net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   2
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 /*
 106  * These LE scan and inquiry parameters were chosen according to LE General
 107  * Discovery Procedure specification.
 108  */
 109 #define LE_SCAN_TYPE                    0x01
 110 #define LE_SCAN_WIN                     0x12
 111 #define LE_SCAN_INT                     0x12
 112 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 113 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 114
 115 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 116 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 117
 118 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 119
 120 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 121                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 122
 123 struct pending_cmd {
 124         struct list_head list;
 125         u16 opcode;
 126         int index;
 127         void *param;
 128         struct sock *sk;
 129         void *user_data;
 130 };
 131
 132 /* HCI to MGMT error code conversion table */
 133 static u8 mgmt_status_table[] = {
 134         MGMT_STATUS_SUCCESS,
 135         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 136         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 137         MGMT_STATUS_FAILED,             /* Hardware Failure */
 138         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 139         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 140         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 141         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 142         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 145         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 146         MGMT_STATUS_BUSY,               /* Command Disallowed */
 147         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 148         MGMT_STATUS_REJECTED,           /* Rejected Security */
 149         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 150         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 151         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 153         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 154         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 155         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 156         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 157         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 158         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 159         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 161         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 162         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 163         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 165         MGMT_STATUS_FAILED,             /* Unspecified Error */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 167         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 168         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 169         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 170         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 171         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 172         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 174         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 176         MGMT_STATUS_FAILED,             /* Transaction Collision */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 178         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 180         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 181         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 182         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 183         MGMT_STATUS_FAILED,             /* Slot Violation */
 184         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 185         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 187         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 188         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 189         MGMT_STATUS_BUSY,               /* Controller Busy */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 191         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 192         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 193         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 194         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 195 };
 196
 197 bool mgmt_valid_hdev(struct hci_dev *hdev)
 198 {
 199         return hdev->dev_type == HCI_BREDR;
 200 }
 201
 202 static u8 mgmt_status(u8 hci_status)
 203 {
 204         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 205                 return mgmt_status_table[hci_status];
 206
 207         return MGMT_STATUS_FAILED;
 208 }
 209
 210 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 211 {
 212         struct sk_buff *skb;
 213         struct mgmt_hdr *hdr;
 214         struct mgmt_ev_cmd_status *ev;
 215         int err;
 216
 217         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 218
 219         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 220         if (!skb)
 221                 return -ENOMEM;
 222
 223         hdr = (void *) skb_put(skb, sizeof(*hdr));
 224
 225         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 226         hdr->index = cpu_to_le16(index);
 227         hdr->len = cpu_to_le16(sizeof(*ev));
 228
 229         ev = (void *) skb_put(skb, sizeof(*ev));
 230         ev->status = status;
 231         ev->opcode = cpu_to_le16(cmd);
 232
 233         err = sock_queue_rcv_skb(sk, skb);
 234         if (err < 0)
 235                 kfree_skb(skb);
 236
 237         return err;
 238 }
 239
 240 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 241                         void *rp, size_t rp_len)
 242 {
 243         struct sk_buff *skb;
 244         struct mgmt_hdr *hdr;
 245         struct mgmt_ev_cmd_complete *ev;
 246         int err;
 247
 248         BT_DBG("sock %p", sk);
 249
 250         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 251         if (!skb)
 252                 return -ENOMEM;
 253
 254         hdr = (void *) skb_put(skb, sizeof(*hdr));
 255
 256         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 257         hdr->index = cpu_to_le16(index);
 258         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 259
 260         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 261         ev->opcode = cpu_to_le16(cmd);
 262         ev->status = status;
 263
 264         if (rp)
 265                 memcpy(ev->data, rp, rp_len);
 266
 267         err = sock_queue_rcv_skb(sk, skb);
 268         if (err < 0)
 269                 kfree_skb(skb);
 270
 271         return err;
 272 }
 273
 274 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 275                         u16 data_len)
 276 {
 277         struct mgmt_rp_read_version rp;
 278
 279         BT_DBG("sock %p", sk);
 280
 281         rp.version = MGMT_VERSION;
 282         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 283
 284         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 285                             sizeof(rp));
 286 }
 287
 288 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 289                          u16 data_len)
 290 {
 291         struct mgmt_rp_read_commands *rp;
 292         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 293         const u16 num_events = ARRAY_SIZE(mgmt_events);
 294         __le16 *opcode;
 295         size_t rp_size;
 296         int i, err;
 297
 298         BT_DBG("sock %p", sk);
 299
 300         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 301
 302         rp = kmalloc(rp_size, GFP_KERNEL);
 303         if (!rp)
 304                 return -ENOMEM;
 305
 306         rp->num_commands = __constant_cpu_to_le16(num_commands);
 307         rp->num_events = __constant_cpu_to_le16(num_events);
 308
 309         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 310                 put_unaligned_le16(mgmt_commands[i], opcode);
 311
 312         for (i = 0; i < num_events; i++, opcode++)
 313                 put_unaligned_le16(mgmt_events[i], opcode);
 314
 315         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 316                            rp_size);
 317         kfree(rp);
 318
 319         return err;
 320 }
 321
 322 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 323                            u16 data_len)
 324 {
 325         struct mgmt_rp_read_index_list *rp;
 326         struct hci_dev *d;
 327         size_t rp_len;
 328         u16 count;
 329         int err;
 330
 331         BT_DBG("sock %p", sk);
 332
 333         read_lock(&hci_dev_list_lock);
 334
 335         count = 0;
 336         list_for_each_entry(d, &hci_dev_list, list) {
 337                 if (!mgmt_valid_hdev(d))
 338                         continue;
 339
 340                 count++;
 341         }
 342
 343         rp_len = sizeof(*rp) + (2 * count);
 344         rp = kmalloc(rp_len, GFP_ATOMIC);
 345         if (!rp) {
 346                 read_unlock(&hci_dev_list_lock);
 347                 return -ENOMEM;
 348         }
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (test_bit(HCI_SETUP, &d->dev_flags))
 353                         continue;
 354
 355                 if (!mgmt_valid_hdev(d))
 356                         continue;
 357
 358                 rp->index[count++] = cpu_to_le16(d->id);
 359                 BT_DBG("Added hci%u", d->id);
 360         }
 361
 362         rp->num_controllers = cpu_to_le16(count);
 363         rp_len = sizeof(*rp) + (2 * count);
 364
 365         read_unlock(&hci_dev_list_lock);
 366
 367         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 368                            rp_len);
 369
 370         kfree(rp);
 371
 372         return err;
 373 }
 374
 375 static u32 get_supported_settings(struct hci_dev *hdev)
 376 {
 377         u32 settings = 0;
 378
 379         settings |= MGMT_SETTING_POWERED;
 380         settings |= MGMT_SETTING_PAIRABLE;
 381
 382         if (lmp_ssp_capable(hdev))
 383                 settings |= MGMT_SETTING_SSP;
 384
 385         if (lmp_bredr_capable(hdev)) {
 386                 settings |= MGMT_SETTING_CONNECTABLE;
 387                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 388                 settings |= MGMT_SETTING_DISCOVERABLE;
 389                 settings |= MGMT_SETTING_BREDR;
 390                 settings |= MGMT_SETTING_LINK_SECURITY;
 391         }
 392
 393         if (enable_hs)
 394                 settings |= MGMT_SETTING_HS;
 395
 396         if (lmp_le_capable(hdev))
 397                 settings |= MGMT_SETTING_LE;
 398
 399         return settings;
 400 }
 401
 402 static u32 get_current_settings(struct hci_dev *hdev)
 403 {
 404         u32 settings = 0;
 405
 406         if (hdev_is_powered(hdev))
 407                 settings |= MGMT_SETTING_POWERED;
 408
 409         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 410                 settings |= MGMT_SETTING_CONNECTABLE;
 411
 412         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 413                 settings |= MGMT_SETTING_DISCOVERABLE;
 414
 415         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 416                 settings |= MGMT_SETTING_PAIRABLE;
 417
 418         if (lmp_bredr_capable(hdev))
 419                 settings |= MGMT_SETTING_BREDR;
 420
 421         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 422                 settings |= MGMT_SETTING_LE;
 423
 424         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 425                 settings |= MGMT_SETTING_LINK_SECURITY;
 426
 427         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 428                 settings |= MGMT_SETTING_SSP;
 429
 430         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 431                 settings |= MGMT_SETTING_HS;
 432
 433         return settings;
 434 }
 435
 436 #define PNP_INFO_SVCLASS_ID             0x1200
 437
 438 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 439 {
 440         u8 *ptr = data, *uuids_start = NULL;
 441         struct bt_uuid *uuid;
 442
 443         if (len < 4)
 444                 return ptr;
 445
 446         list_for_each_entry(uuid, &hdev->uuids, list) {
 447                 u16 uuid16;
 448
 449                 if (uuid->size != 16)
 450                         continue;
 451
 452                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 453                 if (uuid16 < 0x1100)
 454                         continue;
 455
 456                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 457                         continue;
 458
 459                 if (!uuids_start) {
 460                         uuids_start = ptr;
 461                         uuids_start[0] = 1;
 462                         uuids_start[1] = EIR_UUID16_ALL;
 463                         ptr += 2;
 464                 }
 465
 466                 /* Stop if not enough space to put next UUID */
 467                 if ((ptr - data) + sizeof(u16) > len) {
 468                         uuids_start[1] = EIR_UUID16_SOME;
 469                         break;
 470                 }
 471
 472                 *ptr++ = (uuid16 & 0x00ff);
 473                 *ptr++ = (uuid16 & 0xff00) >> 8;
 474                 uuids_start[0] += sizeof(uuid16);
 475         }
 476
 477         return ptr;
 478 }
 479
 480 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 481 {
 482         u8 *ptr = data, *uuids_start = NULL;
 483         struct bt_uuid *uuid;
 484
 485         if (len < 6)
 486                 return ptr;
 487
 488         list_for_each_entry(uuid, &hdev->uuids, list) {
 489                 if (uuid->size != 32)
 490                         continue;
 491
 492                 if (!uuids_start) {
 493                         uuids_start = ptr;
 494                         uuids_start[0] = 1;
 495                         uuids_start[1] = EIR_UUID32_ALL;
 496                         ptr += 2;
 497                 }
 498
 499                 /* Stop if not enough space to put next UUID */
 500                 if ((ptr - data) + sizeof(u32) > len) {
 501                         uuids_start[1] = EIR_UUID32_SOME;
 502                         break;
 503                 }
 504
 505                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 506                 ptr += sizeof(u32);
 507                 uuids_start[0] += sizeof(u32);
 508         }
 509
 510         return ptr;
 511 }
 512
 513 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 514 {
 515         u8 *ptr = data, *uuids_start = NULL;
 516         struct bt_uuid *uuid;
 517
 518         if (len < 18)
 519                 return ptr;
 520
 521         list_for_each_entry(uuid, &hdev->uuids, list) {
 522                 if (uuid->size != 128)
 523                         continue;
 524
 525                 if (!uuids_start) {
 526                         uuids_start = ptr;
 527                         uuids_start[0] = 1;
 528                         uuids_start[1] = EIR_UUID128_ALL;
 529                         ptr += 2;
 530                 }
 531
 532                 /* Stop if not enough space to put next UUID */
 533                 if ((ptr - data) + 16 > len) {
 534                         uuids_start[1] = EIR_UUID128_SOME;
 535                         break;
 536                 }
 537
 538                 memcpy(ptr, uuid->uuid, 16);
 539                 ptr += 16;
 540                 uuids_start[0] += 16;
 541         }
 542
 543         return ptr;
 544 }
 545
 546 static void create_eir(struct hci_dev *hdev, u8 *data)
 547 {
 548         u8 *ptr = data;
 549         size_t name_len;
 550
 551         name_len = strlen(hdev->dev_name);
 552
 553         if (name_len > 0) {
 554                 /* EIR Data type */
 555                 if (name_len > 48) {
 556                         name_len = 48;
 557                         ptr[1] = EIR_NAME_SHORT;
 558                 } else
 559                         ptr[1] = EIR_NAME_COMPLETE;
 560
 561                 /* EIR Data length */
 562                 ptr[0] = name_len + 1;
 563
 564                 memcpy(ptr + 2, hdev->dev_name, name_len);
 565
 566                 ptr += (name_len + 2);
 567         }
 568
 569         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 570                 ptr[0] = 2;
