net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/kernel.h>
  28 #include <linux/uaccess.h>
  29 #include <linux/module.h>
  30 #include <asm/unaligned.h>
  31
  32 #include <net/bluetooth/bluetooth.h>
  33 #include <net/bluetooth/hci_core.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #include <net/bluetooth/smp.h>
  36
  37 bool enable_hs;
  38 bool enable_le;
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   0
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_PAIRABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81 };
  82
  83 static const u16 mgmt_events[] = {
  84         MGMT_EV_CONTROLLER_ERROR,
  85         MGMT_EV_INDEX_ADDED,
  86         MGMT_EV_INDEX_REMOVED,
  87         MGMT_EV_NEW_SETTINGS,
  88         MGMT_EV_CLASS_OF_DEV_CHANGED,
  89         MGMT_EV_LOCAL_NAME_CHANGED,
  90         MGMT_EV_NEW_LINK_KEY,
  91         MGMT_EV_NEW_LONG_TERM_KEY,
  92         MGMT_EV_DEVICE_CONNECTED,
  93         MGMT_EV_DEVICE_DISCONNECTED,
  94         MGMT_EV_CONNECT_FAILED,
  95         MGMT_EV_PIN_CODE_REQUEST,
  96         MGMT_EV_USER_CONFIRM_REQUEST,
  97         MGMT_EV_USER_PASSKEY_REQUEST,
  98         MGMT_EV_AUTH_FAILED,
  99         MGMT_EV_DEVICE_FOUND,
 100         MGMT_EV_DISCOVERING,
 101         MGMT_EV_DEVICE_BLOCKED,
 102         MGMT_EV_DEVICE_UNBLOCKED,
 103         MGMT_EV_DEVICE_UNPAIRED,
 104 };
 105
 106 /*
 107  * These LE scan and inquiry parameters were chosen according to LE General
 108  * Discovery Procedure specification.
 109  */
 110 #define LE_SCAN_TYPE                    0x01
 111 #define LE_SCAN_WIN                     0x12
 112 #define LE_SCAN_INT                     0x12
 113 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 114 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 115
 116 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 117 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 118
 119 #define SERVICE_CACHE_TIMEOUT (5 * 1000)
 120
 121 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 122                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 123
 124 struct pending_cmd {
 125         struct list_head list;
 126         u16 opcode;
 127         int index;
 128         void *param;
 129         struct sock *sk;
 130         void *user_data;
 131 };
 132
 133 /* HCI to MGMT error code conversion table */
 134 static u8 mgmt_status_table[] = {
 135         MGMT_STATUS_SUCCESS,
 136         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 137         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 138         MGMT_STATUS_FAILED,             /* Hardware Failure */
 139         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 140         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 141         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 142         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 143         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 145         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 146         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 147         MGMT_STATUS_BUSY,               /* Command Disallowed */
 148         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 149         MGMT_STATUS_REJECTED,           /* Rejected Security */
 150         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 151         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 152         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 153         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 154         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 155         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 156         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 157         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 158         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 159         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 160         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 161         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 162         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 163         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 164         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 165         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 166         MGMT_STATUS_FAILED,             /* Unspecified Error */
 167         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 168         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 169         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 170         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 171         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 172         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 173         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 175         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 176         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 177         MGMT_STATUS_FAILED,             /* Transaction Collision */
 178         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 179         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 180         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 181         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 182         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 183         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 184         MGMT_STATUS_FAILED,             /* Slot Violation */
 185         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 186         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 187         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 188         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 189         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 190         MGMT_STATUS_BUSY,               /* Controller Busy */
 191         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 192         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 193         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 194         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 195         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 196 };
 197
 198 static u8 mgmt_status(u8 hci_status)
 199 {
 200         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 201                 return mgmt_status_table[hci_status];
 202
 203         return MGMT_STATUS_FAILED;
 204 }
 205
 206 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 207 {
 208         struct sk_buff *skb;
 209         struct mgmt_hdr *hdr;
 210         struct mgmt_ev_cmd_status *ev;
 211         int err;
 212
 213         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 214
 215         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
 216         if (!skb)
 217                 return -ENOMEM;
 218
 219         hdr = (void *) skb_put(skb, sizeof(*hdr));
 220
 221         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 222         hdr->index = cpu_to_le16(index);
 223         hdr->len = cpu_to_le16(sizeof(*ev));
 224
 225         ev = (void *) skb_put(skb, sizeof(*ev));
 226         ev->status = status;
 227         put_unaligned_le16(cmd, &ev->opcode);
 228
 229         err = sock_queue_rcv_skb(sk, skb);
 230         if (err < 0)
 231                 kfree_skb(skb);
 232
 233         return err;
 234 }
 235
 236 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 237                                                 void *rp, size_t rp_len)
 238 {
 239         struct sk_buff *skb;
 240         struct mgmt_hdr *hdr;
 241         struct mgmt_ev_cmd_complete *ev;
 242         int err;
 243
 244         BT_DBG("sock %p", sk);
 245
 246         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
 247         if (!skb)
 248                 return -ENOMEM;
 249
 250         hdr = (void *) skb_put(skb, sizeof(*hdr));
 251
 252         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 253         hdr->index = cpu_to_le16(index);
 254         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 255
 256         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 257         put_unaligned_le16(cmd, &ev->opcode);
 258         ev->status = status;
 259
 260         if (rp)
 261                 memcpy(ev->data, rp, rp_len);
 262
 263         err = sock_queue_rcv_skb(sk, skb);
 264         if (err < 0)
 265                 kfree_skb(skb);
 266
 267         return err;;
 268 }
 269
 270 static int read_version(struct sock *sk)
 271 {
 272         struct mgmt_rp_read_version rp;
 273
 274         BT_DBG("sock %p", sk);
 275
 276         rp.version = MGMT_VERSION;
 277         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 278
 279         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 280                                                                 sizeof(rp));
 281 }
 282
 283 static int read_commands(struct sock *sk)
 284 {
 285         struct mgmt_rp_read_commands *rp;
 286         u16 num_commands = ARRAY_SIZE(mgmt_commands);
 287         u16 num_events = ARRAY_SIZE(mgmt_events);
 288         u16 *opcode;
 289         size_t rp_size;
 290         int i, err;
 291
 292         BT_DBG("sock %p", sk);
 293
 294         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 295
 296         rp = kmalloc(rp_size, GFP_KERNEL);
 297         if (!rp)
 298                 return -ENOMEM;
 299
 300         put_unaligned_le16(num_commands, &rp->num_commands);
 301         put_unaligned_le16(num_events, &rp->num_events);
 302
 303         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 304                 put_unaligned_le16(mgmt_commands[i], opcode);
 305
 306         for (i = 0; i < num_events; i++, opcode++)
 307                 put_unaligned_le16(mgmt_events[i], opcode);
 308
 309         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 310                                                                 rp_size);
 311         kfree(rp);
 312
 313         return err;
 314 }
 315
 316 static int read_index_list(struct sock *sk)
 317 {
 318         struct mgmt_rp_read_index_list *rp;
 319         struct list_head *p;
 320         struct hci_dev *d;
 321         size_t rp_len;
 322         u16 count;
 323         int i, err;
 324
 325         BT_DBG("sock %p", sk);
 326
 327         read_lock(&hci_dev_list_lock);
 328
 329         count = 0;
 330         list_for_each(p, &hci_dev_list) {
 331                 count++;
 332         }
 333
 334         rp_len = sizeof(*rp) + (2 * count);
 335         rp = kmalloc(rp_len, GFP_ATOMIC);
 336         if (!rp) {
 337                 read_unlock(&hci_dev_list_lock);
 338                 return -ENOMEM;
 339         }
 340
 341         put_unaligned_le16(count, &rp->num_controllers);
 342
 343         i = 0;
 344         list_for_each_entry(d, &hci_dev_list, list) {
 345                 if (test_bit(HCI_SETUP, &d->dev_flags))
 346                         continue;
 347
 348                 put_unaligned_le16(d->id, &rp->index[i++]);
 349                 BT_DBG("Added hci%u", d->id);
 350         }
 351
 352         read_unlock(&hci_dev_list_lock);
 353
 354         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 355                                                                         rp_len);
 356
 357         kfree(rp);
 358
 359         return err;
 360 }
 361
 362 static u32 get_supported_settings(struct hci_dev *hdev)
 363 {
 364         u32 settings = 0;
 365
 366         settings |= MGMT_SETTING_POWERED;
 367         settings |= MGMT_SETTING_CONNECTABLE;
 368         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 369         settings |= MGMT_SETTING_DISCOVERABLE;
 370         settings |= MGMT_SETTING_PAIRABLE;
 371
 372         if (hdev->features[6] & LMP_SIMPLE_PAIR)
 373                 settings |= MGMT_SETTING_SSP;
 374
 375         if (!(hdev->features[4] & LMP_NO_BREDR)) {
 376                 settings |= MGMT_SETTING_BREDR;
 377                 settings |= MGMT_SETTING_LINK_SECURITY;
 378         }
 379
 380         if (enable_hs)
 381                 settings |= MGMT_SETTING_HS;
 382
 383         if (enable_le) {
 384                 if (hdev->features[4] & LMP_LE)
 385                         settings |= MGMT_SETTING_LE;
 386         }
 387
 388         return settings;
 389 }
 390
 391 static u32 get_current_settings(struct hci_dev *hdev)
 392 {
 393         u32 settings = 0;
 394
 395         if (hdev_is_powered(hdev))
 396                 settings |= MGMT_SETTING_POWERED;
 397
 398         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 399                 settings |= MGMT_SETTING_CONNECTABLE;
 400
 401         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 402                 settings |= MGMT_SETTING_DISCOVERABLE;
 403
 404         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 405                 settings |= MGMT_SETTING_PAIRABLE;
 406
 407         if (!(hdev->features[4] & LMP_NO_BREDR))
 408                 settings |= MGMT_SETTING_BREDR;
 409
 410         if (hdev->host_features[0] & LMP_HOST_LE)
 411                 settings |= MGMT_SETTING_LE;
 412
 413         if (test_bit(HCI_AUTH, &hdev->flags))
 414                 settings |= MGMT_SETTING_LINK_SECURITY;
 415
 416         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 417                 settings |= MGMT_SETTING_SSP;
 418
 419         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 420                 settings |= MGMT_SETTING_HS;
 421
 422         return settings;
 423 }
 424
 425 #define PNP_INFO_SVCLASS_ID             0x1200
 426
 427 static u8 bluetooth_base_uuid[] = {
 428                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 429                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 430 };
 431
 432 static u16 get_uuid16(u8 *uuid128)
 433 {
 434         u32 val;
 435         int i;
 436
 437         for (i = 0; i < 12; i++) {
 438                 if (bluetooth_base_uuid[i] != uuid128[i])
 439                         return 0;
 440         }
 441
 442         memcpy(&val, &uuid128[12], 4);
 443
 444         val = le32_to_cpu(val);
 445         if (val > 0xffff)
 446                 return 0;
 447
 448         return (u16) val;
 449 }
 450
 451 static void create_eir(struct hci_dev *hdev, u8 *data)
 452 {
 453         u8 *ptr = data;
 454         u16 eir_len = 0;
 455         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 456         int i, truncated = 0;
 457         struct bt_uuid *uuid;
 458         size_t name_len;
 459
 460         name_len = strlen(hdev->dev_name);
 461
 462         if (name_len > 0) {
 463                 /* EIR Data type */
 464                 if (name_len > 48) {
 465                         name_len = 48;
 466                         ptr[1] = EIR_NAME_SHORT;
 467                 } else
 468                         ptr[1] = EIR_NAME_COMPLETE;
 469
 470                 /* EIR Data length */
 471                 ptr[0] = name_len + 1;
 472
 473                 memcpy(ptr + 2, hdev->dev_name, name_len);
 474
 475                 eir_len += (name_len + 2);
 476                 ptr += (name_len + 2);
 477         }
 478
 479         memset(uuid16_list, 0, sizeof(uuid16_list));
 480
 481         /* Group all UUID16 types */
 482         list_for_each_entry(uuid, &hdev->uuids, list) {
 483                 u16 uuid16;
 484
 485                 uuid16 = get_uuid16(uuid->uuid);
 486                 if (uuid16 == 0)
 487                         return;
 488
 489                 if (uuid16 < 0x1100)
 490                         continue;
 491
 492                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 493                         continue;
 494
 495                 /* Stop if not enough space to put next UUID */
 496                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 497                         truncated = 1;
