmd);
1872 }
1873
1874 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1875 {
1876         struct pending_cmd *cmd;
1877
1878         BT_DBG("status %u", status);
1879
1880         cmd = find_pairing(conn);
1881         if (!cmd)
1882                 BT_DBG("Unable to find a pending command");
1883         else
1884                 pairing_complete(cmd, mgmt_status(status));
1885 }
1886
1887 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1888                        u16 len)
1889 {
1890         struct mgmt_cp_pair_device *cp = data;
1891         struct mgmt_rp_pair_device rp;
1892         struct pending_cmd *cmd;
1893         u8 sec_level, auth_type;
1894         struct hci_conn *conn;
1895         int err;
1896
1897         BT_DBG("");
1898
1899         hci_dev_lock(hdev);
1900
1901         if (!hdev_is_powered(hdev)) {
1902                 err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1903                                  MGMT_STATUS_NOT_POWERED);
1904                 goto unlock;
1905         }
1906
1907         sec_level = BT_SECURITY_MEDIUM;
1908         if (cp->io_cap == 0x03)
1909                 auth_type = HCI_AT_DEDICATED_BONDING;
1910         else
1911                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1912
1913         if (cp->addr.type == MGMT_ADDR_BREDR)
1914                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr, sec_level,
1915                                    auth_type);
1916         else
1917                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr, sec_level,
1918                                    auth_type);
1919
1920         memset(&rp, 0, sizeof(rp));
1921         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1922         rp.addr.type = cp->addr.type;
1923
1924         if (IS_ERR(conn)) {
1925                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1926                                    MGMT_STATUS_CONNECT_FAILED, &rp,
1927                                    sizeof(rp));
1928                 goto unlock;
1929         }
1930
1931         if (conn->connect_cfm_cb) {
1932                 hci_conn_put(conn);
1933                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1934                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1935                 goto unlock;
1936         }
1937
1938         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1939         if (!cmd) {
1940                 err = -ENOMEM;
1941                 hci_conn_put(conn);
1942                 goto unlock;
1943         }
1944
1945         /* For LE, just connecting isn't a proof that the pairing finished */
1946         if (cp->addr.type == MGMT_ADDR_BREDR)
1947                 conn->connect_cfm_cb = pairing_complete_cb;
1948
1949         conn->security_cfm_cb = pairing_complete_cb;
1950         conn->disconn_cfm_cb = pairing_complete_cb;
1951         conn->io_capability = cp->io_cap;
1952         cmd->user_data = conn;
1953
1954         if (conn->state == BT_CONNECTED &&
1955                                 hci_conn_security(conn, sec_level, auth_type))
1956                 pairing_complete(cmd, 0);
1957
1958         err = 0;
1959
1960 unlock:
1961         hci_dev_unlock(hdev);
1962         return err;
1963 }
1964
1965 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1966                               u16 len)
1967 {
1968         struct mgmt_addr_info *addr = data;
1969         struct pending_cmd *cmd;
1970         struct hci_conn *conn;
1971         int err;
1972
1973         BT_DBG("");
1974
1975         hci_dev_lock(hdev);
1976
1977         if (!hdev_is_powered(hdev)) {
1978                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1979                                  MGMT_STATUS_NOT_POWERED);
1980                 goto unlock;
1981         }
1982
1983         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
1984         if (!cmd) {
1985                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1986                                  MGMT_STATUS_INVALID_PARAMS);
1987                 goto unlock;
1988         }
1989
1990         conn = cmd->user_data;
1991
1992         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
1993                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1994                                  MGMT_STATUS_INVALID_PARAMS);
1995                 goto unlock;
1996         }
1997
1998         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
1999
2000         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2001                            addr, sizeof(*addr));
2002 unlock:
2003         hci_dev_unlock(hdev);
2004         return err;
2005 }
2006
2007 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2008                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2009                              u16 hci_op, __le32 passkey)
2010 {
2011         struct pending_cmd *cmd;
2012         struct hci_conn *conn;
2013         int err;
2014
2015         hci_dev_lock(hdev);
2016
2017         if (!hdev_is_powered(hdev)) {
2018                 err = cmd_status(sk, hdev->id, mgmt_op,
2019                                  MGMT_STATUS_NOT_POWERED);
2020                 goto done;
2021         }
2022
2023         if (type == MGMT_ADDR_BREDR)
2024                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2025         else
2026                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2027
2028         if (!conn) {
2029                 err = cmd_status(sk, hdev->id, mgmt_op,
2030                                  MGMT_STATUS_NOT_CONNECTED);
2031                 goto done;
2032         }
2033
2034         if (type == MGMT_ADDR_LE_PUBLIC || type == MGMT_ADDR_LE_RANDOM) {
2035                 /* Continue with pairing via SMP */
2036                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2037
2038                 if (!err)
2039                         err = cmd_status(sk, hdev->id, mgmt_op,
2040                                          MGMT_STATUS_SUCCESS);
2041                 else
2042                         err = cmd_status(sk, hdev->id, mgmt_op,
2043                                          MGMT_STATUS_FAILED);
2044
2045                 goto done;
2046         }
2047
2048         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2049         if (!cmd) {
2050                 err = -ENOMEM;
2051                 goto done;
2052         }
2053
2054         /* Continue with pairing via HCI */
2055         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2056                 struct hci_cp_user_passkey_reply cp;
2057
2058                 bacpy(&cp.bdaddr, bdaddr);
2059                 cp.passkey = passkey;
2060                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2061         } else
2062                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2063
2064         if (err < 0)
2065                 mgmt_pending_remove(cmd);
2066
2067 done:
2068         hci_dev_unlock(hdev);
2069         return err;
2070 }
2071
2072 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2073                               u16 len)
2074 {
2075         struct mgmt_cp_user_confirm_reply *cp = data;
2076
2077         BT_DBG("");
2078
2079         if (len != sizeof(*cp))
2080                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2081                                   MGMT_STATUS_INVALID_PARAMS);
2082
2083         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2084                                  MGMT_OP_USER_CONFIRM_REPLY,
2085                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2086 }
2087
2088 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2089                                   void *data, u16 len)