 571                 ptr[1] = EIR_TX_POWER;
 572                 ptr[2] = (u8) hdev->inq_tx_power;
 573
 574                 ptr += 3;
 575         }
 576
 577         if (hdev->devid_source > 0) {
 578                 ptr[0] = 9;
 579                 ptr[1] = EIR_DEVICE_ID;
 580
 581                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 582                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 583                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 584                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 585
 586                 ptr += 10;
 587         }
 588
 589         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 590         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 591         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 592 }
 593
 594 static int update_eir(struct hci_dev *hdev)
 595 {
 596         struct hci_cp_write_eir cp;
 597
 598         if (!hdev_is_powered(hdev))
 599                 return 0;
 600
 601         if (!lmp_ext_inq_capable(hdev))
 602                 return 0;
 603
 604         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 605                 return 0;
 606
 607         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 608                 return 0;
 609
 610         memset(&cp, 0, sizeof(cp));
 611
 612         create_eir(hdev, cp.data);
 613
 614         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 615                 return 0;
 616
 617         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 618
 619         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 620 }
 621
 622 static u8 get_service_classes(struct hci_dev *hdev)
 623 {
 624         struct bt_uuid *uuid;
 625         u8 val = 0;
 626
 627         list_for_each_entry(uuid, &hdev->uuids, list)
 628                 val |= uuid->svc_hint;
 629
 630         return val;
 631 }
 632
 633 static int update_class(struct hci_dev *hdev)
 634 {
 635         u8 cod[3];
 636         int err;
 637
 638         BT_DBG("%s", hdev->name);
 639
 640         if (!hdev_is_powered(hdev))
 641                 return 0;
 642
 643         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 644                 return 0;
 645
 646         cod[0] = hdev->minor_class;
 647         cod[1] = hdev->major_class;
 648         cod[2] = get_service_classes(hdev);
 649
 650         if (memcmp(cod, hdev->dev_class, 3) == 0)
 651                 return 0;
 652
 653         err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 654         if (err == 0)
 655                 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
 656
 657         return err;
 658 }
 659
 660 static void service_cache_off(struct work_struct *work)
 661 {
 662         struct hci_dev *hdev = container_of(work, struct hci_dev,
 663                                             service_cache.work);
 664
 665         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 666                 return;
 667
 668         hci_dev_lock(hdev);
 669
 670         update_eir(hdev);
 671         update_class(hdev);
 672
 673         hci_dev_unlock(hdev);
 674 }
 675
 676 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 677 {
 678         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 679                 return;
 680
 681         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 682
 683         /* Non-mgmt controlled devices get this bit set
 684          * implicitly so that pairing works for them, however
 685          * for mgmt we require user-space to explicitly enable
 686          * it
 687          */
 688         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 689 }
 690
 691 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 692                                 void *data, u16 data_len)
 693 {
 694         struct mgmt_rp_read_info rp;
 695
 696         BT_DBG("sock %p %s", sk, hdev->name);
 697
 698         hci_dev_lock(hdev);
 699
 700         memset(&rp, 0, sizeof(rp));
 701
 702         bacpy(&rp.bdaddr, &hdev->bdaddr);
 703
 704         rp.version = hdev->hci_ver;
 705         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 706
 707         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 708         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 709
 710         memcpy(rp.dev_class, hdev->dev_class, 3);
 711
 712         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 713         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 714
 715         hci_dev_unlock(hdev);
 716
 717         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 718                             sizeof(rp));
 719 }
 720
 721 static void mgmt_pending_free(struct pending_cmd *cmd)
 722 {
 723         sock_put(cmd->sk);
 724         kfree(cmd->param);
 725         kfree(cmd);
 726 }
 727
 728 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 729                                             struct hci_dev *hdev, void *data,
 730                                             u16 len)
 731 {
 732         struct pending_cmd *cmd;
 733
 734         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 735         if (!cmd)
 736                 return NULL;
 737
 738         cmd->opcode = opcode;
 739         cmd->index = hdev->id;
 740
 741         cmd->param = kmalloc(len, GFP_KERNEL);
 742         if (!cmd->param) {
 743                 kfree(cmd);
 744                 return NULL;
 745         }
 746
 747         if (data)
 748                 memcpy(cmd->param, data, len);
 749
 750         cmd->sk = sk;
 751         sock_hold(sk);
 752
 753         list_add(&cmd->list, &hdev->mgmt_pending);
 754
 755         return cmd;
 756 }
 757
 758 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 759                                  void (*cb)(struct pending_cmd *cmd,
 760                                             void *data),
 761                                  void *data)
 762 {
 763         struct list_head *p, *n;
 764
 765         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 766                 struct pending_cmd *cmd;
 767
 768                 cmd = list_entry(p, struct pending_cmd, list);
 769
 770                 if (opcode > 0 && cmd->opcode != opcode)
 771                         continue;
 772
 773                 cb(cmd, data);
 774         }
 775 }
 776
 777 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 778 {
 779         struct pending_cmd *cmd;
 780
 781         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 782                 if (cmd->opcode == opcode)
 783                         return cmd;
 784         }
 785
 786         return NULL;
 787 }
 788
 789 static void mgmt_pending_remove(struct pending_cmd *cmd)
 790 {
 791         list_del(&cmd->list);
 792         mgmt_pending_free(cmd);
 793 }
 794
 795 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 796 {
 797         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 798
 799         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 800                             sizeof(settings));
 801 }
 802
 803 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 804                        u16 len)
 805 {
 806         struct mgmt_mode *cp = data;
 807         struct pending_cmd *cmd;
 808         int err;
 809
 810         BT_DBG("request for %s", hdev->name);
 811
 812         if (cp->val != 0x00 && cp->val != 0x01)
 813                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 814                                   MGMT_STATUS_INVALID_PARAMS);
 815
 816         hci_dev_lock(hdev);
 817
 818         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 819                 cancel_delayed_work(&hdev->power_off);
 820
 821                 if (cp->val) {
 822                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 823                                          data, len);
 824                         err = mgmt_powered(hdev, 1);
 825                         goto failed;
 826                 }
 827         }
 828
 829         if (!!cp->val == hdev_is_powered(hdev)) {
 830                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 831                 goto failed;
 832         }
 833
 834         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 835                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 836                                  MGMT_STATUS_BUSY);
 837                 goto failed;
 838         }
 839
 840         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 841         if (!cmd) {
 842                 err = -ENOMEM;
 843                 goto failed;
 844         }
 845
 846         if (cp->val)
 847                 queue_work(hdev->req_workqueue, &hdev->power_on);
 848         else
 849                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 850
 851         err = 0;
 852
 853 failed:
 854         hci_dev_unlock(hdev);
 855         return err;
 856 }
 857
 858 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 859                       struct sock *skip_sk)
 860 {
 861         struct sk_buff *skb;
 862         struct mgmt_hdr *hdr;
 863
 864         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 865         if (!skb)
 866                 return -ENOMEM;
 867
 868         hdr = (void *) skb_put(skb, sizeof(*hdr));
 869         hdr->opcode = cpu_to_le16(event);
 870         if (hdev)
 871                 hdr->index = cpu_to_le16(hdev->id);
 872         else
 873                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 874         hdr->len = cpu_to_le16(data_len);
 875
 876         if (data)
 877                 memcpy(skb_put(skb, data_len), data, data_len);
 878
 879         /* Time stamp */
 880         __net_timestamp(skb);
 881
 882         hci_send_to_control(skb, skip_sk);
 883         kfree_skb(skb);
 884
 885         return 0;
 886 }
 887
 888 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 889 {
 890         __le32 ev;
 891
 892         ev = cpu_to_le32(get_current_settings(hdev));
 893
 894         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 895 }
 896
 897 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 898                             u16 len)
 899 {
 900         struct mgmt_cp_set_discoverable *cp = data;
 901         struct pending_cmd *cmd;
 902         u16 timeout;
 903         u8 scan;
 904         int err;
 905
 906         BT_DBG("request for %s", hdev->name);
 907
 908         if (!lmp_bredr_capable(hdev))
 909                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 910                                  MGMT_STATUS_NOT_SUPPORTED);
 911
 912         if (cp->val != 0x00 && cp->val != 0x01)
 913                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 914                                   MGMT_STATUS_INVALID_PARAMS);
 915
 916         timeout = __le16_to_cpu(cp->timeout);
 917         if (!cp->val && timeout > 0)
 918                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 919                                   MGMT_STATUS_INVALID_PARAMS);
 920
 921         hci_dev_lock(hdev);
 922
 923         if (!hdev_is_powered(hdev) && timeout > 0) {
 924                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 925                                  MGMT_STATUS_NOT_POWERED);
 926                 goto failed;
 927         }
 928
 929         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 930             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 931                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 932                                  MGMT_STATUS_BUSY);
 933                 goto failed;
 934         }
 935
 936         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 937                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 938                                  MGMT_STATUS_REJECTED);
 939                 goto failed;
 940         }
 941
 942         if (!hdev_is_powered(hdev)) {
 943                 bool changed = false;
 944
 945                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 946                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 947                         changed = true;
 948                 }
 949
 950                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 951                 if (err < 0)
 952                         goto failed;
 953
 954                 if (changed)
 955                         err = new_settings(hdev, sk);
 956
 957                 goto failed;
 958         }
 959
 960         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 961                 if (hdev->discov_timeout > 0) {
 962                         cancel_delayed_work(&hdev->discov_off);
 963                         hdev->discov_timeout = 0;
 964                 }
 965
 966                 if (cp->val && timeout > 0) {
 967                         hdev->discov_timeout = timeout;
 968                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 969                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 970                 }
 971
 972                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 973                 goto failed;
 974         }
 975
 976         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 977         if (!cmd) {
 978                 err = -ENOMEM;
 979                 goto failed;
 980         }
 981
 982         scan = SCAN_PAGE;
 983
 984         if (cp->val)
 985                 scan |= SCAN_INQUIRY;
 986         else
 987                 cancel_delayed_work(&hdev->discov_off);
 988
 989         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 990         if (err < 0)
 991                 mgmt_pending_remove(cmd);
 992
 993         if (cp->val)
 994                 hdev->discov_timeout = timeout;
 995
 996 failed:
 997         hci_dev_unlock(hdev);
 998         return err;
 999 }
1000
1001 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1002                            u16 len)
1003 {
1004         struct mgmt_mode *cp = data;
1005         struct pending_cmd *cmd;
1006         u8 scan;
1007         int err;
1008
1009         BT_DBG("request for %s", hdev->name);
1010
1011         if (!lmp_bredr_capable(hdev))
1012                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1013                                   MGMT_STATUS_NOT_SUPPORTED);
1014
1015         if (cp->val != 0x00 && cp->val != 0x01)
1016                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1017                                   MGMT_STATUS_INVALID_PARAMS);
1018
1019         hci_dev_lock(hdev);
1020
1021         if (!hdev_is_powered(hdev)) {
1022                 bool changed = false;
1023
1024                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1025                         changed = true;
1026
1027                 if (cp->val) {
1028                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1029                 } else {
1030                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1031                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1032                 }
1033
1034                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1035                 if (err < 0)
1036                         goto failed;
1037
1038                 if (changed)
1039                         err = new_settings(hdev, sk);
1040
1041                 goto failed;
1042         }
1043
1044         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1045             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1046                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1047                                  MGMT_STATUS_BUSY);
1048                 goto failed;
1049         }
1050
1051         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1052                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1053                 goto failed;
1054         }
1055
1056         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1057         if (!cmd) {
1058                 err = -ENOMEM;
1059                 goto failed;
1060         }
1061
1062         if (cp->val) {
1063                 scan = SCAN_PAGE;
1064         } else {
1065                 scan = 0;
1066
1067                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1068                     hdev->discov_timeout > 0)
1069                         cancel_delayed_work(&hdev->discov_off);
1070         }
1071
