net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/kernel.h>
  28 #include <linux/uaccess.h>
  29 #include <linux/module.h>
  30 #include <asm/unaligned.h>
  31
  32 #include <net/bluetooth/bluetooth.h>
  33 #include <net/bluetooth/hci_core.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #include <net/bluetooth/smp.h>
  36
  37 bool enable_hs;
  38 bool enable_le;
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   0
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_PAIRABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81 };
  82
  83 static const u16 mgmt_events[] = {
  84         MGMT_EV_CONTROLLER_ERROR,
  85         MGMT_EV_INDEX_ADDED,
  86         MGMT_EV_INDEX_REMOVED,
  87         MGMT_EV_NEW_SETTINGS,
  88         MGMT_EV_CLASS_OF_DEV_CHANGED,
  89         MGMT_EV_LOCAL_NAME_CHANGED,
  90         MGMT_EV_NEW_LINK_KEY,
  91         MGMT_EV_NEW_LONG_TERM_KEY,
  92         MGMT_EV_DEVICE_CONNECTED,
  93         MGMT_EV_DEVICE_DISCONNECTED,
  94         MGMT_EV_CONNECT_FAILED,
  95         MGMT_EV_PIN_CODE_REQUEST,
  96         MGMT_EV_USER_CONFIRM_REQUEST,
  97         MGMT_EV_USER_PASSKEY_REQUEST,
  98         MGMT_EV_AUTH_FAILED,
  99         MGMT_EV_DEVICE_FOUND,
 100         MGMT_EV_DISCOVERING,
 101         MGMT_EV_DEVICE_BLOCKED,
 102         MGMT_EV_DEVICE_UNBLOCKED,
 103         MGMT_EV_DEVICE_UNPAIRED,
 104 };
 105
 106 /*
 107  * These LE scan and inquiry parameters were chosen according to LE General
 108  * Discovery Procedure specification.
 109  */
 110 #define LE_SCAN_TYPE                    0x01
 111 #define LE_SCAN_WIN                     0x12
 112 #define LE_SCAN_INT                     0x12
 113 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 114 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 115
 116 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 117 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 118
 119 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 120
 121 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 122                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 123
 124 struct pending_cmd {
 125         struct list_head list;
 126         u16 opcode;
 127         int index;
 128         void *param;
 129         struct sock *sk;
 130         void *user_data;
 131 };
 132
 133 /* HCI to MGMT error code conversion table */
 134 static u8 mgmt_status_table[] = {
 135         MGMT_STATUS_SUCCESS,
 136         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 137         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 138         MGMT_STATUS_FAILED,             /* Hardware Failure */
 139         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 140         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 141         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 142         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 143         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 145         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 146         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 147         MGMT_STATUS_BUSY,               /* Command Disallowed */
 148         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 149         MGMT_STATUS_REJECTED,           /* Rejected Security */
 150         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 151         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 152         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 153         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 154         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 155         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 156         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 157         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 158         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 159         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 160         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 161         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 162         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 163         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 164         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 165         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 166         MGMT_STATUS_FAILED,             /* Unspecified Error */
 167         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 168         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 169         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 170         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 171         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 172         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 173         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 175         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 176         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 177         MGMT_STATUS_FAILED,             /* Transaction Collision */
 178         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 179         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 180         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 181         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 182         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 183         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 184         MGMT_STATUS_FAILED,             /* Slot Violation */
 185         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 186         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 187         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 188         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 189         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 190         MGMT_STATUS_BUSY,               /* Controller Busy */
 191         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 192         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 193         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 194         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 195         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 196 };
 197
 198 static u8 mgmt_status(u8 hci_status)
 199 {