 498                         break;
 499                 }
 500
 501                 /* Check for duplicates */
 502                 for (i = 0; uuid16_list[i] != 0; i++)
 503                         if (uuid16_list[i] == uuid16)
 504                                 break;
 505
 506                 if (uuid16_list[i] == 0) {
 507                         uuid16_list[i] = uuid16;
 508                         eir_len += sizeof(u16);
 509                 }
 510         }
 511
 512         if (uuid16_list[0] != 0) {
 513                 u8 *length = ptr;
 514
 515                 /* EIR Data type */
 516                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 517
 518                 ptr += 2;
 519                 eir_len += 2;
 520
 521                 for (i = 0; uuid16_list[i] != 0; i++) {
 522                         *ptr++ = (uuid16_list[i] & 0x00ff);
 523                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 524                 }
 525
 526                 /* EIR Data length */
 527                 *length = (i * sizeof(u16)) + 1;
 528         }
 529 }
 530
 531 static int update_eir(struct hci_dev *hdev)
 532 {
 533         struct hci_cp_write_eir cp;
 534
 535         if (!(hdev->features[6] & LMP_EXT_INQ))
 536                 return 0;
 537
 538         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 539                 return 0;
 540
 541         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 542                 return 0;
 543
 544         memset(&cp, 0, sizeof(cp));
 545
 546         create_eir(hdev, cp.data);
 547
 548         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 549                 return 0;
 550
 551         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 552
 553         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 554 }
 555
 556 static u8 get_service_classes(struct hci_dev *hdev)
 557 {
 558         struct bt_uuid *uuid;
 559         u8 val = 0;
 560
 561         list_for_each_entry(uuid, &hdev->uuids, list)
 562                 val |= uuid->svc_hint;
 563
 564         return val;
 565 }
 566
 567 static int update_class(struct hci_dev *hdev)
 568 {
 569         u8 cod[3];
 570
 571         BT_DBG("%s", hdev->name);
 572
 573         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 574                 return 0;
 575
 576         cod[0] = hdev->minor_class;
 577         cod[1] = hdev->major_class;
 578         cod[2] = get_service_classes(hdev);
 579
 580         if (memcmp(cod, hdev->dev_class, 3) == 0)
 581                 return 0;
 582
 583         return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 584 }
 585
 586 static void service_cache_off(struct work_struct *work)
 587 {
 588         struct hci_dev *hdev = container_of(work, struct hci_dev,
 589                                                         service_cache.work);
 590
 591         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 592                 return;
 593
 594         hci_dev_lock(hdev);
 595
 596         update_eir(hdev);
 597         update_class(hdev);
 598
 599         hci_dev_unlock(hdev);
 600 }
 601
 602 static void mgmt_init_hdev(struct hci_dev *hdev)
 603 {
 604         if (!test_and_set_bit(HCI_MGMT, &hdev->dev_flags)) {
 605                 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 606
 607                 /* Non-mgmt controlled devices get this bit set
 608                  * implicitly so that pairing works for them, however
 609                  * for mgmt we require user-space to explicitly enable
 610                  * it
 611                  */
 612                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 613         }
 614
 615         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 616                 schedule_delayed_work(&hdev->service_cache,
 617                                 msecs_to_jiffies(SERVICE_CACHE_TIMEOUT));
 618 }
 619
 620 static int read_controller_info(struct sock *sk, u16 index)
 621 {
 622         struct mgmt_rp_read_info rp;
 623         struct hci_dev *hdev;
 624
 625         BT_DBG("sock %p hci%u", sk, index);
 626
 627         hdev = hci_dev_get(index);
 628         if (!hdev)
 629                 return cmd_status(sk, index, MGMT_OP_READ_INFO,
 630                                                 MGMT_STATUS_INVALID_PARAMS);
 631
 632         hci_dev_lock(hdev);
 633
 634         if (test_and_clear_bit(HCI_PI_MGMT_INIT, &hci_pi(sk)->flags))
 635                 mgmt_init_hdev(hdev);
 636
 637         memset(&rp, 0, sizeof(rp));
 638
 639         bacpy(&rp.bdaddr, &hdev->bdaddr);
 640
 641         rp.version = hdev->hci_ver;
 642
 643         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 644
 645         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 646         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 647
 648         memcpy(rp.dev_class, hdev->dev_class, 3);
 649
 650         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 651
 652         hci_dev_unlock(hdev);
 653         hci_dev_put(hdev);
 654
 655         return cmd_complete(sk, index, MGMT_OP_READ_INFO, 0, &rp, sizeof(rp));
 656 }
 657
 658 static void mgmt_pending_free(struct pending_cmd *cmd)
 659 {
 660         sock_put(cmd->sk);
 661         kfree(cmd->param);
 662         kfree(cmd);
 663 }
 664
 665 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 666                                                         struct hci_dev *hdev,
 667                                                         void *data, u16 len)
 668 {
 669         struct pending_cmd *cmd;
 670
 671         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 672         if (!cmd)
 673                 return NULL;
 674
 675         cmd->opcode = opcode;
 676         cmd->index = hdev->id;
 677
 678         cmd->param = kmalloc(len, GFP_ATOMIC);
 679         if (!cmd->param) {
 680                 kfree(cmd);
 681                 return NULL;
 682         }
 683
 684         if (data)
 685                 memcpy(cmd->param, data, len);
 686
 687         cmd->sk = sk;
 688         sock_hold(sk);
 689
 690         list_add(&cmd->list, &hdev->mgmt_pending);
 691
 692         return cmd;
 693 }
 694
 695 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 696                                 void (*cb)(struct pending_cmd *cmd, void *data),
 697                                 void *data)
 698 {
 699         struct list_head *p, *n;
 700
 701         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 702                 struct pending_cmd *cmd;
 703
 704                 cmd = list_entry(p, struct pending_cmd, list);
 705
 706                 if (opcode > 0 && cmd->opcode != opcode)
 707                         continue;
 708
 709                 cb(cmd, data);
 710         }
 711 }
 712
 713 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 714 {
 715         struct pending_cmd *cmd;
 716
 717         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 718                 if (cmd->opcode == opcode)
 719                         return cmd;
 720         }
 721
 722         return NULL;
 723 }
 724
 725 static void mgmt_pending_remove(struct pending_cmd *cmd)
 726 {
 727         list_del(&cmd->list);
 728         mgmt_pending_free(cmd);
 729 }
 730
 731 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 732 {
 733         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 734
 735         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 736                                                         sizeof(settings));
 737 }
 738
 739 static int set_powered(struct sock *sk, u16 index, void *data, u16 len)
 740 {
 741         struct mgmt_mode *cp = data;
 742         struct hci_dev *hdev;
 743         struct pending_cmd *cmd;
 744         int err;
 745
 746         BT_DBG("request for hci%u", index);
 747
 748         if (len != sizeof(*cp))
 749                 return cmd_status(sk, index, MGMT_OP_SET_POWERED,
 750                                                 MGMT_STATUS_INVALID_PARAMS);
 751
 752         hdev = hci_dev_get(index);
 753         if (!hdev)
 754                 return cmd_status(sk, index, MGMT_OP_SET_POWERED,
 755                                                 MGMT_STATUS_INVALID_PARAMS);
 756
 757         hci_dev_lock(hdev);
 758
 759         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 760                 cancel_delayed_work(&hdev->power_off);
 761
 762                 if (cp->val) {
 763                         err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 764                         mgmt_powered(hdev, 1);
 765                         goto failed;
 766                 }
 767         }
 768
 769         if (!!cp->val == hdev_is_powered(hdev)) {
 770                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 771                 goto failed;
 772         }
 773
 774         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 775                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED,
 776                                                         MGMT_STATUS_BUSY);
 777                 goto failed;
 778         }
 779
 780         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 781         if (!cmd) {
 782                 err = -ENOMEM;
 783                 goto failed;
 784         }
 785
 786         if (cp->val)
 787                 schedule_work(&hdev->power_on);
 788         else
 789                 schedule_work(&hdev->power_off.work);
 790
 791         err = 0;
 792
 793 failed:
 794         hci_dev_unlock(hdev);
 795         hci_dev_put(hdev);
 796         return err;
 797 }
 798
 799 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data,
 800                                         u16 data_len, struct sock *skip_sk)
 801 {
 802         struct sk_buff *skb;
 803         struct mgmt_hdr *hdr;
 804
 805         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 806         if (!skb)
 807                 return -ENOMEM;
 808
 809         hdr = (void *) skb_put(skb, sizeof(*hdr));
 810         hdr->opcode = cpu_to_le16(event);
 811         if (hdev)
 812                 hdr->index = cpu_to_le16(hdev->id);
 813         else
 814                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 815         hdr->len = cpu_to_le16(data_len);
 816
 817         if (data)
 818                 memcpy(skb_put(skb, data_len), data, data_len);
 819
 820         hci_send_to_control(skb, skip_sk);
 821         kfree_skb(skb);
 822
 823         return 0;
 824 }
 825
 826 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 827 {
 828         __le32 ev;
 829
 830         ev = cpu_to_le32(get_current_settings(hdev));
 831
 832         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 833 }
 834
 835 static int set_discoverable(struct sock *sk, u16 index, void *data, u16 len)
 836 {
 837         struct mgmt_cp_set_discoverable *cp = data;
 838         struct hci_dev *hdev;
 839         struct pending_cmd *cmd;
 840         u16 timeout;
 841         u8 scan;
 842         int err;
 843
 844         BT_DBG("request for hci%u", index);
 845
 846         if (len != sizeof(*cp))
 847                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 848                                                 MGMT_STATUS_INVALID_PARAMS);
 849
 850         hdev = hci_dev_get(index);
 851         if (!hdev)
 852                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 853                                                 MGMT_STATUS_INVALID_PARAMS);
 854
 855         timeout = get_unaligned_le16(&cp->timeout);
 856
 857         hci_dev_lock(hdev);
 858
 859         if (!hdev_is_powered(hdev) && timeout > 0) {
 860                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 861                                                 MGMT_STATUS_NOT_POWERED);
 862                 goto failed;
 863         }
 864
 865         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 866                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 867                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 868                                                         MGMT_STATUS_BUSY);
 869                 goto failed;
 870         }
 871
 872         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 873                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 874                                                         MGMT_STATUS_REJECTED);
 875                 goto failed;
 876         }
 877
 878         if (!hdev_is_powered(hdev)) {
 879                 bool changed = false;
 880
 881                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 882                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 883                         changed = true;
 884                 }
 885
 886                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 887                 if (err < 0)
 888                         goto failed;
 889
 890                 if (changed)
 891                         err = new_settings(hdev, sk);
 892
 893                 goto failed;
 894         }
 895
 896         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 897                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 898                 goto failed;
 899         }
 900
 901         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 902         if (!cmd) {
 903                 err = -ENOMEM;
 904                 goto failed;
 905         }
 906
 907         scan = SCAN_PAGE;
 908
 909         if (cp->val)
 910                 scan |= SCAN_INQUIRY;
 911         else
 912                 cancel_delayed_work(&hdev->discov_off);
 913
 914         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 915         if (err < 0)
 916                 mgmt_pending_remove(cmd);
 917
 918         if (cp->val)
 919                 hdev->discov_timeout = timeout;
 920
 921 failed:
 922         hci_dev_unlock(hdev);
 923         hci_dev_put(hdev);
 924
 925         return err;
 926 }
 927
 928 static int set_connectable(struct sock *sk, u16 index, void *data, u16 len)
 929 {
 930         struct mgmt_mode *cp = data;
 931         struct hci_dev *hdev;
 932         struct pending_cmd *cmd;
 933         u8 scan;
 934         int err;
 935
 936         BT_DBG("request for hci%u", index);
 937
 938         if (len != sizeof(*cp))
 939                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 940                                                 MGMT_STATUS_INVALID_PARAMS);
 941
 942         hdev = hci_dev_get(index);
 943         if (!hdev)
 944                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 945                                                 MGMT_STATUS_INVALID_PARAMS);
 946
 947         hci_dev_lock(hdev);
 948
 949         if (!hdev_is_powered(hdev)) {
 950                 bool changed = false;
 951
 952                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 953                         changed = true;
 954
 955                 if (cp->val)
 956                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 957                 else {
 958                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 959                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 960                 }
 961
 962                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 963                 if (err < 0)
 964                         goto failed;
 965
 966                 if (changed)
 967                         err = new_settings(hdev, sk);
 968
 969                 goto failed;
 970         }
 971
 972         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 973                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 974                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 975                                                         MGMT_STATUS_BUSY);
 976                 goto failed;
 977         }