2090 {
2091         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2092
2093         BT_DBG("");
2094
2095         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2096                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2097                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2098 }
2099
2100 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2101                               u16 len)
2102 {
2103         struct mgmt_cp_user_passkey_reply *cp = data;
2104
2105         BT_DBG("");
2106
2107         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2108                                  MGMT_OP_USER_PASSKEY_REPLY,
2109                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2110 }
2111
2112 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2113                                   void *data, u16 len)
2114 {
2115         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2116
2117         BT_DBG("");
2118
2119         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2120                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2121                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2122 }
2123
2124 static int update_name(struct hci_dev *hdev, const char *name)
2125 {
2126         struct hci_cp_write_local_name cp;
2127
2128         memcpy(cp.name, name, sizeof(cp.name));
2129
2130         return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2131 }
2132
2133 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2134                           u16 len)
2135 {
2136         struct mgmt_cp_set_local_name *cp = data;
2137         struct pending_cmd *cmd;
2138         int err;
2139
2140         BT_DBG("");
2141
2142         hci_dev_lock(hdev);
2143
2144         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2145
2146         if (!hdev_is_powered(hdev)) {
2147                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2148
2149                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2150                                    data, len);
2151                 if (err < 0)
2152                         goto failed;
2153
2154                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2155                                  sk);
2156
2157                 goto failed;
2158         }
2159
2160         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2161         if (!cmd) {
2162                 err = -ENOMEM;
2163                 goto failed;
2164         }
2165
2166         err = update_name(hdev, cp->name);
2167         if (err < 0)
2168                 mgmt_pending_remove(cmd);
2169
2170 failed:
2171         hci_dev_unlock(hdev);
2172         return err;
2173 }
2174
2175 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2176                                void *data, u16 data_len)
2177 {
2178         struct pending_cmd *cmd;
2179         int err;
2180
2181         BT_DBG("%s", hdev->name);
2182
2183         hci_dev_lock(hdev);
2184
2185         if (!hdev_is_powered(hdev)) {
2186                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2187                                  MGMT_STATUS_NOT_POWERED);
2188                 goto unlock;
2189         }
2190
2191         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
2192                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2193                                  MGMT_STATUS_NOT_SUPPORTED);
2194                 goto unlock;
2195         }
2196
2197         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2198                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2199                                  MGMT_STATUS_BUSY);
2200                 goto unlock;
2201         }
2202
2203         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2204         if (!cmd) {
2205                 err = -ENOMEM;
2206                 goto unlock;
2207         }
2208
2209         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2210         if (err < 0)
2211                 mgmt_pending_remove(cmd);
2212
2213 unlock:
2214         hci_dev_unlock(hdev);
2215         return err;
2216 }
2217
2218 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2219                                void *data, u16 len)
2220 {
2221         struct mgmt_cp_add_remote_oob_data *cp = data;
2222         u8 status;
2223         int err;
2224
2225         BT_DBG("%s ", hdev->name);
2226
2227         hci_dev_lock(hdev);
2228
2229         if (!hdev_is_powered(hdev)) {
2230                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
2231                                    MGMT_STATUS_NOT_POWERED, &cp->addr,
2232                                    sizeof(cp->addr));
2233                 goto unlock;
2234         }
2235
2236         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2237                                       cp->randomizer);
2238         if (err < 0)
2239                 status = MGMT_STATUS_FAILED;
2240         else
2241                 status = 0;
2242
2243         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2244                            &cp->addr, sizeof(cp->addr));
2245
2246 unlock:
2247         hci_dev_unlock(hdev);
2248         return err;
2249 }
2250
2251 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2252                                                 void *data, u16 len)
2253 {
2254         struct mgmt_cp_remove_remote_oob_data *cp = data;
2255         u8 status;
2256         int err;
2257
2258         BT_DBG("%s", hdev->name);
2259
2260         hci_dev_lock(hdev);
2261
2262         if (!hdev_is_powered(hdev)) {
2263                 err = cmd_complete(sk, hdev->id,
2264                                    MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2265                                    MGMT_STATUS_NOT_POWERED, &cp->addr,
2266                                    sizeof(cp->addr));
2267                 goto unlock;
2268         }
2269
2270         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2271         if (err < 0)
2272                 status = MGMT_STATUS_INVALID_PARAMS;
2273         else
2274                 status = 0;
2275
2276         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2277                            status, &cp->addr, sizeof(cp->addr));
2278
2279 unlock:
2280         hci_dev_unlock(hdev);
2281         return err;
2282 }
2283
2284 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2285 {
2286         int err;
2287
2288         BT_DBG("%s", hdev->name);
2289
2290         hci_dev_lock(hdev);
2291
2292         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2293         if (err < 0)
2294                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2295
2296         hci_dev_unlock(hdev);
2297
2298         return err;
2299 }
2300
2301 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2302                            void *data, u16 len)
2303 {
2304         struct mgmt_cp_start_discovery *cp = data;
2305         struct pending_cmd *cmd;
2306         int err;
2307
2308         BT_DBG("%s", hdev->name);
2309
2310         hci_dev_lock(hdev);
2311
2312         if (!hdev_is_powered(hdev)) {
2313                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2314                                  MGMT_STATUS_NOT_POWERED);
2315                 goto failed;
2316         }
2317
2318         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2319                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2320                                  MGMT_STATUS_BUSY);
2321                 goto failed;
2322         }
2323