1072         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1073         if (err < 0)
1074                 mgmt_pending_remove(cmd);
1075
1076 failed:
1077         hci_dev_unlock(hdev);
1078         return err;
1079 }
1080
1081 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1082                         u16 len)
1083 {
1084         struct mgmt_mode *cp = data;
1085         int err;
1086
1087         BT_DBG("request for %s", hdev->name);
1088
1089         if (cp->val != 0x00 && cp->val != 0x01)
1090                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1091                                   MGMT_STATUS_INVALID_PARAMS);
1092
1093         hci_dev_lock(hdev);
1094
1095         if (cp->val)
1096                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1097         else
1098                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1099
1100         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1101         if (err < 0)
1102                 goto failed;
1103
1104         err = new_settings(hdev, sk);
1105
1106 failed:
1107         hci_dev_unlock(hdev);
1108         return err;
1109 }
1110
1111 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1112                              u16 len)
1113 {
1114         struct mgmt_mode *cp = data;
1115         struct pending_cmd *cmd;
1116         u8 val;
1117         int err;
1118
1119         BT_DBG("request for %s", hdev->name);
1120
1121         if (!lmp_bredr_capable(hdev))
1122                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1123                                   MGMT_STATUS_NOT_SUPPORTED);
1124
1125         if (cp->val != 0x00 && cp->val != 0x01)
1126                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1127                                   MGMT_STATUS_INVALID_PARAMS);
1128
1129         hci_dev_lock(hdev);
1130
1131         if (!hdev_is_powered(hdev)) {
1132                 bool changed = false;
1133
1134                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1135                                           &hdev->dev_flags)) {
1136                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1137                         changed = true;
1138                 }
1139
1140                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1141                 if (err < 0)
1142                         goto failed;
1143
1144                 if (changed)
1145                         err = new_settings(hdev, sk);
1146
1147                 goto failed;
1148         }
1149
1150         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1151                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1152                                  MGMT_STATUS_BUSY);
1153                 goto failed;
1154         }
1155
1156         val = !!cp->val;
1157
1158         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1159                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1160                 goto failed;
1161         }
1162
1163         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1164         if (!cmd) {
1165                 err = -ENOMEM;
1166                 goto failed;
1167         }
1168
1169         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1170         if (err < 0) {
1171                 mgmt_pending_remove(cmd);
1172                 goto failed;
1173         }
1174
1175 failed:
1176         hci_dev_unlock(hdev);
1177         return err;
1178 }
1179
1180 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1181 {
1182         struct mgmt_mode *cp = data;
1183         struct pending_cmd *cmd;
1184         u8 val;
1185         int err;
1186
1187         BT_DBG("request for %s", hdev->name);
1188
1189         if (!lmp_ssp_capable(hdev))
1190                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1191                                   MGMT_STATUS_NOT_SUPPORTED);
1192
1193         if (cp->val != 0x00 && cp->val != 0x01)
1194                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1195                                   MGMT_STATUS_INVALID_PARAMS);
1196
1197         hci_dev_lock(hdev);
1198
1199         val = !!cp->val;
1200
1201         if (!hdev_is_powered(hdev)) {
1202                 bool changed = false;
1203
1204                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1205                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1206                         changed = true;
1207                 }
1208
1209                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1210                 if (err < 0)
1211                         goto failed;
1212
1213                 if (changed)
1214                         err = new_settings(hdev, sk);
1215
1216                 goto failed;
1217         }
1218
1219         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1220                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1221                                  MGMT_STATUS_BUSY);
1222                 goto failed;
1223         }
1224
1225         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1226                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1227                 goto failed;
1228         }
1229
1230         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1231         if (!cmd) {
1232                 err = -ENOMEM;
1233                 goto failed;
1234         }
1235
1236         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1237         if (err < 0) {
1238                 mgmt_pending_remove(cmd);
1239                 goto failed;
1240         }
1241
1242 failed:
1243         hci_dev_unlock(hdev);
1244         return err;
1245 }
1246
1247 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1248 {
1249         struct mgmt_mode *cp = data;
1250
1251         BT_DBG("request for %s", hdev->name);
1252
1253         if (!enable_hs)
1254                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1255                                   MGMT_STATUS_NOT_SUPPORTED);
1256
1257         if (cp->val != 0x00 && cp->val != 0x01)
1258                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1259                                   MGMT_STATUS_INVALID_PARAMS);
1260
1261         if (cp->val)
1262                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1263         else
1264                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1265
1266         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1267 }
1268
1269 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1270 {
1271         struct mgmt_mode *cp = data;
1272         struct hci_cp_write_le_host_supported hci_cp;
1273         struct pending_cmd *cmd;
1274         int err;
1275         u8 val, enabled;
1276
1277         BT_DBG("request for %s", hdev->name);
1278
1279         if (!lmp_le_capable(hdev))
1280                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1281                                   MGMT_STATUS_NOT_SUPPORTED);
1282
1283         if (cp->val != 0x00 && cp->val != 0x01)
1284                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1285                                   MGMT_STATUS_INVALID_PARAMS);
1286
1287         hci_dev_lock(hdev);
1288
1289         val = !!cp->val;
1290         enabled = lmp_host_le_capable(hdev);
1291
1292         if (!hdev_is_powered(hdev) || val == enabled) {
1293                 bool changed = false;
1294
1295                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1296                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1297                         changed = true;
1298                 }
1299
1300                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1301                 if (err < 0)
1302                         goto unlock;
1303
1304                 if (changed)
1305                         err = new_settings(hdev, sk);
1306
1307                 goto unlock;
1308         }
1309
1310         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1311                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1312                                  MGMT_STATUS_BUSY);
1313                 goto unlock;
1314         }
1315
1316         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1317         if (!cmd) {
1318                 err = -ENOMEM;
1319                 goto unlock;
1320         }
1321
1322         memset(&hci_cp, 0, sizeof(hci_cp));
1323
1324         if (val) {
1325                 hci_cp.le = val;
1326                 hci_cp.simul = lmp_le_br_capable(hdev);
1327         }
1328
1329         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1330                            &hci_cp);
1331         if (err < 0)
1332                 mgmt_pending_remove(cmd);
1333
1334 unlock:
1335         hci_dev_unlock(hdev);
1336         return err;
1337 }
1338
1339 static const u8 bluetooth_base_uuid[] = {
1340                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1341                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1342 };
1343
1344 static u8 get_uuid_size(const u8 *uuid)
1345 {
1346         u32 val;
1347
1348         if (memcmp(uuid, bluetooth_base_uuid, 12))
1349                 return 128;
1350
1351         val = get_unaligned_le32(&uuid[12]);
1352         if (val > 0xffff)
1353                 return 32;
1354
1355         return 16;
1356 }
1357
1358 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1359 {
1360         struct mgmt_cp_add_uuid *cp = data;
1361         struct pending_cmd *cmd;
1362         struct bt_uuid *uuid;
1363         int err;
1364
1365         BT_DBG("request for %s", hdev->name);
1366
1367         hci_dev_lock(hdev);
1368
1369         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1370                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1371                                  MGMT_STATUS_BUSY);
1372                 goto failed;
1373         }
1374
1375         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1376         if (!uuid) {
1377                 err = -ENOMEM;
1378                 goto failed;
1379         }
1380
1381         memcpy(uuid->uuid, cp->uuid, 16);
1382         uuid->svc_hint = cp->svc_hint;
1383         uuid->size = get_uuid_size(cp->uuid);
1384
1385         list_add_tail(&uuid->list, &hdev->uuids);
1386
1387         err = update_class(hdev);
1388         if (err < 0)
1389                 goto failed;
1390
1391         err = update_eir(hdev);
1392         if (err < 0)
1393                 goto failed;
1394
1395         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1396                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1397                                    hdev->dev_class, 3);
1398                 goto failed;
1399         }
1400
1401         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1402         if (!cmd)
1403                 err = -ENOMEM;
1404
1405 failed:
1406         hci_dev_unlock(hdev);
1407         return err;
1408 }
1409
1410 static bool enable_service_cache(struct hci_dev *hdev)
1411 {
1412         if (!hdev_is_powered(hdev))
1413                 return false;
1414
1415         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1416                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1417                                    CACHE_TIMEOUT);
1418                 return true;
1419         }
1420
1421         return false;
1422 }
1423
1424 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1425                        u16 len)
1426 {
1427         struct mgmt_cp_remove_uuid *cp = data;
1428         struct pending_cmd *cmd;
1429         struct bt_uuid *match, *tmp;
1430         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1431         int err, found;
1432
1433         BT_DBG("request for %s", hdev->name);
1434
1435         hci_dev_lock(hdev);
1436
1437         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1438                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1439                                  MGMT_STATUS_BUSY);
1440                 goto unlock;
1441         }
1442
1443         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1444                 err = hci_uuids_clear(hdev);
1445
1446                 if (enable_service_cache(hdev)) {
1447                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1448                                            0, hdev->dev_class, 3);
1449                         goto unlock;
1450                 }
1451
1452                 goto update_class;
1453         }
1454
1455         found = 0;
1456
1457         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1458                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1459                         continue;
1460
1461                 list_del(&match->list);
1462                 kfree(match);
1463                 found++;
1464         }
1465
1466         if (found == 0) {
1467                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1468                                  MGMT_STATUS_INVALID_PARAMS);
1469                 goto unlock;
1470         }
1471
1472 update_class:
1473         err = update_class(hdev);
1474         if (err < 0)
1475                 goto unlock;
1476
1477         err = update_eir(hdev);
1478         if (err < 0)
1479                 goto unlock;
1480
1481         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1482                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1483                                    hdev->dev_class, 3);
1484                 goto unlock;
1485         }
1486
1487         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1488         if (!cmd)
1489                 err = -ENOMEM;
1490
1491 unlock:
1492         hci_dev_unlock(hdev);
1493         return err;
1494 }
1495
1496 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1497                          u16 len)
1498 {
1499         struct mgmt_cp_set_dev_class *cp = data;
1500         struct pending_cmd *cmd;
1501         int err;
1502
1503         BT_DBG("request for %s", hdev->name);
1504
1505         if (!lmp_bredr_capable(hdev))
1506                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1507                                   MGMT_STATUS_NOT_SUPPORTED);
1508
1509         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags))
1510                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1511                                   MGMT_STATUS_BUSY);
1512
1513         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0)
1514                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1515                                   MGMT_STATUS_INVALID_PARAMS);
1516
1517         hci_dev_lock(hdev);
1518
1519         hdev->major_class = cp->major;
1520         hdev->minor_class = cp->minor;
1521
1522         if (!hdev_is_powered(hdev)) {
1523                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1524                                    hdev->dev_class, 3);
1525                 goto unlock;
1526         }
1527
1528         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1529                 hci_dev_unlock(hdev);
1530                 cancel_delayed_work_sync(&hdev->service_cache);
1531                 hci_dev_lock(hdev);
1532                 update_eir(hdev);
1533         }
1534
1535         err = update_class(hdev);
1536         if (err < 0)
1537                 goto unlock;
1538
1539         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1540                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1541                                    hdev->dev_class, 3);
1542                 goto unlock;
1543         }
1544
1545         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1546         if (!cmd)
1547                 err = -ENOMEM;
1548
1549 unlock:
1550         hci_dev_unlock(hdev);
1551         return err;
1552 }
1553
1554 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1555                           u16 len)
1556 {
1557         struct mgmt_cp_load_link_keys *cp = data;
1558         u16 key_count, expected_len;
1559         int i;
1560
1561         key_count = __le16_to_cpu(cp->key_count);
1562
1563         expected_len = sizeof(*cp) + key_count *
1564                                         sizeof(struct mgmt_link_key_info);
1565         if (expected_len != len) {
1566                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1567                        len, expected_len);