 978
 979         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 980                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 981                 goto failed;
 982         }
 983
 984         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
 985         if (!cmd) {
 986                 err = -ENOMEM;
 987                 goto failed;
 988         }
 989
 990         if (cp->val)
 991                 scan = SCAN_PAGE;
 992         else {
 993                 scan = 0;
 994
 995                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
 996                                                 hdev->discov_timeout > 0)
 997                         cancel_delayed_work(&hdev->discov_off);
 998         }
 999
1000         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1001         if (err < 0)
1002                 mgmt_pending_remove(cmd);
1003
1004 failed:
1005         hci_dev_unlock(hdev);
1006         hci_dev_put(hdev);
1007
1008         return err;
1009 }
1010
1011 static int set_pairable(struct sock *sk, u16 index, void *data, u16 len)
1012 {
1013         struct mgmt_mode *cp = data;
1014         struct hci_dev *hdev;
1015         int err;
1016
1017         BT_DBG("request for hci%u", index);
1018
1019         if (len != sizeof(*cp))
1020                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
1021                                                 MGMT_STATUS_INVALID_PARAMS);
1022
1023         hdev = hci_dev_get(index);
1024         if (!hdev)
1025                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
1026                                                 MGMT_STATUS_INVALID_PARAMS);
1027
1028         hci_dev_lock(hdev);
1029
1030         if (cp->val)
1031                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1032         else
1033                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1034
1035         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1036         if (err < 0)
1037                 goto failed;
1038
1039         err = new_settings(hdev, sk);
1040
1041 failed:
1042         hci_dev_unlock(hdev);
1043         hci_dev_put(hdev);
1044
1045         return err;
1046 }
1047
1048 static int set_link_security(struct sock *sk, u16 index, void *data, u16 len)
1049 {
1050         struct mgmt_mode *cp = data;
1051         struct pending_cmd *cmd;
1052         struct hci_dev *hdev;
1053         uint8_t val;
1054         int err;
1055
1056         BT_DBG("request for hci%u", index);
1057
1058         if (len != sizeof(*cp))
1059                 return cmd_status(sk, index, MGMT_OP_SET_LINK_SECURITY,
1060                                                 MGMT_STATUS_INVALID_PARAMS);
1061
1062         hdev = hci_dev_get(index);
1063         if (!hdev)
1064                 return cmd_status(sk, index, MGMT_OP_SET_LINK_SECURITY,
1065                                                 MGMT_STATUS_INVALID_PARAMS);
1066
1067         hci_dev_lock(hdev);
1068
1069         if (!hdev_is_powered(hdev)) {
1070                 err = cmd_status(sk, index, MGMT_OP_SET_LINK_SECURITY,
1071                                                 MGMT_STATUS_NOT_POWERED);
1072                 goto failed;
1073         }
1074
1075         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1076                 err = cmd_status(sk, index, MGMT_OP_SET_LINK_SECURITY,
1077                                                         MGMT_STATUS_BUSY);
1078                 goto failed;
1079         }
1080
1081         val = !!cp->val;
1082
1083         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1084                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1085                 goto failed;
1086         }
1087
1088         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1089         if (!cmd) {
1090                 err = -ENOMEM;
1091                 goto failed;
1092         }
1093
1094         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1095         if (err < 0) {
1096                 mgmt_pending_remove(cmd);
1097                 goto failed;
1098         }
1099
1100 failed:
1101         hci_dev_unlock(hdev);
1102         hci_dev_put(hdev);
1103
1104         return err;
1105 }
1106
1107 static int set_ssp(struct sock *sk, u16 index, void *data, u16 len)
1108 {
1109         struct mgmt_mode *cp = data;
1110         struct pending_cmd *cmd;
1111         struct hci_dev *hdev;
1112         uint8_t val;
1113         int err;
1114
1115         BT_DBG("request for hci%u", index);
1116
1117         if (len != sizeof(*cp))
1118                 return cmd_status(sk, index, MGMT_OP_SET_SSP,
1119                                                 MGMT_STATUS_INVALID_PARAMS);
1120
1121         hdev = hci_dev_get(index);
1122         if (!hdev)
1123                 return cmd_status(sk, index, MGMT_OP_SET_SSP,
1124                                                 MGMT_STATUS_INVALID_PARAMS);
1125
1126         hci_dev_lock(hdev);
1127
1128         if (!hdev_is_powered(hdev)) {
1129                 err = cmd_status(sk, index, MGMT_OP_SET_SSP,
1130                                                 MGMT_STATUS_NOT_POWERED);
1131                 goto failed;
1132         }
1133
1134         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1135                 err = cmd_status(sk, index, MGMT_OP_SET_SSP,
1136                                                 MGMT_STATUS_NOT_SUPPORTED);
1137                 goto failed;
1138         }
1139
1140         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1141                 err = cmd_status(sk, index, MGMT_OP_SET_SSP, MGMT_STATUS_BUSY);
1142                 goto failed;
1143         }
1144
1145         val = !!cp->val;
1146
1147         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1148                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1149                 goto failed;
1150         }
1151
1152         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1153         if (!cmd) {
1154                 err = -ENOMEM;
1155                 goto failed;
1156         }
1157
1158         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1159         if (err < 0) {
1160                 mgmt_pending_remove(cmd);
1161                 goto failed;
1162         }
1163
1164 failed:
1165         hci_dev_unlock(hdev);
1166         hci_dev_put(hdev);
1167
1168         return err;
1169 }
1170
1171 static int set_hs(struct sock *sk, u16 index, void *data, u16 len)
1172 {
1173         struct mgmt_mode *cp = data;
1174         struct hci_dev *hdev;
1175         int err;
1176
1177         BT_DBG("request for hci%u", index);
1178
1179         if (len != sizeof(*cp))
1180                 return cmd_status(sk, index, MGMT_OP_SET_HS,
1181                                                 MGMT_STATUS_INVALID_PARAMS);
1182
1183         hdev = hci_dev_get(index);
1184         if (!hdev)
1185                 return cmd_status(sk, index, MGMT_OP_SET_HS,
1186                                                 MGMT_STATUS_INVALID_PARAMS);
1187
1188         if (!enable_hs) {
1189                 err = cmd_status(sk, index, MGMT_OP_SET_HS,
1190                                         MGMT_STATUS_NOT_SUPPORTED);
1191                 goto failed;
1192         }
1193
1194         if (cp->val)
1195                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1196         else
1197                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1198
1199         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1200
1201 failed:
1202         hci_dev_put(hdev);
1203         return err;
1204 }
1205
1206 static int add_uuid(struct sock *sk, u16 index, void *data, u16 len)
1207 {
1208         struct mgmt_cp_add_uuid *cp = data;
1209         struct hci_dev *hdev;
1210         struct bt_uuid *uuid;
1211         int err;
1212
1213         BT_DBG("request for hci%u", index);
1214
1215         if (len != sizeof(*cp))
1216                 return cmd_status(sk, index, MGMT_OP_ADD_UUID,
1217                                                 MGMT_STATUS_INVALID_PARAMS);
1218
1219         hdev = hci_dev_get(index);
1220         if (!hdev)
1221                 return cmd_status(sk, index, MGMT_OP_ADD_UUID,
1222                                                 MGMT_STATUS_INVALID_PARAMS);
1223
1224         hci_dev_lock(hdev);
1225
1226         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
1227         if (!uuid) {
1228                 err = -ENOMEM;
1229                 goto failed;
1230         }
1231
1232         memcpy(uuid->uuid, cp->uuid, 16);
1233         uuid->svc_hint = cp->svc_hint;
1234
1235         list_add(&uuid->list, &hdev->uuids);
1236
1237         err = update_class(hdev);
1238         if (err < 0)
1239                 goto failed;
1240
1241         err = update_eir(hdev);
1242         if (err < 0)
1243                 goto failed;
1244
1245         err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, 0, NULL, 0);
1246
1247 failed:
1248         hci_dev_unlock(hdev);
1249         hci_dev_put(hdev);
1250
1251         return err;
1252 }
1253
1254 static int remove_uuid(struct sock *sk, u16 index, void *data, u16 len)
1255 {
1256         struct mgmt_cp_remove_uuid *cp = data;
1257         struct list_head *p, *n;
1258         struct hci_dev *hdev;
1259         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1260         int err, found;
1261
1262         BT_DBG("request for hci%u", index);
1263
1264         if (len != sizeof(*cp))
1265                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
1266                                                 MGMT_STATUS_INVALID_PARAMS);
1267
1268         hdev = hci_dev_get(index);
1269         if (!hdev)
1270                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
1271                                                 MGMT_STATUS_INVALID_PARAMS);
1272
1273         hci_dev_lock(hdev);
1274
1275         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1276                 err = hci_uuids_clear(hdev);
1277                 goto unlock;
1278         }
1279
1280         found = 0;
1281
1282         list_for_each_safe(p, n, &hdev->uuids) {
1283                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1284
1285                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1286                         continue;
1287
1288                 list_del(&match->list);
1289                 found++;
1290         }
1291
1292         if (found == 0) {
1293                 err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
1294                                                 MGMT_STATUS_INVALID_PARAMS);
1295                 goto unlock;
1296         }
1297
1298         err = update_class(hdev);
1299         if (err < 0)
1300                 goto unlock;
1301
1302         err = update_eir(hdev);
1303         if (err < 0)
1304                 goto unlock;
1305
1306         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, 0, NULL, 0);
1307
1308 unlock:
1309         hci_dev_unlock(hdev);
1310         hci_dev_put(hdev);
1311
1312         return err;
1313 }
1314
1315 static int set_dev_class(struct sock *sk, u16 index, void *data, u16 len)
1316 {
1317         struct hci_dev *hdev;
1318         struct mgmt_cp_set_dev_class *cp = data;
1319         int err;
1320
1321         BT_DBG("request for hci%u", index);
1322
1323         if (len != sizeof(*cp))
1324                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
1325                                                 MGMT_STATUS_INVALID_PARAMS);
1326
1327         hdev = hci_dev_get(index);
1328         if (!hdev)
1329                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
1330                                                 MGMT_STATUS_INVALID_PARAMS);
1331
1332         hci_dev_lock(hdev);
1333
1334         if (!hdev_is_powered(hdev)) {
1335                 err = cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
1336                                                 MGMT_STATUS_NOT_POWERED);
1337                 goto unlock;
1338         }
1339
1340         hdev->major_class = cp->major;
1341         hdev->minor_class = cp->minor;
1342
1343         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1344                 hci_dev_unlock(hdev);
1345                 cancel_delayed_work_sync(&hdev->service_cache);
1346                 hci_dev_lock(hdev);
1347                 update_eir(hdev);
1348         }
1349
1350         err = update_class(hdev);
1351
1352         if (err == 0)
1353                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, 0,
1354                                                                 NULL, 0);
1355
1356 unlock:
1357         hci_dev_unlock(hdev);
1358         hci_dev_put(hdev);
1359
1360         return err;
1361 }
1362
1363 static int load_link_keys(struct sock *sk, u16 index, void *data, u16 len)
1364 {
1365         struct hci_dev *hdev;
1366         struct mgmt_cp_load_link_keys *cp = data;
1367         u16 key_count, expected_len;
1368         int i;
1369
1370         if (len < sizeof(*cp))
1371                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1372                                                 MGMT_STATUS_INVALID_PARAMS);
1373
1374         key_count = get_unaligned_le16(&cp->key_count);
1375
1376         expected_len = sizeof(*cp) + key_count *
1377                                         sizeof(struct mgmt_link_key_info);
1378         if (expected_len != len) {
1379                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1380                                                         len, expected_len);
1381                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1382                                                 MGMT_STATUS_INVALID_PARAMS);
1383         }
1384
1385         hdev = hci_dev_get(index);
1386         if (!hdev)
1387                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1388                                                 MGMT_STATUS_INVALID_PARAMS);
1389
1390         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
1391                                                                 key_count);
1392
1393         hci_dev_lock(hdev);
1394
1395         hci_link_keys_clear(hdev);
1396
1397         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1398
1399         if (cp->debug_keys)
1400                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1401         else
1402                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1403
1404         for (i = 0; i < key_count; i++) {
1405                 struct mgmt_link_key_info *key = &cp->keys[i];
1406
1407                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1408                                                 key->type, key->pin_len);
1409         }
1410
1411         cmd_complete(sk, index, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1412
1413         hci_dev_unlock(hdev);
1414         hci_dev_put(hdev);
1415
1416         return 0;
1417 }
1418
1419 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1420                                         u8 addr_type, struct sock *skip_sk)
1421 {
1422         struct mgmt_ev_device_unpaired ev;
1423
1424         bacpy(&ev.addr.bdaddr, bdaddr);
1425         ev.addr.type = addr_type;
1426
1427         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1428                                                                 skip_sk);
1429 }
1430
1431 static int unpair_device(struct sock *sk, u16 index, void *data, u16 len)
1432 {
1433         struct hci_dev *hdev;
1434         struct mgmt_cp_unpair_device *cp = data;
1435         struct mgmt_rp_unpair_device rp;
1436         struct hci_cp_disconnect dc;
1437         struct pending_cmd *cmd;
1438         struct hci_conn *conn;
1439         u8 status = 0;
1440         int err;
1441
1442         if (len != sizeof(*cp))
1443                 return cmd_status(sk, index, MGMT_OP_UNPAIR_DEVICE,