2324         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2325                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2326                                  MGMT_STATUS_BUSY);
2327                 goto failed;
2328         }
2329
2330         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2331         if (!cmd) {
2332                 err = -ENOMEM;
2333                 goto failed;
2334         }
2335
2336         hdev->discovery.type = cp->type;
2337
2338         switch (hdev->discovery.type) {
2339         case DISCOV_TYPE_BREDR:
2340                 if (lmp_bredr_capable(hdev))
2341                         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2342                 else
2343                         err = -ENOTSUPP;
2344                 break;
2345
2346         case DISCOV_TYPE_LE:
2347                 if (lmp_host_le_capable(hdev))
2348                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2349                                           LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2350                 else
2351                         err = -ENOTSUPP;
2352                 break;
2353
2354         case DISCOV_TYPE_INTERLEAVED:
2355                 if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
2356                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2357                                           LE_SCAN_WIN,
2358                                           LE_SCAN_TIMEOUT_BREDR_LE);
2359                 else
2360                         err = -ENOTSUPP;
2361                 break;
2362
2363         default:
2364                 err = -EINVAL;
2365         }
2366
2367         if (err < 0)
2368                 mgmt_pending_remove(cmd);
2369         else
2370                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2371
2372 failed:
2373         hci_dev_unlock(hdev);
2374         return err;
2375 }
2376
2377 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2378                           u16 len)
2379 {
2380         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2381         struct pending_cmd *cmd;
2382         struct hci_cp_remote_name_req_cancel cp;
2383         struct inquiry_entry *e;
2384         int err;
2385
2386         BT_DBG("%s", hdev->name);
2387
2388         hci_dev_lock(hdev);
2389
2390         if (!hci_discovery_active(hdev)) {
2391                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2392                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2393                                    sizeof(mgmt_cp->type));
2394                 goto unlock;
2395         }
2396
2397         if (hdev->discovery.type != mgmt_cp->type) {
2398                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2399                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2400                                    sizeof(mgmt_cp->type));
2401                 goto unlock;
2402         }
2403
2404         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2405         if (!cmd) {
2406                 err = -ENOMEM;
2407                 goto unlock;
2408         }
2409
2410         switch (hdev->discovery.state) {
2411         case DISCOVERY_FINDING:
2412                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2413                         err = hci_cancel_inquiry(hdev);
2414                 else
2415                         err = hci_cancel_le_scan(hdev);
2416
2417                 break;
2418
2419         case DISCOVERY_RESOLVING:
2420                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2421                                                         NAME_PENDING);
2422                 if (!e) {
2423                         mgmt_pending_remove(cmd);
2424                         err = cmd_complete(sk, hdev->id,
2425                                            MGMT_OP_STOP_DISCOVERY, 0,
2426                                            &mgmt_cp->type,
2427                                            sizeof(mgmt_cp->type));
2428                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2429                         goto unlock;
2430                 }
2431
2432                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2433                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2434                                    sizeof(cp), &cp);
2435
2436                 break;
2437
2438         default:
2439                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2440                 err = -EFAULT;
2441         }
2442
2443         if (err < 0)
2444                 mgmt_pending_remove(cmd);
2445         else
2446                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2447
2448 unlock:
2449         hci_dev_unlock(hdev);
2450         return err;
2451 }
2452
2453 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2454                         u16 len)
2455 {
2456         struct mgmt_cp_confirm_name *cp = data;
2457         struct inquiry_entry *e;
2458         int err;
2459
2460         BT_DBG("%s", hdev->name);
2461
2462         hci_dev_lock(hdev);
2463
2464         if (!hci_discovery_active(hdev)) {
2465                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2466                                  MGMT_STATUS_FAILED);
2467                 goto failed;
2468         }
2469
2470         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2471         if (!e) {
2472                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2473                                  MGMT_STATUS_INVALID_PARAMS);
2474                 goto failed;
2475         }
2476
2477         if (cp->name_known) {
2478                 e->name_state = NAME_KNOWN;
2479                 list_del(&e->list);
2480         } else {
2481                 e->name_state = NAME_NEEDED;
2482                 hci_inquiry_cache_update_resolve(hdev, e);
2483         }
2484
2485         err = 0;
2486
2487 failed:
2488         hci_dev_unlock(hdev);
2489         return err;
2490 }
2491
2492 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2493                         u16 len)
2494 {
2495         struct mgmt_cp_block_device *cp = data;
2496         u8 status;
2497         int err;
2498
2499         BT_DBG("%s", hdev->name);
2500
2501         hci_dev_lock(hdev);
2502
2503         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2504         if (err < 0)
2505                 status = MGMT_STATUS_FAILED;
2506         else
2507                 status = 0;
2508
2509         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2510                            &cp->addr, sizeof(cp->addr));
2511
2512         hci_dev_unlock(hdev);
2513
2514         return err;
2515 }
2516
2517 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2518                           u16 len)
2519 {
2520         struct mgmt_cp_unblock_device *cp = data;
2521         u8 status;
2522         int err;
2523
2524         BT_DBG("%s", hdev->name);
2525
2526         hci_dev_lock(hdev);
2527
2528         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2529         if (err < 0)
2530                 status = MGMT_STATUS_INVALID_PARAMS;
2531         else
2532                 status = 0;
2533
2534         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2535                            &cp->addr, sizeof(cp->addr));
2536
2537         hci_dev_unlock(hdev);
2538
2539         return err;
2540 }
2541
2542 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2543                          u16 len)
2544 {
2545         struct mgmt_cp_set_device_id *cp = data;
2546         int err;
2547         __u16 source;
2548
2549         BT_DBG("%s", hdev->name);
2550
2551         source = __le16_to_cpu(cp->source);
2552
2553         if (source > 0x0002)
