net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   2
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 /*
 106  * These LE scan and inquiry parameters were chosen according to LE General
 107  * Discovery Procedure specification.
 108  */
 109 #define LE_SCAN_TYPE                    0x01
 110 #define LE_SCAN_WIN                     0x12
 111 #define LE_SCAN_INT                     0x12
 112 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 113 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 114
 115 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 116 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 117
 118 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 119
 120 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 121                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 122
 123 struct pending_cmd {
 124         struct list_head list;
 125         u16 opcode;
 126         int index;
 127         void *param;
 128         struct sock *sk;
 129         void *user_data;
 130 };
 131
 132 /* HCI to MGMT error code conversion table */
 133 static u8 mgmt_status_table[] = {
 134         MGMT_STATUS_SUCCESS,
 135         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 136         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 137         MGMT_STATUS_FAILED,             /* Hardware Failure */
 138         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 139         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 140         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 141         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 142         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 145         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 146         MGMT_STATUS_BUSY,               /* Command Disallowed */
 147         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 148         MGMT_STATUS_REJECTED,           /* Rejected Security */
 149         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 150         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 151         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 153         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 154         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 155         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 156         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 157         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 158         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 159         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 161         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 162         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 163         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 165         MGMT_STATUS_FAILED,             /* Unspecified Error */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 167         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 168         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 169         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 170         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 171         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 172         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 174         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 176         MGMT_STATUS_FAILED,             /* Transaction Collision */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 178         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 180         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 181         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 182         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 183         MGMT_STATUS_FAILED,             /* Slot Violation */
 184         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 185         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 187         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 188         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 189         MGMT_STATUS_BUSY,               /* Controller Busy */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 191         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 192         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 193         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 194         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 195 };
 196
 197 bool mgmt_valid_hdev(struct hci_dev *hdev)
 198 {
 199         return hdev->dev_type == HCI_BREDR;
 200 }
 201
 202 static u8 mgmt_status(u8 hci_status)
 203 {
 204         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 205                 return mgmt_status_table[hci_status];
 206
 207         return MGMT_STATUS_FAILED;
 208 }
 209
 210 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 211 {
 212         struct sk_buff *skb;
 213         struct mgmt_hdr *hdr;
 214         struct mgmt_ev_cmd_status *ev;
 215         int err;
 216
 217         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 218
 219         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 220         if (!skb)
 221                 return -ENOMEM;
 222
 223         hdr = (void *) skb_put(skb, sizeof(*hdr));
 224
 225         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 226         hdr->index = cpu_to_le16(index);
 227         hdr->len = cpu_to_le16(sizeof(*ev));
 228
 229         ev = (void *) skb_put(skb, sizeof(*ev));
 230         ev->status = status;
 231         ev->opcode = cpu_to_le16(cmd);
 232
 233         err = sock_queue_rcv_skb(sk, skb);
 234         if (err < 0)
 235                 kfree_skb(skb);
 236
 237         return err;
 238 }
 239
 240 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 241                         void *rp, size_t rp_len)
 242 {
 243         struct sk_buff *skb;
 244         struct mgmt_hdr *hdr;
 245         struct mgmt_ev_cmd_complete *ev;
 246         int err;
 247
 248         BT_DBG("sock %p", sk);
 249
 250         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 251         if (!skb)
 252                 return -ENOMEM;
 253
 254         hdr = (void *) skb_put(skb, sizeof(*hdr));
 255
 256         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 257         hdr->index = cpu_to_le16(index);
 258         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 259
 260         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 261         ev->opcode = cpu_to_le16(cmd);
 262         ev->status = status;
 263
 264         if (rp)
 265                 memcpy(ev->data, rp, rp_len);
 266
 267         err = sock_queue_rcv_skb(sk, skb);
 268         if (err < 0)
 269                 kfree_skb(skb);
 270
 271         return err;
 272 }
 273
 274 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 275                         u16 data_len)
 276 {
 277         struct mgmt_rp_read_version rp;
 278
 279         BT_DBG("sock %p", sk);
 280
 281         rp.version = MGMT_VERSION;
 282         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 283
 284         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 285                             sizeof(rp));
 286 }
 287
 288 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 289                          u16 data_len)
 290 {
 291         struct mgmt_rp_read_commands *rp;
 292         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 293         const u16 num_events = ARRAY_SIZE(mgmt_events);
 294         __le16 *opcode;
 295         size_t rp_size;
 296         int i, err;
 297
 298         BT_DBG("sock %p", sk);
 299
 300         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 301
 302         rp = kmalloc(rp_size, GFP_KERNEL);
 303         if (!rp)
 304                 return -ENOMEM;
 305
 306         rp->num_commands = __constant_cpu_to_le16(num_commands);
 307         rp->num_events = __constant_cpu_to_le16(num_events);
 308
 309         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 310                 put_unaligned_le16(mgmt_commands[i], opcode);
 311
 312         for (i = 0; i < num_events; i++, opcode++)
 313                 put_unaligned_le16(mgmt_events[i], opcode);
 314
 315         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 316                            rp_size);
 317         kfree(rp);
 318
 319         return err;
 320 }
 321
 322 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 323                            u16 data_len)
 324 {
 325         struct mgmt_rp_read_index_list *rp;
 326         struct hci_dev *d;
 327         size_t rp_len;
 328         u16 count;
 329         int err;
 330
 331         BT_DBG("sock %p", sk);
 332
 333         read_lock(&hci_dev_list_lock);
 334
 335         count = 0;
 336         list_for_each_entry(d, &hci_dev_list, list) {
 337                 if (!mgmt_valid_hdev(d))
 338                         continue;
 339
 340                 count++;
 341         }
 342
 343         rp_len = sizeof(*rp) + (2 * count);
 344         rp = kmalloc(rp_len, GFP_ATOMIC);
 345         if (!rp) {
 346                 read_unlock(&hci_dev_list_lock);
 347                 return -ENOMEM;
 348         }
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (test_bit(HCI_SETUP, &d->dev_flags))
 353                         continue;
 354
 355                 if (!mgmt_valid_hdev(d))
 356                         continue;
 357
 358                 rp->index[count++] = cpu_to_le16(d->id);
 359                 BT_DBG("Added hci%u", d->id);
 360         }
 361
 362         rp->num_controllers = cpu_to_le16(count);
 363         rp_len = sizeof(*rp) + (2 * count);
 364
 365         read_unlock(&hci_dev_list_lock);
 366
 367         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 368                            rp_len);
 369
 370         kfree(rp);
 371
 372         return err;
 373 }
 374
 375 static u32 get_supported_settings(struct hci_dev *hdev)
 376 {
 377         u32 settings = 0;
 378
 379         settings |= MGMT_SETTING_POWERED;
 380         settings |= MGMT_SETTING_CONNECTABLE;
 381         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 382         settings |= MGMT_SETTING_DISCOVERABLE;
 383         settings |= MGMT_SETTING_PAIRABLE;
 384
 385         if (lmp_ssp_capable(hdev))
 386                 settings |= MGMT_SETTING_SSP;
 387
 388         if (lmp_bredr_capable(hdev)) {
 389                 settings |= MGMT_SETTING_BREDR;
 390                 settings |= MGMT_SETTING_LINK_SECURITY;
 391         }
 392
 393         if (enable_hs)
 394                 settings |= MGMT_SETTING_HS;
 395
 396         if (lmp_le_capable(hdev))
 397                 settings |= MGMT_SETTING_LE;
 398
 399         return settings;
 400 }
 401
 402 static u32 get_current_settings(struct hci_dev *hdev)
 403 {
 404         u32 settings = 0;
 405
 406         if (hdev_is_powered(hdev))
 407                 settings |= MGMT_SETTING_POWERED;
 408
 409         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 410                 settings |= MGMT_SETTING_CONNECTABLE;
 411
 412         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 413                 settings |= MGMT_SETTING_DISCOVERABLE;
 414
 415         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 416                 settings |= MGMT_SETTING_PAIRABLE;
 417
 418         if (lmp_bredr_capable(hdev))
 419                 settings |= MGMT_SETTING_BREDR;
 420
 421         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 422                 settings |= MGMT_SETTING_LE;
 423
 424         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 425                 settings |= MGMT_SETTING_LINK_SECURITY;
 426
 427         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 428                 settings |= MGMT_SETTING_SSP;
 429
 430         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 431                 settings |= MGMT_SETTING_HS;
 432
 433         return settings;
 434 }
 435
 436 #define PNP_INFO_SVCLASS_ID             0x1200
 437
 438 static u8 bluetooth_base_uuid[] = {
 439                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 440                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 441 };
 442
 443 static u16 get_uuid16(u8 *uuid128)
 444 {
 445         u32 val;
 446         int i;
 447
 448         for (i = 0; i < 12; i++) {
 449                 if (bluetooth_base_uuid[i] != uuid128[i])
 450                         return 0;
 451         }
 452
 453         val = get_unaligned_le32(&uuid128[12]);
 454         if (val > 0xffff)
 455                 return 0;
 456
 457         return (u16) val;
 458 }
 459
 460 static void create_eir(struct hci_dev *hdev, u8 *data)
 461 {
 462         u8 *ptr = data;
 463         u16 eir_len = 0;
 464         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 465         int i, truncated = 0;
 466         struct bt_uuid *uuid;
 467         size_t name_len;
 468
 469         name_len = strlen(hdev->dev_name);
 470
 471         if (name_len > 0) {
 472                 /* EIR Data type */
 473                 if (name_len > 48) {
 474                         name_len = 48;
 475                         ptr[1] = EIR_NAME_SHORT;
 476                 } else
 477                         ptr[1] = EIR_NAME_COMPLETE;
 478
 479                 /* EIR Data length */
 480                 ptr[0] = name_len + 1;
 481
 482                 memcpy(ptr + 2, hdev->dev_name, name_len);
 483
 484                 eir_len += (name_len + 2);
 485                 ptr += (name_len + 2);
 486         }
 487
 488         if (hdev->inq_tx_power) {
 489                 ptr[0] = 2;
 490                 ptr[1] = EIR_TX_POWER;
 491                 ptr[2] = (u8) hdev->inq_tx_power;
 492
 493                 eir_len += 3;
 494                 ptr += 3;
 495         }
 496
 497         if (hdev->devid_source > 0) {
 498                 ptr[0] = 9;
 499                 ptr[1] = EIR_DEVICE_ID;
 500
 501                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 502                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 503                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 504                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 505
 506                 eir_len += 10;
 507                 ptr += 10;
 508         }
 509
 510         memset(uuid16_list, 0, sizeof(uuid16_list));
 511
 512         /* Group all UUID16 types */
 513         list_for_each_entry(uuid, &hdev->uuids, list) {
 514                 u16 uuid16;
 515
 516                 uuid16 = get_uuid16(uuid->uuid);
 517                 if (uuid16 == 0)
 518                         return;
 519
 520                 if (uuid16 < 0x1100)
 521                         continue;
 522
 523                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 524                         continue;
 525
 526                 /* Stop if not enough space to put next UUID */
 527                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 528                         truncated = 1;
 529                         break;
 530                 }
 531
 532                 /* Check for duplicates */
 533                 for (i = 0; uuid16_list[i] != 0; i++)