 200         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 201                 return mgmt_status_table[hci_status];
 202
 203         return MGMT_STATUS_FAILED;
 204 }
 205
 206 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 207 {
 208         struct sk_buff *skb;
 209         struct mgmt_hdr *hdr;
 210         struct mgmt_ev_cmd_status *ev;
 211         int err;
 212
 213         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 214
 215         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
 216         if (!skb)
 217                 return -ENOMEM;
 218
 219         hdr = (void *) skb_put(skb, sizeof(*hdr));
 220
 221         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 222         hdr->index = cpu_to_le16(index);
 223         hdr->len = cpu_to_le16(sizeof(*ev));
 224
 225         ev = (void *) skb_put(skb, sizeof(*ev));
 226         ev->status = status;
 227         put_unaligned_le16(cmd, &ev->opcode);
 228
 229         err = sock_queue_rcv_skb(sk, skb);
 230         if (err < 0)
 231                 kfree_skb(skb);
 232
 233         return err;
 234 }
 235
 236 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 237                         void *rp, size_t rp_len)
 238 {
 239         struct sk_buff *skb;
 240         struct mgmt_hdr *hdr;
 241         struct mgmt_ev_cmd_complete *ev;
 242         int err;
 243
 244         BT_DBG("sock %p", sk);
 245
 246         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
 247         if (!skb)
 248                 return -ENOMEM;
 249
 250         hdr = (void *) skb_put(skb, sizeof(*hdr));
 251
 252         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 253         hdr->index = cpu_to_le16(index);
 254         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 255
 256         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 257         put_unaligned_le16(cmd, &ev->opcode);
 258         ev->status = status;
 259
 260         if (rp)
 261                 memcpy(ev->data, rp, rp_len);
 262
 263         err = sock_queue_rcv_skb(sk, skb);
 264         if (err < 0)
 265                 kfree_skb(skb);
 266
 267         return err;
 268 }
 269
 270 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 271                         u16 data_len)
 272 {
 273         struct mgmt_rp_read_version rp;
 274
 275         BT_DBG("sock %p", sk);
 276
 277         rp.version = MGMT_VERSION;
 278         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 279
 280         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 281                             sizeof(rp));
 282 }
 283
 284 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 285                          u16 data_len)
 286 {
 287         struct mgmt_rp_read_commands *rp;
 288         u16 num_commands = ARRAY_SIZE(mgmt_commands);
 289         u16 num_events = ARRAY_SIZE(mgmt_events);
 290         u16 *opcode;
 291         size_t rp_size;
 292         int i, err;
 293
 294         BT_DBG("sock %p", sk);
 295
 296         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 297
 298         rp = kmalloc(rp_size, GFP_KERNEL);
 299         if (!rp)
 300                 return -ENOMEM;
 301
 302         put_unaligned_le16(num_commands, &rp->num_commands);
 303         put_unaligned_le16(num_events, &rp->num_events);
 304
 305         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 306                 put_unaligned_le16(mgmt_commands[i], opcode);
 307
 308         for (i = 0; i < num_events; i++, opcode++)
 309                 put_unaligned_le16(mgmt_events[i], opcode);
 310
 311         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 312                            rp_size);
 313         kfree(rp);
 314
 315         return err;
 316 }
 317
 318 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 319                            u16 data_len)
 320 {
 321         struct mgmt_rp_read_index_list *rp;
 322         struct list_head *p;
 323         struct hci_dev *d;
 324         size_t rp_len;
 325         u16 count;
 326         int i, err;
 327
 328         BT_DBG("sock %p", sk);
 329
 330         read_lock(&hci_dev_list_lock);
 331
 332         count = 0;
 333         list_for_each(p, &hci_dev_list) {
 334                 count++;
 335         }
 336
 337         rp_len = sizeof(*rp) + (2 * count);
 338         rp = kmalloc(rp_len, GFP_ATOMIC);
 339         if (!rp) {
 340                 read_unlock(&hci_dev_list_lock);
 341                 return -ENOMEM;
 342         }
 343
 344         put_unaligned_le16(count, &rp->num_controllers);
 345
 346         i = 0;
 347         list_for_each_entry(d, &hci_dev_list, list) {
 348                 if (test_bit(HCI_SETUP, &d->dev_flags))
 349                         continue;
 350
 351                 put_unaligned_le16(d->id, &rp->index[i++]);
 352                 BT_DBG("Added hci%u", d->id);
 353         }
 354
 355         read_unlock(&hci_dev_list_lock);
 356
 357         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 358                            rp_len);
 359
 360         kfree(rp);
 361
 362         return err;
 363 }
 364
 365 static u32 get_supported_settings(struct hci_dev *hdev)
 366 {
 367         u32 settings = 0;
 368
 369         settings |= MGMT_SETTING_POWERED;
 370         settings |= MGMT_SETTING_CONNECTABLE;
 371         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 372         settings |= MGMT_SETTING_DISCOVERABLE;
 373         settings |= MGMT_SETTING_PAIRABLE;
 374
 375         if (hdev->features[6] & LMP_SIMPLE_PAIR)
 376                 settings |= MGMT_SETTING_SSP;
 377
 378         if (!(hdev->features[4] & LMP_NO_BREDR)) {
 379                 settings |= MGMT_SETTING_BREDR;
 380                 settings |= MGMT_SETTING_LINK_SECURITY;
 381         }
 382
 383         if (enable_hs)
 384                 settings |= MGMT_SETTING_HS;
 385
 386         if (enable_le) {
 387                 if (hdev->features[4] & LMP_LE)
 388                         settings |= MGMT_SETTING_LE;
 389         }
 390
 391         return settings;
 392 }
 393
 394 static u32 get_current_settings(struct hci_dev *hdev)
 395 {
 396         u32 settings = 0;
 397
 398         if (hdev_is_powered(hdev))
 399                 settings |= MGMT_SETTING_POWERED;
 400
 401         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 402                 settings |= MGMT_SETTING_CONNECTABLE;