2554                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2555                                   MGMT_STATUS_INVALID_PARAMS);
2556
2557         hci_dev_lock(hdev);
2558
2559         hdev->devid_source = source;
2560         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2561         hdev->devid_product = __le16_to_cpu(cp->product);
2562         hdev->devid_version = __le16_to_cpu(cp->version);
2563
2564         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2565
2566         update_eir(hdev);
2567
2568         hci_dev_unlock(hdev);
2569
2570         return err;
2571 }
2572
2573 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2574                                 void *data, u16 len)
2575 {
2576         struct mgmt_mode *cp = data;
2577         struct hci_cp_write_page_scan_activity acp;
2578         u8 type;
2579         int err;
2580
2581         BT_DBG("%s", hdev->name);
2582
2583         if (!hdev_is_powered(hdev))
2584                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2585                                   MGMT_STATUS_NOT_POWERED);
2586
2587         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2588                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2589                                   MGMT_STATUS_REJECTED);
2590
2591         hci_dev_lock(hdev);
2592
2593         if (cp->val) {
2594                 type = PAGE_SCAN_TYPE_INTERLACED;
2595
2596                 /* 22.5 msec page scan interval */
2597                 acp.interval = __constant_cpu_to_le16(0x0024);
2598         } else {
2599                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2600
2601                 /* default 1.28 sec page scan */
2602                 acp.interval = __constant_cpu_to_le16(0x0800);
2603         }
2604
2605         /* default 11.25 msec page scan window */
2606         acp.window = __constant_cpu_to_le16(0x0012);
2607
2608         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2609                            &acp);
2610         if (err < 0) {
2611                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2612                                  MGMT_STATUS_FAILED);
2613                 goto done;
2614         }
2615
2616         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2617         if (err < 0) {
2618                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2619                                  MGMT_STATUS_FAILED);
2620                 goto done;
2621         }
2622
2623         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2624                            NULL, 0);
2625 done:
2626         hci_dev_unlock(hdev);
2627         return err;
2628 }
2629
2630 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2631                                void *cp_data, u16 len)
2632 {
2633         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2634         u16 key_count, expected_len;
2635         int i;
2636
2637         key_count = __le16_to_cpu(cp->key_count);
2638
2639         expected_len = sizeof(*cp) + key_count *
2640                                         sizeof(struct mgmt_ltk_info);
2641         if (expected_len != len) {
2642                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2643                                                         len, expected_len);
2644                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2645                                   EINVAL);
2646         }
2647
2648         BT_DBG("%s key_count %u", hdev->name, key_count);
2649
2650         hci_dev_lock(hdev);
2651
2652         hci_smp_ltks_clear(hdev);
2653
2654         for (i = 0; i < key_count; i++) {
2655                 struct mgmt_ltk_info *key = &cp->keys[i];
2656                 u8 type;
2657
2658                 if (key->master)
2659                         type = HCI_SMP_LTK;
2660                 else
2661                         type = HCI_SMP_LTK_SLAVE;
2662
2663                 hci_add_ltk(hdev, &key->addr.bdaddr, key->addr.type,
2664                             type, 0, key->authenticated, key->val,
2665                             key->enc_size, key->ediv, key->rand);
2666         }
2667
2668         hci_dev_unlock(hdev);
2669
2670         return 0;
2671 }
2672
2673 static const struct mgmt_handler {
2674         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2675                      u16 data_len);
2676         bool var_len;
2677         size_t data_len;
2678 } mgmt_handlers[] = {
2679         { NULL }, /* 0x0000 (no command) */
2680         { read_version,           false, MGMT_READ_VERSION_SIZE },
2681         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
2682         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
2683         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
2684         { set_powered,            false, MGMT_SETTING_SIZE },
2685         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
2686         { set_connectable,        false, MGMT_SETTING_SIZE },
2687         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
2688         { set_pairable,           false, MGMT_SETTING_SIZE },
2689         { set_link_security,      false, MGMT_SETTING_SIZE },
2690         { set_ssp,                false, MGMT_SETTING_SIZE },
2691         { set_hs,                 false, MGMT_SETTING_SIZE },
2692         { set_le,                 false, MGMT_SETTING_SIZE },
2693         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
2694         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
2695         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
2696         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
2697         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
2698         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2699         { disconnect,             false, MGMT_DISCONNECT_SIZE },
2700         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
2701         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
2702         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2703         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
2704         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
2705         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2706         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
2707         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
2708         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2709         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
2710         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2711         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2712         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2713         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2714         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
2715         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
2716         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
2717         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
2718         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
2719         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
2720 };
2721
2722
2723 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2724 {
2725         void *buf;
2726         u8 *cp;
2727         struct mgmt_hdr *hdr;
2728         u16 opcode, index, len;
2729         struct hci_dev *hdev = NULL;
2730         const struct mgmt_handler *handler;
2731         int err;
2732
2733         BT_DBG("got %zu bytes", msglen);
2734
2735         if (msglen < sizeof(*hdr))
2736                 return -EINVAL;
2737
2738         buf = kmalloc(msglen, GFP_KERNEL);
2739         if (!buf)