 534                         if (uuid16_list[i] == uuid16)
 535                                 break;
 536
 537                 if (uuid16_list[i] == 0) {
 538                         uuid16_list[i] = uuid16;
 539                         eir_len += sizeof(u16);
 540                 }
 541         }
 542
 543         if (uuid16_list[0] != 0) {
 544                 u8 *length = ptr;
 545
 546                 /* EIR Data type */
 547                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 548
 549                 ptr += 2;
 550                 eir_len += 2;
 551
 552                 for (i = 0; uuid16_list[i] != 0; i++) {
 553                         *ptr++ = (uuid16_list[i] & 0x00ff);
 554                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 555                 }
 556
 557                 /* EIR Data length */
 558                 *length = (i * sizeof(u16)) + 1;
 559         }
 560 }
 561
 562 static int update_eir(struct hci_dev *hdev)
 563 {
 564         struct hci_cp_write_eir cp;
 565
 566         if (!hdev_is_powered(hdev))
 567                 return 0;
 568
 569         if (!(hdev->features[6] & LMP_EXT_INQ))
 570                 return 0;
 571
 572         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 573                 return 0;
 574
 575         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 576                 return 0;
 577
 578         memset(&cp, 0, sizeof(cp));
 579
 580         create_eir(hdev, cp.data);
 581
 582         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 583                 return 0;
 584
 585         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 586
 587         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 588 }
 589
 590 static u8 get_service_classes(struct hci_dev *hdev)
 591 {
 592         struct bt_uuid *uuid;
 593         u8 val = 0;
 594
 595         list_for_each_entry(uuid, &hdev->uuids, list)
 596                 val |= uuid->svc_hint;
 597
 598         return val;
 599 }
 600
 601 static int update_class(struct hci_dev *hdev)
 602 {
 603         u8 cod[3];
 604         int err;
 605
 606         BT_DBG("%s", hdev->name);
 607
 608         if (!hdev_is_powered(hdev))
 609                 return 0;
 610
 611         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 612                 return 0;
 613
 614         cod[0] = hdev->minor_class;
 615         cod[1] = hdev->major_class;
 616         cod[2] = get_service_classes(hdev);
 617
 618         if (memcmp(cod, hdev->dev_class, 3) == 0)
 619                 return 0;
 620
 621         err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 622         if (err == 0)
 623                 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
 624
 625         return err;
 626 }
 627
 628 static void service_cache_off(struct work_struct *work)
 629 {
 630         struct hci_dev *hdev = container_of(work, struct hci_dev,
 631                                             service_cache.work);
 632
 633         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 634                 return;
 635
 636         hci_dev_lock(hdev);
 637
 638         update_eir(hdev);
 639         update_class(hdev);
 640
 641         hci_dev_unlock(hdev);
 642 }
 643
 644 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 645 {
 646         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 647                 return;
 648
 649         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 650
 651         /* Non-mgmt controlled devices get this bit set
 652          * implicitly so that pairing works for them, however
 653          * for mgmt we require user-space to explicitly enable
 654          * it
 655          */
 656         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 657 }
 658
 659 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 660                                 void *data, u16 data_len)
 661 {
 662         struct mgmt_rp_read_info rp;
 663
 664         BT_DBG("sock %p %s", sk, hdev->name);
 665
 666         hci_dev_lock(hdev);
 667
 668         memset(&rp, 0, sizeof(rp));
 669
 670         bacpy(&rp.bdaddr, &hdev->bdaddr);
 671
 672         rp.version = hdev->hci_ver;
 673         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 674
 675         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 676         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 677
 678         memcpy(rp.dev_class, hdev->dev_class, 3);
 679
 680         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 681         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 682
 683         hci_dev_unlock(hdev);
 684
 685         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 686                             sizeof(rp));
 687 }
 688
 689 static void mgmt_pending_free(struct pending_cmd *cmd)
 690 {
 691         sock_put(cmd->sk);
 692         kfree(cmd->param);
 693         kfree(cmd);
 694 }
 695
 696 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 697                                             struct hci_dev *hdev, void *data,
 698                                             u16 len)
 699 {
 700         struct pending_cmd *cmd;
 701
 702         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 703         if (!cmd)
 704                 return NULL;
 705
 706         cmd->opcode = opcode;
 707         cmd->index = hdev->id;
 708
 709         cmd->param = kmalloc(len, GFP_KERNEL);
 710         if (!cmd->param) {
 711                 kfree(cmd);
 712                 return NULL;
 713         }
 714
 715         if (data)
 716                 memcpy(cmd->param, data, len);
 717
 718         cmd->sk = sk;
 719         sock_hold(sk);
 720
 721         list_add(&cmd->list, &hdev->mgmt_pending);
 722
 723         return cmd;
 724 }
 725
 726 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 727                                  void (*cb)(struct pending_cmd *cmd,
 728                                             void *data),
 729                                  void *data)
 730 {
 731         struct list_head *p, *n;
 732
 733         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 734                 struct pending_cmd *cmd;
 735
 736                 cmd = list_entry(p, struct pending_cmd, list);
 737
 738                 if (opcode > 0 && cmd->opcode != opcode)
 739                         continue;
 740
 741                 cb(cmd, data);
 742         }
 743 }
 744
 745 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 746 {
 747         struct pending_cmd *cmd;
 748
 749         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 750                 if (cmd->opcode == opcode)
 751                         return cmd;
 752         }
 753
 754         return NULL;
 755 }
 756
 757 static void mgmt_pending_remove(struct pending_cmd *cmd)
 758 {
 759         list_del(&cmd->list);
 760         mgmt_pending_free(cmd);
 761 }
 762
 763 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 764 {
 765         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 766
 767         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 768                             sizeof(settings));
 769 }
 770
 771 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 772                        u16 len)
 773 {
 774         struct mgmt_mode *cp = data;
 775         struct pending_cmd *cmd;
 776         int err;
 777
 778         BT_DBG("request for %s", hdev->name);
 779
 780         hci_dev_lock(hdev);
 781
 782         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 783                 cancel_delayed_work(&hdev->power_off);
 784
 785                 if (cp->val) {
 786                         err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 787                         mgmt_powered(hdev, 1);
 788                         goto failed;
 789                 }
 790         }
 791
 792         if (!!cp->val == hdev_is_powered(hdev)) {
 793                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 794                 goto failed;
 795         }
 796
 797         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 798                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 799                                  MGMT_STATUS_BUSY);
 800                 goto failed;
 801         }
 802
 803         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 804         if (!cmd) {
 805                 err = -ENOMEM;
 806                 goto failed;
 807         }
 808
 809         if (cp->val)
 810                 schedule_work(&hdev->power_on);
 811         else
 812                 schedule_work(&hdev->power_off.work);
 813
 814         err = 0;
 815
 816 failed:
 817         hci_dev_unlock(hdev);
 818         return err;
 819 }
 820
 821 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 822                       struct sock *skip_sk)
 823 {
 824         struct sk_buff *skb;
 825         struct mgmt_hdr *hdr;
 826
 827         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 828         if (!skb)
 829                 return -ENOMEM;
 830
 831         hdr = (void *) skb_put(skb, sizeof(*hdr));
 832         hdr->opcode = cpu_to_le16(event);
 833         if (hdev)
 834                 hdr->index = cpu_to_le16(hdev->id);
 835         else
 836                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 837         hdr->len = cpu_to_le16(data_len);
 838
 839         if (data)
 840                 memcpy(skb_put(skb, data_len), data, data_len);
 841
 842         /* Time stamp */
 843         __net_timestamp(skb);
 844
 845         hci_send_to_control(skb, skip_sk);
 846         kfree_skb(skb);
 847
 848         return 0;
 849 }
 850
 851 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 852 {
 853         __le32 ev;
 854
 855         ev = cpu_to_le32(get_current_settings(hdev));
 856
 857         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 858 }
 859
 860 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 861                             u16 len)
 862 {
 863         struct mgmt_cp_set_discoverable *cp = data;
 864         struct pending_cmd *cmd;
 865         u16 timeout;
 866         u8 scan;
 867         int err;
 868
 869         BT_DBG("request for %s", hdev->name);
 870
 871         timeout = __le16_to_cpu(cp->timeout);
 872         if (!cp->val && timeout > 0)
 873                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 874                                   MGMT_STATUS_INVALID_PARAMS);
 875
 876         hci_dev_lock(hdev);
 877
 878         if (!hdev_is_powered(hdev) && timeout > 0) {
 879                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 880                                  MGMT_STATUS_NOT_POWERED);
 881                 goto failed;
 882         }
 883
 884         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 885             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 886                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 887                                  MGMT_STATUS_BUSY);
 888                 goto failed;
 889         }
 890
 891         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 892                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 893                                  MGMT_STATUS_REJECTED);
 894                 goto failed;
 895         }
 896
 897         if (!hdev_is_powered(hdev)) {
 898                 bool changed = false;
 899
 900                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 901                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 902                         changed = true;
 903                 }
 904
 905                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 906                 if (err < 0)
 907                         goto failed;
 908
 909                 if (changed)
 910                         err = new_settings(hdev, sk);
 911
 912                 goto failed;
 913         }
 914
 915         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 916                 if (hdev->discov_timeout > 0) {
 917                         cancel_delayed_work(&hdev->discov_off);
 918                         hdev->discov_timeout = 0;
 919                 }
 920
 921                 if (cp->val && timeout > 0) {
 922                         hdev->discov_timeout = timeout;
 923                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 924                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 925                 }
 926
 927                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 928                 goto failed;
 929         }
 930
 931         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 932         if (!cmd) {
 933                 err = -ENOMEM;
 934                 goto failed;
 935         }
 936
 937         scan = SCAN_PAGE;
 938
 939         if (cp->val)
 940                 scan |= SCAN_INQUIRY;
 941         else
 942                 cancel_delayed_work(&hdev->discov_off);
 943
 944         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 945         if (err < 0)
 946                 mgmt_pending_remove(cmd);
 947
 948         if (cp->val)
 949                 hdev->discov_timeout = timeout;
 950
 951 failed:
 952         hci_dev_unlock(hdev);
 953         return err;
 954 }
 955
 956 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
 957                            u16 len)
 958 {
 959         struct mgmt_mode *cp = data;
 960         struct pending_cmd *cmd;
 961         u8 scan;
 962         int err;
 963
 964         BT_DBG("request for %s", hdev->name);
 965
 966         hci_dev_lock(hdev);
 967
 968         if (!hdev_is_powered(hdev)) {
 969                 bool changed = false;
 970
 971                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 972                         changed = true;
 973
 974                 if (cp->val) {
 975                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 976                 } else {
 977                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 978                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 979                 }
 980
 981                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 982                 if (err < 0)
 983                         goto failed;
 984
 985                 if (changed)
 986                         err = new_settings(hdev, sk);
 987
 988                 goto failed;
 989         }
 990
 991         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 992             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 993                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
 994                                  MGMT_STATUS_BUSY);
 995                 goto failed;
 996         }
 997
 998         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 999                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1000                 goto failed;
1001         }
1002
1003         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1004         if (!cmd) {
1005                 err = -ENOMEM;
1006                 goto failed;
1007         }
1008
1009         if (cp->val) {
1010                 scan = SCAN_PAGE;
1011         } else {
1012                 scan = 0;
1013