 403
 404         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 405                 settings |= MGMT_SETTING_DISCOVERABLE;
 406
 407         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 408                 settings |= MGMT_SETTING_PAIRABLE;
 409
 410         if (!(hdev->features[4] & LMP_NO_BREDR))
 411                 settings |= MGMT_SETTING_BREDR;
 412
 413         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 414                 settings |= MGMT_SETTING_LE;
 415
 416         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 417                 settings |= MGMT_SETTING_LINK_SECURITY;
 418
 419         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 420                 settings |= MGMT_SETTING_SSP;
 421
 422         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 423                 settings |= MGMT_SETTING_HS;
 424
 425         return settings;
 426 }
 427
 428 #define PNP_INFO_SVCLASS_ID             0x1200
 429
 430 static u8 bluetooth_base_uuid[] = {
 431                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 432                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 433 };
 434
 435 static u16 get_uuid16(u8 *uuid128)
 436 {
 437         u32 val;
 438         int i;
 439
 440         for (i = 0; i < 12; i++) {
 441                 if (bluetooth_base_uuid[i] != uuid128[i])
 442                         return 0;
 443         }
 444
 445         memcpy(&val, &uuid128[12], 4);
 446
 447         val = le32_to_cpu(val);
 448         if (val > 0xffff)
 449                 return 0;
 450
 451         return (u16) val;
 452 }
 453
 454 static void create_eir(struct hci_dev *hdev, u8 *data)
 455 {
 456         u8 *ptr = data;
 457         u16 eir_len = 0;
 458         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 459         int i, truncated = 0;
 460         struct bt_uuid *uuid;
 461         size_t name_len;
 462
 463         name_len = strlen(hdev->dev_name);
 464
 465         if (name_len > 0) {
 466                 /* EIR Data type */
 467                 if (name_len > 48) {
 468                         name_len = 48;
 469                         ptr[1] = EIR_NAME_SHORT;
 470                 } else
 471                         ptr[1] = EIR_NAME_COMPLETE;
 472
 473                 /* EIR Data length */
 474                 ptr[0] = name_len + 1;
 475
 476                 memcpy(ptr + 2, hdev->dev_name, name_len);
 477
 478                 eir_len += (name_len + 2);
 479                 ptr += (name_len + 2);
 480         }
 481
 482         memset(uuid16_list, 0, sizeof(uuid16_list));
 483
 484         /* Group all UUID16 types */
 485         list_for_each_entry(uuid, &hdev->uuids, list) {
 486                 u16 uuid16;
 487
 488                 uuid16 = get_uuid16(uuid->uuid);
 489                 if (uuid16 == 0)
 490                         return;
 491
 492                 if (uuid16 < 0x1100)
 493                         continue;
 494
 495                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 496                         continue;
 497
 498                 /* Stop if not enough space to put next UUID */
 499                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 500                         truncated = 1;
 501                         break;
 502                 }
 503
 504                 /* Check for duplicates */
 505                 for (i = 0; uuid16_list[i] != 0; i++)
 506                         if (uuid16_list[i] == uuid16)
 507                                 break;
 508
 509                 if (uuid16_list[i] == 0) {
 510                         uuid16_list[i] = uuid16;
 511                         eir_len += sizeof(u16);
 512                 }
 513         }
 514
 515         if (uuid16_list[0] != 0) {
 516                 u8 *length = ptr;
 517
 518                 /* EIR Data type */
 519                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 520
 521                 ptr += 2;
 522                 eir_len += 2;
 523
 524                 for (i = 0; uuid16_list[i] != 0; i++) {
 525                         *ptr++ = (uuid16_list[i] & 0x00ff);
 526                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 527                 }
 528
 529                 /* EIR Data length */
 530                 *length = (i * sizeof(u16)) + 1;
 531         }
 532 }
 533
 534 static int update_eir(struct hci_dev *hdev)
 535 {
 536         struct hci_cp_write_eir cp;
 537
 538         if (!hdev_is_powered(hdev))
 539                 return 0;
 540
 541         if (!(hdev->features[6] & LMP_EXT_INQ))
 542                 return 0;
 543
 544         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 545                 return 0;
 546
 547         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 548                 return 0;
 549
 550         memset(&cp, 0, sizeof(cp));
 551
 552         create_eir(hdev, cp.data);
 553
 554         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 555                 return 0;
 556
 557         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 558
 559         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 560 }
 561
 562 static u8 get_service_classes(struct hci_dev *hdev)
 563 {
 564         struct bt_uuid *uuid;
 565         u8 val = 0;
 566
 567         list_for_each_entry(uuid, &hdev->uuids, list)
 568                 val |= uuid->svc_hint;
 569
 570         return val;
 571 }
 572
 573 static int update_class(struct hci_dev *hdev)
 574 {
 575         u8 cod[3];
 576         int err;
 577
 578         BT_DBG("%s", hdev->name);
 579
 580         if (!hdev_is_powered(hdev))
 581                 return 0;
 582
 583         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 584                 return 0;
 585
 586         cod[0] = hdev->minor_class;
 587         cod[1] = hdev->major_class;
 588         cod[2] = get_service_classes(hdev);
 589
 590         if (memcmp(cod, hdev->dev_class, 3) == 0)
 591                 return 0;
 592
 593         err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 594         if (err == 0)
 595                 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
 596
 597         return err;
 598 }
 599
 600 static void service_cache_off(struct work_struct *work)
 601 {
 602         struct hci_dev *hdev = container_of(work, struct hci_dev,