2740                 return -ENOMEM;
2741
2742         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2743                 err = -EFAULT;
2744                 goto done;
2745         }
2746
2747         hdr = buf;
2748         opcode = __le16_to_cpu(hdr->opcode);
2749         index = __le16_to_cpu(hdr->index);
2750         len = __le16_to_cpu(hdr->len);
2751
2752         if (len != msglen - sizeof(*hdr)) {
2753                 err = -EINVAL;
2754                 goto done;
2755         }
2756
2757         if (index != MGMT_INDEX_NONE) {
2758                 hdev = hci_dev_get(index);
2759                 if (!hdev) {
2760                         err = cmd_status(sk, index, opcode,
2761                                          MGMT_STATUS_INVALID_INDEX);
2762                         goto done;
2763                 }
2764         }
2765
2766         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2767                                         mgmt_handlers[opcode].func == NULL) {
2768                 BT_DBG("Unknown op %u", opcode);
2769                 err = cmd_status(sk, index, opcode,
2770                                  MGMT_STATUS_UNKNOWN_COMMAND);
2771                 goto done;
2772         }
2773
2774         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2775                         (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2776                 err = cmd_status(sk, index, opcode,
2777                                  MGMT_STATUS_INVALID_INDEX);
2778                 goto done;
2779         }
2780
2781         handler = &mgmt_handlers[opcode];
2782
2783         if ((handler->var_len && len < handler->data_len) ||
2784                         (!handler->var_len && len != handler->data_len)) {
2785                 err = cmd_status(sk, index, opcode,
2786                                  MGMT_STATUS_INVALID_PARAMS);
2787                 goto done;
2788         }
2789
2790         if (hdev)
2791                 mgmt_init_hdev(sk, hdev);
2792
2793         cp = buf + sizeof(*hdr);
2794
2795         err = handler->func(sk, hdev, cp, len);
2796         if (err < 0)
2797                 goto done;
2798
2799         err = msglen;
2800
2801 done:
2802         if (hdev)
2803                 hci_dev_put(hdev);
2804
2805         kfree(buf);
2806         return err;
2807 }
2808
2809 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2810 {
2811         u8 *status = data;
2812
2813         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2814         mgmt_pending_remove(cmd);
2815 }
2816
2817 int mgmt_index_added(struct hci_dev *hdev)
2818 {
2819         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2820 }
2821
2822 int mgmt_index_removed(struct hci_dev *hdev)
2823 {
2824         u8 status = MGMT_STATUS_INVALID_INDEX;
2825
2826         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2827
2828         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2829 }
2830
2831 struct cmd_lookup {
2832         struct sock *sk;
2833         struct hci_dev *hdev;
2834         u8 mgmt_status;
2835 };
2836
2837 static void settings_rsp(struct pending_cmd *cmd, void *data)
2838 {
2839         struct cmd_lookup *match = data;
2840
2841         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2842
2843         list_del(&cmd->list);
2844
2845         if (match->sk == NULL) {
2846                 match->sk = cmd->sk;
2847                 sock_hold(match->sk);
2848         }
2849
2850         mgmt_pending_free(cmd);
2851 }
2852
2853 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2854 {
2855         struct cmd_lookup match = { NULL, hdev };
2856         int err;
2857
2858         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2859                 return 0;
2860
2861         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2862
2863         if (powered) {
2864                 u8 scan = 0;
2865
2866                 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2867                         scan |= SCAN_PAGE;
2868                 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2869                         scan |= SCAN_INQUIRY;
2870
2871                 if (scan)
2872                         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2873
2874                 update_class(hdev);
2875                 update_name(hdev, hdev->dev_name);
2876                 update_eir(hdev);
2877         } else {
2878                 u8 status = MGMT_STATUS_NOT_POWERED;
2879                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2880         }
2881
2882         err = new_settings(hdev, match.sk);
2883
2884         if (match.sk)
2885                 sock_put(match.sk);
2886
2887         return err;
2888 }
2889
2890 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2891 {
2892         struct cmd_lookup match = { NULL, hdev };
2893         bool changed = false;
2894         int err = 0;
2895
2896         if (discoverable) {
2897                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2898                         changed = true;
2899         } else {
2900                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2901                         changed = true;
2902         }
2903
2904         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
2905                              &match);
2906
2907         if (changed)
2908                 err = new_settings(hdev, match.sk);
2909
2910         if (match.sk)
2911                 sock_put(match.sk);
2912
2913         return err;
2914 }
2915
2916 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2917 {
2918         struct cmd_lookup match = { NULL, hdev };
2919         bool changed = false;
2920         int err = 0;
2921
2922         if (connectable) {
2923                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2924                         changed = true;
2925         } else {
2926                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2927                         changed = true;
2928         }
2929
2930         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
2931                              &match);
2932
2933         if (changed)
2934                 err = new_settings(hdev, match.sk);
2935
2936         if (match.sk)
2937                 sock_put(match.sk);
2938
2939         return err;
2940 }
2941
2942 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2943 {
2944         u8 mgmt_err = mgmt_status(status);
2945
2946         if (scan & SCAN_PAGE)
2947                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2948                                      cmd_status_rsp, &mgmt_err);
2949
2950         if (scan & SCAN_INQUIRY)
2951                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2952                                      cmd_status_rsp, &mgmt_err);
2953
2954         return 0;
2955 }
2956
2957 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, bool persistent)
2958 {
2959         struct mgmt_ev_new_link_key ev;
2960
2961         memset(&ev, 0, sizeof(ev));
2962
2963         ev.store_hint = persistent;
2964         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2965         ev.key.addr.type = MGMT_ADDR_BREDR;
2966         ev.key.type = key->type;
2967         memcpy(ev.key.val, key->val, 16);
2968         ev.key.pin_len = key->pin_len;
2969
2970         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2971 }
2972
2973 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
2974 {
2975         struct mgmt_ev_new_long_term_key ev;
2976
2977         memset(&ev, 0, sizeof(ev));
2978
2979         ev.store_hint = persistent;
2980         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2981         ev.key.addr.type = key->bdaddr_type;
