net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/kernel.h>
  28 #include <linux/uaccess.h>
  29 #include <linux/module.h>
  30 #include <asm/unaligned.h>
  31
  32 #include <net/bluetooth/bluetooth.h>
  33 #include <net/bluetooth/hci_core.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #include <net/bluetooth/smp.h>
  36
  37 bool enable_hs;
  38 bool enable_le;
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   0
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_PAIRABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81 };
  82
  83 static const u16 mgmt_events[] = {
  84         MGMT_EV_CONTROLLER_ERROR,
  85         MGMT_EV_INDEX_ADDED,
  86         MGMT_EV_INDEX_REMOVED,
  87         MGMT_EV_NEW_SETTINGS,
  88         MGMT_EV_CLASS_OF_DEV_CHANGED,
  89         MGMT_EV_LOCAL_NAME_CHANGED,
  90         MGMT_EV_NEW_LINK_KEY,
  91         MGMT_EV_NEW_LONG_TERM_KEY,
  92         MGMT_EV_DEVICE_CONNECTED,
  93         MGMT_EV_DEVICE_DISCONNECTED,
  94         MGMT_EV_CONNECT_FAILED,
  95         MGMT_EV_PIN_CODE_REQUEST,
  96         MGMT_EV_USER_CONFIRM_REQUEST,
  97         MGMT_EV_USER_PASSKEY_REQUEST,
  98         MGMT_EV_AUTH_FAILED,
  99         MGMT_EV_DEVICE_FOUND,
 100         MGMT_EV_DISCOVERING,
 101         MGMT_EV_DEVICE_BLOCKED,
 102         MGMT_EV_DEVICE_UNBLOCKED,
 103         MGMT_EV_DEVICE_UNPAIRED,
 104 };
 105
 106 /*
 107  * These LE scan and inquiry parameters were chosen according to LE General
 108  * Discovery Procedure specification.
 109  */
 110 #define LE_SCAN_TYPE                    0x01
 111 #define LE_SCAN_WIN                     0x12
 112 #define LE_SCAN_INT                     0x12
 113 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 114 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 115
 116 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 117 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 118
 119 #define SERVICE_CACHE_TIMEOUT (5 * 1000)
 120
 121 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 122                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 123
 124 struct pending_cmd {
 125         struct list_head list;
 126         u16 opcode;
 127         int index;
 128         void *param;
 129         struct sock *sk;
 130         void *user_data;
 131 };
 132
 133 /* HCI to MGMT error code conversion table */
 134 static u8 mgmt_status_table[] = {
 135         MGMT_STATUS_SUCCESS,
 136         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 137         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 138         MGMT_STATUS_FAILED,             /* Hardware Failure */
 139         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 140         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 141         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 142         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 143         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 145         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 146         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 147         MGMT_STATUS_BUSY,               /* Command Disallowed */
 148         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 149         MGMT_STATUS_REJECTED,           /* Rejected Security */
 150         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 151         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 152         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 153         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 154         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 155         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 156         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 157         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 158         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 159         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 160         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 161         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 162         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 163         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 164         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 165         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 166         MGMT_STATUS_FAILED,             /* Unspecified Error */
 167         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 168         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 169         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 170         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 171         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 172         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 173         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 175         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 176         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 177         MGMT_STATUS_FAILED,             /* Transaction Collision */
 178         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 179         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 180         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 181         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 182         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 183         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 184         MGMT_STATUS_FAILED,             /* Slot Violation */
 185         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 186         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 187         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 188         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 189         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 190         MGMT_STATUS_BUSY,               /* Controller Busy */
 191         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 192         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 193         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 194         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 195         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 196 };
 197
 198 static u8 mgmt_status(u8 hci_status)
 199 {
 200         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 201                 return mgmt_status_table[hci_status];
 202
 203         return MGMT_STATUS_FAILED;
 204 }
 205
 206 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 207 {
 208         struct sk_buff *skb;
 209         struct mgmt_hdr *hdr;
 210         struct mgmt_ev_cmd_status *ev;
 211         int err;
 212
 213         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 214
 215         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
 216         if (!skb)
 217                 return -ENOMEM;
 218
 219         hdr = (void *) skb_put(skb, sizeof(*hdr));
 220
 221         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 222         hdr->index = cpu_to_le16(index);
 223         hdr->len = cpu_to_le16(sizeof(*ev));
 224
 225         ev = (void *) skb_put(skb, sizeof(*ev));
 226         ev->status = status;
 227         put_unaligned_le16(cmd, &ev->opcode);
 228
 229         err = sock_queue_rcv_skb(sk, skb);
 230         if (err < 0)
 231                 kfree_skb(skb);
 232
 233         return err;
 234 }
 235
 236 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 237                                                 void *rp, size_t rp_len)
 238 {
 239         struct sk_buff *skb;
 240         struct mgmt_hdr *hdr;
 241         struct mgmt_ev_cmd_complete *ev;
 242         int err;
 243
 244         BT_DBG("sock %p", sk);
 245
 246         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
 247         if (!skb)
 248                 return -ENOMEM;
 249
 250         hdr = (void *) skb_put(skb, sizeof(*hdr));
 251
 252         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 253         hdr->index = cpu_to_le16(index);
 254         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 255
 256         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 257         put_unaligned_le16(cmd, &ev->opcode);
 258         ev->status = status;
 259
 260         if (rp)
 261                 memcpy(ev->data, rp, rp_len);
 262
 263         err = sock_queue_rcv_skb(sk, skb);
 264         if (err < 0)
 265                 kfree_skb(skb);
 266
 267         return err;;
 268 }
 269
 270 static int read_version(struct sock *sk)
 271 {
 272         struct mgmt_rp_read_version rp;
 273
 274         BT_DBG("sock %p", sk);
 275
 276         rp.version = MGMT_VERSION;
 277         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 278
 279         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 280                                                                 sizeof(rp));
 281 }
 282
 283 static int read_commands(struct sock *sk)
 284 {
 285         struct mgmt_rp_read_commands *rp;
 286         u16 num_commands = ARRAY_SIZE(mgmt_commands);
 287         u16 num_events = ARRAY_SIZE(mgmt_events);
 288         u16 *opcode;
 289         size_t rp_size;
 290         int i, err;
 291
 292         BT_DBG("sock %p", sk);
 293
 294         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 295
 296         rp = kmalloc(rp_size, GFP_KERNEL);
 297         if (!rp)
 298                 return -ENOMEM;
 299
 300         put_unaligned_le16(num_commands, &rp->num_commands);
 301         put_unaligned_le16(num_events, &rp->num_events);
 302
 303         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 304                 put_unaligned_le16(mgmt_commands[i], opcode);
 305
 306         for (i = 0; i < num_events; i++, opcode++)
 307                 put_unaligned_le16(mgmt_events[i], opcode);
 308
 309         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 310                                                                 rp_size);
 311         kfree(rp);
 312
 313         return err;
 314 }
 315
 316 static int read_index_list(struct sock *sk)
 317 {
 318         struct mgmt_rp_read_index_list *rp;
 319         struct list_head *p;
 320         struct hci_dev *d;
 321         size_t rp_len;
 322         u16 count;
 323         int i, err;
 324
 325         BT_DBG("sock %p", sk);
 326
 327         read_lock(&hci_dev_list_lock);
 328
 329         count = 0;
 330         list_for_each(p, &hci_dev_list) {
 331                 count++;
 332         }
 333
 334         rp_len = sizeof(*rp) + (2 * count);
 335         rp = kmalloc(rp_len, GFP_ATOMIC);
 336         if (!rp) {
 337                 read_unlock(&hci_dev_list_lock);
 338                 return -ENOMEM;
 339         }
 340
 341         put_unaligned_le16(count, &rp->num_controllers);
 342
 343         i = 0;
 344         list_for_each_entry(d, &hci_dev_list, list) {
 345                 if (test_bit(HCI_SETUP, &d->dev_flags))
 346                         continue;
 347
 348                 put_unaligned_le16(d->id, &rp->index[i++]);
 349                 BT_DBG("Added hci%u", d->id);
 350         }
 351
 352         read_unlock(&hci_dev_list_lock);
 353
 354         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 355                                                                         rp_len);
 356
 357         kfree(rp);
 358
 359         return err;
 360 }
 361
 362 static u32 get_supported_settings(struct hci_dev *hdev)
 363 {
 364         u32 settings = 0;
 365
 366         settings |= MGMT_SETTING_POWERED;
 367         settings |= MGMT_SETTING_CONNECTABLE;
 368         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 369         settings |= MGMT_SETTING_DISCOVERABLE;
 370         settings |= MGMT_SETTING_PAIRABLE;
 371
 372         if (hdev->features[6] & LMP_SIMPLE_PAIR)
 373                 settings |= MGMT_SETTING_SSP;
 374
 375         if (!(hdev->features[4] & LMP_NO_BREDR)) {
 376                 settings |= MGMT_SETTING_BREDR;
 377                 settings |= MGMT_SETTING_LINK_SECURITY;
 378         }
 379
 380         if (enable_hs)
 381                 settings |= MGMT_SETTING_HS;
 382
 383         if (enable_le) {
 384                 if (hdev->features[4] & LMP_LE)
 385                         settings |= MGMT_SETTING_LE;
 386         }
 387
 388         return settings;
 389 }
 390
 391 static u32 get_current_settings(struct hci_dev *hdev)
 392 {
 393         u32 settings = 0;
 394
 395         if (hdev_is_powered(hdev))
 396                 settings |= MGMT_SETTING_POWERED;
 397
 398         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 399                 settings |= MGMT_SETTING_CONNECTABLE;
 400
 401         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 402                 settings |= MGMT_SETTING_DISCOVERABLE;
 403
 404         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 405                 settings |= MGMT_SETTING_PAIRABLE;
 406
 407         if (!(hdev->features[4] & LMP_NO_BREDR))
 408                 settings |= MGMT_SETTING_BREDR;
 409
 410         if (hdev->host_features[0] & LMP_HOST_LE)
 411                 settings |= MGMT_SETTING_LE;
 412
 413         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 414                 settings |= MGMT_SETTING_LINK_SECURITY;
 415
 416         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 417                 settings |= MGMT_SETTING_SSP;
 418
 419         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 420                 settings |= MGMT_SETTING_HS;
 421
 422         return settings;
 423 }
 424
 425 #define PNP_INFO_SVCLASS_ID             0x1200
 426
 427 static u8 bluetooth_base_uuid[] = {
 428                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 429                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 430 };
 431
 432 static u16 get_uuid16(u8 *uuid128)
 433 {
 434         u32 val;
 435         int i;
 436
 437         for (i = 0; i < 12; i++) {
 438                 if (bluetooth_base_uuid[i] != uuid128[i])
 439                         return 0;
 440         }
 441
 442         memcpy(&val, &uuid128[12], 4);
 443
 444         val = le32_to_cpu(val);
 445         if (val > 0xffff)
 446                 return 0;
 447
 448         return (u16) val;
 449 }
 450
 451 static void create_eir(struct hci_dev *hdev, u8 *data)
 452 {
 453         u8 *ptr = data;
 454         u16 eir_len = 0;
 455         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 456         int i, truncated = 0;
 457         struct bt_uuid *uuid;
 458         size_t name_len;
 459
 460         name_len = strlen(hdev->dev_name);
 461
 462         if (name_len > 0) {
 463                 /* EIR Data type */
 464                 if (name_len > 48) {
 465                         name_len = 48;
 466                         ptr[1] = EIR_NAME_SHORT;
 467                 } else
 468                         ptr[1] = EIR_NAME_COMPLETE;
 469
 470                 /* EIR Data length */
 471                 ptr[0] = name_len + 1;
 472
 473                 memcpy(ptr + 2, hdev->dev_name, name_len);
 474
 475                 eir_len += (name_len + 2);
 476                 ptr += (name_len + 2);
 477         }
 478
 479         memset(uuid16_list, 0, sizeof(uuid16_list));
 480
 481         /* Group all UUID16 types */
 482         list_for_each_entry(uuid, &hdev->uuids, list) {
 483                 u16 uuid16;
 484
 485                 uuid16 = get_uuid16(uuid->uuid);
 486                 if (uuid16 == 0)
 487                         return;
 488
 489                 if (uuid16 < 0x1100)
 490                         continue;
 491
 492                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 493                         continue;
 494
 495                 /* Stop if not enough space to put next UUID */
 496                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 497                         truncated = 1;
 498                         break;
 499                 }
 500
 501                 /* Check for duplicates */