 603                                             service_cache.work);
 604
 605         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 606                 return;
 607
 608         hci_dev_lock(hdev);
 609
 610         update_eir(hdev);
 611         update_class(hdev);
 612
 613         hci_dev_unlock(hdev);
 614 }
 615
 616 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 617 {
 618         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 619                 return;
 620
 621         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 622
 623         /* Non-mgmt controlled devices get this bit set
 624          * implicitly so that pairing works for them, however
 625          * for mgmt we require user-space to explicitly enable
 626          * it
 627          */
 628         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 629 }
 630
 631 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 632                                 void *data, u16 data_len)
 633 {
 634         struct mgmt_rp_read_info rp;
 635
 636         BT_DBG("sock %p %s", sk, hdev->name);
 637
 638         hci_dev_lock(hdev);
 639
 640         memset(&rp, 0, sizeof(rp));
 641
 642         bacpy(&rp.bdaddr, &hdev->bdaddr);
 643
 644         rp.version = hdev->hci_ver;
 645
 646         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 647
 648         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 649         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 650
 651         memcpy(rp.dev_class, hdev->dev_class, 3);
 652
 653         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 654         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 655
 656         hci_dev_unlock(hdev);
 657
 658         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 659                             sizeof(rp));
 660 }
 661
 662 static void mgmt_pending_free(struct pending_cmd *cmd)
 663 {
 664         sock_put(cmd->sk);
 665         kfree(cmd->param);
 666         kfree(cmd);
 667 }
 668
 669 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 670                                             struct hci_dev *hdev, void *data,
 671                                             u16 len)
 672 {
 673         struct pending_cmd *cmd;
 674
 675         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 676         if (!cmd)
 677                 return NULL;
 678
 679         cmd->opcode = opcode;
 680         cmd->index = hdev->id;
 681
 682         cmd->param = kmalloc(len, GFP_ATOMIC);
 683         if (!cmd->param) {
 684                 kfree(cmd);
 685                 return NULL;
 686         }
 687
 688         if (data)
 689                 memcpy(cmd->param, data, len);
 690
 691         cmd->sk = sk;
 692         sock_hold(sk);
 693
 694         list_add(&cmd->list, &hdev->mgmt_pending);
 695
 696         return cmd;
 697 }
 698
 699 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 700                                  void (*cb)(struct pending_cmd *cmd, void *data),
 701                                  void *data)
 702 {
 703         struct list_head *p, *n;
 704
 705         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 706                 struct pending_cmd *cmd;
 707
 708                 cmd = list_entry(p, struct pending_cmd, list);
 709
 710                 if (opcode > 0 && cmd->opcode != opcode)
 711                         continue;
 712
 713                 cb(cmd, data);
 714         }
 715 }
 716
 717 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 718 {
 719         struct pending_cmd *cmd;
 720
 721         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 722                 if (cmd->opcode == opcode)
 723                         return cmd;
 724         }
 725
 726         return NULL;
 727 }
 728
 729 static void mgmt_pending_remove(struct pending_cmd *cmd)
 730 {
 731         list_del(&cmd->list);
 732         mgmt_pending_free(cmd);
 733 }
 734
 735 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 736 {
 737         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 738
 739         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 740                             sizeof(settings));
 741 }
 742
 743 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 744                        u16 len)
 745 {
 746         struct mgmt_mode *cp = data;
 747         struct pending_cmd *cmd;
 748         int err;
 749
 750         BT_DBG("request for %s", hdev->name);
 751
 752         hci_dev_lock(hdev);
 753
 754         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 755                 cancel_delayed_work(&hdev->power_off);
 756
 757                 if (cp->val) {
 758                         err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 759                         mgmt_powered(hdev, 1);
 760                         goto failed;
 761                 }
 762         }
 763
 764         if (!!cp->val == hdev_is_powered(hdev)) {
 765                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 766                 goto failed;
 767         }
 768
 769         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 770                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 771                                  MGMT_STATUS_BUSY);
 772                 goto failed;
 773         }
 774
 775         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 776         if (!cmd) {
 777                 err = -ENOMEM;
 778                 goto failed;
 779         }
 780
 781         if (cp->val)
 782                 schedule_work(&hdev->power_on);
 783         else
 784                 schedule_work(&hdev->power_off.work);
 785
 786         err = 0;
 787
 788 failed:
 789         hci_dev_unlock(hdev);
 790         return err;
 791 }
 792
 793 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 794                       struct sock *skip_sk)
 795 {
 796         struct sk_buff *skb;
 797         struct mgmt_hdr *hdr;
 798
 799         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 800         if (!skb)
 801                 return -ENOMEM;
 802
 803         hdr = (void *) skb_put(skb, sizeof(*hdr));
 804         hdr->opcode = cpu_to_le16(event);
 805         if (hdev)
 806                 hdr->index = cpu_to_le16(hdev->id);
 807         else