2982         ev.key.authenticated = key->authenticated;
2983         ev.key.enc_size = key->enc_size;
2984         ev.key.ediv = key->ediv;
2985
2986         if (key->type == HCI_SMP_LTK)
2987                 ev.key.master = 1;
2988
2989         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
2990         memcpy(ev.key.val, key->val, sizeof(key->val));
2991
2992         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
2993                           NULL);
2994 }
2995
2996 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2997                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
2998                           u8 *dev_class)
2999 {
3000         char buf[512];
3001         struct mgmt_ev_device_connected *ev = (void *) buf;
3002         u16 eir_len = 0;
3003
3004         bacpy(&ev->addr.bdaddr, bdaddr);
3005         ev->addr.type = link_to_mgmt(link_type, addr_type);
3006
3007         ev->flags = __cpu_to_le32(flags);
3008
3009         if (name_len > 0)
3010                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3011                                           name, name_len);
3012
3013         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3014                 eir_len = eir_append_data(ev->eir, eir_len,
3015                                           EIR_CLASS_OF_DEV, dev_class, 3);
3016
3017         ev->eir_len = cpu_to_le16(eir_len);
3018
3019         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3020                           sizeof(*ev) + eir_len, NULL);
3021 }
3022
3023 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3024 {
3025         struct mgmt_cp_disconnect *cp = cmd->param;
3026         struct sock **sk = data;
3027         struct mgmt_rp_disconnect rp;
3028
3029         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3030         rp.addr.type = cp->addr.type;
3031
3032         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3033                      sizeof(rp));
3034
3035         *sk = cmd->sk;
3036         sock_hold(*sk);
3037
3038         mgmt_pending_remove(cmd);
3039 }
3040
3041 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3042 {
3043         struct hci_dev *hdev = data;
3044         struct mgmt_cp_unpair_device *cp = cmd->param;
3045         struct mgmt_rp_unpair_device rp;
3046
3047         memset(&rp, 0, sizeof(rp));
3048         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3049         rp.addr.type = cp->addr.type;
3050
3051         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3052
3053         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3054
3055         mgmt_pending_remove(cmd);
3056 }
3057
3058 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3059                              u8 link_type, u8 addr_type)
3060 {
3061         struct mgmt_addr_info ev;
3062         struct sock *sk = NULL;
3063         int err;
3064
3065         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3066
3067         bacpy(&ev.bdaddr, bdaddr);
3068         ev.type = link_to_mgmt(link_type, addr_type);
3069
3070         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3071                          sk);
3072
3073         if (sk)
3074                 sock_put(sk);
3075
3076         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3077                              hdev);
3078
3079         return err;
3080 }
3081
3082 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3083                            u8 link_type, u8 addr_type, u8 status)
3084 {
3085         struct mgmt_rp_disconnect rp;
3086         struct pending_cmd *cmd;
3087         int err;
3088
3089         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3090         if (!cmd)
3091                 return -ENOENT;
3092
3093         bacpy(&rp.addr.bdaddr, bdaddr);
3094         rp.addr.type = link_to_mgmt(link_type, addr_type);
3095
3096         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3097                            mgmt_status(status), &rp, sizeof(rp));
3098
3099         mgmt_pending_remove(cmd);
3100
3101         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3102                                                                         hdev);
3103         return err;
3104 }
3105
3106 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3107                         u8 addr_type, u8 status)
3108 {
3109         struct mgmt_ev_connect_failed ev;
3110
3111         bacpy(&ev.addr.bdaddr, bdaddr);
3112         ev.addr.type = link_to_mgmt(link_type, addr_type);
3113         ev.status = mgmt_status(status);
3114
3115         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3116 }
3117
3118 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3119 {
3120         struct mgmt_ev_pin_code_request ev;
3121
3122         bacpy(&ev.addr.bdaddr, bdaddr);
3123         ev.addr.type = MGMT_ADDR_BREDR;
3124         ev.secure = secure;
3125
3126         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3127                           NULL);
3128 }
3129
3130 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3131                                  u8 status)
3132 {
3133         struct pending_cmd *cmd;
3134         struct mgmt_rp_pin_code_reply rp;
3135         int err;
3136
3137         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3138         if (!cmd)
3139                 return -ENOENT;
3140
3141         bacpy(&rp.addr.bdaddr, bdaddr);
3142         rp.addr.type = MGMT_ADDR_BREDR;
3143
3144         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3145                            mgmt_status(status), &rp, sizeof(rp));
3146
3147         mgmt_pending_remove(cmd);
3148
3149         return err;
3150 }
3151
3152 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3153                                      u8 status)
3154 {
3155         struct pending_cmd *cmd;
3156         struct mgmt_rp_pin_code_reply rp;
3157         int err;
3158
3159         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3160         if (!cmd)
3161                 return -ENOENT;
3162
3163         bacpy(&rp.addr.bdaddr, bdaddr);
3164         rp.addr.type = MGMT_ADDR_BREDR;
3165
3166         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3167                            mgmt_status(status), &rp, sizeof(rp));
3168
3169         mgmt_pending_remove(cmd);
3170
3171         return err;
3172 }
3173
3174 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3175                               u8 link_type, u8 addr_type, __le32 value,
3176                               u8 confirm_hint)
3177 {
3178         struct mgmt_ev_user_confirm_request ev;
3179
3180         BT_DBG("%s", hdev->name);
3181
3182         bacpy(&ev.addr.bdaddr, bdaddr);
3183         ev.addr.type = link_to_mgmt(link_type, addr_type);
3184         ev.confirm_hint = confirm_hint;
3185         ev.value = value;
3186
3187         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3188                           NULL);
3189 }
3190
3191 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3192                                                 u8 link_type, u8 addr_type)
3193 {
3194         struct mgmt_ev_user_passkey_request ev;
3195
3196         BT_DBG("%s", hdev->name);
3197
3198         bacpy(&ev.addr.bdaddr, bdaddr);
3199         ev.addr.type = link_to_mgmt(link_type, addr_type);
3200
3201         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3202                           NULL);
3203 }
3204
3205 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3206                                         u8 link_type, u8 addr_type, u8 status,
3207                                         u8 opcode)
3208 {
3209         struct pending_cmd *cmd;