1568                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1569                                   MGMT_STATUS_INVALID_PARAMS);
1570         }
1571
1572         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1573                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1574                                   MGMT_STATUS_INVALID_PARAMS);
1575
1576         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1577                key_count);
1578
1579         for (i = 0; i < key_count; i++) {
1580                 struct mgmt_link_key_info *key = &cp->keys[i];
1581
1582                 if (key->addr.type != BDADDR_BREDR)
1583                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1584                                           MGMT_STATUS_INVALID_PARAMS);
1585         }
1586
1587         hci_dev_lock(hdev);
1588
1589         hci_link_keys_clear(hdev);
1590
1591         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1592
1593         if (cp->debug_keys)
1594                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1595         else
1596                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1597
1598         for (i = 0; i < key_count; i++) {
1599                 struct mgmt_link_key_info *key = &cp->keys[i];
1600
1601                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1602                                  key->type, key->pin_len);
1603         }
1604
1605         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1606
1607         hci_dev_unlock(hdev);
1608
1609         return 0;
1610 }
1611
1612 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1613                            u8 addr_type, struct sock *skip_sk)
1614 {
1615         struct mgmt_ev_device_unpaired ev;
1616
1617         bacpy(&ev.addr.bdaddr, bdaddr);
1618         ev.addr.type = addr_type;
1619
1620         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1621                           skip_sk);
1622 }
1623
1624 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1625                          u16 len)
1626 {
1627         struct mgmt_cp_unpair_device *cp = data;
1628         struct mgmt_rp_unpair_device rp;
1629         struct hci_cp_disconnect dc;
1630         struct pending_cmd *cmd;
1631         struct hci_conn *conn;
1632         int err;
1633
1634         memset(&rp, 0, sizeof(rp));
1635         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1636         rp.addr.type = cp->addr.type;
1637
1638         if (!bdaddr_type_is_valid(cp->addr.type))
1639                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1640                                     MGMT_STATUS_INVALID_PARAMS,
1641                                     &rp, sizeof(rp));
1642
1643         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1644                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1645                                     MGMT_STATUS_INVALID_PARAMS,
1646                                     &rp, sizeof(rp));
1647
1648         hci_dev_lock(hdev);
1649
1650         if (!hdev_is_powered(hdev)) {
1651                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1652                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1653                 goto unlock;
1654         }
1655
1656         if (cp->addr.type == BDADDR_BREDR)
1657                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1658         else
1659                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1660
1661         if (err < 0) {
1662                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1663                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1664                 goto unlock;
1665         }
1666
1667         if (cp->disconnect) {
1668                 if (cp->addr.type == BDADDR_BREDR)
1669                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1670                                                        &cp->addr.bdaddr);
1671                 else
1672                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1673                                                        &cp->addr.bdaddr);
1674         } else {
1675                 conn = NULL;
1676         }
1677
1678         if (!conn) {
1679                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1680                                    &rp, sizeof(rp));
1681                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1682                 goto unlock;
1683         }
1684
1685         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1686                                sizeof(*cp));
1687         if (!cmd) {
1688                 err = -ENOMEM;
1689                 goto unlock;
1690         }
1691
1692         dc.handle = cpu_to_le16(conn->handle);
1693         dc.reason = 0x13; /* Remote User Terminated Connection */
1694         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1695         if (err < 0)
1696                 mgmt_pending_remove(cmd);
1697
1698 unlock:
1699         hci_dev_unlock(hdev);
1700         return err;
1701 }
1702
1703 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1704                       u16 len)
1705 {
1706         struct mgmt_cp_disconnect *cp = data;
1707         struct mgmt_rp_disconnect rp;
1708         struct hci_cp_disconnect dc;
1709         struct pending_cmd *cmd;
1710         struct hci_conn *conn;
1711         int err;
1712
1713         BT_DBG("");
1714
1715         memset(&rp, 0, sizeof(rp));
1716         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1717         rp.addr.type = cp->addr.type;
1718
1719         if (!bdaddr_type_is_valid(cp->addr.type))
1720                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1721                                     MGMT_STATUS_INVALID_PARAMS,
1722                                     &rp, sizeof(rp));
1723
1724         hci_dev_lock(hdev);
1725
1726         if (!test_bit(HCI_UP, &hdev->flags)) {
1727                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1728                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1729                 goto failed;
1730         }
1731
1732         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1733                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1734                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1735                 goto failed;
1736         }
1737
1738         if (cp->addr.type == BDADDR_BREDR)
1739                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1740                                                &cp->addr.bdaddr);
1741         else
1742                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1743
1744         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1745                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1746                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1747                 goto failed;
1748         }
1749
1750         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1751         if (!cmd) {
1752                 err = -ENOMEM;
1753                 goto failed;
1754         }
1755
1756         dc.handle = cpu_to_le16(conn->handle);
1757         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1758
1759         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1760         if (err < 0)
1761                 mgmt_pending_remove(cmd);
1762
1763 failed:
1764         hci_dev_unlock(hdev);
1765         return err;
1766 }
1767
1768 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1769 {
1770         switch (link_type) {
1771         case LE_LINK:
1772                 switch (addr_type) {
1773                 case ADDR_LE_DEV_PUBLIC:
1774                         return BDADDR_LE_PUBLIC;
1775
1776                 default:
1777                         /* Fallback to LE Random address type */
1778                         return BDADDR_LE_RANDOM;
1779                 }
1780
1781         default:
1782                 /* Fallback to BR/EDR type */
1783                 return BDADDR_BREDR;
1784         }
1785 }
1786
1787 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1788                            u16 data_len)
1789 {
1790         struct mgmt_rp_get_connections *rp;
1791         struct hci_conn *c;
1792         size_t rp_len;
1793         int err;
1794         u16 i;
1795
1796         BT_DBG("");
1797
1798         hci_dev_lock(hdev);
1799
1800         if (!hdev_is_powered(hdev)) {
1801                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1802                                  MGMT_STATUS_NOT_POWERED);
1803                 goto unlock;
1804         }
1805
1806         i = 0;
1807         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1808                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1809                         i++;
1810         }
1811
1812         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1813         rp = kmalloc(rp_len, GFP_KERNEL);
1814         if (!rp) {
1815                 err = -ENOMEM;
1816                 goto unlock;
1817         }
1818
1819         i = 0;
1820         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1821                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1822                         continue;
1823                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1824                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1825                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1826                         continue;
1827                 i++;
1828         }
1829
1830         rp->conn_count = cpu_to_le16(i);
1831
1832         /* Recalculate length in case of filtered SCO connections, etc */
1833         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1834
1835         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1836                            rp_len);
1837
1838         kfree(rp);
1839
1840 unlock:
1841         hci_dev_unlock(hdev);
1842         return err;
1843 }
1844
1845 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1846                                    struct mgmt_cp_pin_code_neg_reply *cp)
1847 {
1848         struct pending_cmd *cmd;
1849         int err;
1850
1851         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1852                                sizeof(*cp));
1853         if (!cmd)
1854                 return -ENOMEM;
1855
1856         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1857                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1858         if (err < 0)
1859                 mgmt_pending_remove(cmd);
1860
1861         return err;
1862 }
1863
1864 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1865                           u16 len)
1866 {
1867         struct hci_conn *conn;
1868         struct mgmt_cp_pin_code_reply *cp = data;
1869         struct hci_cp_pin_code_reply reply;
1870         struct pending_cmd *cmd;
1871         int err;
1872
1873         BT_DBG("");
1874
1875         hci_dev_lock(hdev);
1876
1877         if (!hdev_is_powered(hdev)) {
1878                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1879                                  MGMT_STATUS_NOT_POWERED);
1880                 goto failed;
1881         }
1882
1883         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1884         if (!conn) {
1885                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1886                                  MGMT_STATUS_NOT_CONNECTED);
1887                 goto failed;
1888         }
1889
1890         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1891                 struct mgmt_cp_pin_code_neg_reply ncp;
1892
1893                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1894
1895                 BT_ERR("PIN code is not 16 bytes long");
1896
1897                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1898                 if (err >= 0)
1899                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1900                                          MGMT_STATUS_INVALID_PARAMS);
1901
1902                 goto failed;
1903         }
1904
1905         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1906         if (!cmd) {
1907                 err = -ENOMEM;
1908                 goto failed;
1909         }
1910
1911         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1912         reply.pin_len = cp->pin_len;
1913         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1914
1915         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1916         if (err < 0)
1917                 mgmt_pending_remove(cmd);
1918
1919 failed:
1920         hci_dev_unlock(hdev);
1921         return err;
1922 }
1923
1924 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1925                              u16 len)
1926 {
1927         struct mgmt_cp_set_io_capability *cp = data;
1928
1929         BT_DBG("");
1930
1931         hci_dev_lock(hdev);
1932
1933         hdev->io_capability = cp->io_capability;
1934
1935         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1936                hdev->io_capability);
1937
1938         hci_dev_unlock(hdev);
1939
1940         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1941                             0);
1942 }
1943
1944 static struct pending_cmd *find_pairing(struct hci_conn *conn)
1945 {
1946         struct hci_dev *hdev = conn->hdev;
1947         struct pending_cmd *cmd;
1948
1949         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1950                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1951                         continue;
1952
1953                 if (cmd->user_data != conn)
1954                         continue;
1955
1956                 return cmd;
1957         }
1958
1959         return NULL;
1960 }
1961
1962 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1963 {
1964         struct mgmt_rp_pair_device rp;
1965         struct hci_conn *conn = cmd->user_data;
1966
1967         bacpy(&rp.addr.bdaddr, &conn->dst);
1968         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
1969
1970         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1971                      &rp, sizeof(rp));
1972
1973         /* So we don't get further callbacks for this connection */
1974         conn->connect_cfm_cb = NULL;
1975         conn->security_cfm_cb = NULL;
1976         conn->disconn_cfm_cb = NULL;
1977
1978         hci_conn_put(conn);
1979
1980         mgmt_pending_remove(cmd);
1981 }
1982
1983 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1984 {
1985         struct pending_cmd *cmd;
1986
1987         BT_DBG("status %u", status);
1988
1989         cmd = find_pairing(conn);
1990         if (!cmd)
1991                 BT_DBG("Unable to find a pending command");
1992         else
1993                 pairing_complete(cmd, mgmt_status(status));
1994 }
1995
1996 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
1997 {
1998         struct pending_cmd *cmd;
1999
2000         BT_DBG("status %u", status);
2001
2002         if (!status)
2003                 return;
2004
2005         cmd = find_pairing(conn);
2006         if (!cmd)
2007                 BT_DBG("Unable to find a pending command");
2008         else
2009                 pairing_complete(cmd, mgmt_status(status));
2010 }
2011
2012 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2013                        u16 len)
2014 {
2015         struct mgmt_cp_pair_device *cp = data;
2016         struct mgmt_rp_pair_device rp;
2017         struct pending_cmd *cmd;
2018         u8 sec_level, auth_type;
2019         struct hci_conn *conn;
2020         int err;
2021
2022         BT_DBG("");
2023
2024         memset(&rp, 0, sizeof(rp));
2025         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2026         rp.addr.type = cp->addr.type;
2027
2028         if (!bdaddr_type_is_valid(cp->addr.type))
2029                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2030                                     MGMT_STATUS_INVALID_PARAMS,
2031                                     &rp, sizeof(rp));
2032
2033         hci_dev_lock(hdev);
2034
2035         if (!hdev_is_powered(hdev)) {
2036                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2037                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2038                 goto unlock;
2039         }
2040
2041         sec_level = BT_SECURITY_MEDIUM;
2042         if (cp->io_cap == 0x03)
2043                 auth_type = HCI_AT_DEDICATED_BONDING;