 502                 for (i = 0; uuid16_list[i] != 0; i++)
 503                         if (uuid16_list[i] == uuid16)
 504                                 break;
 505
 506                 if (uuid16_list[i] == 0) {
 507                         uuid16_list[i] = uuid16;
 508                         eir_len += sizeof(u16);
 509                 }
 510         }
 511
 512         if (uuid16_list[0] != 0) {
 513                 u8 *length = ptr;
 514
 515                 /* EIR Data type */
 516                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 517
 518                 ptr += 2;
 519                 eir_len += 2;
 520
 521                 for (i = 0; uuid16_list[i] != 0; i++) {
 522                         *ptr++ = (uuid16_list[i] & 0x00ff);
 523                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 524                 }
 525
 526                 /* EIR Data length */
 527                 *length = (i * sizeof(u16)) + 1;
 528         }
 529 }
 530
 531 static int update_eir(struct hci_dev *hdev)
 532 {
 533         struct hci_cp_write_eir cp;
 534
 535         if (!(hdev->features[6] & LMP_EXT_INQ))
 536                 return 0;
 537
 538         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 539                 return 0;
 540
 541         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 542                 return 0;
 543
 544         memset(&cp, 0, sizeof(cp));
 545
 546         create_eir(hdev, cp.data);
 547
 548         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 549                 return 0;
 550
 551         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 552
 553         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 554 }
 555
 556 static u8 get_service_classes(struct hci_dev *hdev)
 557 {
 558         struct bt_uuid *uuid;
 559         u8 val = 0;
 560
 561         list_for_each_entry(uuid, &hdev->uuids, list)
 562                 val |= uuid->svc_hint;
 563
 564         return val;
 565 }
 566
 567 static int update_class(struct hci_dev *hdev)
 568 {
 569         u8 cod[3];
 570
 571         BT_DBG("%s", hdev->name);
 572
 573         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 574                 return 0;
 575
 576         cod[0] = hdev->minor_class;
 577         cod[1] = hdev->major_class;
 578         cod[2] = get_service_classes(hdev);
 579
 580         if (memcmp(cod, hdev->dev_class, 3) == 0)
 581                 return 0;
 582
 583         return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 584 }
 585
 586 static void service_cache_off(struct work_struct *work)
 587 {
 588         struct hci_dev *hdev = container_of(work, struct hci_dev,
 589                                                         service_cache.work);
 590
 591         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 592                 return;
 593
 594         hci_dev_lock(hdev);
 595
 596         update_eir(hdev);
 597         update_class(hdev);
 598
 599         hci_dev_unlock(hdev);
 600 }
 601
 602 static void mgmt_init_hdev(struct hci_dev *hdev)
 603 {
 604         if (!test_and_set_bit(HCI_MGMT, &hdev->dev_flags)) {
 605                 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 606
 607                 /* Non-mgmt controlled devices get this bit set
 608                  * implicitly so that pairing works for them, however
 609                  * for mgmt we require user-space to explicitly enable
 610                  * it
 611                  */
 612                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 613         }
 614
 615         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 616                 schedule_delayed_work(&hdev->service_cache,
 617                                 msecs_to_jiffies(SERVICE_CACHE_TIMEOUT));
 618 }
 619
 620 static int read_controller_info(struct sock *sk, u16 index)
 621 {
 622         struct mgmt_rp_read_info rp;
 623         struct hci_dev *hdev;
 624
 625         BT_DBG("sock %p hci%u", sk, index);
 626
 627         hdev = hci_dev_get(index);
 628         if (!hdev)
 629                 return cmd_status(sk, index, MGMT_OP_READ_INFO,
 630                                                 MGMT_STATUS_INVALID_PARAMS);
 631
 632         hci_dev_lock(hdev);
 633
 634         if (test_and_clear_bit(HCI_PI_MGMT_INIT, &hci_pi(sk)->flags))
 635                 mgmt_init_hdev(hdev);
 636
 637         memset(&rp, 0, sizeof(rp));
 638
 639         bacpy(&rp.bdaddr, &hdev->bdaddr);
 640
 641         rp.version = hdev->hci_ver;
 642
 643         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 644
 645         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 646         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 647
 648         memcpy(rp.dev_class, hdev->dev_class, 3);
 649
 650         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 651
 652         hci_dev_unlock(hdev);
 653         hci_dev_put(hdev);
 654
 655         return cmd_complete(sk, index, MGMT_OP_READ_INFO, 0, &rp, sizeof(rp));
 656 }
 657
 658 static void mgmt_pending_free(struct pending_cmd *cmd)
 659 {
 660         sock_put(cmd->sk);
 661         kfree(cmd->param);
 662         kfree(cmd);
 663 }
 664
 665 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 666                                                         struct hci_dev *hdev,
 667                                                         void *data, u16 len)
 668 {
 669         struct pending_cmd *cmd;
 670
 671         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 672         if (!cmd)
 673                 return NULL;
 674
 675         cmd->opcode = opcode;
 676         cmd->index = hdev->id;
 677
 678         cmd->param = kmalloc(len, GFP_ATOMIC);
 679         if (!cmd->param) {
 680                 kfree(cmd);
 681                 return NULL;
 682         }
 683
 684         if (data)
 685                 memcpy(cmd->param, data, len);
 686
 687         cmd->sk = sk;
 688         sock_hold(sk);
 689
 690         list_add(&cmd->list, &hdev->mgmt_pending);
 691
 692         return cmd;
 693 }
 694
 695 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 696                                 void (*cb)(struct pending_cmd *cmd, void *data),
 697                                 void *data)
 698 {
 699         struct list_head *p, *n;
 700
 701         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 702                 struct pending_cmd *cmd;
 703
 704                 cmd = list_entry(p, struct pending_cmd, list);
 705
 706                 if (opcode > 0 && cmd->opcode != opcode)
 707                         continue;
 708
 709                 cb(cmd, data);
 710         }
 711 }
 712
 713 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 714 {
 715         struct pending_cmd *cmd;
 716
 717         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 718                 if (cmd->opcode == opcode)
 719                         return cmd;
 720         }
 721
 722         return NULL;
 723 }
 724
 725 static void mgmt_pending_remove(struct pending_cmd *cmd)
 726 {
 727         list_del(&cmd->list);
 728         mgmt_pending_free(cmd);
 729 }
 730
 731 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 732 {
 733         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 734
 735         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 736                                                         sizeof(settings));
 737 }
 738
 739 static int set_powered(struct sock *sk, u16 index, void *data, u16 len)
 740 {
 741         struct mgmt_mode *cp = data;
 742         struct hci_dev *hdev;
 743         struct pending_cmd *cmd;
 744         int err;
 745
 746         BT_DBG("request for hci%u", index);
 747
 748         if (len != sizeof(*cp))
 749                 return cmd_status(sk, index, MGMT_OP_SET_POWERED,
 750                                                 MGMT_STATUS_INVALID_PARAMS);
 751
 752         hdev = hci_dev_get(index);
 753         if (!hdev)
 754                 return cmd_status(sk, index, MGMT_OP_SET_POWERED,
 755                                                 MGMT_STATUS_INVALID_PARAMS);
 756
 757         hci_dev_lock(hdev);
 758
 759         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 760                 cancel_delayed_work(&hdev->power_off);
 761
 762                 if (cp->val) {
 763                         err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 764                         mgmt_powered(hdev, 1);
 765                         goto failed;
 766                 }
 767         }
 768
 769         if (!!cp->val == hdev_is_powered(hdev)) {
 770                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 771                 goto failed;
 772         }
 773
 774         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 775                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED,
 776                                                         MGMT_STATUS_BUSY);
 777                 goto failed;
 778         }
 779
 780         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 781         if (!cmd) {
 782                 err = -ENOMEM;
 783                 goto failed;
 784         }
 785
 786         if (cp->val)
 787                 schedule_work(&hdev->power_on);
 788         else
 789                 schedule_work(&hdev->power_off.work);
 790
 791         err = 0;
 792
 793 failed:
 794         hci_dev_unlock(hdev);
 795         hci_dev_put(hdev);
 796         return err;
 797 }
 798
 799 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data,
 800                                         u16 data_len, struct sock *skip_sk)
 801 {
 802         struct sk_buff *skb;
 803         struct mgmt_hdr *hdr;
 804
 805         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 806         if (!skb)
 807                 return -ENOMEM;
 808
 809         hdr = (void *) skb_put(skb, sizeof(*hdr));
 810         hdr->opcode = cpu_to_le16(event);
 811         if (hdev)
 812                 hdr->index = cpu_to_le16(hdev->id);
 813         else
 814                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 815         hdr->len = cpu_to_le16(data_len);
 816
 817         if (data)
 818                 memcpy(skb_put(skb, data_len), data, data_len);
 819
 820         hci_send_to_control(skb, skip_sk);
 821         kfree_skb(skb);
 822
 823         return 0;
 824 }
 825
 826 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 827 {
 828         __le32 ev;
 829
 830         ev = cpu_to_le32(get_current_settings(hdev));
 831
 832         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 833 }
 834
 835 static int set_discoverable(struct sock *sk, u16 index, void *data, u16 len)
 836 {
 837         struct mgmt_cp_set_discoverable *cp = data;
 838         struct hci_dev *hdev;
 839         struct pending_cmd *cmd;
 840         u16 timeout;
 841         u8 scan;
 842         int err;
 843
 844         BT_DBG("request for hci%u", index);
 845
 846         if (len != sizeof(*cp))
 847                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 848                                                 MGMT_STATUS_INVALID_PARAMS);
 849
 850         hdev = hci_dev_get(index);
 851         if (!hdev)
 852                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 853                                                 MGMT_STATUS_INVALID_PARAMS);
 854
 855         timeout = get_unaligned_le16(&cp->timeout);
 856
 857         hci_dev_lock(hdev);
 858
 859         if (!hdev_is_powered(hdev) && timeout > 0) {
 860                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 861                                                 MGMT_STATUS_NOT_POWERED);
 862                 goto failed;
 863         }
 864
 865         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 866                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 867                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 868                                                         MGMT_STATUS_BUSY);
 869                 goto failed;
 870         }
 871
 872         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 873                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 874                                                         MGMT_STATUS_REJECTED);
 875                 goto failed;
 876         }
 877
 878         if (!hdev_is_powered(hdev)) {
 879                 bool changed = false;
 880
 881                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 882                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 883                         changed = true;
 884                 }
 885
 886                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 887                 if (err < 0)
 888                         goto failed;
 889
 890                 if (changed)
 891                         err = new_settings(hdev, sk);
 892
 893                 goto failed;
 894         }
 895
 896         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 897                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 898                 goto failed;
 899         }
 900
 901         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 902         if (!cmd) {
 903                 err = -ENOMEM;
 904                 goto failed;
 905         }
 906
 907         scan = SCAN_PAGE;
 908
 909         if (cp->val)
 910                 scan |= SCAN_INQUIRY;
 911         else
 912                 cancel_delayed_work(&hdev->discov_off);
 913
 914         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 915         if (err < 0)
 916                 mgmt_pending_remove(cmd);
 917
 918         if (cp->val)
 919                 hdev->discov_timeout = timeout;
 920
 921 failed:
 922         hci_dev_unlock(hdev);
 923         hci_dev_put(hdev);
 924
 925         return err;
 926 }
 927
 928 static int set_connectable(struct sock *sk, u16 index, void *data, u16 len)
 929 {
 930         struct mgmt_mode *cp = data;
 931         struct hci_dev *hdev;
 932         struct pending_cmd *cmd;
 933         u8 scan;
 934         int err;
 935
 936         BT_DBG("request for hci%u", index);
 937
 938         if (len != sizeof(*cp))
 939                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 940                                                 MGMT_STATUS_INVALID_PARAMS);
 941
 942         hdev = hci_dev_get(index);
 943         if (!hdev)
 944                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 945                                                 MGMT_STATUS_INVALID_PARAMS);
 946
 947         hci_dev_lock(hdev);
 948
 949         if (!hdev_is_powered(hdev)) {
 950                 bool changed = false;
 951
 952                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 953                         changed = true;
 954
 955                 if (cp->val)
 956                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 957                 else {
 958                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 959                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 960                 }
 961
 962                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 963                 if (err < 0)
 964                         goto failed;
 965
 966                 if (changed)
 967                         err = new_settings(hdev, sk);
 968
 969                 goto failed;
 970         }
 971
 972         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 973                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 974                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 975                                                         MGMT_STATUS_BUSY);
 976                 goto failed;
 977         }
 978
 979         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 980                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 981                 goto failed;
 982         }
 983