1014                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1015                     hdev->discov_timeout > 0)
1016                         cancel_delayed_work(&hdev->discov_off);
1017         }
1018
1019         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1020         if (err < 0)
1021                 mgmt_pending_remove(cmd);
1022
1023 failed:
1024         hci_dev_unlock(hdev);
1025         return err;
1026 }
1027
1028 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1029                         u16 len)
1030 {
1031         struct mgmt_mode *cp = data;
1032         int err;
1033
1034         BT_DBG("request for %s", hdev->name);
1035
1036         hci_dev_lock(hdev);
1037
1038         if (cp->val)
1039                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1040         else
1041                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1042
1043         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1044         if (err < 0)
1045                 goto failed;
1046
1047         err = new_settings(hdev, sk);
1048
1049 failed:
1050         hci_dev_unlock(hdev);
1051         return err;
1052 }
1053
1054 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1055                              u16 len)
1056 {
1057         struct mgmt_mode *cp = data;
1058         struct pending_cmd *cmd;
1059         u8 val;
1060         int err;
1061
1062         BT_DBG("request for %s", hdev->name);
1063
1064         hci_dev_lock(hdev);
1065
1066         if (!hdev_is_powered(hdev)) {
1067                 bool changed = false;
1068
1069                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1070                                           &hdev->dev_flags)) {
1071                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1072                         changed = true;
1073                 }
1074
1075                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1076                 if (err < 0)
1077                         goto failed;
1078
1079                 if (changed)
1080                         err = new_settings(hdev, sk);
1081
1082                 goto failed;
1083         }
1084
1085         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1086                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1087                                  MGMT_STATUS_BUSY);
1088                 goto failed;
1089         }
1090
1091         val = !!cp->val;
1092
1093         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1094                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1095                 goto failed;
1096         }
1097
1098         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1099         if (!cmd) {
1100                 err = -ENOMEM;
1101                 goto failed;
1102         }
1103
1104         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1105         if (err < 0) {
1106                 mgmt_pending_remove(cmd);
1107                 goto failed;
1108         }
1109
1110 failed:
1111         hci_dev_unlock(hdev);
1112         return err;
1113 }
1114
1115 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1116 {
1117         struct mgmt_mode *cp = data;
1118         struct pending_cmd *cmd;
1119         u8 val;
1120         int err;
1121
1122         BT_DBG("request for %s", hdev->name);
1123
1124         hci_dev_lock(hdev);
1125
1126         if (!lmp_ssp_capable(hdev)) {
1127                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1128                                  MGMT_STATUS_NOT_SUPPORTED);
1129                 goto failed;
1130         }
1131
1132         val = !!cp->val;
1133
1134         if (!hdev_is_powered(hdev)) {
1135                 bool changed = false;
1136
1137                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1138                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1139                         changed = true;
1140                 }
1141
1142                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1143                 if (err < 0)
1144                         goto failed;
1145
1146                 if (changed)
1147                         err = new_settings(hdev, sk);
1148
1149                 goto failed;
1150         }
1151
1152         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1153                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1154                                  MGMT_STATUS_BUSY);
1155                 goto failed;
1156         }
1157
1158         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1159                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1160                 goto failed;
1161         }
1162
1163         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1164         if (!cmd) {
1165                 err = -ENOMEM;
1166                 goto failed;
1167         }
1168
1169         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1170         if (err < 0) {
1171                 mgmt_pending_remove(cmd);
1172                 goto failed;
1173         }
1174
1175 failed:
1176         hci_dev_unlock(hdev);
1177         return err;
1178 }
1179
1180 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1181 {
1182         struct mgmt_mode *cp = data;
1183
1184         BT_DBG("request for %s", hdev->name);
1185
1186         if (!enable_hs)
1187                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1188                                   MGMT_STATUS_NOT_SUPPORTED);
1189
1190         if (cp->val)
1191                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1192         else
1193                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1194
1195         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1196 }
1197
1198 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1199 {
1200         struct mgmt_mode *cp = data;
1201         struct hci_cp_write_le_host_supported hci_cp;
1202         struct pending_cmd *cmd;
1203         int err;
1204         u8 val, enabled;
1205
1206         BT_DBG("request for %s", hdev->name);
1207
1208         hci_dev_lock(hdev);
1209
1210         if (!lmp_le_capable(hdev)) {
1211                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1212                                  MGMT_STATUS_NOT_SUPPORTED);
1213                 goto unlock;
1214         }
1215
1216         val = !!cp->val;
1217         enabled = !!(hdev->host_features[0] & LMP_HOST_LE);
1218
1219         if (!hdev_is_powered(hdev) || val == enabled) {
1220                 bool changed = false;
1221
1222                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1223                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1224                         changed = true;
1225                 }
1226
1227                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1228                 if (err < 0)
1229                         goto unlock;
1230
1231                 if (changed)
1232                         err = new_settings(hdev, sk);
1233
1234                 goto unlock;
1235         }
1236
1237         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1238                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1239                                  MGMT_STATUS_BUSY);
1240                 goto unlock;
1241         }
1242
1243         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1244         if (!cmd) {
1245                 err = -ENOMEM;
1246                 goto unlock;
1247         }
1248
1249         memset(&hci_cp, 0, sizeof(hci_cp));
1250
1251         if (val) {
1252                 hci_cp.le = val;
1253                 hci_cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
1254         }
1255
1256         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1257                            &hci_cp);
1258         if (err < 0)
1259                 mgmt_pending_remove(cmd);
1260
1261 unlock:
1262         hci_dev_unlock(hdev);
1263         return err;
1264 }
1265
1266 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1267 {
1268         struct mgmt_cp_add_uuid *cp = data;
1269         struct pending_cmd *cmd;
1270         struct bt_uuid *uuid;
1271         int err;
1272
1273         BT_DBG("request for %s", hdev->name);
1274
1275         hci_dev_lock(hdev);
1276
1277         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1278                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1279                                  MGMT_STATUS_BUSY);
1280                 goto failed;
1281         }
1282
1283         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1284         if (!uuid) {
1285                 err = -ENOMEM;
1286                 goto failed;
1287         }
1288
1289         memcpy(uuid->uuid, cp->uuid, 16);
1290         uuid->svc_hint = cp->svc_hint;
1291
1292         list_add(&uuid->list, &hdev->uuids);
1293
1294         err = update_class(hdev);
1295         if (err < 0)
1296                 goto failed;
1297
1298         err = update_eir(hdev);
1299         if (err < 0)
1300                 goto failed;
1301
1302         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1303                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1304                                    hdev->dev_class, 3);
1305                 goto failed;
1306         }
1307
1308         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1309         if (!cmd)
1310                 err = -ENOMEM;
1311
1312 failed:
1313         hci_dev_unlock(hdev);
1314         return err;
1315 }
1316
1317 static bool enable_service_cache(struct hci_dev *hdev)
1318 {
1319         if (!hdev_is_powered(hdev))
1320                 return false;
1321
1322         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1323                 schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
1324                 return true;
1325         }
1326
1327         return false;
1328 }
1329
1330 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1331                        u16 len)
1332 {
1333         struct mgmt_cp_remove_uuid *cp = data;
1334         struct pending_cmd *cmd;
1335         struct list_head *p, *n;
1336         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1337         int err, found;
1338
1339         BT_DBG("request for %s", hdev->name);
1340
1341         hci_dev_lock(hdev);
1342
1343         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1344                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1345                                  MGMT_STATUS_BUSY);
1346                 goto unlock;
1347         }
1348
1349         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1350                 err = hci_uuids_clear(hdev);
1351
1352                 if (enable_service_cache(hdev)) {
1353                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1354                                            0, hdev->dev_class, 3);
1355                         goto unlock;
1356                 }
1357
1358                 goto update_class;
1359         }
1360
1361         found = 0;
1362
1363         list_for_each_safe(p, n, &hdev->uuids) {
1364                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1365
1366                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1367                         continue;
1368
1369                 list_del(&match->list);
1370                 kfree(match);
1371                 found++;
1372         }
1373
1374         if (found == 0) {
1375                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1376                                  MGMT_STATUS_INVALID_PARAMS);
1377                 goto unlock;
1378         }
1379
1380 update_class:
1381         err = update_class(hdev);
1382         if (err < 0)
1383                 goto unlock;
1384
1385         err = update_eir(hdev);
1386         if (err < 0)
1387                 goto unlock;
1388
1389         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1390                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1391                                    hdev->dev_class, 3);
1392                 goto unlock;
1393         }
1394
1395         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1396         if (!cmd)
1397                 err = -ENOMEM;
1398
1399 unlock:
1400         hci_dev_unlock(hdev);
1401         return err;
1402 }
1403
1404 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1405                          u16 len)
1406 {
1407         struct mgmt_cp_set_dev_class *cp = data;
1408         struct pending_cmd *cmd;
1409         int err;
1410
1411         BT_DBG("request for %s", hdev->name);
1412
1413         hci_dev_lock(hdev);
1414
1415         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1416                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1417                                  MGMT_STATUS_BUSY);
1418                 goto unlock;
1419         }
1420
1421         hdev->major_class = cp->major;
1422         hdev->minor_class = cp->minor;
1423
1424         if (!hdev_is_powered(hdev)) {
1425                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1426                                    hdev->dev_class, 3);
1427                 goto unlock;
1428         }
1429
1430         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1431                 hci_dev_unlock(hdev);
1432                 cancel_delayed_work_sync(&hdev->service_cache);
1433                 hci_dev_lock(hdev);
1434                 update_eir(hdev);
1435         }
1436
1437         err = update_class(hdev);
1438         if (err < 0)
1439                 goto unlock;
1440
1441         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1442                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1443                                    hdev->dev_class, 3);
1444                 goto unlock;
1445         }
1446
1447         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1448         if (!cmd)
1449                 err = -ENOMEM;
1450
1451 unlock:
1452         hci_dev_unlock(hdev);
1453         return err;
1454 }
1455
1456 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1457                           u16 len)
1458 {
1459         struct mgmt_cp_load_link_keys *cp = data;
1460         u16 key_count, expected_len;
1461         int i;
1462
1463         key_count = __le16_to_cpu(cp->key_count);
1464
1465         expected_len = sizeof(*cp) + key_count *
1466                                         sizeof(struct mgmt_link_key_info);
1467         if (expected_len != len) {
1468                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1469                        len, expected_len);
1470                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1471                                   MGMT_STATUS_INVALID_PARAMS);
1472         }
1473
1474         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1475                key_count);
1476
1477         hci_dev_lock(hdev);
1478
1479         hci_link_keys_clear(hdev);
1480
1481         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1482
1483         if (cp->debug_keys)
1484                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1485         else
1486                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1487