 808                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 809         hdr->len = cpu_to_le16(data_len);
 810
 811         if (data)
 812                 memcpy(skb_put(skb, data_len), data, data_len);
 813
 814         /* Time stamp */
 815         __net_timestamp(skb);
 816
 817         hci_send_to_control(skb, skip_sk);
 818         kfree_skb(skb);
 819
 820         return 0;
 821 }
 822
 823 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 824 {
 825         __le32 ev;
 826
 827         ev = cpu_to_le32(get_current_settings(hdev));
 828
 829         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 830 }
 831
 832 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 833                             u16 len)
 834 {
 835         struct mgmt_cp_set_discoverable *cp = data;
 836         struct pending_cmd *cmd;
 837         u16 timeout;
 838         u8 scan;
 839         int err;
 840
 841         BT_DBG("request for %s", hdev->name);
 842
 843         timeout = get_unaligned_le16(&cp->timeout);
 844         if (!cp->val && timeout > 0)
 845                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 846                                   MGMT_STATUS_INVALID_PARAMS);
 847
 848         hci_dev_lock(hdev);
 849
 850         if (!hdev_is_powered(hdev) && timeout > 0) {
 851                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 852                                  MGMT_STATUS_NOT_POWERED);
 853                 goto failed;
 854         }
 855
 856         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 857                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 858                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 859                                  MGMT_STATUS_BUSY);
 860                 goto failed;
 861         }
 862
 863         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 864                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 865                                  MGMT_STATUS_REJECTED);
 866                 goto failed;
 867         }
 868
 869         if (!hdev_is_powered(hdev)) {
 870                 bool changed = false;
 871
 872                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 873                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 874                         changed = true;
 875                 }
 876
 877                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 878                 if (err < 0)
 879                         goto failed;
 880
 881                 if (changed)
 882                         err = new_settings(hdev, sk);
 883
 884                 goto failed;
 885         }
 886
 887         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 888                 if (hdev->discov_timeout > 0) {
 889                         cancel_delayed_work(&hdev->discov_off);
 890                         hdev->discov_timeout = 0;
 891                 }
 892
 893                 if (cp->val && timeout > 0) {
 894                         hdev->discov_timeout = timeout;
 895                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 896                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 897                 }
 898
 899                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 900                 goto failed;
 901         }
 902
 903         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 904         if (!cmd) {
 905                 err = -ENOMEM;
 906                 goto failed;
 907         }
 908
 909         scan = SCAN_PAGE;
 910
 911         if (cp->val)
 912                 scan |= SCAN_INQUIRY;
 913         else
 914                 cancel_delayed_work(&hdev->discov_off);
 915
 916         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 917         if (err < 0)
 918                 mgmt_pending_remove(cmd);
 919
 920         if (cp->val)
 921                 hdev->discov_timeout = timeout;
 922
 923 failed:
 924         hci_dev_unlock(hdev);
 925         return err;
 926 }
 927
 928 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
 929                            u16 len)
 930 {
 931         struct mgmt_mode *cp = data;
 932         struct pending_cmd *cmd;
 933         u8 scan;
 934         int err;
 935
 936         BT_DBG("request for %s", hdev->name);
 937
 938         hci_dev_lock(hdev);
 939
 940         if (!hdev_is_powered(hdev)) {
 941                 bool changed = false;
 942
 943                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 944                         changed = true;
 945
 946                 if (cp->val) {
 947                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 948                 } else {
 949                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 950                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 951                 }
 952
 953                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 954                 if (err < 0)
 955                         goto failed;
 956
 957                 if (changed)
 958                         err = new_settings(hdev, sk);
 959
 960                 goto failed;
 961         }
 962
 963         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 964                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 965                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
 966                                  MGMT_STATUS_BUSY);
 967                 goto failed;
 968         }
 969
 970         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 971                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 972                 goto failed;
 973         }
 974
 975         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
 976         if (!cmd) {
 977                 err = -ENOMEM;
 978                 goto failed;
 979         }
 980
 981         if (cp->val) {
 982                 scan = SCAN_PAGE;
 983         } else {
 984                 scan = 0;
 985
 986                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
 987                                                 hdev->discov_timeout > 0)
 988                         cancel_delayed_work(&hdev->discov_off);
 989         }
 990
 991         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 992         if (err < 0)
 993                 mgmt_pending_remove(cmd);
 994