 984         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
 985         if (!cmd) {
 986                 err = -ENOMEM;
 987                 goto failed;
 988         }
 989
 990         if (cp->val)
 991                 scan = SCAN_PAGE;
 992         else {
 993                 scan = 0;
 994
 995                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
 996                                                 hdev->discov_timeout > 0)
 997                         cancel_delayed_work(&hdev->discov_off);
 998         }
 999
1000         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1001         if (err < 0)
1002                 mgmt_pending_remove(cmd);
1003
1004 failed:
1005         hci_dev_unlock(hdev);
1006         hci_dev_put(hdev);
1007
1008         return err;
1009 }
1010
1011 static int set_pairable(struct sock *sk, u16 index, void *data, u16 len)
1012 {
1013         struct mgmt_mode *cp = data;
1014         struct hci_dev *hdev;
1015         int err;
1016
1017         BT_DBG("request for hci%u", index);
1018
1019         if (len != sizeof(*cp))
1020                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
1021                                                 MGMT_STATUS_INVALID_PARAMS);
1022
1023         hdev = hci_dev_get(index);
1024         if (!hdev)
1025                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
1026                                                 MGMT_STATUS_INVALID_PARAMS);
1027
1028         hci_dev_lock(hdev);
1029
1030         if (cp->val)
1031                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1032         else
1033                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1034
1035         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1036         if (err < 0)
1037                 goto failed;
1038
1039         err = new_settings(hdev, sk);
1040
1041 failed:
1042         hci_dev_unlock(hdev);
1043         hci_dev_put(hdev);
1044
1045         return err;
1046 }
1047
1048 static int set_link_security(struct sock *sk, u16 index, void *data, u16 len)
1049 {
1050         struct mgmt_mode *cp = data;
1051         struct pending_cmd *cmd;
1052         struct hci_dev *hdev;
1053         uint8_t val;
1054         int err;
1055
1056         BT_DBG("request for hci%u", index);
1057
1058         if (len != sizeof(*cp))
1059                 return cmd_status(sk, index, MGMT_OP_SET_LINK_SECURITY,
1060                                                 MGMT_STATUS_INVALID_PARAMS);
1061
1062         hdev = hci_dev_get(index);
1063         if (!hdev)
1064                 return cmd_status(sk, index, MGMT_OP_SET_LINK_SECURITY,
1065                                                 MGMT_STATUS_INVALID_PARAMS);
1066
1067         hci_dev_lock(hdev);
1068
1069         if (!hdev_is_powered(hdev)) {
1070                 bool changed = false;
1071
1072                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1073                                                         &hdev->dev_flags)) {
1074                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1075                         changed = true;
1076                 }
1077
1078                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1079                 if (err < 0)
1080                         goto failed;
1081
1082                 if (changed)
1083                         err = new_settings(hdev, sk);
1084
1085                 goto failed;
1086         }
1087
1088         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1089                 err = cmd_status(sk, index, MGMT_OP_SET_LINK_SECURITY,
1090                                                         MGMT_STATUS_BUSY);
1091                 goto failed;
1092         }
1093
1094         val = !!cp->val;
1095
1096         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1097                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1098                 goto failed;
1099         }
1100
1101         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1102         if (!cmd) {
1103                 err = -ENOMEM;
1104                 goto failed;
1105         }
1106
1107         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1108         if (err < 0) {
1109                 mgmt_pending_remove(cmd);
1110                 goto failed;
1111         }
1112
1113 failed:
1114         hci_dev_unlock(hdev);
1115         hci_dev_put(hdev);
1116
1117         return err;
1118 }
1119
1120 static int set_ssp(struct sock *sk, u16 index, void *data, u16 len)
1121 {
1122         struct mgmt_mode *cp = data;
1123         struct pending_cmd *cmd;
1124         struct hci_dev *hdev;
1125         uint8_t val;
1126         int err;
1127
1128         BT_DBG("request for hci%u", index);
1129
1130         if (len != sizeof(*cp))
1131                 return cmd_status(sk, index, MGMT_OP_SET_SSP,
1132                                                 MGMT_STATUS_INVALID_PARAMS);
1133
1134         hdev = hci_dev_get(index);
1135         if (!hdev)
1136                 return cmd_status(sk, index, MGMT_OP_SET_SSP,
1137                                                 MGMT_STATUS_INVALID_PARAMS);
1138
1139         hci_dev_lock(hdev);
1140
1141         if (!hdev_is_powered(hdev)) {
1142                 err = cmd_status(sk, index, MGMT_OP_SET_SSP,
1143                                                 MGMT_STATUS_NOT_POWERED);
1144                 goto failed;
1145         }
1146
1147         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1148                 err = cmd_status(sk, index, MGMT_OP_SET_SSP,
1149                                                 MGMT_STATUS_NOT_SUPPORTED);
1150                 goto failed;
1151         }
1152
1153         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1154                 err = cmd_status(sk, index, MGMT_OP_SET_SSP, MGMT_STATUS_BUSY);
1155                 goto failed;
1156         }
1157
1158         val = !!cp->val;
1159
1160         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1161                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1162                 goto failed;
1163         }
1164
1165         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1166         if (!cmd) {
1167                 err = -ENOMEM;
1168                 goto failed;
1169         }
1170
1171         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1172         if (err < 0) {
1173                 mgmt_pending_remove(cmd);
1174                 goto failed;
1175         }
1176
1177 failed:
1178         hci_dev_unlock(hdev);
1179         hci_dev_put(hdev);
1180
1181         return err;
1182 }
1183
1184 static int set_hs(struct sock *sk, u16 index, void *data, u16 len)
1185 {
1186         struct mgmt_mode *cp = data;
1187         struct hci_dev *hdev;
1188         int err;
1189
1190         BT_DBG("request for hci%u", index);
1191
1192         if (len != sizeof(*cp))
1193                 return cmd_status(sk, index, MGMT_OP_SET_HS,
1194                                                 MGMT_STATUS_INVALID_PARAMS);
1195
1196         hdev = hci_dev_get(index);
1197         if (!hdev)
1198                 return cmd_status(sk, index, MGMT_OP_SET_HS,
1199                                                 MGMT_STATUS_INVALID_PARAMS);
1200
1201         if (!enable_hs) {
1202                 err = cmd_status(sk, index, MGMT_OP_SET_HS,
1203                                         MGMT_STATUS_NOT_SUPPORTED);
1204                 goto failed;
1205         }
1206
1207         if (cp->val)
1208                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1209         else
1210                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1211
1212         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1213
1214 failed:
1215         hci_dev_put(hdev);
1216         return err;
1217 }
1218
1219 static int add_uuid(struct sock *sk, u16 index, void *data, u16 len)
1220 {
1221         struct mgmt_cp_add_uuid *cp = data;
1222         struct hci_dev *hdev;
1223         struct bt_uuid *uuid;
1224         int err;
1225
1226         BT_DBG("request for hci%u", index);
1227
1228         if (len != sizeof(*cp))
1229                 return cmd_status(sk, index, MGMT_OP_ADD_UUID,
1230                                                 MGMT_STATUS_INVALID_PARAMS);
1231
1232         hdev = hci_dev_get(index);
1233         if (!hdev)
1234                 return cmd_status(sk, index, MGMT_OP_ADD_UUID,
1235                                                 MGMT_STATUS_INVALID_PARAMS);
1236
1237         hci_dev_lock(hdev);
1238
1239         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
1240         if (!uuid) {
1241                 err = -ENOMEM;
1242                 goto failed;
1243         }
1244
1245         memcpy(uuid->uuid, cp->uuid, 16);
1246         uuid->svc_hint = cp->svc_hint;
1247
1248         list_add(&uuid->list, &hdev->uuids);
1249
1250         err = update_class(hdev);
1251         if (err < 0)
1252                 goto failed;
1253
1254         err = update_eir(hdev);
1255         if (err < 0)
1256                 goto failed;
1257
1258         err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, 0, NULL, 0);
1259
1260 failed:
1261         hci_dev_unlock(hdev);
1262         hci_dev_put(hdev);
1263
1264         return err;
1265 }
1266
1267 static int remove_uuid(struct sock *sk, u16 index, void *data, u16 len)
1268 {
1269         struct mgmt_cp_remove_uuid *cp = data;
1270         struct list_head *p, *n;
1271         struct hci_dev *hdev;
1272         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1273         int err, found;
1274
1275         BT_DBG("request for hci%u", index);
1276
1277         if (len != sizeof(*cp))
1278                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
1279                                                 MGMT_STATUS_INVALID_PARAMS);
1280
1281         hdev = hci_dev_get(index);
1282         if (!hdev)
1283                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
1284                                                 MGMT_STATUS_INVALID_PARAMS);
1285
1286         hci_dev_lock(hdev);
1287
1288         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1289                 err = hci_uuids_clear(hdev);
1290                 goto unlock;
1291         }
1292
1293         found = 0;
1294
1295         list_for_each_safe(p, n, &hdev->uuids) {
1296                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1297
1298                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1299                         continue;
1300
1301                 list_del(&match->list);
1302                 found++;
1303         }
1304
1305         if (found == 0) {
1306                 err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
1307                                                 MGMT_STATUS_INVALID_PARAMS);
1308                 goto unlock;
1309         }
1310
1311         err = update_class(hdev);
1312         if (err < 0)
1313                 goto unlock;
1314
1315         err = update_eir(hdev);
1316         if (err < 0)
1317                 goto unlock;
1318
1319         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, 0, NULL, 0);
1320
1321 unlock:
1322         hci_dev_unlock(hdev);
1323         hci_dev_put(hdev);
1324
1325         return err;
1326 }
1327
1328 static int set_dev_class(struct sock *sk, u16 index, void *data, u16 len)
1329 {
1330         struct hci_dev *hdev;
1331         struct mgmt_cp_set_dev_class *cp = data;
1332         int err;
1333
1334         BT_DBG("request for hci%u", index);
1335
1336         if (len != sizeof(*cp))
1337                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
1338                                                 MGMT_STATUS_INVALID_PARAMS);
1339
1340         hdev = hci_dev_get(index);
1341         if (!hdev)
1342                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
1343                                                 MGMT_STATUS_INVALID_PARAMS);
1344
1345         hci_dev_lock(hdev);
1346
1347         if (!hdev_is_powered(hdev)) {
1348                 err = cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
1349                                                 MGMT_STATUS_NOT_POWERED);
1350                 goto unlock;
1351         }
1352
1353         hdev->major_class = cp->major;
1354         hdev->minor_class = cp->minor;
1355
1356         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1357                 hci_dev_unlock(hdev);
1358                 cancel_delayed_work_sync(&hdev->service_cache);
1359                 hci_dev_lock(hdev);
1360                 update_eir(hdev);
1361         }
1362
1363         err = update_class(hdev);
1364
1365         if (err == 0)
1366                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, 0,
1367                                                                 NULL, 0);
1368
1369 unlock:
1370         hci_dev_unlock(hdev);
1371         hci_dev_put(hdev);
1372
1373         return err;
1374 }
1375
1376 static int load_link_keys(struct sock *sk, u16 index, void *data, u16 len)
1377 {
1378         struct hci_dev *hdev;
1379         struct mgmt_cp_load_link_keys *cp = data;
1380         u16 key_count, expected_len;
1381         int i;
1382
1383         if (len < sizeof(*cp))
1384                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1385                                                 MGMT_STATUS_INVALID_PARAMS);
1386
1387         key_count = get_unaligned_le16(&cp->key_count);
1388
1389         expected_len = sizeof(*cp) + key_count *
1390                                         sizeof(struct mgmt_link_key_info);
1391         if (expected_len != len) {
1392                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1393                                                         len, expected_len);
1394                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1395                                                 MGMT_STATUS_INVALID_PARAMS);
1396         }
1397
1398         hdev = hci_dev_get(index);
1399         if (!hdev)
1400                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1401                                                 MGMT_STATUS_INVALID_PARAMS);
1402
1403         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
1404                                                                 key_count);
1405
1406         hci_dev_lock(hdev);
1407
1408         hci_link_keys_clear(hdev);
1409
1410         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1411
1412         if (cp->debug_keys)
1413                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1414         else
1415                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1416
1417         for (i = 0; i < key_count; i++) {
1418                 struct mgmt_link_key_info *key = &cp->keys[i];
1419
1420                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1421                                                 key->type, key->pin_len);
1422         }
1423
1424         cmd_complete(sk, index, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1425
1426         hci_dev_unlock(hdev);
1427         hci_dev_put(hdev);
1428
1429         return 0;
1430 }
1431
1432 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1433                                         u8 addr_type, struct sock *skip_sk)
1434 {
1435         struct mgmt_ev_device_unpaired ev;
1436
1437         bacpy(&ev.addr.bdaddr, bdaddr);
1438         ev.addr.type = addr_type;
1439
1440         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1441                                                                 skip_sk);
1442 }
1443
1444 static int unpair_device(struct sock *sk, u16 index, void *data, u16 len)
1445 {
1446         struct hci_dev *hdev;
1447         struct mgmt_cp_unpair_device *cp = data;
1448         struct mgmt_rp_unpair_device rp;
1449         struct hci_cp_disconnect dc;
1450         struct pending_cmd *cmd;
1451         struct hci_conn *conn;