3210         struct mgmt_rp_user_confirm_reply rp;
3211         int err;
3212
3213         cmd = mgmt_pending_find(opcode, hdev);
3214         if (!cmd)
3215                 return -ENOENT;
3216
3217         bacpy(&rp.addr.bdaddr, bdaddr);
3218         rp.addr.type = link_to_mgmt(link_type, addr_type);
3219         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3220                            &rp, sizeof(rp));
3221
3222         mgmt_pending_remove(cmd);
3223
3224         return err;
3225 }
3226
3227 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3228                                      u8 link_type, u8 addr_type, u8 status)
3229 {
3230         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3231                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3232 }
3233
3234 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3235                                          u8 link_type, u8 addr_type, u8 status)
3236 {
3237         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3238                                           status, MGMT_OP_USER_CONFIRM_NEG_REPLY);
3239 }
3240
3241 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3242                                      u8 link_type, u8 addr_type, u8 status)
3243 {
3244         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3245                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3246 }
3247
3248 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3249                                          u8 link_type, u8 addr_type, u8 status)
3250 {
3251         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3252                                           status, MGMT_OP_USER_PASSKEY_NEG_REPLY);
3253 }
3254
3255 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3256                      u8 addr_type, u8 status)
3257 {
3258         struct mgmt_ev_auth_failed ev;
3259
3260         bacpy(&ev.addr.bdaddr, bdaddr);
3261         ev.addr.type = link_to_mgmt(link_type, addr_type);
3262         ev.status = mgmt_status(status);
3263
3264         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3265 }
3266
3267 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3268 {
3269         struct cmd_lookup match = { NULL, hdev };
3270         bool changed = false;
3271         int err = 0;
3272
3273         if (status) {
3274                 u8 mgmt_err = mgmt_status(status);
3275                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3276                                      cmd_status_rsp, &mgmt_err);
3277                 return 0;
3278         }
3279
3280         if (test_bit(HCI_AUTH, &hdev->flags)) {
3281                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3282                         changed = true;
3283         } else {
3284                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3285                         changed = true;
3286         }
3287
3288         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3289                              &match);
3290
3291         if (changed)
3292                 err = new_settings(hdev, match.sk);
3293
3294         if (match.sk)
3295                 sock_put(match.sk);
3296
3297         return err;
3298 }
3299
3300 static int clear_eir(struct hci_dev *hdev)
3301 {
3302         struct hci_cp_write_eir cp;
3303
3304         if (!(hdev->features[6] & LMP_EXT_INQ))
3305                 return 0;
3306
3307         memset(hdev->eir, 0, sizeof(hdev->eir));
3308
3309         memset(&cp, 0, sizeof(cp));
3310
3311         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3312 }
3313
3314 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3315 {
3316         struct cmd_lookup match = { NULL, hdev };
3317         bool changed = false;
3318         int err = 0;
3319
3320         if (status) {
3321                 u8 mgmt_err = mgmt_status(status);
3322
3323                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3324                                                  &hdev->dev_flags))
3325                         err = new_settings(hdev, NULL);
3326
3327                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3328                                      &mgmt_err);
3329
3330                 return err;
3331         }
3332
3333         if (enable) {
3334                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3335                         changed = true;
3336         } else {
3337                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3338                         changed = true;
3339         }
3340
3341         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3342
3343         if (changed)
3344                 err = new_settings(hdev, match.sk);
3345
3346         if (match.sk)
3347                 sock_put(match.sk);
3348
3349         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3350                 update_eir(hdev);
3351         else
3352                 clear_eir(hdev);
3353
3354         return err;
3355 }
3356
3357 static void class_rsp(struct pending_cmd *cmd, void *data)
3358 {
3359         struct cmd_lookup *match = data;
3360
3361         cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3362                      match->hdev->dev_class, 3);
3363
3364         list_del(&cmd->list);
3365
3366         if (match->sk == NULL) {
3367                 match->sk = cmd->sk;
3368                 sock_hold(match->sk);
3369         }
3370
3371         mgmt_pending_free(cmd);
3372 }
3373
3374 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3375                                    u8 status)
3376 {
3377         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3378         int err = 0;
3379
3380         clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3381
3382         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3383         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3384         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3385
3386         if (!status)
3387                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3388                                  3, NULL);
3389
3390         if (match.sk)
3391                 sock_put(match.sk);
3392
3393         return err;
3394 }
3395
3396 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3397 {
3398         struct pending_cmd *cmd;
3399         struct mgmt_cp_set_local_name ev;
3400         bool changed = false;
3401         int err = 0;
3402
3403         if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3404                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3405                 changed = true;
3406         }
3407
3408         memset(&ev, 0, sizeof(ev));
3409         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3410         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3411
3412         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3413         if (!cmd)
3414                 goto send_event;
3415
3416         /* Always assume that either the short or the complete name has
3417          * changed if there was a pending mgmt command */
3418         changed = true;
3419
3420         if (status) {
3421                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3422                                  mgmt_status(status));
3423                 goto failed;
3424         }
3425
3426         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3427                            sizeof(ev));
3428         if (err < 0)
3429                 goto failed;
3430
3431 send_event:
3432         if (changed)
3433                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3434                                  sizeof(ev), cmd ? cmd->sk : NULL);
3435