 995 failed:
 996         hci_dev_unlock(hdev);
 997         return err;
 998 }
 999
1000 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1001                         u16 len)
1002 {
1003         struct mgmt_mode *cp = data;
1004         int err;
1005
1006         BT_DBG("request for %s", hdev->name);
1007
1008         hci_dev_lock(hdev);
1009
1010         if (cp->val)
1011                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1012         else
1013                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1014
1015         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1016         if (err < 0)
1017                 goto failed;
1018
1019         err = new_settings(hdev, sk);
1020
1021 failed:
1022         hci_dev_unlock(hdev);
1023         return err;
1024 }
1025
1026 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1027                              u16 len)
1028 {
1029         struct mgmt_mode *cp = data;
1030         struct pending_cmd *cmd;
1031         u8 val;
1032         int err;
1033
1034         BT_DBG("request for %s", hdev->name);
1035
1036         hci_dev_lock(hdev);
1037
1038         if (!hdev_is_powered(hdev)) {
1039                 bool changed = false;
1040
1041                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1042                                                         &hdev->dev_flags)) {
1043                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1044                         changed = true;
1045                 }
1046
1047                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1048                 if (err < 0)
1049                         goto failed;
1050
1051                 if (changed)
1052                         err = new_settings(hdev, sk);
1053
1054                 goto failed;
1055         }
1056
1057         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1058                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1059                                  MGMT_STATUS_BUSY);
1060                 goto failed;
1061         }
1062
1063         val = !!cp->val;
1064
1065         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1066                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1067                 goto failed;
1068         }
1069
1070         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1071         if (!cmd) {
1072                 err = -ENOMEM;
1073                 goto failed;
1074         }
1075
1076         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1077         if (err < 0) {
1078                 mgmt_pending_remove(cmd);
1079                 goto failed;
1080         }
1081
1082 failed:
1083         hci_dev_unlock(hdev);
1084         return err;
1085 }
1086
1087 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1088 {
1089         struct mgmt_mode *cp = data;
1090         struct pending_cmd *cmd;
1091         u8 val;
1092         int err;
1093
1094         BT_DBG("request for %s", hdev->name);
1095
1096         hci_dev_lock(hdev);
1097
1098         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1099                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1100                                  MGMT_STATUS_NOT_SUPPORTED);
1101                 goto failed;
1102         }
1103
1104         val = !!cp->val;
1105
1106         if (!hdev_is_powered(hdev)) {
1107                 bool changed = false;
1108
1109                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1110                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1111                         changed = true;
1112                 }
1113
1114                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1115                 if (err < 0)
1116                         goto failed;
1117
1118                 if (changed)
1119                         err = new_settings(hdev, sk);
1120
1121                 goto failed;
1122         }
1123
1124         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1125              err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1126                               MGMT_STATUS_BUSY);
1127                 goto failed;
1128         }
1129
1130         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1131                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1132                 goto failed;
1133         }
1134
1135         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1136         if (!cmd) {
1137                 err = -ENOMEM;
1138                 goto failed;
1139         }
1140
1141         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1142         if (err < 0) {
1143                 mgmt_pending_remove(cmd);
1144                 goto failed;
1145         }
1146
1147 failed:
1148         hci_dev_unlock(hdev);
1149         return err;
1150 }
1151
1152 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1153 {
1154         struct mgmt_mode *cp = data;
1155
1156         BT_DBG("request for %s", hdev->name);
1157
1158         if (!enable_hs)
1159                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1160                                   MGMT_STATUS_NOT_SUPPORTED);
1161
1162         if (cp->val)
1163                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1164         else
1165                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1166
1167         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1168 }
1169
1170 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1171 {
1172         struct mgmt_mode *cp = data;
1173         struct hci_cp_write_le_host_supported hci_cp;
1174         struct pending_cmd *cmd;
1175         int err;
1176         u8 val, enabled;
1177
1178         BT_DBG("request for %s", hdev->name);
1179
1180         hci_dev_lock(hdev);
1181
1182         if (!enable_le || !(hdev->features[4] & LMP_LE)) {
1183                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1184                                  MGMT_STATUS_NOT_SUPPORTED);
1185                 goto unlock;
1186         }
1187
1188         val = !!cp->val;
1189         enabled = !!(hdev->host_features[0] & LMP_HOST_LE);
1190
1191         if (!hdev_is_powered(hdev) || val == enabled) {
1192                 bool changed = false;
1193