1444                                                 MGMT_STATUS_INVALID_PARAMS);
1445
1446         hdev = hci_dev_get(index);
1447         if (!hdev)
1448                 return cmd_status(sk, index, MGMT_OP_UNPAIR_DEVICE,
1449                                                 MGMT_STATUS_INVALID_PARAMS);
1450
1451         hci_dev_lock(hdev);
1452
1453         memset(&rp, 0, sizeof(rp));
1454         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1455         rp.addr.type = cp->addr.type;
1456
1457         if (cp->addr.type == MGMT_ADDR_BREDR)
1458                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1459         else
1460                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1461
1462         if (err < 0) {
1463                 status = MGMT_STATUS_NOT_PAIRED;
1464                 goto unlock;
1465         }
1466
1467         if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect) {
1468                 err = cmd_complete(sk, index, MGMT_OP_UNPAIR_DEVICE, status,
1469                                                         &rp, sizeof(rp));
1470                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1471                 goto unlock;
1472         }
1473
1474         if (cp->addr.type == MGMT_ADDR_BREDR)
1475                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1476                                                         &cp->addr.bdaddr);
1477         else
1478                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1479                                                         &cp->addr.bdaddr);
1480
1481         if (!conn) {
1482                 err = cmd_complete(sk, index, MGMT_OP_UNPAIR_DEVICE, status,
1483                                                         &rp, sizeof(rp));
1484                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1485                 goto unlock;
1486         }
1487
1488         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1489                                                                 sizeof(*cp));
1490         if (!cmd) {
1491                 err = -ENOMEM;
1492                 goto unlock;
1493         }
1494
1495         put_unaligned_le16(conn->handle, &dc.handle);
1496         dc.reason = 0x13; /* Remote User Terminated Connection */
1497         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1498         if (err < 0)
1499                 mgmt_pending_remove(cmd);
1500
1501 unlock:
1502         if (err < 0)
1503                 err = cmd_complete(sk, index, MGMT_OP_UNPAIR_DEVICE, status,
1504                                                         &rp, sizeof(rp));
1505         hci_dev_unlock(hdev);
1506         hci_dev_put(hdev);
1507
1508         return err;
1509 }
1510
1511 static int disconnect(struct sock *sk, u16 index, void *data, u16 len)
1512 {
1513         struct hci_dev *hdev;
1514         struct mgmt_cp_disconnect *cp = data;
1515         struct hci_cp_disconnect dc;
1516         struct pending_cmd *cmd;
1517         struct hci_conn *conn;
1518         int err;
1519
1520         BT_DBG("");
1521
1522         if (len != sizeof(*cp))
1523                 return cmd_status(sk, index, MGMT_OP_DISCONNECT,
1524                                                 MGMT_STATUS_INVALID_PARAMS);
1525
1526         hdev = hci_dev_get(index);
1527         if (!hdev)
1528                 return cmd_status(sk, index, MGMT_OP_DISCONNECT,
1529                                                 MGMT_STATUS_INVALID_PARAMS);
1530
1531         hci_dev_lock(hdev);
1532
1533         if (!test_bit(HCI_UP, &hdev->flags)) {
1534                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1535                                                 MGMT_STATUS_NOT_POWERED);
1536                 goto failed;
1537         }
1538
1539         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1540                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1541                                                         MGMT_STATUS_BUSY);
1542                 goto failed;
1543         }
1544
1545         if (cp->addr.type == MGMT_ADDR_BREDR)
1546                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1547         else
1548                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1549
1550         if (!conn) {
1551                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1552                                                 MGMT_STATUS_NOT_CONNECTED);
1553                 goto failed;
1554         }
1555
1556         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1557         if (!cmd) {
1558                 err = -ENOMEM;
1559                 goto failed;
1560         }
1561
1562         put_unaligned_le16(conn->handle, &dc.handle);
1563         dc.reason = 0x13; /* Remote User Terminated Connection */
1564
1565         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1566         if (err < 0)
1567                 mgmt_pending_remove(cmd);
1568
1569 failed:
1570         hci_dev_unlock(hdev);
1571         hci_dev_put(hdev);
1572
1573         return err;
1574 }
1575
1576 static u8 link_to_mgmt(u8 link_type, u8 addr_type)
1577 {
1578         switch (link_type) {
1579         case LE_LINK:
1580                 switch (addr_type) {
1581                 case ADDR_LE_DEV_PUBLIC:
1582                         return MGMT_ADDR_LE_PUBLIC;
1583                 case ADDR_LE_DEV_RANDOM:
1584                         return MGMT_ADDR_LE_RANDOM;
1585                 default:
1586                         return MGMT_ADDR_INVALID;
1587                 }
1588         case ACL_LINK:
1589                 return MGMT_ADDR_BREDR;
1590         default:
1591                 return MGMT_ADDR_INVALID;
1592         }
1593 }
1594
1595 static int get_connections(struct sock *sk, u16 index)
1596 {
1597         struct mgmt_rp_get_connections *rp;
1598         struct hci_dev *hdev;
1599         struct hci_conn *c;
1600         size_t rp_len;
1601         u16 count;
1602         int i, err;
1603
1604         BT_DBG("");
1605
1606         hdev = hci_dev_get(index);
1607         if (!hdev)
1608                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS,
1609                                                 MGMT_STATUS_INVALID_PARAMS);
1610
1611         hci_dev_lock(hdev);
1612
1613         count = 0;
1614         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1615                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1616                         count++;
1617         }
1618
1619         rp_len = sizeof(*rp) + (count * sizeof(struct mgmt_addr_info));
1620         rp = kmalloc(rp_len, GFP_ATOMIC);
1621         if (!rp) {
1622                 err = -ENOMEM;
1623                 goto unlock;
1624         }
1625
1626         put_unaligned_le16(count, &rp->conn_count);
1627
1628         i = 0;
1629         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1630                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1631                         continue;
1632                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1633                 rp->addr[i].type = link_to_mgmt(c->type, c->dst_type);
1634                 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1635                         continue;
1636                 i++;
1637         }
1638
1639         /* Recalculate length in case of filtered SCO connections, etc */
1640         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1641
1642         err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, 0, rp, rp_len);
1643
1644 unlock:
1645         kfree(rp);
1646         hci_dev_unlock(hdev);
1647         hci_dev_put(hdev);
1648         return err;
1649 }
1650
1651 static int send_pin_code_neg_reply(struct sock *sk, u16 index,
1652                 struct hci_dev *hdev, struct mgmt_cp_pin_code_neg_reply *cp)
1653 {
1654         struct pending_cmd *cmd;
1655         int err;
1656
1657         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1658                                                                 sizeof(*cp));
1659         if (!cmd)
1660                 return -ENOMEM;
1661
1662         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1663                                 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1664         if (err < 0)
1665                 mgmt_pending_remove(cmd);
1666
1667         return err;
1668 }
1669
1670 static int pin_code_reply(struct sock *sk, u16 index, void *data, u16 len)
1671 {
1672         struct hci_dev *hdev;
1673         struct hci_conn *conn;
1674         struct mgmt_cp_pin_code_reply *cp = data;
1675         struct hci_cp_pin_code_reply reply;
1676         struct pending_cmd *cmd;
1677         int err;
1678
1679         BT_DBG("");
1680
1681         if (len != sizeof(*cp))
1682                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1683                                                 MGMT_STATUS_INVALID_PARAMS);
1684
1685         hdev = hci_dev_get(index);
1686         if (!hdev)
1687                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1688                                                 MGMT_STATUS_INVALID_PARAMS);
1689
1690         hci_dev_lock(hdev);
1691
1692         if (!hdev_is_powered(hdev)) {
1693                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1694                                                 MGMT_STATUS_NOT_POWERED);
1695                 goto failed;
1696         }
1697
1698         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1699         if (!conn) {
1700                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1701                                                 MGMT_STATUS_NOT_CONNECTED);
1702                 goto failed;
1703         }
1704
1705         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1706                 struct mgmt_cp_pin_code_neg_reply ncp;
1707
1708                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1709
1710                 BT_ERR("PIN code is not 16 bytes long");
1711
1712                 err = send_pin_code_neg_reply(sk, index, hdev, &ncp);
1713                 if (err >= 0)
1714                         err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1715                                                 MGMT_STATUS_INVALID_PARAMS);
1716
1717                 goto failed;
1718         }
1719
1720         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data,
1721                                                                         len);
1722         if (!cmd) {
1723                 err = -ENOMEM;
1724                 goto failed;
1725         }
1726
1727         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1728         reply.pin_len = cp->pin_len;
1729         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1730
1731         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1732         if (err < 0)
1733                 mgmt_pending_remove(cmd);
1734
1735 failed:
1736         hci_dev_unlock(hdev);
1737         hci_dev_put(hdev);
1738
1739         return err;
1740 }
1741
1742 static int pin_code_neg_reply(struct sock *sk, u16 index, void *data, u16 len)
1743 {
1744         struct hci_dev *hdev;
1745         struct mgmt_cp_pin_code_neg_reply *cp = data;
1746         int err;
1747
1748         BT_DBG("");
1749
1750         if (len != sizeof(*cp))
1751                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1752                                                 MGMT_STATUS_INVALID_PARAMS);
1753
1754         hdev = hci_dev_get(index);
1755         if (!hdev)
1756                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1757                                                 MGMT_STATUS_INVALID_PARAMS);
1758
1759         hci_dev_lock(hdev);
1760
1761         if (!hdev_is_powered(hdev)) {
1762                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1763                                                 MGMT_STATUS_NOT_POWERED);
1764                 goto failed;
1765         }
1766
1767         err = send_pin_code_neg_reply(sk, index, hdev, cp);
1768
1769 failed:
1770         hci_dev_unlock(hdev);
1771         hci_dev_put(hdev);
1772
1773         return err;
1774 }
1775
1776 static int set_io_capability(struct sock *sk, u16 index, void *data, u16 len)
1777 {
1778         struct hci_dev *hdev;
1779         struct mgmt_cp_set_io_capability *cp = data;
1780
1781         BT_DBG("");
1782
1783         if (len != sizeof(*cp))
1784                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
1785                                                 MGMT_STATUS_INVALID_PARAMS);
1786
1787         hdev = hci_dev_get(index);
1788         if (!hdev)
1789                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
1790                                                 MGMT_STATUS_INVALID_PARAMS);
1791
1792         hci_dev_lock(hdev);
1793
1794         hdev->io_capability = cp->io_capability;
1795
1796         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1797                                                         hdev->io_capability);
1798
1799         hci_dev_unlock(hdev);
1800         hci_dev_put(hdev);
1801
1802         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, 0, NULL, 0);
1803 }
1804
1805 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1806 {
1807         struct hci_dev *hdev = conn->hdev;
1808         struct pending_cmd *cmd;
1809
1810         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1811                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1812                         continue;
1813
1814                 if (cmd->user_data != conn)
1815                         continue;
1816
1817                 return cmd;
1818         }
1819
1820         return NULL;
1821 }
1822
1823 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1824 {
1825         struct mgmt_rp_pair_device rp;
1826         struct hci_conn *conn = cmd->user_data;
1827
1828         bacpy(&rp.addr.bdaddr, &conn->dst);
1829         rp.addr.type = link_to_mgmt(conn->type, conn->dst_type);
1830
1831         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1832                                                         &rp, sizeof(rp));
1833
1834         /* So we don't get further callbacks for this connection */
1835         conn->connect_cfm_cb = NULL;
1836         conn->security_cfm_cb = NULL;
1837         conn->disconn_cfm_cb = NULL;
1838
1839         hci_conn_put(conn);
1840
1841         mgmt_pending_remove(cmd);
1842 }
1843
1844 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1845 {
1846         struct pending_cmd *cmd;
1847
1848         BT_DBG("status %u", status);
1849
1850         cmd = find_pairing(conn);
1851         if (!cmd)
1852                 BT_DBG("Unable to find a pending command");
1853         else
1854                 pairing_complete(cmd, mgmt_status(status));
1855 }
1856
1857 static int pair_device(struct sock *sk, u16 index, void *data, u16 len)
1858 {
1859         struct hci_dev *hdev;
1860         struct mgmt_cp_pair_device *cp = data;
1861         struct mgmt_rp_pair_device rp;
1862         struct pending_cmd *cmd;
1863         u8 sec_level, auth_type;
1864         struct hci_conn *conn;
1865         int err;
1866
1867         BT_DBG("");
1868
1869         if (len != sizeof(*cp))
1870                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
1871                                                 MGMT_STATUS_INVALID_PARAMS);
1872
1873         hdev = hci_dev_get(index);
1874         if (!hdev)
1875                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
1876                                                 MGMT_STATUS_INVALID_PARAMS);
1877
1878         hci_dev_lock(hdev);
1879
1880         sec_level = BT_SECURITY_MEDIUM;
1881         if (cp->io_cap == 0x03)
1882                 auth_type = HCI_AT_DEDICATED_BONDING;