3436         update_eir(hdev);
3437
3438 failed:
3439         if (cmd)
3440                 mgmt_pending_remove(cmd);
3441         return err;
3442 }
3443
3444 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3445                                             u8 *randomizer, u8 status)
3446 {
3447         struct pending_cmd *cmd;
3448         int err;
3449
3450         BT_DBG("%s status %u", hdev->name, status);
3451
3452         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3453         if (!cmd)
3454                 return -ENOENT;
3455
3456         if (status) {
3457                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3458                                  mgmt_status(status));
3459         } else {
3460                 struct mgmt_rp_read_local_oob_data rp;
3461
3462                 memcpy(rp.hash, hash, sizeof(rp.hash));
3463                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3464
3465                 err = cmd_complete(cmd->sk, hdev->id,
3466                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3467                                    sizeof(rp));
3468         }
3469
3470         mgmt_pending_remove(cmd);
3471
3472         return err;
3473 }
3474
3475 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3476 {
3477         struct cmd_lookup match = { NULL, hdev };
3478         bool changed = false;
3479         int err = 0;
3480
3481         if (status) {
3482                 u8 mgmt_err = mgmt_status(status);
3483
3484                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3485                                                  &hdev->dev_flags))
3486                         err = new_settings(hdev, NULL);
3487
3488                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3489                                      &mgmt_err);
3490
3491                 return err;
3492         }
3493
3494         if (enable) {
3495                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3496                         changed = true;
3497         } else {
3498                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3499                         changed = true;
3500         }
3501
3502         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3503
3504         if (changed)
3505                 err = new_settings(hdev, match.sk);
3506
3507         if (match.sk)
3508                 sock_put(match.sk);
3509
3510         return err;
3511 }
3512
3513 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3514                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3515                       ssp, u8 *eir, u16 eir_len)
3516 {
3517         char buf[512];
3518         struct mgmt_ev_device_found *ev = (void *) buf;
3519         size_t ev_size;
3520
3521         /* Leave 5 bytes for a potential CoD field */
3522         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3523                 return -EINVAL;
3524
3525         memset(buf, 0, sizeof(buf));
3526
3527         bacpy(&ev->addr.bdaddr, bdaddr);
3528         ev->addr.type = link_to_mgmt(link_type, addr_type);
3529         ev->rssi = rssi;
3530         if (cfm_name)
3531                 ev->flags[0] |= MGMT_DEV_FOUND_CONFIRM_NAME;
3532         if (!ssp)
3533                 ev->flags[0] |= MGMT_DEV_FOUND_LEGACY_PAIRING;
3534
3535         if (eir_len > 0)
3536                 memcpy(ev->eir, eir, eir_len);
3537
3538         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3539                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3540                                           dev_class, 3);
3541
3542         ev->eir_len = cpu_to_le16(eir_len);
3543
3544         ev_size = sizeof(*ev) + eir_len;
3545
3546         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3547 }
3548
3549 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3550                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3551 {
3552         struct mgmt_ev_device_found *ev;
3553         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3554         u16 eir_len;
3555
3556         ev = (struct mgmt_ev_device_found *) buf;
3557
3558         memset(buf, 0, sizeof(buf));
3559
3560         bacpy(&ev->addr.bdaddr, bdaddr);
3561         ev->addr.type = link_to_mgmt(link_type, addr_type);
3562         ev->rssi = rssi;
3563
3564         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3565                                   name_len);
3566
3567         ev->eir_len = cpu_to_le16(eir_len);
3568
3569         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3570                           sizeof(*ev) + eir_len, NULL);
3571 }
3572
3573 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3574 {
3575         struct pending_cmd *cmd;
3576         u8 type;
3577         int err;
3578
3579         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3580
3581         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3582         if (!cmd)
3583                 return -ENOENT;
3584
3585         type = hdev->discovery.type;
3586
3587         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3588                            &type, sizeof(type));
3589         mgmt_pending_remove(cmd);
3590
3591         return err;
3592 }
3593
3594 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3595 {
3596         struct pending_cmd *cmd;
3597         int err;
3598
3599         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3600         if (!cmd)
3601                 return -ENOENT;
3602
3603         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3604                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3605         mgmt_pending_remove(cmd);
3606
3607         return err;
3608 }
3609
3610 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3611 {
3612         struct mgmt_ev_discovering ev;
3613         struct pending_cmd *cmd;
3614
3615         BT_DBG("%s discovering %u", hdev->name, discovering);
3616
3617         if (discovering)
3618                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3619         else
3620                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3621
3622         if (cmd != NULL) {
3623                 u8 type = hdev->discovery.type;
3624
3625                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3626                              sizeof(type));
3627                 mgmt_pending_remove(cmd);
3628         }
3629
3630         memset(&ev, 0, sizeof(ev));
3631         ev.type = hdev->discovery.type;
3632         ev.discovering = discovering;
3633
3634         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3635 }
3636
3637 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3638 {
3639         struct pending_cmd *cmd;
3640         struct mgmt_ev_device_blocked ev;
3641
3642         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3643
3644         bacpy(&ev.addr.bdaddr, bdaddr);
3645         ev.addr.type = type;
3646
3647         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3648                           cmd ? cmd->sk : NULL);
3649 }
3650
3651 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3652 {
3653         struct pending_cmd *cmd;
3654         struct mgmt_ev_device_unblocked ev;
3655
3656         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3657
3658         bacpy(&ev.addr.bdaddr, bdaddr);
3659         ev.addr.type = type;
3660
3661         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3662                           cmd ? cmd->sk : NULL);
3663 }
3664
3665 module_param(enable_hs, bool, 0644);
3666 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");
3667
3668 module_param(enable_le, bool, 0644);
3669 MODULE_PARM_DESC(enable_le, "Enable Low Energy support");