1194                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1195                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1196                         changed = true;
1197                 }
1198
1199                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1200                 if (err < 0)
1201                         goto unlock;
1202
1203                 if (changed)
1204                         err = new_settings(hdev, sk);
1205
1206                 goto unlock;
1207         }
1208
1209         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1210                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1211                                  MGMT_STATUS_BUSY);
1212                 goto unlock;
1213         }
1214
1215         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1216         if (!cmd) {
1217                 err = -ENOMEM;
1218                 goto unlock;
1219         }
1220
1221         memset(&hci_cp, 0, sizeof(hci_cp));
1222
1223         if (val) {
1224                 hci_cp.le = val;
1225                 hci_cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
1226         }
1227
1228         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1229                            &hci_cp);
1230         if (err < 0) {
1231                 mgmt_pending_remove(cmd);
1232                 goto unlock;
1233         }
1234
1235 unlock:
1236         hci_dev_unlock(hdev);
1237         return err;
1238 }
1239
1240 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1241 {
1242         struct mgmt_cp_add_uuid *cp = data;
1243         struct pending_cmd *cmd;
1244         struct bt_uuid *uuid;
1245         int err;
1246
1247         BT_DBG("request for %s", hdev->name);
1248
1249         hci_dev_lock(hdev);
1250
1251         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1252                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1253                                  MGMT_STATUS_BUSY);
1254                 goto failed;
1255         }
1256
1257         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
1258         if (!uuid) {
1259                 err = -ENOMEM;
1260                 goto failed;
1261         }
1262
1263         memcpy(uuid->uuid, cp->uuid, 16);
1264         uuid->svc_hint = cp->svc_hint;
1265
1266         list_add(&uuid->list, &hdev->uuids);
1267
1268         err = update_class(hdev);
1269         if (err < 0)
1270                 goto failed;
1271
1272         err = update_eir(hdev);
1273         if (err < 0)
1274                 goto failed;
1275
1276         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1277                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1278                                    hdev->dev_class, 3);
1279                 goto failed;
1280         }
1281
1282         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1283         if (!cmd) {
1284                 err = -ENOMEM;
1285                 goto failed;
1286         }
1287
1288 failed:
1289         hci_dev_unlock(hdev);
1290         return err;
1291 }
1292
1293 static bool enable_service_cache(struct hci_dev *hdev)
1294 {
1295         if (!hdev_is_powered(hdev))
1296                 return false;
1297
1298         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1299                 schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
1300                 return true;
1301         }
1302
1303         return false;
1304 }
1305
1306 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1307                                                                 u16 len)
1308 {
1309         struct mgmt_cp_remove_uuid *cp = data;
1310         struct pending_cmd *cmd;
1311         struct list_head *p, *n;
1312         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1313         int err, found;
1314
1315         BT_DBG("request for %s", hdev->name);
1316
1317         hci_dev_lock(hdev);
1318
1319         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1320                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1321                                  MGMT_STATUS_BUSY);
1322                 goto unlock;
1323         }
1324
1325         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1326                 err = hci_uuids_clear(hdev);
1327
1328                 if (enable_service_cache(hdev)) {
1329                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1330                                            0, hdev->dev_class, 3);
1331                         goto unlock;
1332                 }
1333
1334                 goto update_class;
1335         }
1336
1337         found = 0;
1338
1339         list_for_each_safe(p, n, &hdev->uuids) {
1340                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1341
1342                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1343                         continue;
1344
1345                 list_del(&match->list);
1346                 found++;
1347         }
1348
1349         if (found == 0) {
1350                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1351                                  MGMT_STATUS_INVALID_PARAMS);
1352                 goto unlock;
1353         }
1354
1355 update_class:
1356         err = update_class(hdev);
1357         if (err < 0)
1358                 goto unlock;
1359
1360         err = update_eir(hdev);
1361         if (err < 0)
1362                 goto unlock;
1363
1364         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1365                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1366                                    hdev->dev_class, 3);
1367                 goto unlock;
1368         }
1369
1370         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1371         if (!cmd) {
1372                 err = -ENOMEM;
1373                 goto unlock;
1374         }
1375
1376 unlock:
1377         hci_dev_unlock(hdev);
1378         return err;
1379 }
1380
1381 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1382                          u16 len)
1383 {
1384         struct mgmt_cp_set_dev_class *cp = data;
1385         struct pending_cmd *cmd;
1386         int err;
1387
1388         BT_DBG("request for %s", hdev->name);
1389
1390         hci_dev_lock(hdev);
1391
1392         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1393                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1394                                  MGMT_STATUS_BUSY);