1883         else
1884                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1885
1886         if (cp->addr.type == MGMT_ADDR_BREDR)
1887                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr, sec_level,
1888                                                                 auth_type);
1889         else
1890                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr, sec_level,
1891                                                                 auth_type);
1892
1893         memset(&rp, 0, sizeof(rp));
1894         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1895         rp.addr.type = cp->addr.type;
1896
1897         if (IS_ERR(conn)) {
1898                 err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
1899                                                 MGMT_STATUS_CONNECT_FAILED,
1900                                                 &rp, sizeof(rp));
1901                 goto unlock;
1902         }
1903
1904         if (conn->connect_cfm_cb) {
1905                 hci_conn_put(conn);
1906                 err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
1907                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
1908                 goto unlock;
1909         }
1910
1911         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1912         if (!cmd) {
1913                 err = -ENOMEM;
1914                 hci_conn_put(conn);
1915                 goto unlock;
1916         }
1917
1918         /* For LE, just connecting isn't a proof that the pairing finished */
1919         if (cp->addr.type == MGMT_ADDR_BREDR)
1920                 conn->connect_cfm_cb = pairing_complete_cb;
1921
1922         conn->security_cfm_cb = pairing_complete_cb;
1923         conn->disconn_cfm_cb = pairing_complete_cb;
1924         conn->io_capability = cp->io_cap;
1925         cmd->user_data = conn;
1926
1927         if (conn->state == BT_CONNECTED &&
1928                                 hci_conn_security(conn, sec_level, auth_type))
1929                 pairing_complete(cmd, 0);
1930
1931         err = 0;
1932
1933 unlock:
1934         hci_dev_unlock(hdev);
1935         hci_dev_put(hdev);
1936
1937         return err;
1938 }
1939
1940 static int cancel_pair_device(struct sock *sk, u16 index,
1941                                                 unsigned char *data, u16 len)
1942 {
1943         struct mgmt_addr_info *addr = (void *) data;
1944         struct hci_dev *hdev;
1945         struct pending_cmd *cmd;
1946         struct hci_conn *conn;
1947         int err;
1948
1949         BT_DBG("");
1950
1951         if (len != sizeof(*addr))
1952                 return cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
1953                                                 MGMT_STATUS_INVALID_PARAMS);
1954
1955         hdev = hci_dev_get(index);
1956         if (!hdev)
1957                 return cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
1958                                                 MGMT_STATUS_INVALID_PARAMS);
1959
1960         hci_dev_lock(hdev);
1961
1962         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
1963         if (!cmd) {
1964                 err = cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
1965                                                 MGMT_STATUS_INVALID_PARAMS);
1966                 goto unlock;
1967         }
1968
1969         conn = cmd->user_data;
1970
1971         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
1972                 err = cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
1973                                                 MGMT_STATUS_INVALID_PARAMS);
1974                 goto unlock;
1975         }
1976
1977         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
1978
1979         err = cmd_complete(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE, 0, addr,
1980                                                                 sizeof(*addr));
1981 unlock:
1982         hci_dev_unlock(hdev);
1983         hci_dev_put(hdev);
1984
1985         return err;
1986 }
1987
1988 static int user_pairing_resp(struct sock *sk, u16 index, bdaddr_t *bdaddr,
1989                                         u8 type, u16 mgmt_op, u16 hci_op,
1990                                         __le32 passkey)
1991 {
1992         struct pending_cmd *cmd;
1993         struct hci_dev *hdev;
1994         struct hci_conn *conn;
1995         int err;
1996
1997         hdev = hci_dev_get(index);
1998         if (!hdev)
1999                 return cmd_status(sk, index, mgmt_op,
2000                                                 MGMT_STATUS_INVALID_PARAMS);
2001
2002         hci_dev_lock(hdev);
2003
2004         if (!hdev_is_powered(hdev)) {
2005                 err = cmd_status(sk, index, mgmt_op, MGMT_STATUS_NOT_POWERED);
2006                 goto done;
2007         }
2008
2009         if (type == MGMT_ADDR_BREDR)
2010                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2011         else
2012                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2013
2014         if (!conn) {
2015                 err = cmd_status(sk, index, mgmt_op,
2016                                                 MGMT_STATUS_NOT_CONNECTED);
2017                 goto done;
2018         }
2019
2020         if (type == MGMT_ADDR_LE_PUBLIC || type == MGMT_ADDR_LE_RANDOM) {
2021                 /* Continue with pairing via SMP */
2022                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2023
2024                 if (!err)
2025                         err = cmd_status(sk, index, mgmt_op,
2026                                                         MGMT_STATUS_SUCCESS);
2027                 else
2028                         err = cmd_status(sk, index, mgmt_op,
2029                                                         MGMT_STATUS_FAILED);
2030
2031                 goto done;
2032         }
2033
2034         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2035         if (!cmd) {
2036                 err = -ENOMEM;
2037                 goto done;
2038         }
2039
2040         /* Continue with pairing via HCI */
2041         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2042                 struct hci_cp_user_passkey_reply cp;
2043
2044                 bacpy(&cp.bdaddr, bdaddr);
2045                 cp.passkey = passkey;
2046                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2047         } else
2048                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2049
2050         if (err < 0)
2051                 mgmt_pending_remove(cmd);
2052
2053 done:
2054         hci_dev_unlock(hdev);
2055         hci_dev_put(hdev);
2056
2057         return err;
2058 }
2059
2060 static int user_confirm_reply(struct sock *sk, u16 index, void *data, u16 len)
2061 {
2062         struct mgmt_cp_user_confirm_reply *cp = data;
2063
2064         BT_DBG("");
2065
2066         if (len != sizeof(*cp))
2067                 return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_REPLY,
2068                                                 MGMT_STATUS_INVALID_PARAMS);
2069
2070         return user_pairing_resp(sk, index, &cp->addr.bdaddr, cp->addr.type,
2071                                                 MGMT_OP_USER_CONFIRM_REPLY,
2072                                                 HCI_OP_USER_CONFIRM_REPLY, 0);
2073 }
2074
2075 static int user_confirm_neg_reply(struct sock *sk, u16 index, void *data,
2076                                                                         u16 len)
2077 {
2078         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2079
2080         BT_DBG("");
2081
2082         if (len != sizeof(*cp))
2083                 return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_NEG_REPLY,
2084                                                 MGMT_STATUS_INVALID_PARAMS);
2085
2086         return user_pairing_resp(sk, index, &cp->addr.bdaddr, cp->addr.type,
2087                                         MGMT_OP_USER_CONFIRM_NEG_REPLY,
2088                                         HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2089 }
2090
2091 static int user_passkey_reply(struct sock *sk, u16 index, void *data, u16 len)
2092 {
2093         struct mgmt_cp_user_passkey_reply *cp = data;
2094
2095         BT_DBG("");
2096
2097         if (len != sizeof(*cp))
2098                 return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_REPLY,
2099                                                                         EINVAL);
2100
2101         return user_pairing_resp(sk, index, &cp->addr.bdaddr, cp->addr.type,
2102                                                 MGMT_OP_USER_PASSKEY_REPLY,
2103                                                 HCI_OP_USER_PASSKEY_REPLY,
2104                                                 cp->passkey);
2105 }
2106
2107 static int user_passkey_neg_reply(struct sock *sk, u16 index, void *data,
2108                                                                         u16 len)
2109 {
2110         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2111
2112         BT_DBG("");
2113
2114         if (len != sizeof(*cp))
2115                 return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_NEG_REPLY,
2116                                                                         EINVAL);
2117
2118         return user_pairing_resp(sk, index, &cp->addr.bdaddr, cp->addr.type,
2119                                         MGMT_OP_USER_PASSKEY_NEG_REPLY,
2120                                         HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2121 }
2122
2123 static int set_local_name(struct sock *sk, u16 index, void *data,
2124                                                                 u16 len)
2125 {
2126         struct mgmt_cp_set_local_name *mgmt_cp = data;
2127         struct hci_cp_write_local_name hci_cp;
2128         struct hci_dev *hdev;
2129         struct pending_cmd *cmd;
2130         int err;
2131
2132         BT_DBG("");
2133
2134         if (len != sizeof(*mgmt_cp))
2135                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
2136                                                 MGMT_STATUS_INVALID_PARAMS);
2137
2138         hdev = hci_dev_get(index);
2139         if (!hdev)
2140                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
2141                                                 MGMT_STATUS_INVALID_PARAMS);
2142
2143         hci_dev_lock(hdev);
2144
2145         if (!hdev_is_powered(hdev)) {
2146                 err = cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
2147                                                 MGMT_STATUS_NOT_POWERED);
2148                 goto failed;
2149         }
2150
2151         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data,
2152                                                                         len);
2153         if (!cmd) {
2154                 err = -ENOMEM;
2155                 goto failed;
2156         }
2157
2158         memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
2159         err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
2160                                                                 &hci_cp);
2161         if (err < 0)
2162                 mgmt_pending_remove(cmd);
2163
2164 failed:
2165         hci_dev_unlock(hdev);
2166         hci_dev_put(hdev);
2167
2168         return err;
2169 }
2170
2171 static int read_local_oob_data(struct sock *sk, u16 index)
2172 {
2173         struct hci_dev *hdev;
2174         struct pending_cmd *cmd;
2175         int err;
2176
2177         BT_DBG("hci%u", index);
2178
2179         hdev = hci_dev_get(index);
2180         if (!hdev)
2181                 return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
2182                                                 MGMT_STATUS_INVALID_PARAMS);
2183
2184         hci_dev_lock(hdev);
2185
2186         if (!hdev_is_powered(hdev)) {
2187                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
2188                                                 MGMT_STATUS_NOT_POWERED);
2189                 goto unlock;
2190         }
2191
2192         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
2193                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
2194                                                 MGMT_STATUS_NOT_SUPPORTED);
2195                 goto unlock;
2196         }
2197
2198         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2199                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
2200                                                         MGMT_STATUS_BUSY);
2201                 goto unlock;
2202         }
2203
2204         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2205         if (!cmd) {
2206                 err = -ENOMEM;
2207                 goto unlock;
2208         }
2209
2210         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2211         if (err < 0)
2212                 mgmt_pending_remove(cmd);
2213
2214 unlock:
2215         hci_dev_unlock(hdev);
2216         hci_dev_put(hdev);
2217
2218         return err;
2219 }
2220
2221 static int add_remote_oob_data(struct sock *sk, u16 index, void *data,
2222                                                                 u16 len)
2223 {
2224         struct hci_dev *hdev;
2225         struct mgmt_cp_add_remote_oob_data *cp = data;
2226         u8 status;
2227         int err;
2228
2229         BT_DBG("hci%u ", index);
2230
2231         if (len != sizeof(*cp))
2232                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
2233                                                 MGMT_STATUS_INVALID_PARAMS);
2234
2235         hdev = hci_dev_get(index);
2236         if (!hdev)
2237                 return cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
2238                                                 MGMT_STATUS_INVALID_PARAMS,
2239                                                 &cp->addr, sizeof(cp->addr));
2240
2241         hci_dev_lock(hdev);
2242
2243         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2244                                                                 cp->randomizer);
2245         if (err < 0)
2246                 status = MGMT_STATUS_FAILED;
2247         else
2248                 status = 0;
2249
2250         err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2251                                                 &cp->addr, sizeof(cp->addr));
2252
2253         hci_dev_unlock(hdev);
2254         hci_dev_put(hdev);
2255
2256         return err;
2257 }
2258
2259 static int remove_remote_oob_data(struct sock *sk, u16 index,
2260                                                 void *data, u16 len)
2261 {
2262         struct hci_dev *hdev;
2263         struct mgmt_cp_remove_remote_oob_data *cp = data;
2264         u8 status;
2265         int err;
2266
2267         BT_DBG("hci%u ", index);
2268
2269         if (len != sizeof(*cp))
2270                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2271                                                 MGMT_STATUS_INVALID_PARAMS);
2272
2273         hdev = hci_dev_get(index);
2274         if (!hdev)
2275                 return cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2276                                                 MGMT_STATUS_INVALID_PARAMS,
2277                                                 &cp->addr, sizeof(cp->addr));
2278
2279         hci_dev_lock(hdev);
2280
2281         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2282         if (err < 0)
2283                 status = MGMT_STATUS_INVALID_PARAMS;
2284         else
2285                 status = 0;
2286
2287         err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA, status,
2288                                                 &cp->addr, sizeof(cp->addr));
2289
2290         hci_dev_unlock(hdev);
2291         hci_dev_put(hdev);
2292