1452         u8 status = 0;
1453         int err;
1454
1455         if (len != sizeof(*cp))
1456                 return cmd_status(sk, index, MGMT_OP_UNPAIR_DEVICE,
1457                                                 MGMT_STATUS_INVALID_PARAMS);
1458
1459         hdev = hci_dev_get(index);
1460         if (!hdev)
1461                 return cmd_status(sk, index, MGMT_OP_UNPAIR_DEVICE,
1462                                                 MGMT_STATUS_INVALID_PARAMS);
1463
1464         hci_dev_lock(hdev);
1465
1466         memset(&rp, 0, sizeof(rp));
1467         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1468         rp.addr.type = cp->addr.type;
1469
1470         if (cp->addr.type == MGMT_ADDR_BREDR)
1471                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1472         else
1473                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1474
1475         if (err < 0) {
1476                 status = MGMT_STATUS_NOT_PAIRED;
1477                 goto unlock;
1478         }
1479
1480         if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect) {
1481                 err = cmd_complete(sk, index, MGMT_OP_UNPAIR_DEVICE, status,
1482                                                         &rp, sizeof(rp));
1483                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1484                 goto unlock;
1485         }
1486
1487         if (cp->addr.type == MGMT_ADDR_BREDR)
1488                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1489                                                         &cp->addr.bdaddr);
1490         else
1491                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1492                                                         &cp->addr.bdaddr);
1493
1494         if (!conn) {
1495                 err = cmd_complete(sk, index, MGMT_OP_UNPAIR_DEVICE, status,
1496                                                         &rp, sizeof(rp));
1497                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1498                 goto unlock;
1499         }
1500
1501         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1502                                                                 sizeof(*cp));
1503         if (!cmd) {
1504                 err = -ENOMEM;
1505                 goto unlock;
1506         }
1507
1508         put_unaligned_le16(conn->handle, &dc.handle);
1509         dc.reason = 0x13; /* Remote User Terminated Connection */
1510         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1511         if (err < 0)
1512                 mgmt_pending_remove(cmd);
1513
1514 unlock:
1515         if (err < 0)
1516                 err = cmd_complete(sk, index, MGMT_OP_UNPAIR_DEVICE, status,
1517                                                         &rp, sizeof(rp));
1518         hci_dev_unlock(hdev);
1519         hci_dev_put(hdev);
1520
1521         return err;
1522 }
1523
1524 static int disconnect(struct sock *sk, u16 index, void *data, u16 len)
1525 {
1526         struct hci_dev *hdev;
1527         struct mgmt_cp_disconnect *cp = data;
1528         struct hci_cp_disconnect dc;
1529         struct pending_cmd *cmd;
1530         struct hci_conn *conn;
1531         int err;
1532
1533         BT_DBG("");
1534
1535         if (len != sizeof(*cp))
1536                 return cmd_status(sk, index, MGMT_OP_DISCONNECT,
1537                                                 MGMT_STATUS_INVALID_PARAMS);
1538
1539         hdev = hci_dev_get(index);
1540         if (!hdev)
1541                 return cmd_status(sk, index, MGMT_OP_DISCONNECT,
1542                                                 MGMT_STATUS_INVALID_PARAMS);
1543
1544         hci_dev_lock(hdev);
1545
1546         if (!test_bit(HCI_UP, &hdev->flags)) {
1547                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1548                                                 MGMT_STATUS_NOT_POWERED);
1549                 goto failed;
1550         }
1551
1552         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1553                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1554                                                         MGMT_STATUS_BUSY);
1555                 goto failed;
1556         }
1557
1558         if (cp->addr.type == MGMT_ADDR_BREDR)
1559                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1560         else
1561                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1562
1563         if (!conn) {
1564                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1565                                                 MGMT_STATUS_NOT_CONNECTED);
1566                 goto failed;
1567         }
1568
1569         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1570         if (!cmd) {
1571                 err = -ENOMEM;
1572                 goto failed;
1573         }
1574
1575         put_unaligned_le16(conn->handle, &dc.handle);
1576         dc.reason = 0x13; /* Remote User Terminated Connection */
1577
1578         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1579         if (err < 0)
1580                 mgmt_pending_remove(cmd);
1581
1582 failed:
1583         hci_dev_unlock(hdev);
1584         hci_dev_put(hdev);
1585
1586         return err;
1587 }
1588
1589 static u8 link_to_mgmt(u8 link_type, u8 addr_type)
1590 {
1591         switch (link_type) {
1592         case LE_LINK:
1593                 switch (addr_type) {
1594                 case ADDR_LE_DEV_PUBLIC:
1595                         return MGMT_ADDR_LE_PUBLIC;
1596                 case ADDR_LE_DEV_RANDOM:
1597                         return MGMT_ADDR_LE_RANDOM;
1598                 default:
1599                         return MGMT_ADDR_INVALID;
1600                 }
1601         case ACL_LINK:
1602                 return MGMT_ADDR_BREDR;
1603         default:
1604                 return MGMT_ADDR_INVALID;
1605         }
1606 }
1607
1608 static int get_connections(struct sock *sk, u16 index)
1609 {
1610         struct mgmt_rp_get_connections *rp;
1611         struct hci_dev *hdev;
1612         struct hci_conn *c;
1613         size_t rp_len;
1614         u16 count;
1615         int i, err;
1616
1617         BT_DBG("");
1618
1619         hdev = hci_dev_get(index);
1620         if (!hdev)
1621                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS,
1622                                                 MGMT_STATUS_INVALID_PARAMS);
1623
1624         hci_dev_lock(hdev);
1625
1626         count = 0;
1627         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1628                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1629                         count++;
1630         }
1631
1632         rp_len = sizeof(*rp) + (count * sizeof(struct mgmt_addr_info));
1633         rp = kmalloc(rp_len, GFP_ATOMIC);
1634         if (!rp) {
1635                 err = -ENOMEM;
1636                 goto unlock;
1637         }
1638
1639         put_unaligned_le16(count, &rp->conn_count);
1640
1641         i = 0;
1642         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1643                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1644                         continue;
1645                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1646                 rp->addr[i].type = link_to_mgmt(c->type, c->dst_type);
1647                 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1648                         continue;
1649                 i++;
1650         }
1651
1652         /* Recalculate length in case of filtered SCO connections, etc */
1653         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1654
1655         err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, 0, rp, rp_len);
1656
1657 unlock:
1658         kfree(rp);
1659         hci_dev_unlock(hdev);
1660         hci_dev_put(hdev);
1661         return err;
1662 }
1663
1664 static int send_pin_code_neg_reply(struct sock *sk, u16 index,
1665                 struct hci_dev *hdev, struct mgmt_cp_pin_code_neg_reply *cp)
1666 {
1667         struct pending_cmd *cmd;
1668         int err;
1669
1670         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1671                                                                 sizeof(*cp));
1672         if (!cmd)
1673                 return -ENOMEM;
1674
1675         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1676                                 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1677         if (err < 0)
1678                 mgmt_pending_remove(cmd);
1679
1680         return err;
1681 }
1682
1683 static int pin_code_reply(struct sock *sk, u16 index, void *data, u16 len)
1684 {
1685         struct hci_dev *hdev;
1686         struct hci_conn *conn;
1687         struct mgmt_cp_pin_code_reply *cp = data;
1688         struct hci_cp_pin_code_reply reply;
1689         struct pending_cmd *cmd;
1690         int err;
1691
1692         BT_DBG("");
1693
1694         if (len != sizeof(*cp))
1695                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1696                                                 MGMT_STATUS_INVALID_PARAMS);
1697
1698         hdev = hci_dev_get(index);
1699         if (!hdev)
1700                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1701                                                 MGMT_STATUS_INVALID_PARAMS);
1702
1703         hci_dev_lock(hdev);
1704
1705         if (!hdev_is_powered(hdev)) {
1706                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1707                                                 MGMT_STATUS_NOT_POWERED);
1708                 goto failed;
1709         }
1710
1711         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1712         if (!conn) {
1713                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1714                                                 MGMT_STATUS_NOT_CONNECTED);
1715                 goto failed;
1716         }
1717
1718         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1719                 struct mgmt_cp_pin_code_neg_reply ncp;
1720
1721                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1722
1723                 BT_ERR("PIN code is not 16 bytes long");
1724
1725                 err = send_pin_code_neg_reply(sk, index, hdev, &ncp);
1726                 if (err >= 0)
1727                         err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1728                                                 MGMT_STATUS_INVALID_PARAMS);
1729
1730                 goto failed;
1731         }
1732
1733         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data,
1734                                                                         len);
1735         if (!cmd) {
1736                 err = -ENOMEM;
1737                 goto failed;
1738         }
1739
1740         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1741         reply.pin_len = cp->pin_len;
1742         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1743
1744         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1745         if (err < 0)
1746                 mgmt_pending_remove(cmd);
1747
1748 failed:
1749         hci_dev_unlock(hdev);
1750         hci_dev_put(hdev);
1751
1752         return err;
1753 }
1754
1755 static int pin_code_neg_reply(struct sock *sk, u16 index, void *data, u16 len)
1756 {
1757         struct hci_dev *hdev;
1758         struct mgmt_cp_pin_code_neg_reply *cp = data;
1759         int err;
1760
1761         BT_DBG("");
1762
1763         if (len != sizeof(*cp))
1764                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1765                                                 MGMT_STATUS_INVALID_PARAMS);
1766
1767         hdev = hci_dev_get(index);
1768         if (!hdev)
1769                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1770                                                 MGMT_STATUS_INVALID_PARAMS);
1771
1772         hci_dev_lock(hdev);
1773
1774         if (!hdev_is_powered(hdev)) {
1775                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1776                                                 MGMT_STATUS_NOT_POWERED);
1777                 goto failed;
1778         }
1779
1780         err = send_pin_code_neg_reply(sk, index, hdev, cp);
1781
1782 failed:
1783         hci_dev_unlock(hdev);
1784         hci_dev_put(hdev);
1785
1786         return err;
1787 }
1788
1789 static int set_io_capability(struct sock *sk, u16 index, void *data, u16 len)
1790 {
1791         struct hci_dev *hdev;
1792         struct mgmt_cp_set_io_capability *cp = data;
1793
1794         BT_DBG("");
1795
1796         if (len != sizeof(*cp))
1797                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
1798                                                 MGMT_STATUS_INVALID_PARAMS);
1799
1800         hdev = hci_dev_get(index);
1801         if (!hdev)
1802                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
1803                                                 MGMT_STATUS_INVALID_PARAMS);
1804
1805         hci_dev_lock(hdev);
1806
1807         hdev->io_capability = cp->io_capability;
1808
1809         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1810                                                         hdev->io_capability);
1811
1812         hci_dev_unlock(hdev);
1813         hci_dev_put(hdev);
1814
1815         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, 0, NULL, 0);
1816 }
1817
1818 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1819 {
1820         struct hci_dev *hdev = conn->hdev;
1821         struct pending_cmd *cmd;
1822
1823         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1824                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1825                         continue;
1826
1827                 if (cmd->user_data != conn)
1828                         continue;
1829
1830                 return cmd;
1831         }
1832
1833         return NULL;
1834 }
1835
1836 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1837 {
1838         struct mgmt_rp_pair_device rp;
1839         struct hci_conn *conn = cmd->user_data;
1840
1841         bacpy(&rp.addr.bdaddr, &conn->dst);
1842         rp.addr.type = link_to_mgmt(conn->type, conn->dst_type);
1843
1844         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1845                                                         &rp, sizeof(rp));
1846
1847         /* So we don't get further callbacks for this connection */
1848         conn->connect_cfm_cb = NULL;
1849         conn->security_cfm_cb = NULL;
1850         conn->disconn_cfm_cb = NULL;
1851
1852         hci_conn_put(conn);
1853
1854         mgmt_pending_remove(cmd);
1855 }
1856
1857 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1858 {
1859         struct pending_cmd *cmd;
1860
1861         BT_DBG("status %u", status);
1862
1863         cmd = find_pairing(conn);
1864         if (!cmd)
1865                 BT_DBG("Unable to find a pending command");
1866         else
1867                 pairing_complete(cmd, mgmt_status(status));
1868 }
1869
1870 static int pair_device(struct sock *sk, u16 index, void *data, u16 len)
1871 {
1872         struct hci_dev *hdev;
1873         struct mgmt_cp_pair_device *cp = data;
1874         struct mgmt_rp_pair_device rp;
1875         struct pending_cmd *cmd;
1876         u8 sec_level, auth_type;
1877         struct hci_conn *conn;
1878         int err;
1879
1880         BT_DBG("");
1881
1882         if (len != sizeof(*cp))
1883                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
1884                                                 MGMT_STATUS_INVALID_PARAMS);
1885
1886         hdev = hci_dev_get(index);
1887         if (!hdev)
1888                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
1889                                                 MGMT_STATUS_INVALID_PARAMS);
1890
1891         hci_dev_lock(hdev);
1892
1893         sec_level = BT_SECURITY_MEDIUM;
1894         if (cp->io_cap == 0x03)
1895                 auth_type = HCI_AT_DEDICATED_BONDING;