1488         for (i = 0; i < key_count; i++) {
1489                 struct mgmt_link_key_info *key = &cp->keys[i];
1490
1491                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1492                                  key->type, key->pin_len);
1493         }
1494
1495         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1496
1497         hci_dev_unlock(hdev);
1498
1499         return 0;
1500 }
1501
1502 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1503                            u8 addr_type, struct sock *skip_sk)
1504 {
1505         struct mgmt_ev_device_unpaired ev;
1506
1507         bacpy(&ev.addr.bdaddr, bdaddr);
1508         ev.addr.type = addr_type;
1509
1510         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1511                           skip_sk);
1512 }
1513
1514 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1515                          u16 len)
1516 {
1517         struct mgmt_cp_unpair_device *cp = data;
1518         struct mgmt_rp_unpair_device rp;
1519         struct hci_cp_disconnect dc;
1520         struct pending_cmd *cmd;
1521         struct hci_conn *conn;
1522         int err;
1523
1524         hci_dev_lock(hdev);
1525
1526         memset(&rp, 0, sizeof(rp));
1527         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1528         rp.addr.type = cp->addr.type;
1529
1530         if (!hdev_is_powered(hdev)) {
1531                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1532                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1533                 goto unlock;
1534         }
1535
1536         if (cp->addr.type == BDADDR_BREDR)
1537                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1538         else
1539                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1540
1541         if (err < 0) {
1542                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1543                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1544                 goto unlock;
1545         }
1546
1547         if (cp->disconnect) {
1548                 if (cp->addr.type == BDADDR_BREDR)
1549                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1550                                                        &cp->addr.bdaddr);
1551                 else
1552                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1553                                                        &cp->addr.bdaddr);
1554         } else {
1555                 conn = NULL;
1556         }
1557
1558         if (!conn) {
1559                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1560                                    &rp, sizeof(rp));
1561                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1562                 goto unlock;
1563         }
1564
1565         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1566                                sizeof(*cp));
1567         if (!cmd) {
1568                 err = -ENOMEM;
1569                 goto unlock;
1570         }
1571
1572         dc.handle = cpu_to_le16(conn->handle);
1573         dc.reason = 0x13; /* Remote User Terminated Connection */
1574         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1575         if (err < 0)
1576                 mgmt_pending_remove(cmd);
1577
1578 unlock:
1579         hci_dev_unlock(hdev);
1580         return err;
1581 }
1582
1583 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1584                       u16 len)
1585 {
1586         struct mgmt_cp_disconnect *cp = data;
1587         struct hci_cp_disconnect dc;
1588         struct pending_cmd *cmd;
1589         struct hci_conn *conn;
1590         int err;
1591
1592         BT_DBG("");
1593
1594         hci_dev_lock(hdev);
1595
1596         if (!test_bit(HCI_UP, &hdev->flags)) {
1597                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1598                                  MGMT_STATUS_NOT_POWERED);
1599                 goto failed;
1600         }
1601
1602         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1603                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1604                                  MGMT_STATUS_BUSY);
1605                 goto failed;
1606         }
1607
1608         if (cp->addr.type == BDADDR_BREDR)
1609                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1610                                                &cp->addr.bdaddr);
1611         else
1612                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1613
1614         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1615                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1616                                  MGMT_STATUS_NOT_CONNECTED);
1617                 goto failed;
1618         }
1619
1620         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1621         if (!cmd) {
1622                 err = -ENOMEM;
1623                 goto failed;
1624         }
1625
1626         dc.handle = cpu_to_le16(conn->handle);
1627         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1628
1629         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1630         if (err < 0)
1631                 mgmt_pending_remove(cmd);
1632
1633 failed:
1634         hci_dev_unlock(hdev);
1635         return err;
1636 }
1637
1638 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1639 {
1640         switch (link_type) {
1641         case LE_LINK:
1642                 switch (addr_type) {
1643                 case ADDR_LE_DEV_PUBLIC:
1644                         return BDADDR_LE_PUBLIC;
1645
1646                 default:
1647                         /* Fallback to LE Random address type */
1648                         return BDADDR_LE_RANDOM;
1649                 }
1650
1651         default:
1652                 /* Fallback to BR/EDR type */
1653                 return BDADDR_BREDR;
1654         }
1655 }
1656
1657 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1658                            u16 data_len)
1659 {
1660         struct mgmt_rp_get_connections *rp;
1661         struct hci_conn *c;
1662         size_t rp_len;
1663         int err;
1664         u16 i;
1665
1666         BT_DBG("");
1667
1668         hci_dev_lock(hdev);
1669
1670         if (!hdev_is_powered(hdev)) {
1671                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1672                                  MGMT_STATUS_NOT_POWERED);
1673                 goto unlock;
1674         }
1675
1676         i = 0;
1677         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1678                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1679                         i++;
1680         }
1681
1682         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1683         rp = kmalloc(rp_len, GFP_KERNEL);
1684         if (!rp) {
1685                 err = -ENOMEM;
1686                 goto unlock;
1687         }
1688
1689         i = 0;
1690         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1691                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1692                         continue;
1693                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1694                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1695                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1696                         continue;
1697                 i++;
1698         }
1699
1700         rp->conn_count = cpu_to_le16(i);
1701
1702         /* Recalculate length in case of filtered SCO connections, etc */
1703         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1704
1705         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1706                            rp_len);
1707
1708         kfree(rp);
1709
1710 unlock:
1711         hci_dev_unlock(hdev);
1712         return err;
1713 }
1714
1715 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1716                                    struct mgmt_cp_pin_code_neg_reply *cp)
1717 {
1718         struct pending_cmd *cmd;
1719         int err;
1720
1721         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1722                                sizeof(*cp));
1723         if (!cmd)
1724                 return -ENOMEM;
1725
1726         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1727                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1728         if (err < 0)
1729                 mgmt_pending_remove(cmd);
1730
1731         return err;
1732 }
1733
1734 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1735                           u16 len)
1736 {
1737         struct hci_conn *conn;
1738         struct mgmt_cp_pin_code_reply *cp = data;
1739         struct hci_cp_pin_code_reply reply;
1740         struct pending_cmd *cmd;
1741         int err;
1742
1743         BT_DBG("");
1744
1745         hci_dev_lock(hdev);
1746
1747         if (!hdev_is_powered(hdev)) {
1748                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1749                                  MGMT_STATUS_NOT_POWERED);
1750                 goto failed;
1751         }
1752
1753         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1754         if (!conn) {
1755                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1756                                  MGMT_STATUS_NOT_CONNECTED);
1757                 goto failed;
1758         }
1759
1760         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1761                 struct mgmt_cp_pin_code_neg_reply ncp;
1762
1763                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1764
1765                 BT_ERR("PIN code is not 16 bytes long");
1766
1767                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1768                 if (err >= 0)
1769                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1770                                          MGMT_STATUS_INVALID_PARAMS);
1771
1772                 goto failed;
1773         }
1774
1775         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1776         if (!cmd) {
1777                 err = -ENOMEM;
1778                 goto failed;
1779         }
1780
1781         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1782         reply.pin_len = cp->pin_len;
1783         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1784
1785         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1786         if (err < 0)
1787                 mgmt_pending_remove(cmd);
1788
1789 failed:
1790         hci_dev_unlock(hdev);
1791         return err;
1792 }
1793
1794 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1795                              u16 len)
1796 {
1797         struct mgmt_cp_set_io_capability *cp = data;
1798
1799         BT_DBG("");
1800
1801         hci_dev_lock(hdev);
1802
1803         hdev->io_capability = cp->io_capability;
1804
1805         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1806                hdev->io_capability);
1807
1808         hci_dev_unlock(hdev);
1809
1810         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1811                             0);
1812 }
1813
1814 static struct pending_cmd *find_pairing(struct hci_conn *conn)
1815 {
1816         struct hci_dev *hdev = conn->hdev;
1817         struct pending_cmd *cmd;
1818
1819         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1820                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1821                         continue;
1822
1823                 if (cmd->user_data != conn)
1824                         continue;
1825
1826                 return cmd;
1827         }
1828
1829         return NULL;
1830 }
1831
1832 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1833 {
1834         struct mgmt_rp_pair_device rp;
1835         struct hci_conn *conn = cmd->user_data;
1836
1837         bacpy(&rp.addr.bdaddr, &conn->dst);
1838         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
1839
1840         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1841                      &rp, sizeof(rp));
1842
1843         /* So we don't get further callbacks for this connection */
1844         conn->connect_cfm_cb = NULL;
1845         conn->security_cfm_cb = NULL;
1846         conn->disconn_cfm_cb = NULL;
1847
1848         hci_conn_put(conn);
1849
1850         mgmt_pending_remove(cmd);
1851 }
1852
1853 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1854 {
1855         struct pending_cmd *cmd;
1856
1857         BT_DBG("status %u", status);
1858
1859         cmd = find_pairing(conn);
1860         if (!cmd)
1861                 BT_DBG("Unable to find a pending command");
1862         else
1863                 pairing_complete(cmd, mgmt_status(status));
1864 }
1865
1866 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
1867 {
1868         struct pending_cmd *cmd;
1869
1870         BT_DBG("status %u", status);
1871
1872         if (!status)
1873                 return;
1874
1875         cmd = find_pairing(conn);
1876         if (!cmd)
1877                 BT_DBG("Unable to find a pending command");
1878         else
1879                 pairing_complete(cmd, mgmt_status(status));
1880 }
1881
1882 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1883                        u16 len)
1884 {
1885         struct mgmt_cp_pair_device *cp = data;
1886         struct mgmt_rp_pair_device rp;
1887         struct pending_cmd *cmd;
1888         u8 sec_level, auth_type;
1889         struct hci_conn *conn;
1890         int err;
1891
1892         BT_DBG("");
1893
1894         hci_dev_lock(hdev);
1895
1896         if (!hdev_is_powered(hdev)) {
1897                 err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1898                                  MGMT_STATUS_NOT_POWERED);
1899                 goto unlock;
1900         }
1901
1902         sec_level = BT_SECURITY_MEDIUM;
1903         if (cp->io_cap == 0x03)
1904                 auth_type = HCI_AT_DEDICATED_BONDING;
1905         else
1906                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1907
1908         if (cp->addr.type == BDADDR_BREDR)
1909                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
1910                                    cp->addr.type, sec_level, auth_type);
1911         else
1912                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
1913                                    cp->addr.type, sec_level, auth_type);
1914
1915         memset(&rp, 0, sizeof(rp));
1916         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1917         rp.addr.type = cp->addr.type;
1918
1919         if (IS_ERR(conn)) {
1920                 int status;
1921
1922                 if (PTR_ERR(conn) == -EBUSY)
1923                         status = MGMT_STATUS_BUSY;
1924                 else
1925                         status = MGMT_STATUS_CONNECT_FAILED;
1926
1927                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1928                                    status, &rp,
1929                                    sizeof(rp));
1930                 goto unlock;
1931         }
1932
1933         if (conn->connect_cfm_cb) {
1934                 hci_conn_put(conn);
1935                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1936                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1937                 goto unlock;