2293         return err;
2294 }
2295
2296 static int discovery(struct hci_dev *hdev)
2297 {
2298         int err;
2299
2300         if (lmp_host_le_capable(hdev)) {
2301                 if (lmp_bredr_capable(hdev)) {
2302                         err = hci_le_scan(hdev, LE_SCAN_TYPE,
2303                                                 LE_SCAN_INT, LE_SCAN_WIN,
2304                                                 LE_SCAN_TIMEOUT_BREDR_LE);
2305                 } else {
2306                         hdev->discovery.type = DISCOV_TYPE_LE;
2307                         err = hci_le_scan(hdev, LE_SCAN_TYPE,
2308                                                 LE_SCAN_INT, LE_SCAN_WIN,
2309                                                 LE_SCAN_TIMEOUT_LE_ONLY);
2310                 }
2311         } else {
2312                 hdev->discovery.type = DISCOV_TYPE_BREDR;
2313                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2314         }
2315
2316         return err;
2317 }
2318
2319 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2320 {
2321         int err;
2322
2323         BT_DBG("%s", hdev->name);
2324
2325         hci_dev_lock(hdev);
2326
2327         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2328         if (err < 0)
2329                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2330
2331         hci_dev_unlock(hdev);
2332
2333         return err;
2334 }
2335
2336 static int start_discovery(struct sock *sk, u16 index,
2337                                                 void *data, u16 len)
2338 {
2339         struct mgmt_cp_start_discovery *cp = data;
2340         struct pending_cmd *cmd;
2341         struct hci_dev *hdev;
2342         int err;
2343
2344         BT_DBG("hci%u", index);
2345
2346         if (len != sizeof(*cp))
2347                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
2348                                                 MGMT_STATUS_INVALID_PARAMS);
2349
2350         hdev = hci_dev_get(index);
2351         if (!hdev)
2352                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
2353                                                 MGMT_STATUS_INVALID_PARAMS);
2354
2355         hci_dev_lock(hdev);
2356
2357         if (!hdev_is_powered(hdev)) {
2358                 err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
2359                                                 MGMT_STATUS_NOT_POWERED);
2360                 goto failed;
2361         }
2362
2363         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2364                 err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
2365                                                 MGMT_STATUS_BUSY);
2366                 goto failed;
2367         }
2368
2369         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2370         if (!cmd) {
2371                 err = -ENOMEM;
2372                 goto failed;
2373         }
2374
2375         hdev->discovery.type = cp->type;
2376
2377         switch (hdev->discovery.type) {
2378         case DISCOV_TYPE_BREDR:
2379                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2380                 break;
2381
2382         case DISCOV_TYPE_LE:
2383                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2384                                         LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2385                 break;
2386
2387         case DISCOV_TYPE_INTERLEAVED:
2388                 err = discovery(hdev);
2389                 break;
2390
2391         default:
2392                 err = -EINVAL;
2393         }
2394
2395         if (err < 0)
2396                 mgmt_pending_remove(cmd);
2397         else
2398                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2399
2400 failed:
2401         hci_dev_unlock(hdev);
2402         hci_dev_put(hdev);
2403
2404         return err;
2405 }
2406
2407 static int stop_discovery(struct sock *sk, u16 index, void *data, u16 len)
2408 {
2409         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2410         struct hci_dev *hdev;
2411         struct pending_cmd *cmd;
2412         struct hci_cp_remote_name_req_cancel cp;
2413         struct inquiry_entry *e;
2414         int err;
2415
2416         BT_DBG("hci%u", index);
2417
2418         if (len != sizeof(*mgmt_cp))
2419                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY,
2420                                                 MGMT_STATUS_INVALID_PARAMS);
2421
2422         hdev = hci_dev_get(index);
2423         if (!hdev)
2424                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY,
2425                                                 MGMT_STATUS_INVALID_PARAMS);
2426
2427         hci_dev_lock(hdev);
2428
2429         if (!hci_discovery_active(hdev)) {
2430                 err = cmd_complete(sk, index, MGMT_OP_STOP_DISCOVERY,
2431                                         MGMT_STATUS_REJECTED,
2432                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
2433                 goto unlock;
2434         }
2435
2436         if (hdev->discovery.type != mgmt_cp->type) {
2437                 err = cmd_complete(sk, index, MGMT_OP_STOP_DISCOVERY,
2438                                         MGMT_STATUS_INVALID_PARAMS,
2439                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
2440                 goto unlock;
2441         }
2442
2443         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2444         if (!cmd) {
2445                 err = -ENOMEM;
2446                 goto unlock;
2447         }
2448
2449         if (hdev->discovery.state == DISCOVERY_FINDING) {
2450                 err = hci_cancel_inquiry(hdev);
2451                 if (err < 0)
2452                         mgmt_pending_remove(cmd);
2453                 else
2454                         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2455                 goto unlock;
2456         }
2457
2458         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_PENDING);
2459         if (!e) {
2460                 mgmt_pending_remove(cmd);
2461                 err = cmd_complete(sk, index, MGMT_OP_STOP_DISCOVERY, 0,
2462                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
2463                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2464                 goto unlock;
2465         }
2466
2467         bacpy(&cp.bdaddr, &e->data.bdaddr);
2468         err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2469                                                         sizeof(cp), &cp);
2470         if (err < 0)
2471                 mgmt_pending_remove(cmd);
2472         else
2473                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2474
2475 unlock:
2476         hci_dev_unlock(hdev);
2477         hci_dev_put(hdev);
2478
2479         return err;
2480 }
2481
2482 static int confirm_name(struct sock *sk, u16 index, void *data, u16 len)
2483 {
2484         struct mgmt_cp_confirm_name *cp = data;
2485         struct inquiry_entry *e;
2486         struct hci_dev *hdev;
2487         int err;
2488
2489         BT_DBG("hci%u", index);
2490
2491         if (len != sizeof(*cp))
2492                 return cmd_status(sk, index, MGMT_OP_CONFIRM_NAME,
2493                                 MGMT_STATUS_INVALID_PARAMS);
2494
2495         hdev = hci_dev_get(index);
2496         if (!hdev)
2497                 return cmd_status(sk, index, MGMT_OP_CONFIRM_NAME,
2498                                 MGMT_STATUS_INVALID_PARAMS);
2499
2500         hci_dev_lock(hdev);
2501
2502         if (!hci_discovery_active(hdev)) {
2503                 err = cmd_status(sk, index, MGMT_OP_CONFIRM_NAME,
2504                                                         MGMT_STATUS_FAILED);
2505                 goto failed;
2506         }
2507
2508         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2509         if (!e) {
2510                 err = cmd_status (sk, index, MGMT_OP_CONFIRM_NAME,
2511                                 MGMT_STATUS_INVALID_PARAMS);
2512                 goto failed;
2513         }
2514
2515         if (cp->name_known) {
2516                 e->name_state = NAME_KNOWN;
2517                 list_del(&e->list);
2518         } else {
2519                 e->name_state = NAME_NEEDED;
2520                 hci_inquiry_cache_update_resolve(hdev, e);
2521         }
2522
2523         err = 0;
2524
2525 failed:
2526         hci_dev_unlock(hdev);
2527
2528         return err;
2529 }
2530
2531 static int block_device(struct sock *sk, u16 index, void *data, u16 len)
2532 {
2533         struct hci_dev *hdev;
2534         struct mgmt_cp_block_device *cp = data;
2535         u8 status;
2536         int err;
2537
2538         BT_DBG("hci%u", index);
2539
2540         if (len != sizeof(*cp))
2541                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
2542                                                 MGMT_STATUS_INVALID_PARAMS);
2543
2544         hdev = hci_dev_get(index);
2545         if (!hdev)
2546                 return cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
2547                                                 MGMT_STATUS_INVALID_PARAMS,
2548                                                 &cp->addr, sizeof(cp->addr));
2549
2550         hci_dev_lock(hdev);
2551
2552         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2553         if (err < 0)
2554                 status = MGMT_STATUS_FAILED;
2555         else
2556                 status = 0;
2557
2558         err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE, status,
2559                                                 &cp->addr, sizeof(cp->addr));
2560
2561         hci_dev_unlock(hdev);
2562         hci_dev_put(hdev);
2563
2564         return err;
2565 }
2566
2567 static int unblock_device(struct sock *sk, u16 index, void *data, u16 len)
2568 {
2569         struct hci_dev *hdev;
2570         struct mgmt_cp_unblock_device *cp = data;
2571         u8 status;
2572         int err;
2573
2574         BT_DBG("hci%u", index);
2575
2576         if (len != sizeof(*cp))
2577                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2578                                                 MGMT_STATUS_INVALID_PARAMS);
2579
2580         hdev = hci_dev_get(index);
2581         if (!hdev)
2582                 return cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2583                                                 MGMT_STATUS_INVALID_PARAMS,
2584                                                 &cp->addr, sizeof(cp->addr));
2585
2586         hci_dev_lock(hdev);
2587
2588         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2589         if (err < 0)
2590                 status = MGMT_STATUS_INVALID_PARAMS;
2591         else
2592                 status = 0;
2593
2594         err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE, status,
2595                                                 &cp->addr, sizeof(cp->addr));
2596
2597         hci_dev_unlock(hdev);
2598         hci_dev_put(hdev);
2599
2600         return err;
2601 }
2602
2603 static int set_fast_connectable(struct sock *sk, u16 index,
2604                                         void *data, u16 len)
2605 {
2606         struct hci_dev *hdev;
2607         struct mgmt_mode *cp = data;
2608         struct hci_cp_write_page_scan_activity acp;
2609         u8 type;
2610         int err;
2611
2612         BT_DBG("hci%u", index);
2613
2614         if (len != sizeof(*cp))
2615                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2616                                                 MGMT_STATUS_INVALID_PARAMS);
2617
2618         hdev = hci_dev_get(index);
2619         if (!hdev)
2620                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2621                                                 MGMT_STATUS_INVALID_PARAMS);
2622         if (!hdev_is_powered(hdev))
2623                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2624                                                 MGMT_STATUS_NOT_POWERED);
2625
2626         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2627                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2628                                                         MGMT_STATUS_REJECTED);
2629
2630         hci_dev_lock(hdev);
2631
2632         if (cp->val) {
2633                 type = PAGE_SCAN_TYPE_INTERLACED;
2634                 acp.interval = 0x0024;  /* 22.5 msec page scan interval */
2635         } else {
2636                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2637                 acp.interval = 0x0800;  /* default 1.28 sec page scan */
2638         }
2639
2640         acp.window = 0x0012;    /* default 11.25 msec page scan window */
2641
2642         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
2643                                                 sizeof(acp), &acp);
2644         if (err < 0) {
2645                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2646                                                         MGMT_STATUS_FAILED);
2647                 goto done;
2648         }
2649
2650         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2651         if (err < 0) {
2652                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2653                                                         MGMT_STATUS_FAILED);
2654                 goto done;
2655         }
2656
2657         err = cmd_complete(sk, index, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2658                                                                 NULL, 0);
2659 done:
2660         hci_dev_unlock(hdev);
2661         hci_dev_put(hdev);
2662
2663         return err;
2664 }
2665
2666 static int load_long_term_keys(struct sock *sk, u16 index,
2667                                         void *cp_data, u16 len)
2668 {
2669         struct hci_dev *hdev;
2670         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2671         u16 key_count, expected_len;
2672         int i;
2673
2674         if (len < sizeof(*cp))
2675                 return cmd_status(sk, index, MGMT_OP_LOAD_LONG_TERM_KEYS,
2676                                                                 EINVAL);
2677
2678         key_count = get_unaligned_le16(&cp->key_count);
2679
2680         expected_len = sizeof(*cp) + key_count *
2681                                         sizeof(struct mgmt_ltk_info);
2682         if (expected_len != len) {
2683                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2684                                                         len, expected_len);
2685                 return cmd_status(sk, index, MGMT_OP_LOAD_LONG_TERM_KEYS,
2686                                                                 EINVAL);
2687         }
2688
2689         hdev = hci_dev_get(index);
2690         if (!hdev)
2691                 return cmd_status(sk, index, MGMT_OP_LOAD_LONG_TERM_KEYS,
2692                                                                 ENODEV);
2693
2694         BT_DBG("hci%u key_count %u", index, key_count);
2695
2696         hci_dev_lock(hdev);
2697
2698         hci_smp_ltks_clear(hdev);
2699
2700         for (i = 0; i < key_count; i++) {
2701                 struct mgmt_ltk_info *key = &cp->keys[i];
2702                 u8 type;
2703
2704                 if (key->master)
2705                         type = HCI_SMP_LTK;
2706                 else
2707                         type = HCI_SMP_LTK_SLAVE;
2708
2709                 hci_add_ltk(hdev, &key->addr.bdaddr, key->addr.type,
2710                                         type, 0, key->authenticated, key->val,
2711                                         key->enc_size, key->ediv, key->rand);
2712         }
2713
2714         hci_dev_unlock(hdev);
2715         hci_dev_put(hdev);
2716
2717         return 0;
2718 }
2719
2720 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2721 {
2722         void *buf;
2723         u8 *cp;