1896         else
1897                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1898
1899         if (cp->addr.type == MGMT_ADDR_BREDR)
1900                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr, sec_level,
1901                                                                 auth_type);
1902         else
1903                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr, sec_level,
1904                                                                 auth_type);
1905
1906         memset(&rp, 0, sizeof(rp));
1907         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1908         rp.addr.type = cp->addr.type;
1909
1910         if (IS_ERR(conn)) {
1911                 err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
1912                                                 MGMT_STATUS_CONNECT_FAILED,
1913                                                 &rp, sizeof(rp));
1914                 goto unlock;
1915         }
1916
1917         if (conn->connect_cfm_cb) {
1918                 hci_conn_put(conn);
1919                 err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
1920                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
1921                 goto unlock;
1922         }
1923
1924         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1925         if (!cmd) {
1926                 err = -ENOMEM;
1927                 hci_conn_put(conn);
1928                 goto unlock;
1929         }
1930
1931         /* For LE, just connecting isn't a proof that the pairing finished */
1932         if (cp->addr.type == MGMT_ADDR_BREDR)
1933                 conn->connect_cfm_cb = pairing_complete_cb;
1934
1935         conn->security_cfm_cb = pairing_complete_cb;
1936         conn->disconn_cfm_cb = pairing_complete_cb;
1937         conn->io_capability = cp->io_cap;
1938         cmd->user_data = conn;
1939
1940         if (conn->state == BT_CONNECTED &&
1941                                 hci_conn_security(conn, sec_level, auth_type))
1942                 pairing_complete(cmd, 0);
1943
1944         err = 0;
1945
1946 unlock:
1947         hci_dev_unlock(hdev);
1948         hci_dev_put(hdev);
1949
1950         return err;
1951 }
1952
1953 static int cancel_pair_device(struct sock *sk, u16 index,
1954                                                 unsigned char *data, u16 len)
1955 {
1956         struct mgmt_addr_info *addr = (void *) data;
1957         struct hci_dev *hdev;
1958         struct pending_cmd *cmd;
1959         struct hci_conn *conn;
1960         int err;
1961
1962         BT_DBG("");
1963
1964         if (len != sizeof(*addr))
1965                 return cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
1966                                                 MGMT_STATUS_INVALID_PARAMS);
1967
1968         hdev = hci_dev_get(index);
1969         if (!hdev)
1970                 return cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
1971                                                 MGMT_STATUS_INVALID_PARAMS);
1972
1973         hci_dev_lock(hdev);
1974
1975         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
1976         if (!cmd) {
1977                 err = cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
1978                                                 MGMT_STATUS_INVALID_PARAMS);
1979                 goto unlock;
1980         }
1981
1982         conn = cmd->user_data;
1983
1984         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
1985                 err = cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
1986                                                 MGMT_STATUS_INVALID_PARAMS);
1987                 goto unlock;
1988         }
1989
1990         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
1991
1992         err = cmd_complete(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE, 0, addr,
1993                                                                 sizeof(*addr));
1994 unlock:
1995         hci_dev_unlock(hdev);
1996         hci_dev_put(hdev);
1997
1998         return err;
1999 }
2000
2001 static int user_pairing_resp(struct sock *sk, u16 index, bdaddr_t *bdaddr,
2002                                         u8 type, u16 mgmt_op, u16 hci_op,
2003                                         __le32 passkey)
2004 {
2005         struct pending_cmd *cmd;
2006         struct hci_dev *hdev;
2007         struct hci_conn *conn;
2008         int err;
2009
2010         hdev = hci_dev_get(index);
2011         if (!hdev)
2012                 return cmd_status(sk, index, mgmt_op,
2013                                                 MGMT_STATUS_INVALID_PARAMS);
2014
2015         hci_dev_lock(hdev);
2016
2017         if (!hdev_is_powered(hdev)) {
2018                 err = cmd_status(sk, index, mgmt_op, MGMT_STATUS_NOT_POWERED);
2019                 goto done;
2020         }
2021
2022         if (type == MGMT_ADDR_BREDR)
2023                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2024         else
2025                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2026
2027         if (!conn) {
2028                 err = cmd_status(sk, index, mgmt_op,
2029                                                 MGMT_STATUS_NOT_CONNECTED);
2030                 goto done;
2031         }
2032
2033         if (type == MGMT_ADDR_LE_PUBLIC || type == MGMT_ADDR_LE_RANDOM) {
2034                 /* Continue with pairing via SMP */
2035                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2036
2037                 if (!err)
2038                         err = cmd_status(sk, index, mgmt_op,
2039                                                         MGMT_STATUS_SUCCESS);
2040                 else
2041                         err = cmd_status(sk, index, mgmt_op,
2042                                                         MGMT_STATUS_FAILED);
2043
2044                 goto done;
2045         }
2046
2047         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2048         if (!cmd) {
2049                 err = -ENOMEM;
2050                 goto done;
2051         }
2052
2053         /* Continue with pairing via HCI */
2054         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2055                 struct hci_cp_user_passkey_reply cp;
2056
2057                 bacpy(&cp.bdaddr, bdaddr);
2058                 cp.passkey = passkey;
2059                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2060         } else
2061                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2062
2063         if (err < 0)
2064                 mgmt_pending_remove(cmd);
2065
2066 done:
2067         hci_dev_unlock(hdev);
2068         hci_dev_put(hdev);
2069
2070         return err;
2071 }
2072
2073 static int user_confirm_reply(struct sock *sk, u16 index, void *data, u16 len)
2074 {
2075         struct mgmt_cp_user_confirm_reply *cp = data;
2076
2077         BT_DBG("");
2078
2079         if (len != sizeof(*cp))
2080                 return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_REPLY,
2081                                                 MGMT_STATUS_INVALID_PARAMS);
2082
2083         return user_pairing_resp(sk, index, &cp->addr.bdaddr, cp->addr.type,
2084                                                 MGMT_OP_USER_CONFIRM_REPLY,
2085                                                 HCI_OP_USER_CONFIRM_REPLY, 0);
2086 }
2087
2088 static int user_confirm_neg_reply(struct sock *sk, u16 index, void *data,
2089                                                                         u16 len)
2090 {
2091         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2092
2093         BT_DBG("");
2094
2095         if (len != sizeof(*cp))
2096                 return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_NEG_REPLY,
2097                                                 MGMT_STATUS_INVALID_PARAMS);
2098
2099         return user_pairing_resp(sk, index, &cp->addr.bdaddr, cp->addr.type,
2100                                         MGMT_OP_USER_CONFIRM_NEG_REPLY,
2101                                         HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2102 }
2103
2104 static int user_passkey_reply(struct sock *sk, u16 index, void *data, u16 len)
2105 {
2106         struct mgmt_cp_user_passkey_reply *cp = data;
2107
2108         BT_DBG("");
2109
2110         if (len != sizeof(*cp))
2111                 return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_REPLY,
2112                                                                         EINVAL);
2113
2114         return user_pairing_resp(sk, index, &cp->addr.bdaddr, cp->addr.type,
2115                                                 MGMT_OP_USER_PASSKEY_REPLY,
2116                                                 HCI_OP_USER_PASSKEY_REPLY,
2117                                                 cp->passkey);
2118 }
2119
2120 static int user_passkey_neg_reply(struct sock *sk, u16 index, void *data,
2121                                                                         u16 len)
2122 {
2123         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2124
2125         BT_DBG("");
2126
2127         if (len != sizeof(*cp))
2128                 return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_NEG_REPLY,
2129                                                                         EINVAL);
2130
2131         return user_pairing_resp(sk, index, &cp->addr.bdaddr, cp->addr.type,
2132                                         MGMT_OP_USER_PASSKEY_NEG_REPLY,
2133                                         HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2134 }
2135
2136 static int set_local_name(struct sock *sk, u16 index, void *data,
2137                                                                 u16 len)
2138 {
2139         struct mgmt_cp_set_local_name *mgmt_cp = data;
2140         struct hci_cp_write_local_name hci_cp;
2141         struct hci_dev *hdev;
2142         struct pending_cmd *cmd;
2143         int err;
2144
2145         BT_DBG("");
2146
2147         if (len != sizeof(*mgmt_cp))
2148                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
2149                                                 MGMT_STATUS_INVALID_PARAMS);
2150
2151         hdev = hci_dev_get(index);
2152         if (!hdev)
2153                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
2154                                                 MGMT_STATUS_INVALID_PARAMS);
2155
2156         hci_dev_lock(hdev);
2157
2158         if (!hdev_is_powered(hdev)) {
2159                 err = cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
2160                                                 MGMT_STATUS_NOT_POWERED);
2161                 goto failed;
2162         }
2163
2164         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data,
2165                                                                         len);
2166         if (!cmd) {
2167                 err = -ENOMEM;
2168                 goto failed;
2169         }
2170
2171         memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
2172         err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
2173                                                                 &hci_cp);
2174         if (err < 0)
2175                 mgmt_pending_remove(cmd);
2176
2177 failed:
2178         hci_dev_unlock(hdev);
2179         hci_dev_put(hdev);
2180
2181         return err;
2182 }
2183
2184 static int read_local_oob_data(struct sock *sk, u16 index)
2185 {
2186         struct hci_dev *hdev;
2187         struct pending_cmd *cmd;
2188         int err;
2189
2190         BT_DBG("hci%u", index);
2191
2192         hdev = hci_dev_get(index);
2193         if (!hdev)
2194                 return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
2195                                                 MGMT_STATUS_INVALID_PARAMS);
2196
2197         hci_dev_lock(hdev);
2198
2199         if (!hdev_is_powered(hdev)) {
2200                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
2201                                                 MGMT_STATUS_NOT_POWERED);
2202                 goto unlock;
2203         }
2204
2205         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
2206                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
2207                                                 MGMT_STATUS_NOT_SUPPORTED);
2208                 goto unlock;
2209         }
2210
2211         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2212                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
2213                                                         MGMT_STATUS_BUSY);
2214                 goto unlock;
2215         }
2216
2217         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2218         if (!cmd) {
2219                 err = -ENOMEM;
2220                 goto unlock;
2221         }
2222
2223         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2224         if (err < 0)
2225                 mgmt_pending_remove(cmd);
2226
2227 unlock:
2228         hci_dev_unlock(hdev);
2229         hci_dev_put(hdev);
2230
2231         return err;
2232 }
2233
2234 static int add_remote_oob_data(struct sock *sk, u16 index, void *data,
2235                                                                 u16 len)
2236 {
2237         struct hci_dev *hdev;
2238         struct mgmt_cp_add_remote_oob_data *cp = data;
2239         u8 status;
2240         int err;
2241
2242         BT_DBG("hci%u ", index);
2243
2244         if (len != sizeof(*cp))
2245                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
2246                                                 MGMT_STATUS_INVALID_PARAMS);
2247
2248         hdev = hci_dev_get(index);
2249         if (!hdev)
2250                 return cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
2251                                                 MGMT_STATUS_INVALID_PARAMS,
2252                                                 &cp->addr, sizeof(cp->addr));
2253
2254         hci_dev_lock(hdev);
2255
2256         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2257                                                                 cp->randomizer);
2258         if (err < 0)
2259                 status = MGMT_STATUS_FAILED;
2260         else
2261                 status = 0;
2262
2263         err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2264                                                 &cp->addr, sizeof(cp->addr));
2265
2266         hci_dev_unlock(hdev);
2267         hci_dev_put(hdev);
2268
2269         return err;
2270 }
2271
2272 static int remove_remote_oob_data(struct sock *sk, u16 index,
2273                                                 void *data, u16 len)
2274 {
2275         struct hci_dev *hdev;
2276         struct mgmt_cp_remove_remote_oob_data *cp = data;
2277         u8 status;
2278         int err;
2279
2280         BT_DBG("hci%u ", index);
2281
2282         if (len != sizeof(*cp))
2283                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2284                                                 MGMT_STATUS_INVALID_PARAMS);
2285
2286         hdev = hci_dev_get(index);
2287         if (!hdev)
2288                 return cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2289                                                 MGMT_STATUS_INVALID_PARAMS,
2290                                                 &cp->addr, sizeof(cp->addr));
2291
2292         hci_dev_lock(hdev);
2293
2294         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2295         if (err < 0)
2296                 status = MGMT_STATUS_INVALID_PARAMS;
2297         else
2298                 status = 0;
2299
2300         err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA, status,
2301                                                 &cp->addr, sizeof(cp->addr));
2302
2303         hci_dev_unlock(hdev);
2304         hci_dev_put(hdev);
2305
2306         return err;
2307 }
2308
2309 static int discovery(struct hci_dev *hdev)
2310 {