2044         else
2045                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2046
2047         if (cp->addr.type == BDADDR_BREDR)
2048                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2049                                    cp->addr.type, sec_level, auth_type);
2050         else
2051                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2052                                    cp->addr.type, sec_level, auth_type);
2053
2054         if (IS_ERR(conn)) {
2055                 int status;
2056
2057                 if (PTR_ERR(conn) == -EBUSY)
2058                         status = MGMT_STATUS_BUSY;
2059                 else
2060                         status = MGMT_STATUS_CONNECT_FAILED;
2061
2062                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2063                                    status, &rp,
2064                                    sizeof(rp));
2065                 goto unlock;
2066         }
2067
2068         if (conn->connect_cfm_cb) {
2069                 hci_conn_put(conn);
2070                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2071                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2072                 goto unlock;
2073         }
2074
2075         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2076         if (!cmd) {
2077                 err = -ENOMEM;
2078                 hci_conn_put(conn);
2079                 goto unlock;
2080         }
2081
2082         /* For LE, just connecting isn't a proof that the pairing finished */
2083         if (cp->addr.type == BDADDR_BREDR)
2084                 conn->connect_cfm_cb = pairing_complete_cb;
2085         else
2086                 conn->connect_cfm_cb = le_connect_complete_cb;
2087
2088         conn->security_cfm_cb = pairing_complete_cb;
2089         conn->disconn_cfm_cb = pairing_complete_cb;
2090         conn->io_capability = cp->io_cap;
2091         cmd->user_data = conn;
2092
2093         if (conn->state == BT_CONNECTED &&
2094             hci_conn_security(conn, sec_level, auth_type))
2095                 pairing_complete(cmd, 0);
2096
2097         err = 0;
2098
2099 unlock:
2100         hci_dev_unlock(hdev);
2101         return err;
2102 }
2103
2104 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2105                               u16 len)
2106 {
2107         struct mgmt_addr_info *addr = data;
2108         struct pending_cmd *cmd;
2109         struct hci_conn *conn;
2110         int err;
2111
2112         BT_DBG("");
2113
2114         hci_dev_lock(hdev);
2115
2116         if (!hdev_is_powered(hdev)) {
2117                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2118                                  MGMT_STATUS_NOT_POWERED);
2119                 goto unlock;
2120         }
2121
2122         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2123         if (!cmd) {
2124                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2125                                  MGMT_STATUS_INVALID_PARAMS);
2126                 goto unlock;
2127         }
2128
2129         conn = cmd->user_data;
2130
2131         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2132                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2133                                  MGMT_STATUS_INVALID_PARAMS);
2134                 goto unlock;
2135         }
2136
2137         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2138
2139         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2140                            addr, sizeof(*addr));
2141 unlock:
2142         hci_dev_unlock(hdev);
2143         return err;
2144 }
2145
2146 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2147                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2148                              u16 hci_op, __le32 passkey)
2149 {
2150         struct pending_cmd *cmd;
2151         struct hci_conn *conn;
2152         int err;
2153
2154         hci_dev_lock(hdev);
2155
2156         if (!hdev_is_powered(hdev)) {
2157                 err = cmd_status(sk, hdev->id, mgmt_op,
2158                                  MGMT_STATUS_NOT_POWERED);
2159                 goto done;
2160         }
2161
2162         if (type == BDADDR_BREDR)
2163                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2164         else
2165                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2166
2167         if (!conn) {
2168                 err = cmd_status(sk, hdev->id, mgmt_op,
2169                                  MGMT_STATUS_NOT_CONNECTED);
2170                 goto done;
2171         }
2172
2173         if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2174                 /* Continue with pairing via SMP */
2175                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2176
2177                 if (!err)
2178                         err = cmd_status(sk, hdev->id, mgmt_op,
2179                                          MGMT_STATUS_SUCCESS);
2180                 else
2181                         err = cmd_status(sk, hdev->id, mgmt_op,
2182                                          MGMT_STATUS_FAILED);
2183
2184                 goto done;
2185         }
2186
2187         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2188         if (!cmd) {
2189                 err = -ENOMEM;
2190                 goto done;
2191         }
2192
2193         /* Continue with pairing via HCI */
2194         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2195                 struct hci_cp_user_passkey_reply cp;
2196
2197                 bacpy(&cp.bdaddr, bdaddr);
2198                 cp.passkey = passkey;
2199                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2200         } else
2201                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2202
2203         if (err < 0)
2204                 mgmt_pending_remove(cmd);
2205
2206 done:
2207         hci_dev_unlock(hdev);
2208         return err;
2209 }
2210
2211 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2212                               void *data, u16 len)
2213 {
2214         struct mgmt_cp_pin_code_neg_reply *cp = data;
2215
2216         BT_DBG("");
2217
2218         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2219                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2220                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2221 }
2222
2223 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2224                               u16 len)
2225 {
2226         struct mgmt_cp_user_confirm_reply *cp = data;
2227
2228         BT_DBG("");
2229
2230         if (len != sizeof(*cp))
2231                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2232                                   MGMT_STATUS_INVALID_PARAMS);
2233
2234         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2235                                  MGMT_OP_USER_CONFIRM_REPLY,
2236                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2237 }
2238
2239 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2240                                   void *data, u16 len)
2241 {
2242         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2243
2244         BT_DBG("");
2245
2246         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2247                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2248                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2249 }
2250
2251 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2252                               u16 len)
2253 {
2254         struct mgmt_cp_user_passkey_reply *cp = data;
2255
2256         BT_DBG("");
2257
2258         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2259                                  MGMT_OP_USER_PASSKEY_REPLY,
2260                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2261 }
2262
2263 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2264                                   void *data, u16 len)
2265 {
2266         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2267
2268         BT_DBG("");
2269
2270         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2271                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2272                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2273 }
2274
2275 static int update_name(struct hci_dev *hdev, const char *name)
2276 {
2277         struct hci_cp_write_local_name cp;
2278
2279         memcpy(cp.name, name, sizeof(cp.name));
2280
2281         return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2282 }
2283
2284 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2285                           u16 len)
2286 {
2287         struct mgmt_cp_set_local_name *cp = data;
2288         struct pending_cmd *cmd;
2289         int err;
2290
2291         BT_DBG("");
2292
2293         hci_dev_lock(hdev);
2294
2295         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2296
2297         if (!hdev_is_powered(hdev)) {
2298                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2299
2300                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2301                                    data, len);
2302                 if (err < 0)
2303                         goto failed;
2304
2305                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2306                                  sk);
2307
2308                 goto failed;
2309         }
2310
2311         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2312         if (!cmd) {
2313                 err = -ENOMEM;
2314                 goto failed;
2315         }
2316
2317         err = update_name(hdev, cp->name);
2318         if (err < 0)
2319                 mgmt_pending_remove(cmd);
2320
2321 failed:
2322         hci_dev_unlock(hdev);
2323         return err;
2324 }
2325
2326 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2327                                void *data, u16 data_len)
2328 {
2329         struct pending_cmd *cmd;
2330         int err;
2331
2332         BT_DBG("%s", hdev->name);
2333
2334         hci_dev_lock(hdev);
2335
2336         if (!hdev_is_powered(hdev)) {
2337                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2338                                  MGMT_STATUS_NOT_POWERED);
2339                 goto unlock;
2340         }
2341
2342         if (!lmp_ssp_capable(hdev)) {
2343                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2344                                  MGMT_STATUS_NOT_SUPPORTED);
2345                 goto unlock;
2346         }
2347
2348         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2349                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2350                                  MGMT_STATUS_BUSY);
2351                 goto unlock;
2352         }
2353
2354         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2355         if (!cmd) {
2356                 err = -ENOMEM;
2357                 goto unlock;
2358         }
2359
2360         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2361         if (err < 0)
2362                 mgmt_pending_remove(cmd);
2363
2364 unlock:
2365         hci_dev_unlock(hdev);
2366         return err;
2367 }
2368
2369 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2370                                void *data, u16 len)
2371 {
2372         struct mgmt_cp_add_remote_oob_data *cp = data;
2373         u8 status;
2374         int err;
2375
2376         BT_DBG("%s ", hdev->name);
2377
2378         hci_dev_lock(hdev);
2379
2380         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2381                                       cp->randomizer);
2382         if (err < 0)
2383                 status = MGMT_STATUS_FAILED;
2384         else
2385                 status = MGMT_STATUS_SUCCESS;
2386
2387         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2388                            &cp->addr, sizeof(cp->addr));
2389
2390         hci_dev_unlock(hdev);
2391         return err;
2392 }
2393
2394 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2395                                   void *data, u16 len)
2396 {
2397         struct mgmt_cp_remove_remote_oob_data *cp = data;
2398         u8 status;
2399         int err;
2400
2401         BT_DBG("%s", hdev->name);
2402
2403         hci_dev_lock(hdev);
2404
2405         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2406         if (err < 0)
2407                 status = MGMT_STATUS_INVALID_PARAMS;
2408         else
2409                 status = MGMT_STATUS_SUCCESS;
2410
2411         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2412                            status, &cp->addr, sizeof(cp->addr));
2413
2414         hci_dev_unlock(hdev);
2415         return err;
2416 }
2417
2418 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2419 {
2420         int err;
2421
2422         BT_DBG("%s", hdev->name);
2423
2424         hci_dev_lock(hdev);
2425
2426         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2427         if (err < 0)
2428                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2429
2430         hci_dev_unlock(hdev);
2431
2432         return err;
2433 }
2434
2435 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2436                            void *data, u16 len)
2437 {
2438         struct mgmt_cp_start_discovery *cp = data;
2439         struct pending_cmd *cmd;
2440         int err;
2441
2442         BT_DBG("%s", hdev->name);
2443
2444         hci_dev_lock(hdev);
2445
2446         if (!hdev_is_powered(hdev)) {
2447                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2448                                  MGMT_STATUS_NOT_POWERED);
2449                 goto failed;
2450         }
2451
2452         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2453                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2454                                  MGMT_STATUS_BUSY);
2455                 goto failed;
2456         }
2457
2458         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2459                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2460                                  MGMT_STATUS_BUSY);
2461                 goto failed;
2462         }
2463
2464         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2465         if (!cmd) {
2466                 err = -ENOMEM;
2467                 goto failed;
2468         }
2469
2470         hdev->discovery.type = cp->type;
2471
2472         switch (hdev->discovery.type) {
2473         case DISCOV_TYPE_BREDR:
2474                 if (!lmp_bredr_capable(hdev)) {
2475                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2476                                          MGMT_STATUS_NOT_SUPPORTED);
2477                         mgmt_pending_remove(cmd);
2478                         goto failed;
2479                 }
2480
2481                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2482                 break;
2483
2484         case DISCOV_TYPE_LE:
2485                 if (!lmp_host_le_capable(hdev)) {
2486                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2487                                          MGMT_STATUS_NOT_SUPPORTED);
2488                         mgmt_pending_remove(cmd);
2489                         goto failed;
2490                 }
2491
2492                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2493                                   LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2494                 break;
2495
2496         case DISCOV_TYPE_INTERLEAVED:
2497                 if (!lmp_host_le_capable(hdev) || !lmp_bredr_capable(hdev)) {
2498                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2499                                          MGMT_STATUS_NOT_SUPPORTED);
2500                         mgmt_pending_remove(cmd);
2501                         goto failed;
2502                 }
2503
2504                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT, LE_SCAN_WIN,
2505                                   LE_SCAN_TIMEOUT_BREDR_LE);
2506                 break;
2507
2508         default:
2509                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2510                                  MGMT_STATUS_INVALID_PARAMS);
2511                 mgmt_pending_remove(cmd);
2512                 goto failed;
2513         }
2514
2515         if (err < 0)
2516                 mgmt_pending_remove(cmd);