2724         struct mgmt_hdr *hdr;
2725         u16 opcode, index, len;
2726         int err;
2727
2728         BT_DBG("got %zu bytes", msglen);
2729
2730         if (msglen < sizeof(*hdr))
2731                 return -EINVAL;
2732
2733         buf = kmalloc(msglen, GFP_KERNEL);
2734         if (!buf)
2735                 return -ENOMEM;
2736
2737         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2738                 err = -EFAULT;
2739                 goto done;
2740         }
2741
2742         hdr = buf;
2743         opcode = get_unaligned_le16(&hdr->opcode);
2744         index = get_unaligned_le16(&hdr->index);
2745         len = get_unaligned_le16(&hdr->len);
2746
2747         if (len != msglen - sizeof(*hdr)) {
2748                 err = -EINVAL;
2749                 goto done;
2750         }
2751
2752         cp = buf + sizeof(*hdr);
2753
2754         switch (opcode) {
2755         case MGMT_OP_READ_VERSION:
2756                 err = read_version(sk);
2757                 break;
2758         case MGMT_OP_READ_COMMANDS:
2759                 err = read_commands(sk);
2760                 break;
2761         case MGMT_OP_READ_INDEX_LIST:
2762                 err = read_index_list(sk);
2763                 break;
2764         case MGMT_OP_READ_INFO:
2765                 err = read_controller_info(sk, index);
2766                 break;
2767         case MGMT_OP_SET_POWERED:
2768                 err = set_powered(sk, index, cp, len);
2769                 break;
2770         case MGMT_OP_SET_DISCOVERABLE:
2771                 err = set_discoverable(sk, index, cp, len);
2772                 break;
2773         case MGMT_OP_SET_CONNECTABLE:
2774                 err = set_connectable(sk, index, cp, len);
2775                 break;
2776         case MGMT_OP_SET_FAST_CONNECTABLE:
2777                 err = set_fast_connectable(sk, index, cp, len);
2778                 break;
2779         case MGMT_OP_SET_PAIRABLE:
2780                 err = set_pairable(sk, index, cp, len);
2781                 break;
2782         case MGMT_OP_SET_LINK_SECURITY:
2783                 err = set_link_security(sk, index, cp, len);
2784                 break;
2785         case MGMT_OP_SET_SSP:
2786                 err = set_ssp(sk, index, cp, len);
2787                 break;
2788         case MGMT_OP_SET_HS:
2789                 err = set_hs(sk, index, cp, len);
2790                 break;
2791         case MGMT_OP_ADD_UUID:
2792                 err = add_uuid(sk, index, cp, len);
2793                 break;
2794         case MGMT_OP_REMOVE_UUID:
2795                 err = remove_uuid(sk, index, cp, len);
2796                 break;
2797         case MGMT_OP_SET_DEV_CLASS:
2798                 err = set_dev_class(sk, index, cp, len);
2799                 break;
2800         case MGMT_OP_LOAD_LINK_KEYS:
2801                 err = load_link_keys(sk, index, cp, len);
2802                 break;
2803         case MGMT_OP_DISCONNECT:
2804                 err = disconnect(sk, index, cp, len);
2805                 break;
2806         case MGMT_OP_GET_CONNECTIONS:
2807                 err = get_connections(sk, index);
2808                 break;
2809         case MGMT_OP_PIN_CODE_REPLY:
2810                 err = pin_code_reply(sk, index, cp, len);
2811                 break;
2812         case MGMT_OP_PIN_CODE_NEG_REPLY:
2813                 err = pin_code_neg_reply(sk, index, cp, len);
2814                 break;
2815         case MGMT_OP_SET_IO_CAPABILITY:
2816                 err = set_io_capability(sk, index, cp, len);
2817                 break;
2818         case MGMT_OP_PAIR_DEVICE:
2819                 err = pair_device(sk, index, cp, len);
2820                 break;
2821         case MGMT_OP_CANCEL_PAIR_DEVICE:
2822                 err = cancel_pair_device(sk, index, buf + sizeof(*hdr), len);
2823                 break;
2824         case MGMT_OP_UNPAIR_DEVICE:
2825                 err = unpair_device(sk, index, cp, len);
2826                 break;
2827         case MGMT_OP_USER_CONFIRM_REPLY:
2828                 err = user_confirm_reply(sk, index, cp, len);
2829                 break;
2830         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
2831                 err = user_confirm_neg_reply(sk, index, cp, len);
2832                 break;
2833         case MGMT_OP_USER_PASSKEY_REPLY:
2834                 err = user_passkey_reply(sk, index, cp, len);
2835                 break;
2836         case MGMT_OP_USER_PASSKEY_NEG_REPLY:
2837                 err = user_passkey_neg_reply(sk, index, cp, len);
2838                 break;
2839         case MGMT_OP_SET_LOCAL_NAME:
2840                 err = set_local_name(sk, index, cp, len);
2841                 break;
2842         case MGMT_OP_READ_LOCAL_OOB_DATA:
2843                 err = read_local_oob_data(sk, index);
2844                 break;
2845         case MGMT_OP_ADD_REMOTE_OOB_DATA:
2846                 err = add_remote_oob_data(sk, index, cp, len);
2847                 break;
2848         case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
2849                 err = remove_remote_oob_data(sk, index, cp, len);
2850                 break;
2851         case MGMT_OP_START_DISCOVERY:
2852                 err = start_discovery(sk, index, cp, len);
2853                 break;
2854         case MGMT_OP_STOP_DISCOVERY:
2855                 err = stop_discovery(sk, index, cp, len);
2856                 break;
2857         case MGMT_OP_CONFIRM_NAME:
2858                 err = confirm_name(sk, index, cp, len);
2859                 break;
2860         case MGMT_OP_BLOCK_DEVICE:
2861                 err = block_device(sk, index, cp, len);
2862                 break;
2863         case MGMT_OP_UNBLOCK_DEVICE:
2864                 err = unblock_device(sk, index, cp, len);
2865                 break;
2866         case MGMT_OP_LOAD_LONG_TERM_KEYS:
2867                 err = load_long_term_keys(sk, index, cp, len);
2868                 break;
2869         default:
2870                 BT_DBG("Unknown op %u", opcode);
2871                 err = cmd_status(sk, index, opcode,
2872                                                 MGMT_STATUS_UNKNOWN_COMMAND);
2873                 break;
2874         }
2875
2876         if (err < 0)
2877                 goto done;
2878
2879         err = msglen;
2880
2881 done:
2882         kfree(buf);
2883         return err;
2884 }
2885
2886 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2887 {
2888         u8 *status = data;
2889
2890         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2891         mgmt_pending_remove(cmd);
2892 }
2893
2894 int mgmt_index_added(struct hci_dev *hdev)
2895 {
2896         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2897 }
2898
2899 int mgmt_index_removed(struct hci_dev *hdev)
2900 {
2901         u8 status = ENODEV;
2902
2903         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2904
2905         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2906 }
2907
2908 struct cmd_lookup {
2909         struct sock *sk;
2910         struct hci_dev *hdev;
2911 };
2912
2913 static void settings_rsp(struct pending_cmd *cmd, void *data)
2914 {
2915         struct cmd_lookup *match = data;
2916
2917         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2918
2919         list_del(&cmd->list);
2920
2921         if (match->sk == NULL) {
2922                 match->sk = cmd->sk;
2923                 sock_hold(match->sk);
2924         }
2925
2926         mgmt_pending_free(cmd);
2927 }
2928
2929 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2930 {
2931         struct cmd_lookup match = { NULL, hdev };
2932         int err;
2933
2934         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2935                 return 0;
2936
2937         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2938
2939         if (powered) {
2940                 u8 scan = 0;
2941
2942                 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2943                         scan |= SCAN_PAGE;
2944                 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2945                         scan |= SCAN_INQUIRY;
2946
2947                 if (scan)
2948                         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2949         } else {
2950                 u8 status = ENETDOWN;
2951                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2952         }
2953
2954         err = new_settings(hdev, match.sk);
2955
2956         if (match.sk)
2957                 sock_put(match.sk);
2958
2959         return err;
2960 }
2961
2962 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2963 {
2964         struct cmd_lookup match = { NULL, hdev };
2965         bool changed = false;
2966         int err = 0;
2967
2968         if (discoverable) {
2969                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2970                         changed = true;
2971         } else {
2972                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2973                         changed = true;
2974         }
2975
2976         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
2977                                                                 &match);
2978
2979         if (changed)
2980                 err = new_settings(hdev, match.sk);
2981
2982         if (match.sk)
2983                 sock_put(match.sk);
2984
2985         return err;
2986 }
2987
2988 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2989 {
2990         struct cmd_lookup match = { NULL, hdev };
2991         bool changed = false;
2992         int err = 0;
2993
2994         if (connectable) {
2995                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2996                         changed = true;
2997         } else {
2998                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2999                         changed = true;
3000         }
3001
3002         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
3003                                                                 &match);
3004
3005         if (changed)
3006                 err = new_settings(hdev, match.sk);
3007
3008         if (match.sk)
3009                 sock_put(match.sk);
3010
3011         return err;
3012 }
3013
3014 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3015 {
3016         u8 mgmt_err = mgmt_status(status);
3017
3018         if (scan & SCAN_PAGE)
3019                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3020                                                 cmd_status_rsp, &mgmt_err);
3021
3022         if (scan & SCAN_INQUIRY)
3023                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3024                                                 cmd_status_rsp, &mgmt_err);
3025
3026         return 0;
3027 }
3028
3029 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3030                                                                 u8 persistent)
3031 {
3032         struct mgmt_ev_new_link_key ev;
3033
3034         memset(&ev, 0, sizeof(ev));
3035
3036         ev.store_hint = persistent;
3037         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3038         ev.key.addr.type = MGMT_ADDR_BREDR;
3039         ev.key.type = key->type;
3040         memcpy(ev.key.val, key->val, 16);
3041         ev.key.pin_len = key->pin_len;
3042
3043         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3044 }
3045
3046 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3047 {
3048         struct mgmt_ev_new_long_term_key ev;
3049
3050         memset(&ev, 0, sizeof(ev));
3051
3052         ev.store_hint = persistent;
3053         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3054         ev.key.addr.type = key->bdaddr_type;
3055         ev.key.authenticated = key->authenticated;
3056         ev.key.enc_size = key->enc_size;
3057         ev.key.ediv = key->ediv;
3058
3059         if (key->type == HCI_SMP_LTK)
3060                 ev.key.master = 1;
3061
3062         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3063         memcpy(ev.key.val, key->val, sizeof(key->val));
3064
3065         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev,
3066                                                 &ev, sizeof(ev), NULL);
3067 }
3068
3069 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3070                                         u8 addr_type, u8 *name, u8 name_len,
3071                                         u8 *dev_class)
3072 {
3073         char buf[512];
3074         struct mgmt_ev_device_connected *ev = (void *) buf;
3075         u16 eir_len = 0;
3076
3077         bacpy(&ev->addr.bdaddr, bdaddr);
3078         ev->addr.type = link_to_mgmt(link_type, addr_type);
3079
3080         if (name_len > 0)
3081                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3082                                                                 name, name_len);
3083
3084         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3085                 eir_len = eir_append_data(&ev->eir[eir_len], eir_len,
3086                                         EIR_CLASS_OF_DEV, dev_class, 3);
3087
3088         put_unaligned_le16(eir_len, &ev->eir_len);
3089
3090         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3091                                                 sizeof(*ev) + eir_len, NULL);
3092 }
3093
3094 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3095 {
3096         struct mgmt_cp_disconnect *cp = cmd->param;
3097         struct sock **sk = data;
3098         struct mgmt_rp_disconnect rp;
3099
3100         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3101         rp.addr.type = cp->addr.type;
3102
3103         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3104                                                                 sizeof(rp));
3105
3106         *sk = cmd->sk;
3107         sock_hold(*sk);
3108
3109         mgmt_pending_remove(cmd);
3110 }
3111
3112 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3113 {
3114         struct hci_dev *hdev = data;
3115         struct mgmt_cp_unpair_device *cp = cmd->param;
3116         struct mgmt_rp_unpair_device rp;
3117
3118         memset(&rp, 0, sizeof(rp));
3119         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3120         rp.addr.type = cp->addr.type;
3121
3122         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3123
3124         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3125
3126         mgmt_pending_remove(cmd);
3127 }
3128
3129 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3130                                                 u8 link_type, u8 addr_type)
3131 {
3132         struct mgmt_addr_info ev;
3133         struct sock *sk = NULL;
3134         int err;
3135
3136         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3137
3138         bacpy(&ev.bdaddr, bdaddr);
3139         ev.type = link_to_mgmt(link_type, addr_type);
3140
3141         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3142                                                                         sk);
3143
3144         if (sk)
3145                 sock_put(sk);
3146
3147         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3148                                                                         hdev);
3149
3150         return err;
3151 }
3152
3153 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3154                                         u8 link_type, u8 addr_type, u8 status)
3155 {
3156         struct mgmt_rp_disconnect rp;
3157         struct pending_cmd *cmd;
3158         int err;
3159
3160         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3161         if (!cmd)
3162                 return -ENOENT;
3163
3164         bacpy(&rp.addr.bdaddr, bdaddr);
3165         rp.addr.type = link_to_mgmt(link_type, addr_type);
3166
3167         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3168                                         mgmt_status(status), &rp, sizeof(rp));