2311         int err;
2312
2313         if (lmp_host_le_capable(hdev)) {
2314                 if (lmp_bredr_capable(hdev)) {
2315                         err = hci_le_scan(hdev, LE_SCAN_TYPE,
2316                                                 LE_SCAN_INT, LE_SCAN_WIN,
2317                                                 LE_SCAN_TIMEOUT_BREDR_LE);
2318                 } else {
2319                         hdev->discovery.type = DISCOV_TYPE_LE;
2320                         err = hci_le_scan(hdev, LE_SCAN_TYPE,
2321                                                 LE_SCAN_INT, LE_SCAN_WIN,
2322                                                 LE_SCAN_TIMEOUT_LE_ONLY);
2323                 }
2324         } else {
2325                 hdev->discovery.type = DISCOV_TYPE_BREDR;
2326                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2327         }
2328
2329         return err;
2330 }
2331
2332 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2333 {
2334         int err;
2335
2336         BT_DBG("%s", hdev->name);
2337
2338         hci_dev_lock(hdev);
2339
2340         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2341         if (err < 0)
2342                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2343
2344         hci_dev_unlock(hdev);
2345
2346         return err;
2347 }
2348
2349 static int start_discovery(struct sock *sk, u16 index,
2350                                                 void *data, u16 len)
2351 {
2352         struct mgmt_cp_start_discovery *cp = data;
2353         struct pending_cmd *cmd;
2354         struct hci_dev *hdev;
2355         int err;
2356
2357         BT_DBG("hci%u", index);
2358
2359         if (len != sizeof(*cp))
2360                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
2361                                                 MGMT_STATUS_INVALID_PARAMS);
2362
2363         hdev = hci_dev_get(index);
2364         if (!hdev)
2365                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
2366                                                 MGMT_STATUS_INVALID_PARAMS);
2367
2368         hci_dev_lock(hdev);
2369
2370         if (!hdev_is_powered(hdev)) {
2371                 err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
2372                                                 MGMT_STATUS_NOT_POWERED);
2373                 goto failed;
2374         }
2375
2376         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2377                 err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
2378                                                 MGMT_STATUS_BUSY);
2379                 goto failed;
2380         }
2381
2382         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2383         if (!cmd) {
2384                 err = -ENOMEM;
2385                 goto failed;
2386         }
2387
2388         hdev->discovery.type = cp->type;
2389
2390         switch (hdev->discovery.type) {
2391         case DISCOV_TYPE_BREDR:
2392                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2393                 break;
2394
2395         case DISCOV_TYPE_LE:
2396                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2397                                         LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2398                 break;
2399
2400         case DISCOV_TYPE_INTERLEAVED:
2401                 err = discovery(hdev);
2402                 break;
2403
2404         default:
2405                 err = -EINVAL;
2406         }
2407
2408         if (err < 0)
2409                 mgmt_pending_remove(cmd);
2410         else
2411                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2412
2413 failed:
2414         hci_dev_unlock(hdev);
2415         hci_dev_put(hdev);
2416
2417         return err;
2418 }
2419
2420 static int stop_discovery(struct sock *sk, u16 index, void *data, u16 len)
2421 {
2422         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2423         struct hci_dev *hdev;
2424         struct pending_cmd *cmd;
2425         struct hci_cp_remote_name_req_cancel cp;
2426         struct inquiry_entry *e;
2427         int err;
2428
2429         BT_DBG("hci%u", index);
2430
2431         if (len != sizeof(*mgmt_cp))
2432                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY,
2433                                                 MGMT_STATUS_INVALID_PARAMS);
2434
2435         hdev = hci_dev_get(index);
2436         if (!hdev)
2437                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY,
2438                                                 MGMT_STATUS_INVALID_PARAMS);
2439
2440         hci_dev_lock(hdev);
2441
2442         if (!hci_discovery_active(hdev)) {
2443                 err = cmd_complete(sk, index, MGMT_OP_STOP_DISCOVERY,
2444                                         MGMT_STATUS_REJECTED,
2445                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
2446                 goto unlock;
2447         }
2448
2449         if (hdev->discovery.type != mgmt_cp->type) {
2450                 err = cmd_complete(sk, index, MGMT_OP_STOP_DISCOVERY,
2451                                         MGMT_STATUS_INVALID_PARAMS,
2452                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
2453                 goto unlock;
2454         }
2455
2456         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2457         if (!cmd) {
2458                 err = -ENOMEM;
2459                 goto unlock;
2460         }
2461
2462         if (hdev->discovery.state == DISCOVERY_FINDING) {
2463                 err = hci_cancel_inquiry(hdev);
2464                 if (err < 0)
2465                         mgmt_pending_remove(cmd);
2466                 else
2467                         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2468                 goto unlock;
2469         }
2470
2471         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_PENDING);
2472         if (!e) {
2473                 mgmt_pending_remove(cmd);
2474                 err = cmd_complete(sk, index, MGMT_OP_STOP_DISCOVERY, 0,
2475                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
2476                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2477                 goto unlock;
2478         }
2479
2480         bacpy(&cp.bdaddr, &e->data.bdaddr);
2481         err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2482                                                         sizeof(cp), &cp);
2483         if (err < 0)
2484                 mgmt_pending_remove(cmd);
2485         else
2486                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2487
2488 unlock:
2489         hci_dev_unlock(hdev);
2490         hci_dev_put(hdev);
2491
2492         return err;
2493 }
2494
2495 static int confirm_name(struct sock *sk, u16 index, void *data, u16 len)
2496 {
2497         struct mgmt_cp_confirm_name *cp = data;
2498         struct inquiry_entry *e;
2499         struct hci_dev *hdev;
2500         int err;
2501
2502         BT_DBG("hci%u", index);
2503
2504         if (len != sizeof(*cp))
2505                 return cmd_status(sk, index, MGMT_OP_CONFIRM_NAME,
2506                                 MGMT_STATUS_INVALID_PARAMS);
2507
2508         hdev = hci_dev_get(index);
2509         if (!hdev)
2510                 return cmd_status(sk, index, MGMT_OP_CONFIRM_NAME,
2511                                 MGMT_STATUS_INVALID_PARAMS);
2512
2513         hci_dev_lock(hdev);
2514
2515         if (!hci_discovery_active(hdev)) {
2516                 err = cmd_status(sk, index, MGMT_OP_CONFIRM_NAME,
2517                                                         MGMT_STATUS_FAILED);
2518                 goto failed;
2519         }
2520
2521         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2522         if (!e) {
2523                 err = cmd_status (sk, index, MGMT_OP_CONFIRM_NAME,
2524                                 MGMT_STATUS_INVALID_PARAMS);
2525                 goto failed;
2526         }
2527
2528         if (cp->name_known) {
2529                 e->name_state = NAME_KNOWN;
2530                 list_del(&e->list);
2531         } else {
2532                 e->name_state = NAME_NEEDED;
2533                 hci_inquiry_cache_update_resolve(hdev, e);
2534         }
2535
2536         err = 0;
2537
2538 failed:
2539         hci_dev_unlock(hdev);
2540
2541         return err;
2542 }
2543
2544 static int block_device(struct sock *sk, u16 index, void *data, u16 len)
2545 {
2546         struct hci_dev *hdev;
2547         struct mgmt_cp_block_device *cp = data;
2548         u8 status;
2549         int err;
2550
2551         BT_DBG("hci%u", index);
2552
2553         if (len != sizeof(*cp))
2554                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
2555                                                 MGMT_STATUS_INVALID_PARAMS);
2556
2557         hdev = hci_dev_get(index);
2558         if (!hdev)
2559                 return cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
2560                                                 MGMT_STATUS_INVALID_PARAMS,
2561                                                 &cp->addr, sizeof(cp->addr));
2562
2563         hci_dev_lock(hdev);
2564
2565         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2566         if (err < 0)
2567                 status = MGMT_STATUS_FAILED;
2568         else
2569                 status = 0;
2570
2571         err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE, status,
2572                                                 &cp->addr, sizeof(cp->addr));
2573
2574         hci_dev_unlock(hdev);
2575         hci_dev_put(hdev);
2576
2577         return err;
2578 }
2579
2580 static int unblock_device(struct sock *sk, u16 index, void *data, u16 len)
2581 {
2582         struct hci_dev *hdev;
2583         struct mgmt_cp_unblock_device *cp = data;
2584         u8 status;
2585         int err;
2586
2587         BT_DBG("hci%u", index);
2588
2589         if (len != sizeof(*cp))
2590                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2591                                                 MGMT_STATUS_INVALID_PARAMS);
2592
2593         hdev = hci_dev_get(index);
2594         if (!hdev)
2595                 return cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2596                                                 MGMT_STATUS_INVALID_PARAMS,
2597                                                 &cp->addr, sizeof(cp->addr));
2598
2599         hci_dev_lock(hdev);
2600
2601         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2602         if (err < 0)
2603                 status = MGMT_STATUS_INVALID_PARAMS;
2604         else
2605                 status = 0;
2606
2607         err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE, status,
2608                                                 &cp->addr, sizeof(cp->addr));
2609
2610         hci_dev_unlock(hdev);
2611         hci_dev_put(hdev);
2612
2613         return err;
2614 }
2615
2616 static int set_fast_connectable(struct sock *sk, u16 index,
2617                                         void *data, u16 len)
2618 {
2619         struct hci_dev *hdev;
2620         struct mgmt_mode *cp = data;
2621         struct hci_cp_write_page_scan_activity acp;
2622         u8 type;
2623         int err;
2624
2625         BT_DBG("hci%u", index);
2626
2627         if (len != sizeof(*cp))
2628                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2629                                                 MGMT_STATUS_INVALID_PARAMS);
2630
2631         hdev = hci_dev_get(index);
2632         if (!hdev)
2633                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2634                                                 MGMT_STATUS_INVALID_PARAMS);
2635         if (!hdev_is_powered(hdev))
2636                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2637                                                 MGMT_STATUS_NOT_POWERED);
2638
2639         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2640                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2641                                                         MGMT_STATUS_REJECTED);
2642
2643         hci_dev_lock(hdev);
2644
2645         if (cp->val) {
2646                 type = PAGE_SCAN_TYPE_INTERLACED;
2647                 acp.interval = 0x0024;  /* 22.5 msec page scan interval */
2648         } else {
2649                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2650                 acp.interval = 0x0800;  /* default 1.28 sec page scan */
2651         }
2652
2653         acp.window = 0x0012;    /* default 11.25 msec page scan window */
2654
2655         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
2656                                                 sizeof(acp), &acp);
2657         if (err < 0) {
2658                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2659                                                         MGMT_STATUS_FAILED);
2660                 goto done;
2661         }
2662
2663         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2664         if (err < 0) {
2665                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2666                                                         MGMT_STATUS_FAILED);
2667                 goto done;
2668         }
2669
2670         err = cmd_complete(sk, index, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2671                                                                 NULL, 0);
2672 done:
2673         hci_dev_unlock(hdev);
2674         hci_dev_put(hdev);
2675
2676         return err;
2677 }
2678
2679 static int load_long_term_keys(struct sock *sk, u16 index,
2680                                         void *cp_data, u16 len)
2681 {
2682         struct hci_dev *hdev;
2683         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2684         u16 key_count, expected_len;
2685         int i;
2686
2687         if (len < sizeof(*cp))
2688                 return cmd_status(sk, index, MGMT_OP_LOAD_LONG_TERM_KEYS,
2689                                                                 EINVAL);
2690
2691         key_count = get_unaligned_le16(&cp->key_count);
2692
2693         expected_len = sizeof(*cp) + key_count *
2694                                         sizeof(struct mgmt_ltk_info);
2695         if (expected_len != len) {
2696                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2697                                                         len, expected_len);
2698                 return cmd_status(sk, index, MGMT_OP_LOAD_LONG_TERM_KEYS,
2699                                                                 EINVAL);
2700         }
2701
2702         hdev = hci_dev_get(index);
2703         if (!hdev)
2704                 return cmd_status(sk, index, MGMT_OP_LOAD_LONG_TERM_KEYS,
2705                                                                 ENODEV);
2706
2707         BT_DBG("hci%u key_count %u", index, key_count);
2708
2709         hci_dev_lock(hdev);
2710
2711         hci_smp_ltks_clear(hdev);
2712
2713         for (i = 0; i < key_count; i++) {
2714                 struct mgmt_ltk_info *key = &cp->keys[i];
2715                 u8 type;
2716
2717                 if (key->master)
2718                         type = HCI_SMP_LTK;
2719                 else
2720                         type = HCI_SMP_LTK_SLAVE;
2721
2722                 hci_add_ltk(hdev, &key->addr.bdaddr, key->addr.type,
2723                                         type, 0, key->authenticated, key->val,
2724                                         key->enc_size, key->ediv, key->rand);
2725         }
2726
2727         hci_dev_unlock(hdev);
2728         hci_dev_put(hdev);
2729
2730         return 0;
2731 }
2732
2733 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2734 {
2735         void *buf;
2736         u8 *cp;
2737         struct mgmt_hdr *hdr;
2738         u16 opcode, index, len;
2739         int err;
2740
2741         BT_DBG("got %zu bytes", msglen);
2742
2743         if (msglen < sizeof(*hdr))