2517         else
2518                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2519
2520 failed:
2521         hci_dev_unlock(hdev);
2522         return err;
2523 }
2524
2525 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2526                           u16 len)
2527 {
2528         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2529         struct pending_cmd *cmd;
2530         struct hci_cp_remote_name_req_cancel cp;
2531         struct inquiry_entry *e;
2532         int err;
2533
2534         BT_DBG("%s", hdev->name);
2535
2536         hci_dev_lock(hdev);
2537
2538         if (!hci_discovery_active(hdev)) {
2539                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2540                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2541                                    sizeof(mgmt_cp->type));
2542                 goto unlock;
2543         }
2544
2545         if (hdev->discovery.type != mgmt_cp->type) {
2546                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2547                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2548                                    sizeof(mgmt_cp->type));
2549                 goto unlock;
2550         }
2551
2552         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2553         if (!cmd) {
2554                 err = -ENOMEM;
2555                 goto unlock;
2556         }
2557
2558         switch (hdev->discovery.state) {
2559         case DISCOVERY_FINDING:
2560                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2561                         err = hci_cancel_inquiry(hdev);
2562                 else
2563                         err = hci_cancel_le_scan(hdev);
2564
2565                 break;
2566
2567         case DISCOVERY_RESOLVING:
2568                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2569                                                      NAME_PENDING);
2570                 if (!e) {
2571                         mgmt_pending_remove(cmd);
2572                         err = cmd_complete(sk, hdev->id,
2573                                            MGMT_OP_STOP_DISCOVERY, 0,
2574                                            &mgmt_cp->type,
2575                                            sizeof(mgmt_cp->type));
2576                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2577                         goto unlock;
2578                 }
2579
2580                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2581                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2582                                    sizeof(cp), &cp);
2583
2584                 break;
2585
2586         default:
2587                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2588                 err = -EFAULT;
2589         }
2590
2591         if (err < 0)
2592                 mgmt_pending_remove(cmd);
2593         else
2594                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2595
2596 unlock:
2597         hci_dev_unlock(hdev);
2598         return err;
2599 }
2600
2601 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2602                         u16 len)
2603 {
2604         struct mgmt_cp_confirm_name *cp = data;
2605         struct inquiry_entry *e;
2606         int err;
2607
2608         BT_DBG("%s", hdev->name);
2609
2610         hci_dev_lock(hdev);
2611
2612         if (!hci_discovery_active(hdev)) {
2613                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2614                                  MGMT_STATUS_FAILED);
2615                 goto failed;
2616         }
2617
2618         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2619         if (!e) {
2620                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2621                                  MGMT_STATUS_INVALID_PARAMS);
2622                 goto failed;
2623         }
2624
2625         if (cp->name_known) {
2626                 e->name_state = NAME_KNOWN;
2627                 list_del(&e->list);
2628         } else {
2629                 e->name_state = NAME_NEEDED;
2630                 hci_inquiry_cache_update_resolve(hdev, e);
2631         }
2632
2633         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
2634                            sizeof(cp->addr));
2635
2636 failed:
2637         hci_dev_unlock(hdev);
2638         return err;
2639 }
2640
2641 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2642                         u16 len)
2643 {
2644         struct mgmt_cp_block_device *cp = data;
2645         u8 status;
2646         int err;
2647
2648         BT_DBG("%s", hdev->name);
2649
2650         if (!bdaddr_type_is_valid(cp->addr.type))
2651                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
2652                                     MGMT_STATUS_INVALID_PARAMS,
2653                                     &cp->addr, sizeof(cp->addr));
2654
2655         hci_dev_lock(hdev);
2656
2657         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2658         if (err < 0)
2659                 status = MGMT_STATUS_FAILED;
2660         else
2661                 status = MGMT_STATUS_SUCCESS;
2662
2663         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2664                            &cp->addr, sizeof(cp->addr));
2665
2666         hci_dev_unlock(hdev);
2667
2668         return err;
2669 }
2670
2671 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2672                           u16 len)
2673 {
2674         struct mgmt_cp_unblock_device *cp = data;
2675         u8 status;
2676         int err;
2677
2678         BT_DBG("%s", hdev->name);
2679
2680         if (!bdaddr_type_is_valid(cp->addr.type))
2681                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
2682                                     MGMT_STATUS_INVALID_PARAMS,
2683                                     &cp->addr, sizeof(cp->addr));
2684
2685         hci_dev_lock(hdev);
2686
2687         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2688         if (err < 0)
2689                 status = MGMT_STATUS_INVALID_PARAMS;
2690         else
2691                 status = MGMT_STATUS_SUCCESS;
2692
2693         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2694                            &cp->addr, sizeof(cp->addr));
2695
2696         hci_dev_unlock(hdev);
2697
2698         return err;
2699 }
2700
2701 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2702                          u16 len)
2703 {
2704         struct mgmt_cp_set_device_id *cp = data;
2705         int err;
2706         __u16 source;
2707
2708         BT_DBG("%s", hdev->name);
2709
2710         source = __le16_to_cpu(cp->source);
2711
2712         if (source > 0x0002)
2713                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2714                                   MGMT_STATUS_INVALID_PARAMS);
2715
2716         hci_dev_lock(hdev);
2717
2718         hdev->devid_source = source;
2719         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2720         hdev->devid_product = __le16_to_cpu(cp->product);
2721         hdev->devid_version = __le16_to_cpu(cp->version);
2722
2723         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2724
2725         update_eir(hdev);
2726
2727         hci_dev_unlock(hdev);
2728
2729         return err;
2730 }
2731
2732 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2733                                 void *data, u16 len)
2734 {
2735         struct mgmt_mode *cp = data;
2736         struct hci_cp_write_page_scan_activity acp;
2737         u8 type;
2738         int err;
2739
2740         BT_DBG("%s", hdev->name);
2741
2742         if (!lmp_bredr_capable(hdev))
2743                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2744                                   MGMT_STATUS_NOT_SUPPORTED);
2745
2746         if (cp->val != 0x00 && cp->val != 0x01)
2747                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2748                                   MGMT_STATUS_INVALID_PARAMS);
2749
2750         if (!hdev_is_powered(hdev))
2751                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2752                                   MGMT_STATUS_NOT_POWERED);
2753
2754         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2755                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2756                                   MGMT_STATUS_REJECTED);
2757
2758         hci_dev_lock(hdev);
2759
2760         if (cp->val) {
2761                 type = PAGE_SCAN_TYPE_INTERLACED;
2762
2763                 /* 160 msec page scan interval */
2764                 acp.interval = __constant_cpu_to_le16(0x0100);
2765         } else {
2766                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2767
2768                 /* default 1.28 sec page scan */
2769                 acp.interval = __constant_cpu_to_le16(0x0800);
2770         }
2771
2772         /* default 11.25 msec page scan window */
2773         acp.window = __constant_cpu_to_le16(0x0012);
2774
2775         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2776                            &acp);
2777         if (err < 0) {
2778                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2779                                  MGMT_STATUS_FAILED);
2780                 goto done;
2781         }
2782
2783         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2784         if (err < 0) {
2785                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2786                                  MGMT_STATUS_FAILED);
2787                 goto done;
2788         }
2789
2790         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2791                            NULL, 0);
2792 done:
2793         hci_dev_unlock(hdev);
2794         return err;
2795 }
2796
2797 static bool ltk_is_valid(struct mgmt_ltk_info *key)
2798 {
2799         if (key->authenticated != 0x00 && key->authenticated != 0x01)
2800                 return false;
2801         if (key->master != 0x00 && key->master != 0x01)
2802                 return false;
2803         if (!bdaddr_type_is_le(key->addr.type))
2804                 return false;
2805         return true;
2806 }
2807
2808 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2809                                void *cp_data, u16 len)
2810 {
2811         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2812         u16 key_count, expected_len;
2813         int i, err;
2814
2815         key_count = __le16_to_cpu(cp->key_count);
2816
2817         expected_len = sizeof(*cp) + key_count *
2818                                         sizeof(struct mgmt_ltk_info);
2819         if (expected_len != len) {
2820                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2821                        len, expected_len);
2822                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2823                                   MGMT_STATUS_INVALID_PARAMS);
2824         }
2825
2826         BT_DBG("%s key_count %u", hdev->name, key_count);
2827
2828         for (i = 0; i < key_count; i++) {
2829                 struct mgmt_ltk_info *key = &cp->keys[i];
2830
2831                 if (!ltk_is_valid(key))
2832                         return cmd_status(sk, hdev->id,
2833                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
2834                                           MGMT_STATUS_INVALID_PARAMS);
2835         }
2836
2837         hci_dev_lock(hdev);
2838
2839         hci_smp_ltks_clear(hdev);
2840
2841         for (i = 0; i < key_count; i++) {
2842                 struct mgmt_ltk_info *key = &cp->keys[i];
2843                 u8 type;
2844
2845                 if (key->master)
2846                         type = HCI_SMP_LTK;
2847                 else
2848                         type = HCI_SMP_LTK_SLAVE;
2849
2850                 hci_add_ltk(hdev, &key->addr.bdaddr,
2851                             bdaddr_to_le(key->addr.type),
2852                             type, 0, key->authenticated, key->val,
2853                             key->enc_size, key->ediv, key->rand);
2854         }
2855
2856         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
2857                            NULL, 0);
2858
2859         hci_dev_unlock(hdev);
2860
2861         return err;
2862 }
2863
2864 static const struct mgmt_handler {
2865         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2866                      u16 data_len);
2867         bool var_len;
2868         size_t data_len;
2869 } mgmt_handlers[] = {
2870         { NULL }, /* 0x0000 (no command) */
2871         { read_version,           false, MGMT_READ_VERSION_SIZE },
2872         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
2873         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
2874         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
2875         { set_powered,            false, MGMT_SETTING_SIZE },
2876         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
2877         { set_connectable,        false, MGMT_SETTING_SIZE },
2878         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
2879         { set_pairable,           false, MGMT_SETTING_SIZE },
2880         { set_link_security,      false, MGMT_SETTING_SIZE },
2881         { set_ssp,                false, MGMT_SETTING_SIZE },
2882         { set_hs,                 false, MGMT_SETTING_SIZE },
2883         { set_le,                 false, MGMT_SETTING_SIZE },
2884         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
2885         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
2886         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
2887         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
2888         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
2889         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2890         { disconnect,             false, MGMT_DISCONNECT_SIZE },
2891         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
2892         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
2893         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2894         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
2895         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
2896         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2897         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
2898         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
2899         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2900         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
2901         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2902         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2903         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2904         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2905         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
2906         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
2907         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
2908         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
2909         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
2910         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
2911 };
2912
2913
2914 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2915 {
2916         void *buf;
2917         u8 *cp;
2918         struct mgmt_hdr *hdr;
2919         u16 opcode, index, len;
2920         struct hci_dev *hdev = NULL;
2921         const struct mgmt_handler *handler;
2922         int err;
2923
2924         BT_DBG("got %zu bytes", msglen);
2925
2926         if (msglen < sizeof(*hdr))
2927                 return -EINVAL;
2928
2929         buf = kmalloc(msglen, GFP_KERNEL);
2930         if (!buf)
2931                 return -ENOMEM;
2932
2933         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2934                 err = -EFAULT;
2935                 goto done;
2936         }
2937
2938         hdr = buf;
2939         opcode = __le16_to_cpu(hdr->opcode);
2940         index = __le16_to_cpu(hdr->index);
2941         len = __le16_to_cpu(hdr->len);
2942
2943         if (len != msglen - sizeof(*hdr)) {
2944                 err = -EINVAL;
2945                 goto done;
2946         }
2947
2948         if (index != MGMT_INDEX_NONE) {
2949                 hdev = hci_dev_get(index);
2950                 if (!hdev) {
2951                         err = cmd_status(sk, index, opcode,