1938         }
1939
1940         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1941         if (!cmd) {
1942                 err = -ENOMEM;
1943                 hci_conn_put(conn);
1944                 goto unlock;
1945         }
1946
1947         /* For LE, just connecting isn't a proof that the pairing finished */
1948         if (cp->addr.type == BDADDR_BREDR)
1949                 conn->connect_cfm_cb = pairing_complete_cb;
1950         else
1951                 conn->connect_cfm_cb = le_connect_complete_cb;
1952
1953         conn->security_cfm_cb = pairing_complete_cb;
1954         conn->disconn_cfm_cb = pairing_complete_cb;
1955         conn->io_capability = cp->io_cap;
1956         cmd->user_data = conn;
1957
1958         if (conn->state == BT_CONNECTED &&
1959             hci_conn_security(conn, sec_level, auth_type))
1960                 pairing_complete(cmd, 0);
1961
1962         err = 0;
1963
1964 unlock:
1965         hci_dev_unlock(hdev);
1966         return err;
1967 }
1968
1969 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1970                               u16 len)
1971 {
1972         struct mgmt_addr_info *addr = data;
1973         struct pending_cmd *cmd;
1974         struct hci_conn *conn;
1975         int err;
1976
1977         BT_DBG("");
1978
1979         hci_dev_lock(hdev);
1980
1981         if (!hdev_is_powered(hdev)) {
1982                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1983                                  MGMT_STATUS_NOT_POWERED);
1984                 goto unlock;
1985         }
1986
1987         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
1988         if (!cmd) {
1989                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1990                                  MGMT_STATUS_INVALID_PARAMS);
1991                 goto unlock;
1992         }
1993
1994         conn = cmd->user_data;
1995
1996         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
1997                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1998                                  MGMT_STATUS_INVALID_PARAMS);
1999                 goto unlock;
2000         }
2001
2002         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2003
2004         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2005                            addr, sizeof(*addr));
2006 unlock:
2007         hci_dev_unlock(hdev);
2008         return err;
2009 }
2010
2011 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2012                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2013                              u16 hci_op, __le32 passkey)
2014 {
2015         struct pending_cmd *cmd;
2016         struct hci_conn *conn;
2017         int err;
2018
2019         hci_dev_lock(hdev);
2020
2021         if (!hdev_is_powered(hdev)) {
2022                 err = cmd_status(sk, hdev->id, mgmt_op,
2023                                  MGMT_STATUS_NOT_POWERED);
2024                 goto done;
2025         }
2026
2027         if (type == BDADDR_BREDR)
2028                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2029         else
2030                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2031
2032         if (!conn) {
2033                 err = cmd_status(sk, hdev->id, mgmt_op,
2034                                  MGMT_STATUS_NOT_CONNECTED);
2035                 goto done;
2036         }
2037
2038         if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2039                 /* Continue with pairing via SMP */
2040                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2041
2042                 if (!err)
2043                         err = cmd_status(sk, hdev->id, mgmt_op,
2044                                          MGMT_STATUS_SUCCESS);
2045                 else
2046                         err = cmd_status(sk, hdev->id, mgmt_op,
2047                                          MGMT_STATUS_FAILED);
2048
2049                 goto done;
2050         }
2051
2052         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2053         if (!cmd) {
2054                 err = -ENOMEM;
2055                 goto done;
2056         }
2057
2058         /* Continue with pairing via HCI */
2059         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2060                 struct hci_cp_user_passkey_reply cp;
2061
2062                 bacpy(&cp.bdaddr, bdaddr);
2063                 cp.passkey = passkey;
2064                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2065         } else
2066                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2067
2068         if (err < 0)
2069                 mgmt_pending_remove(cmd);
2070
2071 done:
2072         hci_dev_unlock(hdev);
2073         return err;
2074 }
2075
2076 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2077                               void *data, u16 len)
2078 {
2079         struct mgmt_cp_pin_code_neg_reply *cp = data;
2080
2081         BT_DBG("");
2082
2083         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2084                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2085                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2086 }
2087
2088 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2089                               u16 len)
2090 {
2091         struct mgmt_cp_user_confirm_reply *cp = data;
2092
2093         BT_DBG("");
2094
2095         if (len != sizeof(*cp))
2096                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2097                                   MGMT_STATUS_INVALID_PARAMS);
2098
2099         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2100                                  MGMT_OP_USER_CONFIRM_REPLY,
2101                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2102 }
2103
2104 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2105                                   void *data, u16 len)
2106 {
2107         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2108
2109         BT_DBG("");
2110
2111         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2112                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2113                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2114 }
2115
2116 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2117                               u16 len)
2118 {
2119         struct mgmt_cp_user_passkey_reply *cp = data;
2120
2121         BT_DBG("");
2122
2123         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2124                                  MGMT_OP_USER_PASSKEY_REPLY,
2125                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2126 }
2127
2128 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2129                                   void *data, u16 len)
2130 {
2131         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2132
2133         BT_DBG("");
2134
2135         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2136                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2137                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2138 }
2139
2140 static int update_name(struct hci_dev *hdev, const char *name)
2141 {
2142         struct hci_cp_write_local_name cp;
2143
2144         memcpy(cp.name, name, sizeof(cp.name));
2145
2146         return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2147 }
2148
2149 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2150                           u16 len)
2151 {
2152         struct mgmt_cp_set_local_name *cp = data;
2153         struct pending_cmd *cmd;
2154         int err;
2155
2156         BT_DBG("");
2157
2158         hci_dev_lock(hdev);
2159
2160         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2161
2162         if (!hdev_is_powered(hdev)) {
2163                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2164
2165                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2166                                    data, len);
2167                 if (err < 0)
2168                         goto failed;
2169
2170                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2171                                  sk);
2172
2173                 goto failed;
2174         }
2175
2176         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2177         if (!cmd) {
2178                 err = -ENOMEM;
2179                 goto failed;
2180         }
2181
2182         err = update_name(hdev, cp->name);
2183         if (err < 0)
2184                 mgmt_pending_remove(cmd);
2185
2186 failed:
2187         hci_dev_unlock(hdev);
2188         return err;
2189 }
2190
2191 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2192                                void *data, u16 data_len)
2193 {
2194         struct pending_cmd *cmd;
2195         int err;
2196
2197         BT_DBG("%s", hdev->name);
2198
2199         hci_dev_lock(hdev);
2200
2201         if (!hdev_is_powered(hdev)) {
2202                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2203                                  MGMT_STATUS_NOT_POWERED);
2204                 goto unlock;
2205         }
2206
2207         if (!lmp_ssp_capable(hdev)) {
2208                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2209                                  MGMT_STATUS_NOT_SUPPORTED);
2210                 goto unlock;
2211         }
2212
2213         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2214                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2215                                  MGMT_STATUS_BUSY);
2216                 goto unlock;
2217         }
2218
2219         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2220         if (!cmd) {
2221                 err = -ENOMEM;
2222                 goto unlock;
2223         }
2224
2225         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2226         if (err < 0)
2227                 mgmt_pending_remove(cmd);
2228
2229 unlock:
2230         hci_dev_unlock(hdev);
2231         return err;
2232 }
2233
2234 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2235                                void *data, u16 len)
2236 {
2237         struct mgmt_cp_add_remote_oob_data *cp = data;
2238         u8 status;
2239         int err;
2240
2241         BT_DBG("%s ", hdev->name);
2242
2243         hci_dev_lock(hdev);
2244
2245         if (!hdev_is_powered(hdev)) {
2246                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
2247                                    MGMT_STATUS_NOT_POWERED, &cp->addr,
2248                                    sizeof(cp->addr));
2249                 goto unlock;
2250         }
2251
2252         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2253                                       cp->randomizer);
2254         if (err < 0)
2255                 status = MGMT_STATUS_FAILED;
2256         else
2257                 status = 0;
2258
2259         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2260                            &cp->addr, sizeof(cp->addr));
2261
2262 unlock:
2263         hci_dev_unlock(hdev);
2264         return err;
2265 }
2266
2267 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2268                                   void *data, u16 len)
2269 {
2270         struct mgmt_cp_remove_remote_oob_data *cp = data;
2271         u8 status;
2272         int err;
2273
2274         BT_DBG("%s", hdev->name);
2275
2276         hci_dev_lock(hdev);
2277
2278         if (!hdev_is_powered(hdev)) {
2279                 err = cmd_complete(sk, hdev->id,
2280                                    MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2281                                    MGMT_STATUS_NOT_POWERED, &cp->addr,
2282                                    sizeof(cp->addr));
2283                 goto unlock;
2284         }
2285
2286         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2287         if (err < 0)
2288                 status = MGMT_STATUS_INVALID_PARAMS;
2289         else
2290                 status = 0;
2291
2292         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2293                            status, &cp->addr, sizeof(cp->addr));
2294
2295 unlock:
2296         hci_dev_unlock(hdev);
2297         return err;
2298 }
2299
2300 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2301 {
2302         int err;
2303
2304         BT_DBG("%s", hdev->name);
2305
2306         hci_dev_lock(hdev);
2307
2308         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2309         if (err < 0)
2310                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2311
2312         hci_dev_unlock(hdev);
2313
2314         return err;
2315 }
2316
2317 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2318                            void *data, u16 len)
2319 {
2320         struct mgmt_cp_start_discovery *cp = data;
2321         struct pending_cmd *cmd;
2322         int err;
2323
2324         BT_DBG("%s", hdev->name);
2325
2326         hci_dev_lock(hdev);
2327
2328         if (!hdev_is_powered(hdev)) {
2329                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2330                                  MGMT_STATUS_NOT_POWERED);
2331                 goto failed;
2332         }
2333
2334         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2335                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2336                                  MGMT_STATUS_BUSY);
2337                 goto failed;
2338         }
2339
2340         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2341                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2342                                  MGMT_STATUS_BUSY);
2343                 goto failed;
2344         }
2345
2346         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2347         if (!cmd) {
2348                 err = -ENOMEM;
2349                 goto failed;
2350         }
2351
2352         hdev->discovery.type = cp->type;
2353
2354         switch (hdev->discovery.type) {
2355         case DISCOV_TYPE_BREDR:
2356                 if (lmp_bredr_capable(hdev))
2357                         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2358                 else
2359                         err = -ENOTSUPP;
2360                 break;
2361
2362         case DISCOV_TYPE_LE:
2363                 if (lmp_host_le_capable(hdev))
2364                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2365                                           LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2366                 else
2367                         err = -ENOTSUPP;
2368                 break;
2369
2370         case DISCOV_TYPE_INTERLEAVED:
2371                 if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
2372                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2373                                           LE_SCAN_WIN,
2374                                           LE_SCAN_TIMEOUT_BREDR_LE);
2375                 else
2376                         err = -ENOTSUPP;
2377                 break;
2378
2379         default:
2380                 err = -EINVAL;
2381         }
2382
2383         if (err < 0)
2384                 mgmt_pending_remove(cmd);
2385         else
2386                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2387