2744                 return -EINVAL;
2745
2746         buf = kmalloc(msglen, GFP_KERNEL);
2747         if (!buf)
2748                 return -ENOMEM;
2749
2750         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2751                 err = -EFAULT;
2752                 goto done;
2753         }
2754
2755         hdr = buf;
2756         opcode = get_unaligned_le16(&hdr->opcode);
2757         index = get_unaligned_le16(&hdr->index);
2758         len = get_unaligned_le16(&hdr->len);
2759
2760         if (len != msglen - sizeof(*hdr)) {
2761                 err = -EINVAL;
2762                 goto done;
2763         }
2764
2765         cp = buf + sizeof(*hdr);
2766
2767         switch (opcode) {
2768         case MGMT_OP_READ_VERSION:
2769                 err = read_version(sk);
2770                 break;
2771         case MGMT_OP_READ_COMMANDS:
2772                 err = read_commands(sk);
2773                 break;
2774         case MGMT_OP_READ_INDEX_LIST:
2775                 err = read_index_list(sk);
2776                 break;
2777         case MGMT_OP_READ_INFO:
2778                 err = read_controller_info(sk, index);
2779                 break;
2780         case MGMT_OP_SET_POWERED:
2781                 err = set_powered(sk, index, cp, len);
2782                 break;
2783         case MGMT_OP_SET_DISCOVERABLE:
2784                 err = set_discoverable(sk, index, cp, len);
2785                 break;
2786         case MGMT_OP_SET_CONNECTABLE:
2787                 err = set_connectable(sk, index, cp, len);
2788                 break;
2789         case MGMT_OP_SET_FAST_CONNECTABLE:
2790                 err = set_fast_connectable(sk, index, cp, len);
2791                 break;
2792         case MGMT_OP_SET_PAIRABLE:
2793                 err = set_pairable(sk, index, cp, len);
2794                 break;
2795         case MGMT_OP_SET_LINK_SECURITY:
2796                 err = set_link_security(sk, index, cp, len);
2797                 break;
2798         case MGMT_OP_SET_SSP:
2799                 err = set_ssp(sk, index, cp, len);
2800                 break;
2801         case MGMT_OP_SET_HS:
2802                 err = set_hs(sk, index, cp, len);
2803                 break;
2804         case MGMT_OP_ADD_UUID:
2805                 err = add_uuid(sk, index, cp, len);
2806                 break;
2807         case MGMT_OP_REMOVE_UUID:
2808                 err = remove_uuid(sk, index, cp, len);
2809                 break;
2810         case MGMT_OP_SET_DEV_CLASS:
2811                 err = set_dev_class(sk, index, cp, len);
2812                 break;
2813         case MGMT_OP_LOAD_LINK_KEYS:
2814                 err = load_link_keys(sk, index, cp, len);
2815                 break;
2816         case MGMT_OP_DISCONNECT:
2817                 err = disconnect(sk, index, cp, len);
2818                 break;
2819         case MGMT_OP_GET_CONNECTIONS:
2820                 err = get_connections(sk, index);
2821                 break;
2822         case MGMT_OP_PIN_CODE_REPLY:
2823                 err = pin_code_reply(sk, index, cp, len);
2824                 break;
2825         case MGMT_OP_PIN_CODE_NEG_REPLY:
2826                 err = pin_code_neg_reply(sk, index, cp, len);
2827                 break;
2828         case MGMT_OP_SET_IO_CAPABILITY:
2829                 err = set_io_capability(sk, index, cp, len);
2830                 break;
2831         case MGMT_OP_PAIR_DEVICE:
2832                 err = pair_device(sk, index, cp, len);
2833                 break;
2834         case MGMT_OP_CANCEL_PAIR_DEVICE:
2835                 err = cancel_pair_device(sk, index, buf + sizeof(*hdr), len);
2836                 break;
2837         case MGMT_OP_UNPAIR_DEVICE:
2838                 err = unpair_device(sk, index, cp, len);
2839                 break;
2840         case MGMT_OP_USER_CONFIRM_REPLY:
2841                 err = user_confirm_reply(sk, index, cp, len);
2842                 break;
2843         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
2844                 err = user_confirm_neg_reply(sk, index, cp, len);
2845                 break;
2846         case MGMT_OP_USER_PASSKEY_REPLY:
2847                 err = user_passkey_reply(sk, index, cp, len);
2848                 break;
2849         case MGMT_OP_USER_PASSKEY_NEG_REPLY:
2850                 err = user_passkey_neg_reply(sk, index, cp, len);
2851                 break;
2852         case MGMT_OP_SET_LOCAL_NAME:
2853                 err = set_local_name(sk, index, cp, len);
2854                 break;
2855         case MGMT_OP_READ_LOCAL_OOB_DATA:
2856                 err = read_local_oob_data(sk, index);
2857                 break;
2858         case MGMT_OP_ADD_REMOTE_OOB_DATA:
2859                 err = add_remote_oob_data(sk, index, cp, len);
2860                 break;
2861         case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
2862                 err = remove_remote_oob_data(sk, index, cp, len);
2863                 break;
2864         case MGMT_OP_START_DISCOVERY:
2865                 err = start_discovery(sk, index, cp, len);
2866                 break;
2867         case MGMT_OP_STOP_DISCOVERY:
2868                 err = stop_discovery(sk, index, cp, len);
2869                 break;
2870         case MGMT_OP_CONFIRM_NAME:
2871                 err = confirm_name(sk, index, cp, len);
2872                 break;
2873         case MGMT_OP_BLOCK_DEVICE:
2874                 err = block_device(sk, index, cp, len);
2875                 break;
2876         case MGMT_OP_UNBLOCK_DEVICE:
2877                 err = unblock_device(sk, index, cp, len);
2878                 break;
2879         case MGMT_OP_LOAD_LONG_TERM_KEYS:
2880                 err = load_long_term_keys(sk, index, cp, len);
2881                 break;
2882         default:
2883                 BT_DBG("Unknown op %u", opcode);
2884                 err = cmd_status(sk, index, opcode,
2885                                                 MGMT_STATUS_UNKNOWN_COMMAND);
2886                 break;
2887         }
2888
2889         if (err < 0)
2890                 goto done;
2891
2892         err = msglen;
2893
2894 done:
2895         kfree(buf);
2896         return err;
2897 }
2898
2899 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2900 {
2901         u8 *status = data;
2902
2903         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2904         mgmt_pending_remove(cmd);
2905 }
2906
2907 int mgmt_index_added(struct hci_dev *hdev)
2908 {
2909         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2910 }
2911
2912 int mgmt_index_removed(struct hci_dev *hdev)
2913 {
2914         u8 status = ENODEV;
2915
2916         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2917
2918         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2919 }
2920
2921 struct cmd_lookup {
2922         struct sock *sk;
2923         struct hci_dev *hdev;
2924 };
2925
2926 static void settings_rsp(struct pending_cmd *cmd, void *data)
2927 {
2928         struct cmd_lookup *match = data;
2929
2930         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2931
2932         list_del(&cmd->list);
2933
2934         if (match->sk == NULL) {
2935                 match->sk = cmd->sk;
2936                 sock_hold(match->sk);
2937         }
2938
2939         mgmt_pending_free(cmd);
2940 }
2941
2942 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2943 {
2944         struct cmd_lookup match = { NULL, hdev };
2945         int err;
2946
2947         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2948                 return 0;
2949
2950         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2951
2952         if (powered) {
2953                 u8 scan = 0;
2954
2955                 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2956                         scan |= SCAN_PAGE;
2957                 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2958                         scan |= SCAN_INQUIRY;
2959
2960                 if (scan)
2961                         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2962         } else {
2963                 u8 status = ENETDOWN;
2964                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2965         }
2966
2967         err = new_settings(hdev, match.sk);
2968
2969         if (match.sk)
2970                 sock_put(match.sk);
2971
2972         return err;
2973 }
2974
2975 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2976 {
2977         struct cmd_lookup match = { NULL, hdev };
2978         bool changed = false;
2979         int err = 0;
2980
2981         if (discoverable) {
2982                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2983                         changed = true;
2984         } else {
2985                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2986                         changed = true;
2987         }
2988
2989         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
2990                                                                 &match);
2991
2992         if (changed)
2993                 err = new_settings(hdev, match.sk);
2994
2995         if (match.sk)
2996                 sock_put(match.sk);
2997
2998         return err;
2999 }
3000
3001 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3002 {
3003         struct cmd_lookup match = { NULL, hdev };
3004         bool changed = false;
3005         int err = 0;
3006
3007         if (connectable) {
3008                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3009                         changed = true;
3010         } else {
3011                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3012                         changed = true;
3013         }
3014
3015         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
3016                                                                 &match);
3017
3018         if (changed)
3019                 err = new_settings(hdev, match.sk);
3020
3021         if (match.sk)
3022                 sock_put(match.sk);
3023
3024         return err;
3025 }
3026
3027 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3028 {
3029         u8 mgmt_err = mgmt_status(status);
3030
3031         if (scan & SCAN_PAGE)
3032                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3033                                                 cmd_status_rsp, &mgmt_err);
3034
3035         if (scan & SCAN_INQUIRY)
3036                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3037                                                 cmd_status_rsp, &mgmt_err);
3038
3039         return 0;
3040 }
3041
3042 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3043                                                                 u8 persistent)
3044 {
3045         struct mgmt_ev_new_link_key ev;
3046
3047         memset(&ev, 0, sizeof(ev));
3048
3049         ev.store_hint = persistent;
3050         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3051         ev.key.addr.type = MGMT_ADDR_BREDR;
3052         ev.key.type = key->type;
3053         memcpy(ev.key.val, key->val, 16);
3054         ev.key.pin_len = key->pin_len;
3055
3056         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3057 }
3058
3059 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3060 {
3061         struct mgmt_ev_new_long_term_key ev;
3062
3063         memset(&ev, 0, sizeof(ev));
3064
3065         ev.store_hint = persistent;
3066         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3067         ev.key.addr.type = key->bdaddr_type;
3068         ev.key.authenticated = key->authenticated;
3069         ev.key.enc_size = key->enc_size;
3070         ev.key.ediv = key->ediv;
3071
3072         if (key->type == HCI_SMP_LTK)
3073                 ev.key.master = 1;
3074
3075         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3076         memcpy(ev.key.val, key->val, sizeof(key->val));
3077
3078         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev,
3079                                                 &ev, sizeof(ev), NULL);
3080 }
3081
3082 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3083                                         u8 addr_type, u8 *name, u8 name_len,
3084                                         u8 *dev_class)
3085 {
3086         char buf[512];
3087         struct mgmt_ev_device_connected *ev = (void *) buf;
3088         u16 eir_len = 0;
3089
3090         bacpy(&ev->addr.bdaddr, bdaddr);
3091         ev->addr.type = link_to_mgmt(link_type, addr_type);
3092
3093         if (name_len > 0)
3094                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3095                                                                 name, name_len);
3096
3097         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3098                 eir_len = eir_append_data(&ev->eir[eir_len], eir_len,
3099                                         EIR_CLASS_OF_DEV, dev_class, 3);
3100
3101         put_unaligned_le16(eir_len, &ev->eir_len);
3102
3103         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3104                                                 sizeof(*ev) + eir_len, NULL);
3105 }
3106
3107 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3108 {
3109         struct mgmt_cp_disconnect *cp = cmd->param;
3110         struct sock **sk = data;
3111         struct mgmt_rp_disconnect rp;
3112
3113         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3114         rp.addr.type = cp->addr.type;
3115
3116         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3117                                                                 sizeof(rp));
3118
3119         *sk = cmd->sk;
3120         sock_hold(*sk);
3121
3122         mgmt_pending_remove(cmd);
3123 }
3124
3125 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3126 {
3127         struct hci_dev *hdev = data;
3128         struct mgmt_cp_unpair_device *cp = cmd->param;
3129         struct mgmt_rp_unpair_device rp;
3130
3131         memset(&rp, 0, sizeof(rp));
3132         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3133         rp.addr.type = cp->addr.type;
3134
3135         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3136
3137         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3138
3139         mgmt_pending_remove(cmd);
3140 }
3141
3142 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3143                                                 u8 link_type, u8 addr_type)
3144 {
3145         struct mgmt_addr_info ev;
3146         struct sock *sk = NULL;
3147         int err;
3148
3149         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3150
3151         bacpy(&ev.bdaddr, bdaddr);
3152         ev.type = link_to_mgmt(link_type, addr_type);
3153
3154         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3155                                                                         sk);
3156
3157         if (sk)
3158                 sock_put(sk);
3159
3160         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3161                                                                         hdev);
3162
3163         return err;
3164 }
3165
3166 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3167                                         u8 link_type, u8 addr_type, u8 status)
3168 {
3169         struct mgmt_rp_disconnect rp;
3170         struct pending_cmd *cmd;
3171         int err;
3172
3173         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3174         if (!cmd)
3175                 return -ENOENT;
3176
3177         bacpy(&rp.addr.bdaddr, bdaddr);
3178         rp.addr.type = link_to_mgmt(link_type, addr_type);
3179
3180         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3181                                         mgmt_status(status), &rp, sizeof(rp));
3182
3183         mgmt_pending_remove(cmd);
3184
3185         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3186                                                                         hdev);
3187         return err;
3188 }
3189