2952                                          MGMT_STATUS_INVALID_INDEX);
2953                         goto done;
2954                 }
2955         }
2956
2957         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2958             mgmt_handlers[opcode].func == NULL) {
2959                 BT_DBG("Unknown op %u", opcode);
2960                 err = cmd_status(sk, index, opcode,
2961                                  MGMT_STATUS_UNKNOWN_COMMAND);
2962                 goto done;
2963         }
2964
2965         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2966             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2967                 err = cmd_status(sk, index, opcode,
2968                                  MGMT_STATUS_INVALID_INDEX);
2969                 goto done;
2970         }
2971
2972         handler = &mgmt_handlers[opcode];
2973
2974         if ((handler->var_len && len < handler->data_len) ||
2975             (!handler->var_len && len != handler->data_len)) {
2976                 err = cmd_status(sk, index, opcode,
2977                                  MGMT_STATUS_INVALID_PARAMS);
2978                 goto done;
2979         }
2980
2981         if (hdev)
2982                 mgmt_init_hdev(sk, hdev);
2983
2984         cp = buf + sizeof(*hdr);
2985
2986         err = handler->func(sk, hdev, cp, len);
2987         if (err < 0)
2988                 goto done;
2989
2990         err = msglen;
2991
2992 done:
2993         if (hdev)
2994                 hci_dev_put(hdev);
2995
2996         kfree(buf);
2997         return err;
2998 }
2999
3000 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
3001 {
3002         u8 *status = data;
3003
3004         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
3005         mgmt_pending_remove(cmd);
3006 }
3007
3008 int mgmt_index_added(struct hci_dev *hdev)
3009 {
3010         if (!mgmt_valid_hdev(hdev))
3011                 return -ENOTSUPP;
3012
3013         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3014 }
3015
3016 int mgmt_index_removed(struct hci_dev *hdev)
3017 {
3018         u8 status = MGMT_STATUS_INVALID_INDEX;
3019
3020         if (!mgmt_valid_hdev(hdev))
3021                 return -ENOTSUPP;
3022
3023         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3024
3025         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3026 }
3027
3028 struct cmd_lookup {
3029         struct sock *sk;
3030         struct hci_dev *hdev;
3031         u8 mgmt_status;
3032 };
3033
3034 static void settings_rsp(struct pending_cmd *cmd, void *data)
3035 {
3036         struct cmd_lookup *match = data;
3037
3038         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
3039
3040         list_del(&cmd->list);
3041
3042         if (match->sk == NULL) {
3043                 match->sk = cmd->sk;
3044                 sock_hold(match->sk);
3045         }
3046
3047         mgmt_pending_free(cmd);
3048 }
3049
3050 static int set_bredr_scan(struct hci_dev *hdev)
3051 {
3052         u8 scan = 0;
3053
3054         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3055                 scan |= SCAN_PAGE;
3056         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3057                 scan |= SCAN_INQUIRY;
3058
3059         if (!scan)
3060                 return 0;
3061
3062         return hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3063 }
3064
3065 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3066 {
3067         struct cmd_lookup match = { NULL, hdev };
3068         int err;
3069
3070         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3071                 return 0;
3072
3073         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3074
3075         if (powered) {
3076                 u8 link_sec;
3077
3078                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3079                     !lmp_host_ssp_capable(hdev)) {
3080                         u8 ssp = 1;
3081
3082                         hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3083                 }
3084
3085                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
3086                         struct hci_cp_write_le_host_supported cp;
3087
3088                         cp.le = 1;
3089                         cp.simul = lmp_le_br_capable(hdev);
3090
3091                         /* Check first if we already have the right
3092                          * host state (host features set)
3093                          */
3094                         if (cp.le != lmp_host_le_capable(hdev) ||
3095                             cp.simul != lmp_host_le_br_capable(hdev))
3096                                 hci_send_cmd(hdev,
3097                                              HCI_OP_WRITE_LE_HOST_SUPPORTED,
3098                                              sizeof(cp), &cp);
3099                 }
3100
3101                 link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3102                 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3103                         hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE,
3104                                      sizeof(link_sec), &link_sec);
3105
3106                 if (lmp_bredr_capable(hdev)) {
3107                         set_bredr_scan(hdev);
3108                         update_class(hdev);
3109                         update_name(hdev, hdev->dev_name);
3110                         update_eir(hdev);
3111                 }
3112         } else {
3113                 u8 status = MGMT_STATUS_NOT_POWERED;
3114                 u8 zero_cod[] = { 0, 0, 0 };
3115
3116                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3117
3118                 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3119                         mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3120                                    zero_cod, sizeof(zero_cod), NULL);
3121         }
3122
3123         err = new_settings(hdev, match.sk);
3124
3125         if (match.sk)
3126                 sock_put(match.sk);
3127
3128         return err;
3129 }
3130
3131 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3132 {
3133         struct cmd_lookup match = { NULL, hdev };
3134         bool changed = false;
3135         int err = 0;
3136
3137         if (discoverable) {
3138                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3139                         changed = true;
3140         } else {
3141                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3142                         changed = true;
3143         }
3144
3145         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3146                              &match);
3147
3148         if (changed)
3149                 err = new_settings(hdev, match.sk);
3150
3151         if (match.sk)
3152                 sock_put(match.sk);
3153
3154         return err;
3155 }
3156
3157 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3158 {
3159         struct cmd_lookup match = { NULL, hdev };
3160         bool changed = false;
3161         int err = 0;
3162
3163         if (connectable) {
3164                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3165                         changed = true;
3166         } else {
3167                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3168                         changed = true;
3169         }
3170
3171         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
3172                              &match);
3173
3174         if (changed)
3175                 err = new_settings(hdev, match.sk);
3176
3177         if (match.sk)
3178                 sock_put(match.sk);
3179
3180         return err;
3181 }
3182
3183 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3184 {
3185         u8 mgmt_err = mgmt_status(status);
3186
3187         if (scan & SCAN_PAGE)
3188                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3189                                      cmd_status_rsp, &mgmt_err);
3190
3191         if (scan & SCAN_INQUIRY)
3192                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3193                                      cmd_status_rsp, &mgmt_err);
3194
3195         return 0;
3196 }
3197
3198 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3199                       bool persistent)
3200 {
3201         struct mgmt_ev_new_link_key ev;
3202
3203         memset(&ev, 0, sizeof(ev));
3204
3205         ev.store_hint = persistent;
3206         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3207         ev.key.addr.type = BDADDR_BREDR;
3208         ev.key.type = key->type;
3209         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3210         ev.key.pin_len = key->pin_len;
3211
3212         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3213 }
3214
3215 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3216 {
3217         struct mgmt_ev_new_long_term_key ev;
3218
3219         memset(&ev, 0, sizeof(ev));
3220
3221         ev.store_hint = persistent;
3222         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3223         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3224         ev.key.authenticated = key->authenticated;
3225         ev.key.enc_size = key->enc_size;
3226         ev.key.ediv = key->ediv;
3227
3228         if (key->type == HCI_SMP_LTK)
3229                 ev.key.master = 1;
3230
3231         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3232         memcpy(ev.key.val, key->val, sizeof(key->val));
3233
3234         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3235                           NULL);
3236 }
3237
3238 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3239                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3240                           u8 *dev_class)
3241 {
3242         char buf[512];
3243         struct mgmt_ev_device_connected *ev = (void *) buf;
3244         u16 eir_len = 0;
3245
3246         bacpy(&ev->addr.bdaddr, bdaddr);
3247         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3248
3249         ev->flags = __cpu_to_le32(flags);
3250
3251         if (name_len > 0)
3252                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3253                                           name, name_len);
3254
3255         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3256                 eir_len = eir_append_data(ev->eir, eir_len,
3257                                           EIR_CLASS_OF_DEV, dev_class, 3);
3258
3259         ev->eir_len = cpu_to_le16(eir_len);
3260
3261         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3262                           sizeof(*ev) + eir_len, NULL);
3263 }
3264
3265 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3266 {
3267         struct mgmt_cp_disconnect *cp = cmd->param;
3268         struct sock **sk = data;
3269         struct mgmt_rp_disconnect rp;
3270
3271         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3272         rp.addr.type = cp->addr.type;
3273
3274         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3275                      sizeof(rp));
3276
3277         *sk = cmd->sk;
3278         sock_hold(*sk);
3279
3280         mgmt_pending_remove(cmd);
3281 }
3282
3283 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3284 {
3285         struct hci_dev *hdev = data;
3286         struct mgmt_cp_unpair_device *cp = cmd->param;
3287         struct mgmt_rp_unpair_device rp;
3288
3289         memset(&rp, 0, sizeof(rp));
3290         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3291         rp.addr.type = cp->addr.type;
3292
3293         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3294
3295         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3296
3297         mgmt_pending_remove(cmd);
3298 }
3299
3300 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3301                              u8 link_type, u8 addr_type, u8 reason)
3302 {
3303         struct mgmt_ev_device_disconnected ev;
3304         struct sock *sk = NULL;
3305         int err;
3306
3307         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3308
3309         bacpy(&ev.addr.bdaddr, bdaddr);
3310         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3311         ev.reason = reason;
3312
3313         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3314                          sk);
3315
3316         if (sk)
3317                 sock_put(sk);
3318
3319         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3320                              hdev);
3321
3322         return err;
3323 }
3324
3325 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3326                            u8 link_type, u8 addr_type, u8 status)
3327 {
3328         struct mgmt_rp_disconnect rp;
3329         struct pending_cmd *cmd;
3330         int err;
3331
3332         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3333                              hdev);
3334
3335         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3336         if (!cmd)
3337                 return -ENOENT;
3338
3339         bacpy(&rp.addr.bdaddr, bdaddr);
3340         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3341
3342         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3343                            mgmt_status(status), &rp, sizeof(rp));
3344
3345         mgmt_pending_remove(cmd);
3346
3347         return err;
3348 }
3349
3350 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3351                         u8 addr_type, u8 status)
3352 {
3353         struct mgmt_ev_connect_failed ev;
3354
3355         bacpy(&ev.addr.bdaddr, bdaddr);
3356         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3357         ev.status = mgmt_status(status);
3358
3359         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3360 }
3361
3362 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3363 {
3364         struct mgmt_ev_pin_code_request ev;
3365
3366         bacpy(&ev.addr.bdaddr, bdaddr);
3367         ev.addr.type = BDADDR_BREDR;
3368         ev.secure = secure;
3369
3370         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3371                           NULL);
3372 }
3373
3374 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3375                                  u8 status)
3376 {
3377         struct pending_cmd *cmd;
3378         struct mgmt_rp_pin_code_reply rp;
3379         int err;
3380
3381         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3382         if (!cmd)
3383                 return -ENOENT;
3384
3385         bacpy(&rp.addr.bdaddr, bdaddr);
3386         rp.addr.type = BDADDR_BREDR;
3387
3388         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3389                            mgmt_status(status), &rp, sizeof(rp));
3390
3391         mgmt_pending_remove(cmd);
3392
3393         return err;
3394 }
3395
3396 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3397                                      u8 status)
3398 {
3399         struct pending_cmd *cmd;
3400         struct mgmt_rp_pin_code_reply rp;
3401         int err;
3402
3403         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3404         if (!cmd)
3405                 return -ENOENT;
3406
3407         bacpy(&rp.addr.bdaddr, bdaddr);
3408         rp.addr.type = BDADDR_BREDR;
3409
3410         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3411                            mgmt_status(status), &rp, sizeof(rp));
3412
3413         mgmt_pending_remove(cmd);
3414
3415         return err;
3416 }
3417
3418 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3419                               u8 link_type, u8 addr_type, __le32 value,
3420                               u8 confirm_hint)
3421 {
3422         struct mgmt_ev_user_confirm_request ev;
3423
3424         BT_DBG("%s", hdev->name);
3425
3426         bacpy(&ev.addr.bdaddr, bdaddr);
3427         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3428         ev.confirm_hint = confirm_hint;
3429         ev.value = value;
3430
3431         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3432                           NULL);
3433 }
3434
3435 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3436                               u8 link_type, u8 addr_type)
3437 {
3438         struct mgmt_ev_user_passkey_request ev;
3439
3440         BT_DBG("%s", hdev->name);
3441
3442         bacpy(&ev.addr.bdaddr, bdaddr);
3443         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3444
3445         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3446                           NULL);