2388 failed:
2389         hci_dev_unlock(hdev);
2390         return err;
2391 }
2392
2393 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2394                           u16 len)
2395 {
2396         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2397         struct pending_cmd *cmd;
2398         struct hci_cp_remote_name_req_cancel cp;
2399         struct inquiry_entry *e;
2400         int err;
2401
2402         BT_DBG("%s", hdev->name);
2403
2404         hci_dev_lock(hdev);
2405
2406         if (!hci_discovery_active(hdev)) {
2407                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2408                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2409                                    sizeof(mgmt_cp->type));
2410                 goto unlock;
2411         }
2412
2413         if (hdev->discovery.type != mgmt_cp->type) {
2414                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2415                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2416                                    sizeof(mgmt_cp->type));
2417                 goto unlock;
2418         }
2419
2420         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2421         if (!cmd) {
2422                 err = -ENOMEM;
2423                 goto unlock;
2424         }
2425
2426         switch (hdev->discovery.state) {
2427         case DISCOVERY_FINDING:
2428                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2429                         err = hci_cancel_inquiry(hdev);
2430                 else
2431                         err = hci_cancel_le_scan(hdev);
2432
2433                 break;
2434
2435         case DISCOVERY_RESOLVING:
2436                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2437                                                      NAME_PENDING);
2438                 if (!e) {
2439                         mgmt_pending_remove(cmd);
2440                         err = cmd_complete(sk, hdev->id,
2441                                            MGMT_OP_STOP_DISCOVERY, 0,
2442                                            &mgmt_cp->type,
2443                                            sizeof(mgmt_cp->type));
2444                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2445                         goto unlock;
2446                 }
2447
2448                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2449                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2450                                    sizeof(cp), &cp);
2451
2452                 break;
2453
2454         default:
2455                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2456                 err = -EFAULT;
2457         }
2458
2459         if (err < 0)
2460                 mgmt_pending_remove(cmd);
2461         else
2462                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2463
2464 unlock:
2465         hci_dev_unlock(hdev);
2466         return err;
2467 }
2468
2469 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2470                         u16 len)
2471 {
2472         struct mgmt_cp_confirm_name *cp = data;
2473         struct inquiry_entry *e;
2474         int err;
2475
2476         BT_DBG("%s", hdev->name);
2477
2478         hci_dev_lock(hdev);
2479
2480         if (!hci_discovery_active(hdev)) {
2481                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2482                                  MGMT_STATUS_FAILED);
2483                 goto failed;
2484         }
2485
2486         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2487         if (!e) {
2488                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2489                                  MGMT_STATUS_INVALID_PARAMS);
2490                 goto failed;
2491         }
2492
2493         if (cp->name_known) {
2494                 e->name_state = NAME_KNOWN;
2495                 list_del(&e->list);
2496         } else {
2497                 e->name_state = NAME_NEEDED;
2498                 hci_inquiry_cache_update_resolve(hdev, e);
2499         }
2500
2501         err = 0;
2502
2503 failed:
2504         hci_dev_unlock(hdev);
2505         return err;
2506 }
2507
2508 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2509                         u16 len)
2510 {
2511         struct mgmt_cp_block_device *cp = data;
2512         u8 status;
2513         int err;
2514
2515         BT_DBG("%s", hdev->name);
2516
2517         hci_dev_lock(hdev);
2518
2519         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2520         if (err < 0)
2521                 status = MGMT_STATUS_FAILED;
2522         else
2523                 status = 0;
2524
2525         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2526                            &cp->addr, sizeof(cp->addr));
2527
2528         hci_dev_unlock(hdev);
2529
2530         return err;
2531 }
2532
2533 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2534                           u16 len)
2535 {
2536         struct mgmt_cp_unblock_device *cp = data;
2537         u8 status;
2538         int err;
2539
2540         BT_DBG("%s", hdev->name);
2541
2542         hci_dev_lock(hdev);
2543
2544         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2545         if (err < 0)
2546                 status = MGMT_STATUS_INVALID_PARAMS;
2547         else
2548                 status = 0;
2549
2550         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2551                            &cp->addr, sizeof(cp->addr));
2552
2553         hci_dev_unlock(hdev);
2554
2555         return err;
2556 }
2557
2558 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2559                          u16 len)
2560 {
2561         struct mgmt_cp_set_device_id *cp = data;
2562         int err;
2563         __u16 source;
2564
2565         BT_DBG("%s", hdev->name);
2566
2567         source = __le16_to_cpu(cp->source);
2568
2569         if (source > 0x0002)
2570                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2571                                   MGMT_STATUS_INVALID_PARAMS);
2572
2573         hci_dev_lock(hdev);
2574
2575         hdev->devid_source = source;
2576         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2577         hdev->devid_product = __le16_to_cpu(cp->product);
2578         hdev->devid_version = __le16_to_cpu(cp->version);
2579
2580         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2581
2582         update_eir(hdev);
2583
2584         hci_dev_unlock(hdev);
2585
2586         return err;
2587 }
2588
2589 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2590                                 void *data, u16 len)
2591 {
2592         struct mgmt_mode *cp = data;
2593         struct hci_cp_write_page_scan_activity acp;
2594         u8 type;
2595         int err;
2596
2597         BT_DBG("%s", hdev->name);
2598
2599         if (!hdev_is_powered(hdev))
2600                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2601                                   MGMT_STATUS_NOT_POWERED);
2602
2603         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2604                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2605                                   MGMT_STATUS_REJECTED);
2606
2607         hci_dev_lock(hdev);
2608
2609         if (cp->val) {
2610                 type = PAGE_SCAN_TYPE_INTERLACED;
2611
2612                 /* 160 msec page scan interval */
2613                 acp.interval = __constant_cpu_to_le16(0x0100);
2614         } else {
2615                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2616
2617                 /* default 1.28 sec page scan */
2618                 acp.interval = __constant_cpu_to_le16(0x0800);
2619         }
2620
2621         /* default 11.25 msec page scan window */
2622         acp.window = __constant_cpu_to_le16(0x0012);
2623
2624         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2625                            &acp);
2626         if (err < 0) {
2627                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2628                                  MGMT_STATUS_FAILED);
2629                 goto done;
2630         }
2631
2632         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2633         if (err < 0) {
2634                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2635                                  MGMT_STATUS_FAILED);
2636                 goto done;
2637         }
2638
2639         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2640                            NULL, 0);
2641 done:
2642         hci_dev_unlock(hdev);
2643         return err;
2644 }
2645
2646 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2647                                void *cp_data, u16 len)
2648 {
2649         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2650         u16 key_count, expected_len;
2651         int i;
2652
2653         key_count = __le16_to_cpu(cp->key_count);
2654
2655         expected_len = sizeof(*cp) + key_count *
2656                                         sizeof(struct mgmt_ltk_info);
2657         if (expected_len != len) {
2658                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2659                        len, expected_len);
2660                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2661                                   EINVAL);
2662         }
2663
2664         BT_DBG("%s key_count %u", hdev->name, key_count);
2665
2666         hci_dev_lock(hdev);
2667
2668         hci_smp_ltks_clear(hdev);
2669
2670         for (i = 0; i < key_count; i++) {
2671                 struct mgmt_ltk_info *key = &cp->keys[i];
2672                 u8 type;
2673
2674                 if (key->master)
2675                         type = HCI_SMP_LTK;
2676                 else
2677                         type = HCI_SMP_LTK_SLAVE;
2678
2679                 hci_add_ltk(hdev, &key->addr.bdaddr,
2680                             bdaddr_to_le(key->addr.type),
2681                             type, 0, key->authenticated, key->val,
2682                             key->enc_size, key->ediv, key->rand);
2683         }
2684
2685         hci_dev_unlock(hdev);
2686
2687         return 0;
2688 }
2689
2690 static const struct mgmt_handler {
2691         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2692                      u16 data_len);
2693         bool var_len;
2694         size_t data_len;
2695 } mgmt_handlers[] = {
2696         { NULL }, /* 0x0000 (no command) */
2697         { read_version,           false, MGMT_READ_VERSION_SIZE },
2698         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
2699         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
2700         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
2701         { set_powered,            false, MGMT_SETTING_SIZE },
2702         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
2703         { set_connectable,        false, MGMT_SETTING_SIZE },
2704         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
2705         { set_pairable,           false, MGMT_SETTING_SIZE },
2706         { set_link_security,      false, MGMT_SETTING_SIZE },
2707         { set_ssp,                false, MGMT_SETTING_SIZE },
2708         { set_hs,                 false, MGMT_SETTING_SIZE },
2709         { set_le,                 false, MGMT_SETTING_SIZE },
2710         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
2711         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
2712         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
2713         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
2714         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
2715         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2716         { disconnect,             false, MGMT_DISCONNECT_SIZE },
2717         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
2718         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
2719         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2720         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
2721         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
2722         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2723         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
2724         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
2725         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2726         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
2727         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2728         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2729         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2730         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2731         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
2732         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
2733         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
2734         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
2735         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
2736         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
2737 };
2738
2739
2740 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2741 {
2742         void *buf;
2743         u8 *cp;
2744         struct mgmt_hdr *hdr;
2745         u16 opcode, index, len;
2746         struct hci_dev *hdev = NULL;
2747         const struct mgmt_handler *handler;
2748         int err;
2749
2750         BT_DBG("got %zu bytes", msglen);
2751
2752         if (msglen < sizeof(*hdr))
2753                 return -EINVAL;
2754
2755         buf = kmalloc(msglen, GFP_KERNEL);
2756         if (!buf)
2757                 return -ENOMEM;
2758
2759         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2760                 err = -EFAULT;
2761                 goto done;
2762         }
2763
2764         hdr = buf;
2765         opcode = __le16_to_cpu(hdr->opcode);
2766         index = __le16_to_cpu(hdr->index);
2767         len = __le16_to_cpu(hdr->len);
2768
2769         if (len != msglen - sizeof(*hdr)) {
2770                 err = -EINVAL;
2771                 goto done;
2772         }
2773
2774         if (index != MGMT_INDEX_NONE) {
2775                 hdev = hci_dev_get(index);
2776                 if (!hdev) {
2777                         err = cmd_status(sk, index, opcode,
2778                                          MGMT_STATUS_INVALID_INDEX);
2779                         goto done;
2780                 }
2781         }
2782
2783         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2784             mgmt_handlers[opcode].func == NULL) {
2785                 BT_DBG("Unknown op %u", opcode);
2786                 err = cmd_status(sk, index, opcode,
2787                                  MGMT_STATUS_UNKNOWN_COMMAND);
2788                 goto done;
2789         }
2790
2791         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2792             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2793                 err = cmd_status(sk, index, opcode,
2794                                  MGMT_STATUS_INVALID_INDEX);
2795                 goto done;
2796         }
2797
2798         handler = &mgmt_handlers[opcode];
2799
2800         if ((handler->var_len && len < handler->data_len) ||