3169
3170         mgmt_pending_remove(cmd);
3171
3172         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3173                                                                         hdev);
3174         return err;
3175 }
3176
3177 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3178                                                 u8 addr_type, u8 status)
3179 {
3180         struct mgmt_ev_connect_failed ev;
3181
3182         bacpy(&ev.addr.bdaddr, bdaddr);
3183         ev.addr.type = link_to_mgmt(link_type, addr_type);
3184         ev.status = mgmt_status(status);
3185
3186         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3187 }
3188
3189 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3190 {
3191         struct mgmt_ev_pin_code_request ev;
3192
3193         bacpy(&ev.addr.bdaddr, bdaddr);
3194         ev.addr.type = MGMT_ADDR_BREDR;
3195         ev.secure = secure;
3196
3197         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3198                                                                         NULL);
3199 }
3200
3201 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3202                                                                 u8 status)
3203 {
3204         struct pending_cmd *cmd;
3205         struct mgmt_rp_pin_code_reply rp;
3206         int err;
3207
3208         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3209         if (!cmd)
3210                 return -ENOENT;
3211
3212         bacpy(&rp.addr.bdaddr, bdaddr);
3213         rp.addr.type = MGMT_ADDR_BREDR;
3214
3215         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3216                                         mgmt_status(status), &rp, sizeof(rp));
3217
3218         mgmt_pending_remove(cmd);
3219
3220         return err;
3221 }
3222
3223 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3224                                                                 u8 status)
3225 {
3226         struct pending_cmd *cmd;
3227         struct mgmt_rp_pin_code_reply rp;
3228         int err;
3229
3230         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3231         if (!cmd)
3232                 return -ENOENT;
3233
3234         bacpy(&rp.addr.bdaddr, bdaddr);
3235         rp.addr.type = MGMT_ADDR_BREDR;
3236
3237         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3238                                         mgmt_status(status), &rp, sizeof(rp));
3239
3240         mgmt_pending_remove(cmd);
3241
3242         return err;
3243 }
3244
3245 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3246                                 u8 link_type, u8 addr_type, __le32 value,
3247                                 u8 confirm_hint)
3248 {
3249         struct mgmt_ev_user_confirm_request ev;
3250
3251         BT_DBG("%s", hdev->name);
3252
3253         bacpy(&ev.addr.bdaddr, bdaddr);
3254         ev.addr.type = link_to_mgmt(link_type, addr_type);
3255         ev.confirm_hint = confirm_hint;
3256         put_unaligned_le32(value, &ev.value);
3257
3258         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3259                                                                         NULL);
3260 }
3261
3262 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3263                                                 u8 link_type, u8 addr_type)
3264 {
3265         struct mgmt_ev_user_passkey_request ev;
3266
3267         BT_DBG("%s", hdev->name);
3268
3269         bacpy(&ev.addr.bdaddr, bdaddr);
3270         ev.addr.type = link_to_mgmt(link_type, addr_type);
3271
3272         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3273                                                                         NULL);
3274 }
3275
3276 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3277                                         u8 link_type, u8 addr_type, u8 status,
3278                                         u8 opcode)
3279 {
3280         struct pending_cmd *cmd;
3281         struct mgmt_rp_user_confirm_reply rp;
3282         int err;
3283
3284         cmd = mgmt_pending_find(opcode, hdev);
3285         if (!cmd)
3286                 return -ENOENT;
3287
3288         bacpy(&rp.addr.bdaddr, bdaddr);
3289         rp.addr.type = link_to_mgmt(link_type, addr_type);
3290         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3291                                                         &rp, sizeof(rp));
3292
3293         mgmt_pending_remove(cmd);
3294
3295         return err;
3296 }
3297
3298 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3299                                         u8 link_type, u8 addr_type, u8 status)
3300 {
3301         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3302                                         status, MGMT_OP_USER_CONFIRM_REPLY);
3303 }
3304
3305 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3306                                         u8 link_type, u8 addr_type, u8 status)
3307 {
3308         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3309                                         status, MGMT_OP_USER_CONFIRM_NEG_REPLY);
3310 }
3311
3312 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3313                                         u8 link_type, u8 addr_type, u8 status)
3314 {
3315         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3316                                         status, MGMT_OP_USER_PASSKEY_REPLY);
3317 }
3318
3319 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3320                                         u8 link_type, u8 addr_type, u8 status)
3321 {
3322         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3323                                         status, MGMT_OP_USER_PASSKEY_NEG_REPLY);
3324 }
3325
3326 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3327                                                 u8 addr_type, u8 status)
3328 {
3329         struct mgmt_ev_auth_failed ev;
3330
3331         bacpy(&ev.addr.bdaddr, bdaddr);
3332         ev.addr.type = link_to_mgmt(link_type, addr_type);
3333         ev.status = mgmt_status(status);
3334
3335         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3336 }
3337
3338 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3339 {
3340         struct cmd_lookup match = { NULL, hdev };
3341         int err;
3342
3343         if (status) {
3344                 u8 mgmt_err = mgmt_status(status);
3345                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3346                                                 cmd_status_rsp, &mgmt_err);
3347                 return 0;
3348         }
3349
3350         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3351                                                                 &match);
3352
3353         err = new_settings(hdev, match.sk);
3354
3355         if (match.sk)
3356                 sock_put(match.sk);
3357
3358         return err;
3359 }
3360
3361 static int clear_eir(struct hci_dev *hdev)
3362 {
3363         struct hci_cp_write_eir cp;
3364
3365         if (!(hdev->features[6] & LMP_EXT_INQ))
3366                 return 0;
3367
3368         memset(&cp, 0, sizeof(cp));
3369
3370         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3371 }
3372
3373 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 status)
3374 {
3375         struct cmd_lookup match = { NULL, hdev };
3376         int err;
3377
3378         if (status) {
3379                 u8 mgmt_err = mgmt_status(status);
3380                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev,
3381                                                 cmd_status_rsp, &mgmt_err);
3382                 return 0;
3383         }
3384
3385         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3386
3387         err = new_settings(hdev, match.sk);
3388
3389         if (match.sk) {
3390                 sock_put(match.sk);
3391
3392                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3393                         update_eir(hdev);
3394                 else
3395                         clear_eir(hdev);
3396         }
3397
3398         return err;
3399 }
3400
3401 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3402 {
3403         struct pending_cmd *cmd;
3404         struct mgmt_cp_set_local_name ev;
3405         int err;
3406
3407         memset(&ev, 0, sizeof(ev));
3408         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3409
3410         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3411         if (!cmd)
3412                 goto send_event;
3413
3414         if (status) {
3415                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3416                                                         mgmt_status(status));
3417                 goto failed;
3418         }
3419
3420         update_eir(hdev);
3421
3422         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3423                                                                 sizeof(ev));
3424         if (err < 0)
3425                 goto failed;
3426
3427 send_event:
3428         err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
3429                                                         cmd ? cmd->sk : NULL);
3430
3431 failed:
3432         if (cmd)
3433                 mgmt_pending_remove(cmd);
3434         return err;
3435 }
3436
3437 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3438                                                 u8 *randomizer, u8 status)
3439 {
3440         struct pending_cmd *cmd;
3441         int err;
3442
3443         BT_DBG("%s status %u", hdev->name, status);
3444
3445         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3446         if (!cmd)
3447                 return -ENOENT;
3448
3449         if (status) {
3450                 err = cmd_status(cmd->sk, hdev->id,
3451                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
3452                                                 mgmt_status(status));
3453         } else {
3454                 struct mgmt_rp_read_local_oob_data rp;
3455
3456                 memcpy(rp.hash, hash, sizeof(rp.hash));
3457                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3458
3459                 err = cmd_complete(cmd->sk, hdev->id,
3460                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
3461                                                 0, &rp, sizeof(rp));
3462         }
3463
3464         mgmt_pending_remove(cmd);
3465
3466         return err;
3467 }
3468
3469 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3470                                 u8 addr_type, u8 *dev_class, s8 rssi,
3471                                 u8 cfm_name, u8 *eir, u16 eir_len)
3472 {
3473         char buf[512];
3474         struct mgmt_ev_device_found *ev = (void *) buf;
3475         size_t ev_size;
3476
3477         /* Leave 5 bytes for a potential CoD field */
3478         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3479                 return -EINVAL;
3480
3481         memset(buf, 0, sizeof(buf));
3482
3483         bacpy(&ev->addr.bdaddr, bdaddr);
3484         ev->addr.type = link_to_mgmt(link_type, addr_type);
3485         ev->rssi = rssi;
3486         ev->confirm_name = cfm_name;
3487
3488         if (eir_len > 0)
3489                 memcpy(ev->eir, eir, eir_len);
3490
3491         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3492                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3493                                                                 dev_class, 3);
3494
3495         put_unaligned_le16(eir_len, &ev->eir_len);
3496
3497         ev_size = sizeof(*ev) + eir_len;
3498
3499         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3500 }
3501
3502 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3503                                 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3504 {
3505         struct mgmt_ev_device_found *ev;
3506         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3507         u16 eir_len;
3508
3509         ev = (struct mgmt_ev_device_found *) buf;
3510
3511         memset(buf, 0, sizeof(buf));
3512
3513         bacpy(&ev->addr.bdaddr, bdaddr);
3514         ev->addr.type = link_to_mgmt(link_type, addr_type);
3515         ev->rssi = rssi;
3516
3517         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3518                                                                 name_len);
3519
3520         put_unaligned_le16(eir_len, &ev->eir_len);
3521
3522         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3523                                                 sizeof(*ev) + eir_len, NULL);
3524 }
3525
3526 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3527 {
3528         struct pending_cmd *cmd;
3529         u8 type;
3530         int err;
3531
3532         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3533
3534         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3535         if (!cmd)
3536                 return -ENOENT;
3537
3538         type = hdev->discovery.type;
3539
3540         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3541                                                         &type, sizeof(type));
3542         mgmt_pending_remove(cmd);
3543
3544         return err;
3545 }
3546
3547 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3548 {
3549         struct pending_cmd *cmd;
3550         int err;
3551
3552         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3553         if (!cmd)
3554                 return -ENOENT;
3555
3556         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3557                                                 &hdev->discovery.type,
3558                                                 sizeof(hdev->discovery.type));
3559         mgmt_pending_remove(cmd);
3560
3561         return err;
3562 }
3563
3564 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3565 {
3566         struct mgmt_ev_discovering ev;
3567         struct pending_cmd *cmd;
3568
3569         BT_DBG("%s discovering %u", hdev->name, discovering);
3570
3571         if (discovering)
3572                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3573         else
3574                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3575
3576         if (cmd != NULL) {
3577                 u8 type = hdev->discovery.type;
3578
3579                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0,
3580                                                         &type, sizeof(type));
3581                 mgmt_pending_remove(cmd);
3582         }
3583
3584         memset(&ev, 0, sizeof(ev));
3585         ev.type = hdev->discovery.type;
3586         ev.discovering = discovering;
3587
3588         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3589 }
3590
3591 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3592 {
3593         struct pending_cmd *cmd;
3594         struct mgmt_ev_device_blocked ev;
3595
3596         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3597
3598         bacpy(&ev.addr.bdaddr, bdaddr);
3599         ev.addr.type = type;
3600
3601         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3602                                                         cmd ? cmd->sk : NULL);
3603 }
3604
3605 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3606 {
3607         struct pending_cmd *cmd;
3608         struct mgmt_ev_device_unblocked ev;
3609
3610         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3611
3612         bacpy(&ev.addr.bdaddr, bdaddr);
3613         ev.addr.type = type;
3614
3615         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3616                                                         cmd ? cmd->sk : NULL);
3617 }
3618
3619 module_param(enable_hs, bool, 0644);
3620 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");
3621
3622 module_param(enable_le, bool, 0644);
3623 MODULE_PARM_DESC(enable_le, "Enable Low Energy support");