3190 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3191                                                 u8 addr_type, u8 status)
3192 {
3193         struct mgmt_ev_connect_failed ev;
3194
3195         bacpy(&ev.addr.bdaddr, bdaddr);
3196         ev.addr.type = link_to_mgmt(link_type, addr_type);
3197         ev.status = mgmt_status(status);
3198
3199         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3200 }
3201
3202 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3203 {
3204         struct mgmt_ev_pin_code_request ev;
3205
3206         bacpy(&ev.addr.bdaddr, bdaddr);
3207         ev.addr.type = MGMT_ADDR_BREDR;
3208         ev.secure = secure;
3209
3210         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3211                                                                         NULL);
3212 }
3213
3214 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3215                                                                 u8 status)
3216 {
3217         struct pending_cmd *cmd;
3218         struct mgmt_rp_pin_code_reply rp;
3219         int err;
3220
3221         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3222         if (!cmd)
3223                 return -ENOENT;
3224
3225         bacpy(&rp.addr.bdaddr, bdaddr);
3226         rp.addr.type = MGMT_ADDR_BREDR;
3227
3228         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3229                                         mgmt_status(status), &rp, sizeof(rp));
3230
3231         mgmt_pending_remove(cmd);
3232
3233         return err;
3234 }
3235
3236 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3237                                                                 u8 status)
3238 {
3239         struct pending_cmd *cmd;
3240         struct mgmt_rp_pin_code_reply rp;
3241         int err;
3242
3243         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3244         if (!cmd)
3245                 return -ENOENT;
3246
3247         bacpy(&rp.addr.bdaddr, bdaddr);
3248         rp.addr.type = MGMT_ADDR_BREDR;
3249
3250         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3251                                         mgmt_status(status), &rp, sizeof(rp));
3252
3253         mgmt_pending_remove(cmd);
3254
3255         return err;
3256 }
3257
3258 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3259                                 u8 link_type, u8 addr_type, __le32 value,
3260                                 u8 confirm_hint)
3261 {
3262         struct mgmt_ev_user_confirm_request ev;
3263
3264         BT_DBG("%s", hdev->name);
3265
3266         bacpy(&ev.addr.bdaddr, bdaddr);
3267         ev.addr.type = link_to_mgmt(link_type, addr_type);
3268         ev.confirm_hint = confirm_hint;
3269         put_unaligned_le32(value, &ev.value);
3270
3271         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3272                                                                         NULL);
3273 }
3274
3275 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3276                                                 u8 link_type, u8 addr_type)
3277 {
3278         struct mgmt_ev_user_passkey_request ev;
3279
3280         BT_DBG("%s", hdev->name);
3281
3282         bacpy(&ev.addr.bdaddr, bdaddr);
3283         ev.addr.type = link_to_mgmt(link_type, addr_type);
3284
3285         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3286                                                                         NULL);
3287 }
3288
3289 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3290                                         u8 link_type, u8 addr_type, u8 status,
3291                                         u8 opcode)
3292 {
3293         struct pending_cmd *cmd;
3294         struct mgmt_rp_user_confirm_reply rp;
3295         int err;
3296
3297         cmd = mgmt_pending_find(opcode, hdev);
3298         if (!cmd)
3299                 return -ENOENT;
3300
3301         bacpy(&rp.addr.bdaddr, bdaddr);
3302         rp.addr.type = link_to_mgmt(link_type, addr_type);
3303         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3304                                                         &rp, sizeof(rp));
3305
3306         mgmt_pending_remove(cmd);
3307
3308         return err;
3309 }
3310
3311 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3312                                         u8 link_type, u8 addr_type, u8 status)
3313 {
3314         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3315                                         status, MGMT_OP_USER_CONFIRM_REPLY);
3316 }
3317
3318 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3319                                         u8 link_type, u8 addr_type, u8 status)
3320 {
3321         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3322                                         status, MGMT_OP_USER_CONFIRM_NEG_REPLY);
3323 }
3324
3325 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3326                                         u8 link_type, u8 addr_type, u8 status)
3327 {
3328         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3329                                         status, MGMT_OP_USER_PASSKEY_REPLY);
3330 }
3331
3332 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3333                                         u8 link_type, u8 addr_type, u8 status)
3334 {
3335         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3336                                         status, MGMT_OP_USER_PASSKEY_NEG_REPLY);
3337 }
3338
3339 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3340                                                 u8 addr_type, u8 status)
3341 {
3342         struct mgmt_ev_auth_failed ev;
3343
3344         bacpy(&ev.addr.bdaddr, bdaddr);
3345         ev.addr.type = link_to_mgmt(link_type, addr_type);
3346         ev.status = mgmt_status(status);
3347
3348         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3349 }
3350
3351 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3352 {
3353         struct cmd_lookup match = { NULL, hdev };
3354         bool changed = false;
3355         int err = 0;
3356
3357         if (status) {
3358                 u8 mgmt_err = mgmt_status(status);
3359                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3360                                                 cmd_status_rsp, &mgmt_err);
3361                 return 0;
3362         }
3363
3364         if (test_bit(HCI_AUTH, &hdev->flags)) {
3365                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3366                         changed = true;
3367         } else {
3368                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3369                         changed = true;
3370         }
3371
3372         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3373                                                                 &match);
3374
3375         if (changed)
3376                 err = new_settings(hdev, match.sk);
3377
3378         if (match.sk)
3379                 sock_put(match.sk);
3380
3381         return err;
3382 }
3383
3384 static int clear_eir(struct hci_dev *hdev)
3385 {
3386         struct hci_cp_write_eir cp;
3387
3388         if (!(hdev->features[6] & LMP_EXT_INQ))
3389                 return 0;
3390
3391         memset(&cp, 0, sizeof(cp));
3392
3393         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3394 }
3395
3396 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 status)
3397 {
3398         struct cmd_lookup match = { NULL, hdev };
3399         int err;
3400
3401         if (status) {
3402                 u8 mgmt_err = mgmt_status(status);
3403                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev,
3404                                                 cmd_status_rsp, &mgmt_err);
3405                 return 0;
3406         }
3407
3408         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3409
3410         err = new_settings(hdev, match.sk);
3411
3412         if (match.sk) {
3413                 sock_put(match.sk);
3414
3415                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3416                         update_eir(hdev);
3417                 else
3418                         clear_eir(hdev);
3419         }
3420
3421         return err;
3422 }
3423
3424 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3425 {
3426         struct pending_cmd *cmd;
3427         struct mgmt_cp_set_local_name ev;
3428         int err;
3429
3430         memset(&ev, 0, sizeof(ev));
3431         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3432
3433         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3434         if (!cmd)
3435                 goto send_event;
3436
3437         if (status) {
3438                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3439                                                         mgmt_status(status));
3440                 goto failed;
3441         }
3442
3443         update_eir(hdev);
3444
3445         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3446                                                                 sizeof(ev));
3447         if (err < 0)
3448                 goto failed;
3449
3450 send_event:
3451         err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
3452                                                         cmd ? cmd->sk : NULL);
3453
3454 failed:
3455         if (cmd)
3456                 mgmt_pending_remove(cmd);
3457         return err;
3458 }
3459
3460 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3461                                                 u8 *randomizer, u8 status)
3462 {
3463         struct pending_cmd *cmd;
3464         int err;
3465
3466         BT_DBG("%s status %u", hdev->name, status);
3467
3468         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3469         if (!cmd)
3470                 return -ENOENT;
3471
3472         if (status) {
3473                 err = cmd_status(cmd->sk, hdev->id,
3474                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
3475                                                 mgmt_status(status));
3476         } else {
3477                 struct mgmt_rp_read_local_oob_data rp;
3478
3479                 memcpy(rp.hash, hash, sizeof(rp.hash));
3480                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3481
3482                 err = cmd_complete(cmd->sk, hdev->id,
3483                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
3484                                                 0, &rp, sizeof(rp));
3485         }
3486
3487         mgmt_pending_remove(cmd);
3488
3489         return err;
3490 }
3491
3492 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3493                                 u8 addr_type, u8 *dev_class, s8 rssi,
3494                                 u8 cfm_name, u8 *eir, u16 eir_len)
3495 {
3496         char buf[512];
3497         struct mgmt_ev_device_found *ev = (void *) buf;
3498         size_t ev_size;
3499
3500         /* Leave 5 bytes for a potential CoD field */
3501         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3502                 return -EINVAL;
3503
3504         memset(buf, 0, sizeof(buf));
3505
3506         bacpy(&ev->addr.bdaddr, bdaddr);
3507         ev->addr.type = link_to_mgmt(link_type, addr_type);
3508         ev->rssi = rssi;
3509         ev->confirm_name = cfm_name;
3510
3511         if (eir_len > 0)
3512                 memcpy(ev->eir, eir, eir_len);
3513
3514         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3515                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3516                                                                 dev_class, 3);
3517
3518         put_unaligned_le16(eir_len, &ev->eir_len);
3519
3520         ev_size = sizeof(*ev) + eir_len;
3521
3522         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3523 }
3524
3525 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3526                                 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3527 {
3528         struct mgmt_ev_device_found *ev;
3529         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3530         u16 eir_len;
3531
3532         ev = (struct mgmt_ev_device_found *) buf;
3533
3534         memset(buf, 0, sizeof(buf));
3535
3536         bacpy(&ev->addr.bdaddr, bdaddr);
3537         ev->addr.type = link_to_mgmt(link_type, addr_type);
3538         ev->rssi = rssi;
3539
3540         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3541                                                                 name_len);
3542
3543         put_unaligned_le16(eir_len, &ev->eir_len);
3544
3545         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3546                                                 sizeof(*ev) + eir_len, NULL);
3547 }
3548
3549 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3550 {
3551         struct pending_cmd *cmd;
3552         u8 type;
3553         int err;
3554
3555         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3556
3557         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3558         if (!cmd)
3559                 return -ENOENT;
3560
3561         type = hdev->discovery.type;
3562
3563         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3564                                                         &type, sizeof(type));
3565         mgmt_pending_remove(cmd);
3566
3567         return err;
3568 }
3569
3570 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3571 {
3572         struct pending_cmd *cmd;
3573         int err;
3574
3575         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3576         if (!cmd)
3577                 return -ENOENT;
3578
3579         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3580                                                 &hdev->discovery.type,
3581                                                 sizeof(hdev->discovery.type));
3582         mgmt_pending_remove(cmd);
3583
3584         return err;
3585 }
3586
3587 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3588 {
3589         struct mgmt_ev_discovering ev;
3590         struct pending_cmd *cmd;
3591
3592         BT_DBG("%s discovering %u", hdev->name, discovering);
3593
3594         if (discovering)
3595                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3596         else
3597                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3598
3599         if (cmd != NULL) {
3600                 u8 type = hdev->discovery.type;
3601
3602                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0,
3603                                                         &type, sizeof(type));
3604                 mgmt_pending_remove(cmd);
3605         }
3606
3607         memset(&ev, 0, sizeof(ev));
3608         ev.type = hdev->discovery.type;
3609         ev.discovering = discovering;
3610
3611         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3612 }
3613
3614 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3615 {
3616         struct pending_cmd *cmd;
3617         struct mgmt_ev_device_blocked ev;
3618
3619         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3620
3621         bacpy(&ev.addr.bdaddr, bdaddr);
3622         ev.addr.type = type;
3623
3624         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3625                                                         cmd ? cmd->sk : NULL);
3626 }
3627
3628 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3629 {
3630         struct pending_cmd *cmd;
3631         struct mgmt_ev_device_unblocked ev;
3632
3633         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3634
3635         bacpy(&ev.addr.bdaddr, bdaddr);
3636         ev.addr.type = type;
3637
3638         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3639                                                         cmd ? cmd->sk : NULL);
3640 }
3641
3642 module_param(enable_hs, bool, 0644);
3643 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");
3644
3645 module_param(enable_le, bool, 0644);
3646 MODULE_PARM_DESC(enable_le, "Enable Low Energy support");