2801             (!handler->var_len && len != handler->data_len)) {
2802                 err = cmd_status(sk, index, opcode,
2803                                  MGMT_STATUS_INVALID_PARAMS);
2804                 goto done;
2805         }
2806
2807         if (hdev)
2808                 mgmt_init_hdev(sk, hdev);
2809
2810         cp = buf + sizeof(*hdr);
2811
2812         err = handler->func(sk, hdev, cp, len);
2813         if (err < 0)
2814                 goto done;
2815
2816         err = msglen;
2817
2818 done:
2819         if (hdev)
2820                 hci_dev_put(hdev);
2821
2822         kfree(buf);
2823         return err;
2824 }
2825
2826 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2827 {
2828         u8 *status = data;
2829
2830         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2831         mgmt_pending_remove(cmd);
2832 }
2833
2834 int mgmt_index_added(struct hci_dev *hdev)
2835 {
2836         if (!mgmt_valid_hdev(hdev))
2837                 return -ENOTSUPP;
2838
2839         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2840 }
2841
2842 int mgmt_index_removed(struct hci_dev *hdev)
2843 {
2844         u8 status = MGMT_STATUS_INVALID_INDEX;
2845
2846         if (!mgmt_valid_hdev(hdev))
2847                 return -ENOTSUPP;
2848
2849         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2850
2851         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2852 }
2853
2854 struct cmd_lookup {
2855         struct sock *sk;
2856         struct hci_dev *hdev;
2857         u8 mgmt_status;
2858 };
2859
2860 static void settings_rsp(struct pending_cmd *cmd, void *data)
2861 {
2862         struct cmd_lookup *match = data;
2863
2864         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2865
2866         list_del(&cmd->list);
2867
2868         if (match->sk == NULL) {
2869                 match->sk = cmd->sk;
2870                 sock_hold(match->sk);
2871         }
2872
2873         mgmt_pending_free(cmd);
2874 }
2875
2876 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2877 {
2878         struct cmd_lookup match = { NULL, hdev };
2879         int err;
2880
2881         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2882                 return 0;
2883
2884         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2885
2886         if (powered) {
2887                 u8 scan = 0;
2888
2889                 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2890                         scan |= SCAN_PAGE;
2891                 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2892                         scan |= SCAN_INQUIRY;
2893
2894                 if (scan)
2895                         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2896
2897                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
2898                         u8 ssp = 1;
2899
2900                         hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
2901                 }
2902
2903                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2904                         struct hci_cp_write_le_host_supported cp;
2905
2906                         cp.le = 1;
2907                         cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
2908
2909                         hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED,
2910                                      sizeof(cp), &cp);
2911                 }
2912
2913                 update_class(hdev);
2914                 update_name(hdev, hdev->dev_name);
2915                 update_eir(hdev);
2916         } else {
2917                 u8 status = MGMT_STATUS_NOT_POWERED;
2918                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2919         }
2920
2921         err = new_settings(hdev, match.sk);
2922
2923         if (match.sk)
2924                 sock_put(match.sk);
2925
2926         return err;
2927 }
2928
2929 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2930 {
2931         struct cmd_lookup match = { NULL, hdev };
2932         bool changed = false;
2933         int err = 0;
2934
2935         if (discoverable) {
2936                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2937                         changed = true;
2938         } else {
2939                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2940                         changed = true;
2941         }
2942
2943         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
2944                              &match);
2945
2946         if (changed)
2947                 err = new_settings(hdev, match.sk);
2948
2949         if (match.sk)
2950                 sock_put(match.sk);
2951
2952         return err;
2953 }
2954
2955 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2956 {
2957         struct cmd_lookup match = { NULL, hdev };
2958         bool changed = false;
2959         int err = 0;
2960
2961         if (connectable) {
2962                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2963                         changed = true;
2964         } else {
2965                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2966                         changed = true;
2967         }
2968
2969         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
2970                              &match);
2971
2972         if (changed)
2973                 err = new_settings(hdev, match.sk);
2974
2975         if (match.sk)
2976                 sock_put(match.sk);
2977
2978         return err;
2979 }
2980
2981 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2982 {
2983         u8 mgmt_err = mgmt_status(status);
2984
2985         if (scan & SCAN_PAGE)
2986                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2987                                      cmd_status_rsp, &mgmt_err);
2988
2989         if (scan & SCAN_INQUIRY)
2990                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2991                                      cmd_status_rsp, &mgmt_err);
2992
2993         return 0;
2994 }
2995
2996 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
2997                       bool persistent)
2998 {
2999         struct mgmt_ev_new_link_key ev;
3000
3001         memset(&ev, 0, sizeof(ev));
3002
3003         ev.store_hint = persistent;
3004         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3005         ev.key.addr.type = BDADDR_BREDR;
3006         ev.key.type = key->type;
3007         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3008         ev.key.pin_len = key->pin_len;
3009
3010         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3011 }
3012
3013 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3014 {
3015         struct mgmt_ev_new_long_term_key ev;
3016
3017         memset(&ev, 0, sizeof(ev));
3018
3019         ev.store_hint = persistent;
3020         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3021         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3022         ev.key.authenticated = key->authenticated;
3023         ev.key.enc_size = key->enc_size;
3024         ev.key.ediv = key->ediv;
3025
3026         if (key->type == HCI_SMP_LTK)
3027                 ev.key.master = 1;
3028
3029         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3030         memcpy(ev.key.val, key->val, sizeof(key->val));
3031
3032         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3033                           NULL);
3034 }
3035
3036 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3037                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3038                           u8 *dev_class)
3039 {
3040         char buf[512];
3041         struct mgmt_ev_device_connected *ev = (void *) buf;
3042         u16 eir_len = 0;
3043
3044         bacpy(&ev->addr.bdaddr, bdaddr);
3045         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3046
3047         ev->flags = __cpu_to_le32(flags);
3048
3049         if (name_len > 0)
3050                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3051                                           name, name_len);
3052
3053         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3054                 eir_len = eir_append_data(ev->eir, eir_len,
3055                                           EIR_CLASS_OF_DEV, dev_class, 3);
3056
3057         ev->eir_len = cpu_to_le16(eir_len);
3058
3059         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3060                           sizeof(*ev) + eir_len, NULL);
3061 }
3062
3063 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3064 {
3065         struct mgmt_cp_disconnect *cp = cmd->param;
3066         struct sock **sk = data;
3067         struct mgmt_rp_disconnect rp;
3068
3069         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3070         rp.addr.type = cp->addr.type;
3071
3072         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3073                      sizeof(rp));
3074
3075         *sk = cmd->sk;
3076         sock_hold(*sk);
3077
3078         mgmt_pending_remove(cmd);
3079 }
3080
3081 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3082 {
3083         struct hci_dev *hdev = data;
3084         struct mgmt_cp_unpair_device *cp = cmd->param;
3085         struct mgmt_rp_unpair_device rp;
3086
3087         memset(&rp, 0, sizeof(rp));
3088         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3089         rp.addr.type = cp->addr.type;
3090
3091         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3092
3093         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3094
3095         mgmt_pending_remove(cmd);
3096 }
3097
3098 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3099                              u8 link_type, u8 addr_type, u8 reason)
3100 {
3101         struct mgmt_ev_device_disconnected ev;
3102         struct sock *sk = NULL;
3103         int err;
3104
3105         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3106
3107         bacpy(&ev.addr.bdaddr, bdaddr);
3108         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3109         ev.reason = reason;
3110
3111         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3112                          sk);
3113
3114         if (sk)
3115                 sock_put(sk);
3116
3117         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3118                              hdev);
3119
3120         return err;
3121 }
3122
3123 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3124                            u8 link_type, u8 addr_type, u8 status)
3125 {
3126         struct mgmt_rp_disconnect rp;
3127         struct pending_cmd *cmd;
3128         int err;
3129
3130         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3131                              hdev);
3132
3133         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3134         if (!cmd)
3135                 return -ENOENT;
3136
3137         bacpy(&rp.addr.bdaddr, bdaddr);
3138         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3139
3140         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3141                            mgmt_status(status), &rp, sizeof(rp));
3142
3143         mgmt_pending_remove(cmd);
3144
3145         return err;
3146 }
3147
3148 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3149                         u8 addr_type, u8 status)
3150 {
3151         struct mgmt_ev_connect_failed ev;
3152
3153         bacpy(&ev.addr.bdaddr, bdaddr);
3154         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3155         ev.status = mgmt_status(status);
3156
3157         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3158 }
3159
3160 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3161 {
3162         struct mgmt_ev_pin_code_request ev;
3163
3164         bacpy(&ev.addr.bdaddr, bdaddr);
3165         ev.addr.type = BDADDR_BREDR;
3166         ev.secure = secure;
3167
3168         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3169                           NULL);
3170 }
3171
3172 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3173                                  u8 status)
3174 {
3175         struct pending_cmd *cmd;
3176         struct mgmt_rp_pin_code_reply rp;
3177         int err;
3178
3179         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3180         if (!cmd)
3181                 return -ENOENT;
3182
3183         bacpy(&rp.addr.bdaddr, bdaddr);
3184         rp.addr.type = BDADDR_BREDR;
3185
3186         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3187                            mgmt_status(status), &rp, sizeof(rp));
3188
3189         mgmt_pending_remove(cmd);
3190
3191         return err;
3192 }
3193
3194 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3195                                      u8 status)
3196 {
3197         struct pending_cmd *cmd;
3198         struct mgmt_rp_pin_code_reply rp;
3199         int err;
3200
3201         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3202         if (!cmd)
3203                 return -ENOENT;
3204
3205         bacpy(&rp.addr.bdaddr, bdaddr);
3206         rp.addr.type = BDADDR_BREDR;
3207
3208         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3209                            mgmt_status(status), &rp, sizeof(rp));
3210
3211         mgmt_pending_remove(cmd);
3212
3213         return err;
3214 }
3215
3216 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3217                               u8 link_type, u8 addr_type, __le32 value,
3218                               u8 confirm_hint)
3219 {
3220         struct mgmt_ev_user_confirm_request ev;
3221
3222         BT_DBG("%s", hdev->name);
3223
3224         bacpy(&ev.addr.bdaddr, bdaddr);
3225         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3226         ev.confirm_hint = confirm_hint;
3227         ev.value = value;
3228
3229         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3230                           NULL);
3231 }
3232
3233 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3234                               u8 link_type, u8 addr_type)
3235 {
3236         struct mgmt_ev_user_passkey_request ev;
3237
3238         BT_DBG("%s", hdev->name);
3239
3240         bacpy(&ev.addr.bdaddr, bdaddr);
3241         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3242
3243         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3244                           NULL);
3245 }
3246
3247 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3248                                       u8 link_type, u8 addr_type, u8 status,
3249                                       u8 opcode)
3250 {
3251         struct pending_cmd *cmd;
3252         struct mgmt_rp_user_confirm_reply rp;
3253         int err;
3254
3255         cmd = mgmt_pending_find(opcode, hdev);
3256         if (!cmd)
3257                 return -ENOENT;
3258
3259         bacpy(&rp.addr.bdaddr, bdaddr);
3260         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3261         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3262                            &rp, sizeof(rp));
3263
3264         mgmt_pending_remove(cmd);
3265
3266         return err;
3267 }
3268
3269 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3270                                      u8 link_type, u8 addr_type, u8 status)
3271 {