3447 }
3448
3449 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3450                                       u8 link_type, u8 addr_type, u8 status,
3451                                       u8 opcode)
3452 {
3453         struct pending_cmd *cmd;
3454         struct mgmt_rp_user_confirm_reply rp;
3455         int err;
3456
3457         cmd = mgmt_pending_find(opcode, hdev);
3458         if (!cmd)
3459                 return -ENOENT;
3460
3461         bacpy(&rp.addr.bdaddr, bdaddr);
3462         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3463         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3464                            &rp, sizeof(rp));
3465
3466         mgmt_pending_remove(cmd);
3467
3468         return err;
3469 }
3470
3471 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3472                                      u8 link_type, u8 addr_type, u8 status)
3473 {
3474         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3475                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3476 }
3477
3478 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3479                                          u8 link_type, u8 addr_type, u8 status)
3480 {
3481         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3482                                           status,
3483                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3484 }
3485
3486 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3487                                      u8 link_type, u8 addr_type, u8 status)
3488 {
3489         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3490                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3491 }
3492
3493 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3494                                          u8 link_type, u8 addr_type, u8 status)
3495 {
3496         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3497                                           status,
3498                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3499 }
3500
3501 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3502                              u8 link_type, u8 addr_type, u32 passkey,
3503                              u8 entered)
3504 {
3505         struct mgmt_ev_passkey_notify ev;
3506
3507         BT_DBG("%s", hdev->name);
3508
3509         bacpy(&ev.addr.bdaddr, bdaddr);
3510         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3511         ev.passkey = __cpu_to_le32(passkey);
3512         ev.entered = entered;
3513
3514         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3515 }
3516
3517 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3518                      u8 addr_type, u8 status)
3519 {
3520         struct mgmt_ev_auth_failed ev;
3521
3522         bacpy(&ev.addr.bdaddr, bdaddr);
3523         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3524         ev.status = mgmt_status(status);
3525
3526         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3527 }
3528
3529 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3530 {
3531         struct cmd_lookup match = { NULL, hdev };
3532         bool changed = false;
3533         int err = 0;
3534
3535         if (status) {
3536                 u8 mgmt_err = mgmt_status(status);
3537                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3538                                      cmd_status_rsp, &mgmt_err);
3539                 return 0;
3540         }
3541
3542         if (test_bit(HCI_AUTH, &hdev->flags)) {
3543                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3544                         changed = true;
3545         } else {
3546                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3547                         changed = true;
3548         }
3549
3550         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3551                              &match);
3552
3553         if (changed)
3554                 err = new_settings(hdev, match.sk);
3555
3556         if (match.sk)
3557                 sock_put(match.sk);
3558
3559         return err;
3560 }
3561
3562 static int clear_eir(struct hci_dev *hdev)
3563 {
3564         struct hci_cp_write_eir cp;
3565
3566         if (!lmp_ext_inq_capable(hdev))
3567                 return 0;
3568
3569         memset(hdev->eir, 0, sizeof(hdev->eir));
3570
3571         memset(&cp, 0, sizeof(cp));
3572
3573         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3574 }
3575
3576 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3577 {
3578         struct cmd_lookup match = { NULL, hdev };
3579         bool changed = false;
3580         int err = 0;
3581
3582         if (status) {
3583                 u8 mgmt_err = mgmt_status(status);
3584
3585                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3586                                                  &hdev->dev_flags))
3587                         err = new_settings(hdev, NULL);
3588
3589                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3590                                      &mgmt_err);
3591
3592                 return err;
3593         }
3594
3595         if (enable) {
3596                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3597                         changed = true;
3598         } else {
3599                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3600                         changed = true;
3601         }
3602
3603         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3604
3605         if (changed)
3606                 err = new_settings(hdev, match.sk);
3607
3608         if (match.sk)
3609                 sock_put(match.sk);
3610
3611         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3612                 update_eir(hdev);
3613         else
3614                 clear_eir(hdev);
3615
3616         return err;
3617 }
3618
3619 static void class_rsp(struct pending_cmd *cmd, void *data)
3620 {
3621         struct cmd_lookup *match = data;
3622
3623         cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3624                      match->hdev->dev_class, 3);
3625
3626         list_del(&cmd->list);
3627
3628         if (match->sk == NULL) {
3629                 match->sk = cmd->sk;
3630                 sock_hold(match->sk);
3631         }
3632
3633         mgmt_pending_free(cmd);
3634 }
3635
3636 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3637                                    u8 status)
3638 {
3639         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3640         int err = 0;
3641
3642         clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3643
3644         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3645         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3646         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3647
3648         if (!status)
3649                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3650                                  3, NULL);
3651
3652         if (match.sk)
3653                 sock_put(match.sk);
3654
3655         return err;
3656 }
3657
3658 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3659 {
3660         struct pending_cmd *cmd;
3661         struct mgmt_cp_set_local_name ev;
3662         bool changed = false;
3663         int err = 0;
3664
3665         if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3666                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3667                 changed = true;
3668         }
3669
3670         memset(&ev, 0, sizeof(ev));
3671         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3672         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3673
3674         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3675         if (!cmd)
3676                 goto send_event;
3677
3678         /* Always assume that either the short or the complete name has
3679          * changed if there was a pending mgmt command */
3680         changed = true;
3681
3682         if (status) {
3683                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3684                                  mgmt_status(status));
3685                 goto failed;
3686         }
3687
3688         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3689                            sizeof(ev));
3690         if (err < 0)
3691                 goto failed;
3692
3693 send_event:
3694         if (changed)
3695                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3696                                  sizeof(ev), cmd ? cmd->sk : NULL);
3697
3698         /* EIR is taken care of separately when powering on the
3699          * adapter so only update them here if this is a name change
3700          * unrelated to power on.
3701          */
3702         if (!test_bit(HCI_INIT, &hdev->flags))
3703                 update_eir(hdev);
3704
3705 failed:
3706         if (cmd)
3707                 mgmt_pending_remove(cmd);
3708         return err;
3709 }
3710
3711 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3712                                             u8 *randomizer, u8 status)
3713 {
3714         struct pending_cmd *cmd;
3715         int err;
3716
3717         BT_DBG("%s status %u", hdev->name, status);
3718
3719         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3720         if (!cmd)
3721                 return -ENOENT;
3722
3723         if (status) {
3724                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3725                                  mgmt_status(status));
3726         } else {
3727                 struct mgmt_rp_read_local_oob_data rp;
3728
3729                 memcpy(rp.hash, hash, sizeof(rp.hash));
3730                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3731
3732                 err = cmd_complete(cmd->sk, hdev->id,
3733                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3734                                    sizeof(rp));
3735         }
3736
3737         mgmt_pending_remove(cmd);
3738
3739         return err;
3740 }
3741
3742 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3743 {
3744         struct cmd_lookup match = { NULL, hdev };
3745         bool changed = false;
3746         int err = 0;
3747
3748         if (status) {
3749                 u8 mgmt_err = mgmt_status(status);
3750
3751                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3752                                                  &hdev->dev_flags))
3753                         err = new_settings(hdev, NULL);
3754
3755                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3756                                      &mgmt_err);
3757
3758                 return err;
3759         }
3760
3761         if (enable) {
3762                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3763                         changed = true;
3764         } else {
3765                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3766                         changed = true;
3767         }
3768
3769         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3770
3771         if (changed)
3772                 err = new_settings(hdev, match.sk);
3773
3774         if (match.sk)
3775                 sock_put(match.sk);
3776
3777         return err;
3778 }
3779
3780 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3781                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3782                       ssp, u8 *eir, u16 eir_len)
3783 {
3784         char buf[512];
3785         struct mgmt_ev_device_found *ev = (void *) buf;
3786         size_t ev_size;
3787
3788         /* Leave 5 bytes for a potential CoD field */
3789         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3790                 return -EINVAL;
3791
3792         memset(buf, 0, sizeof(buf));
3793
3794         bacpy(&ev->addr.bdaddr, bdaddr);
3795         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3796         ev->rssi = rssi;
3797         if (cfm_name)
3798                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
3799         if (!ssp)
3800                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
3801
3802         if (eir_len > 0)
3803                 memcpy(ev->eir, eir, eir_len);
3804
3805         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3806                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3807                                           dev_class, 3);
3808
3809         ev->eir_len = cpu_to_le16(eir_len);
3810         ev_size = sizeof(*ev) + eir_len;
3811
3812         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3813 }
3814
3815 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3816                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3817 {
3818         struct mgmt_ev_device_found *ev;
3819         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3820         u16 eir_len;
3821
3822         ev = (struct mgmt_ev_device_found *) buf;
3823
3824         memset(buf, 0, sizeof(buf));
3825
3826         bacpy(&ev->addr.bdaddr, bdaddr);
3827         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3828         ev->rssi = rssi;
3829
3830         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3831                                   name_len);
3832
3833         ev->eir_len = cpu_to_le16(eir_len);
3834
3835         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3836                           sizeof(*ev) + eir_len, NULL);
3837 }
3838
3839 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3840 {
3841         struct pending_cmd *cmd;
3842         u8 type;
3843         int err;
3844
3845         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3846
3847         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3848         if (!cmd)
3849                 return -ENOENT;
3850
3851         type = hdev->discovery.type;
3852
3853         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3854                            &type, sizeof(type));
3855         mgmt_pending_remove(cmd);
3856
3857         return err;
3858 }
3859
3860 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3861 {
3862         struct pending_cmd *cmd;
3863         int err;
3864
3865         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3866         if (!cmd)
3867                 return -ENOENT;
3868
3869         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3870                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3871         mgmt_pending_remove(cmd);
3872
3873         return err;
3874 }
3875
3876 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3877 {
3878         struct mgmt_ev_discovering ev;
3879         struct pending_cmd *cmd;
3880
3881         BT_DBG("%s discovering %u", hdev->name, discovering);
3882
3883         if (discovering)
3884                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3885         else
3886                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3887
3888         if (cmd != NULL) {
3889                 u8 type = hdev->discovery.type;
3890
3891                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3892                              sizeof(type));
3893                 mgmt_pending_remove(cmd);
3894         }
3895
3896         memset(&ev, 0, sizeof(ev));
3897         ev.type = hdev->discovery.type;
3898         ev.discovering = discovering;
3899
3900         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3901 }
3902
3903 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3904 {
3905         struct pending_cmd *cmd;
3906         struct mgmt_ev_device_blocked ev;
3907
3908         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3909
3910         bacpy(&ev.addr.bdaddr, bdaddr);
3911         ev.addr.type = type;
3912
3913         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3914                           cmd ? cmd->sk : NULL);
3915 }
3916
3917 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3918 {
3919         struct pending_cmd *cmd;
3920         struct mgmt_ev_device_unblocked ev;
3921
3922         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3923
3924         bacpy(&ev.addr.bdaddr, bdaddr);
3925         ev.addr.type = type;
3926
3927         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3928                           cmd ? cmd->sk : NULL);
3929 }
3930
3931 module_param(enable_hs, bool, 0644);
3932 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");