3272         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3273                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3274 }
3275
3276 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3277                                          u8 link_type, u8 addr_type, u8 status)
3278 {
3279         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3280                                           status,
3281                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3282 }
3283
3284 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3285                                      u8 link_type, u8 addr_type, u8 status)
3286 {
3287         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3288                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3289 }
3290
3291 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3292                                          u8 link_type, u8 addr_type, u8 status)
3293 {
3294         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3295                                           status,
3296                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3297 }
3298
3299 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3300                              u8 link_type, u8 addr_type, u32 passkey,
3301                              u8 entered)
3302 {
3303         struct mgmt_ev_passkey_notify ev;
3304
3305         BT_DBG("%s", hdev->name);
3306
3307         bacpy(&ev.addr.bdaddr, bdaddr);
3308         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3309         ev.passkey = __cpu_to_le32(passkey);
3310         ev.entered = entered;
3311
3312         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3313 }
3314
3315 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3316                      u8 addr_type, u8 status)
3317 {
3318         struct mgmt_ev_auth_failed ev;
3319
3320         bacpy(&ev.addr.bdaddr, bdaddr);
3321         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3322         ev.status = mgmt_status(status);
3323
3324         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3325 }
3326
3327 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3328 {
3329         struct cmd_lookup match = { NULL, hdev };
3330         bool changed = false;
3331         int err = 0;
3332
3333         if (status) {
3334                 u8 mgmt_err = mgmt_status(status);
3335                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3336                                      cmd_status_rsp, &mgmt_err);
3337                 return 0;
3338         }
3339
3340         if (test_bit(HCI_AUTH, &hdev->flags)) {
3341                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3342                         changed = true;
3343         } else {
3344                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3345                         changed = true;
3346         }
3347
3348         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3349                              &match);
3350
3351         if (changed)
3352                 err = new_settings(hdev, match.sk);
3353
3354         if (match.sk)
3355                 sock_put(match.sk);
3356
3357         return err;
3358 }
3359
3360 static int clear_eir(struct hci_dev *hdev)
3361 {
3362         struct hci_cp_write_eir cp;
3363
3364         if (!(hdev->features[6] & LMP_EXT_INQ))
3365                 return 0;
3366
3367         memset(hdev->eir, 0, sizeof(hdev->eir));
3368
3369         memset(&cp, 0, sizeof(cp));
3370
3371         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3372 }
3373
3374 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3375 {
3376         struct cmd_lookup match = { NULL, hdev };
3377         bool changed = false;
3378         int err = 0;
3379
3380         if (status) {
3381                 u8 mgmt_err = mgmt_status(status);
3382
3383                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3384                                                  &hdev->dev_flags))
3385                         err = new_settings(hdev, NULL);
3386
3387                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3388                                      &mgmt_err);
3389
3390                 return err;
3391         }
3392
3393         if (enable) {
3394                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3395                         changed = true;
3396         } else {
3397                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3398                         changed = true;
3399         }
3400
3401         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3402
3403         if (changed)
3404                 err = new_settings(hdev, match.sk);
3405
3406         if (match.sk)
3407                 sock_put(match.sk);
3408
3409         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3410                 update_eir(hdev);
3411         else
3412                 clear_eir(hdev);
3413
3414         return err;
3415 }
3416
3417 static void class_rsp(struct pending_cmd *cmd, void *data)
3418 {
3419         struct cmd_lookup *match = data;
3420
3421         cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3422                      match->hdev->dev_class, 3);
3423
3424         list_del(&cmd->list);
3425
3426         if (match->sk == NULL) {
3427                 match->sk = cmd->sk;
3428                 sock_hold(match->sk);
3429         }
3430
3431         mgmt_pending_free(cmd);
3432 }
3433
3434 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3435                                    u8 status)
3436 {
3437         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3438         int err = 0;
3439
3440         clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3441
3442         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3443         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3444         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3445
3446         if (!status)
3447                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3448                                  3, NULL);
3449
3450         if (match.sk)
3451                 sock_put(match.sk);
3452
3453         return err;
3454 }
3455
3456 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3457 {
3458         struct pending_cmd *cmd;
3459         struct mgmt_cp_set_local_name ev;
3460         bool changed = false;
3461         int err = 0;
3462
3463         if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3464                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3465                 changed = true;
3466         }
3467
3468         memset(&ev, 0, sizeof(ev));
3469         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3470         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3471
3472         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3473         if (!cmd)
3474                 goto send_event;
3475
3476         /* Always assume that either the short or the complete name has
3477          * changed if there was a pending mgmt command */
3478         changed = true;
3479
3480         if (status) {
3481                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3482                                  mgmt_status(status));
3483                 goto failed;
3484         }
3485
3486         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3487                            sizeof(ev));
3488         if (err < 0)
3489                 goto failed;
3490
3491 send_event:
3492         if (changed)
3493                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3494                                  sizeof(ev), cmd ? cmd->sk : NULL);
3495
3496         update_eir(hdev);
3497
3498 failed:
3499         if (cmd)
3500                 mgmt_pending_remove(cmd);
3501         return err;
3502 }
3503
3504 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3505                                             u8 *randomizer, u8 status)
3506 {
3507         struct pending_cmd *cmd;
3508         int err;
3509
3510         BT_DBG("%s status %u", hdev->name, status);
3511
3512         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3513         if (!cmd)
3514                 return -ENOENT;
3515
3516         if (status) {
3517                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3518                                  mgmt_status(status));
3519         } else {
3520                 struct mgmt_rp_read_local_oob_data rp;
3521
3522                 memcpy(rp.hash, hash, sizeof(rp.hash));
3523                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3524
3525                 err = cmd_complete(cmd->sk, hdev->id,
3526                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3527                                    sizeof(rp));
3528         }
3529
3530         mgmt_pending_remove(cmd);
3531
3532         return err;
3533 }
3534
3535 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3536 {
3537         struct cmd_lookup match = { NULL, hdev };
3538         bool changed = false;
3539         int err = 0;
3540
3541         if (status) {
3542                 u8 mgmt_err = mgmt_status(status);
3543
3544                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3545                                                  &hdev->dev_flags))
3546                         err = new_settings(hdev, NULL);
3547
3548                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3549                                      &mgmt_err);
3550
3551                 return err;
3552         }
3553
3554         if (enable) {
3555                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3556                         changed = true;
3557         } else {
3558                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3559                         changed = true;
3560         }
3561
3562         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3563
3564         if (changed)
3565                 err = new_settings(hdev, match.sk);
3566
3567         if (match.sk)
3568                 sock_put(match.sk);
3569
3570         return err;
3571 }
3572
3573 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3574                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3575                       ssp, u8 *eir, u16 eir_len)
3576 {
3577         char buf[512];
3578         struct mgmt_ev_device_found *ev = (void *) buf;
3579         size_t ev_size;
3580
3581         /* Leave 5 bytes for a potential CoD field */
3582         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3583                 return -EINVAL;
3584
3585         memset(buf, 0, sizeof(buf));
3586
3587         bacpy(&ev->addr.bdaddr, bdaddr);
3588         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3589         ev->rssi = rssi;
3590         if (cfm_name)
3591                 ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
3592         if (!ssp)
3593                 ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
3594
3595         if (eir_len > 0)
3596                 memcpy(ev->eir, eir, eir_len);
3597
3598         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3599                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3600                                           dev_class, 3);
3601
3602         ev->eir_len = cpu_to_le16(eir_len);
3603         ev_size = sizeof(*ev) + eir_len;
3604
3605         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3606 }
3607
3608 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3609                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3610 {
3611         struct mgmt_ev_device_found *ev;
3612         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3613         u16 eir_len;
3614
3615         ev = (struct mgmt_ev_device_found *) buf;
3616
3617         memset(buf, 0, sizeof(buf));
3618
3619         bacpy(&ev->addr.bdaddr, bdaddr);
3620         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3621         ev->rssi = rssi;
3622
3623         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3624                                   name_len);
3625
3626         ev->eir_len = cpu_to_le16(eir_len);
3627
3628         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3629                           sizeof(*ev) + eir_len, NULL);
3630 }
3631
3632 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3633 {
3634         struct pending_cmd *cmd;
3635         u8 type;
3636         int err;
3637
3638         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3639
3640         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3641         if (!cmd)
3642                 return -ENOENT;
3643
3644         type = hdev->discovery.type;
3645
3646         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3647                            &type, sizeof(type));
3648         mgmt_pending_remove(cmd);
3649
3650         return err;
3651 }
3652
3653 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3654 {
3655         struct pending_cmd *cmd;
3656         int err;
3657
3658         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3659         if (!cmd)
3660                 return -ENOENT;
3661
3662         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3663                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3664         mgmt_pending_remove(cmd);
3665
3666         return err;
3667 }
3668
3669 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3670 {
3671         struct mgmt_ev_discovering ev;
3672         struct pending_cmd *cmd;
3673
3674         BT_DBG("%s discovering %u", hdev->name, discovering);
3675
3676         if (discovering)
3677                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3678         else
3679                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3680
3681         if (cmd != NULL) {
3682                 u8 type = hdev->discovery.type;
3683
3684                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3685                              sizeof(type));
3686                 mgmt_pending_remove(cmd);
3687         }
3688
3689         memset(&ev, 0, sizeof(ev));
3690         ev.type = hdev->discovery.type;
3691         ev.discovering = discovering;
3692
3693         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3694 }
3695
3696 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3697 {
3698         struct pending_cmd *cmd;
3699         struct mgmt_ev_device_blocked ev;
3700
3701         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3702
3703         bacpy(&ev.addr.bdaddr, bdaddr);
3704         ev.addr.type = type;
3705
3706         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3707                           cmd ? cmd->sk : NULL);
3708 }
3709
3710 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3711 {
3712         struct pending_cmd *cmd;
3713         struct mgmt_ev_device_unblocked ev;
3714
3715         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3716
3717         bacpy(&ev.addr.bdaddr, bdaddr);
3718         ev.addr.type = type;
3719
3720         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3721                           cmd ? cmd->sk : NULL);
3722 }
3723
3724 module_param(enable_hs, bool, 0644);
3725 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");