1395                 goto unlock;
1396         }
1397
1398         hdev->major_class = cp->major;
1399         hdev->minor_class = cp->minor;
1400
1401         if (!hdev_is_powered(hdev)) {
1402                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1403                                    hdev->dev_class, 3);
1404                 goto unlock;
1405         }
1406
1407         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1408                 hci_dev_unlock(hdev);
1409                 cancel_delayed_work_sync(&hdev->service_cache);
1410                 hci_dev_lock(hdev);
1411                 update_eir(hdev);
1412         }
1413
1414         err = update_class(hdev);
1415         if (err < 0)
1416                 goto unlock;
1417
1418         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1419                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1420                                    hdev->dev_class, 3);
1421                 goto unlock;
1422         }
1423
1424         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1425         if (!cmd) {
1426                 err = -ENOMEM;
1427                 goto unlock;
1428         }
1429
1430 unlock:
1431         hci_dev_unlock(hdev);
1432         return err;
1433 }
1434
1435 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1436                                                                 u16 len)
1437 {
1438         struct mgmt_cp_load_link_keys *cp = data;
1439         u16 key_count, expected_len;
1440         int i;
1441
1442         key_count = get_unaligned_le16(&cp->key_count);
1443
1444         expected_len = sizeof(*cp) + key_count *
1445                                         sizeof(struct mgmt_link_key_info);
1446         if (expected_len != len) {
1447                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1448                                                         len, expected_len);
1449                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1450                                   MGMT_STATUS_INVALID_PARAMS);
1451         }
1452
1453         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1454                                                                 key_count);
1455
1456         hci_dev_lock(hdev);
1457
1458         hci_link_keys_clear(hdev);
1459
1460         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1461
1462         if (cp->debug_keys)
1463                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1464         else
1465                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1466
1467         for (i = 0; i < key_count; i++) {
1468                 struct mgmt_link_key_info *key = &cp->keys[i];
1469
1470                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1471                                  key->type, key->pin_len);
1472         }
1473
1474         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1475
1476         hci_dev_unlock(hdev);
1477
1478         return 0;
1479 }
1480
1481 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1482                            u8 addr_type, struct sock *skip_sk)
1483 {
1484         struct mgmt_ev_device_unpaired ev;
1485
1486         bacpy(&ev.addr.bdaddr, bdaddr);
1487         ev.addr.type = addr_type;
1488
1489         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1490                           skip_sk);
1491 }
1492
1493 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1494                          u16 len)
1495 {
1496         struct mgmt_cp_unpair_device *cp = data;
1497         struct mgmt_rp_unpair_device rp;
1498         struct hci_cp_disconnect dc;
1499         struct pending_cmd *cmd;
1500         struct hci_conn *conn;
1501         int err;
1502
1503         hci_dev_lock(hdev);
1504
1505         memset(&rp, 0, sizeof(rp));
1506         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1507         rp.addr.type = cp->addr.type;
1508
1509         if (!hdev_is_powered(hdev)) {
1510                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1511                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1512                 goto unlock;
1513         }
1514
1515         if (cp->addr.type == MGMT_ADDR_BREDR)
1516                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1517         else
1518                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1519
1520         if (err < 0) {
1521                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1522                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1523                 goto unlock;
1524         }
1525
1526         if (cp->disconnect) {
1527                 if (cp->addr.type == MGMT_ADDR_BREDR)
1528                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1529                                                         &cp->addr.bdaddr);
1530                 else
1531                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1532                                                         &cp->addr.bdaddr);
1533         } else {
1534                 conn = NULL;
1535         }
1536
1537         if (!conn) {
1538                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1539                                    &rp, sizeof(rp));
1540                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1541                 goto unlock;
1542         }
1543
1544         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1545                                sizeof(*cp));
1546         if (!cmd) {
1547                 err = -ENOMEM;
1548                 goto unlock;
1549         }
1550
1551         put_unaligned_le16(conn->handle, &dc.handle);
1552         dc.reason = 0x13; /* Remote User Terminated Connection */
1553         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1554         if (err < 0)
1555                 mgmt_pending_remove(cmd);
1556
1557 unlock:
1558         hci_dev_unlock(hdev);
1559         return err;
1560 }
1561
1562 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1563                       u16 len)
1564 {
1565         struct mgmt_cp_disconnect *cp = data;
1566         struct hci_cp_disconnect dc;
1567         struct pending_cmd *cmd;
1568         struct hci_conn *conn;
1569         int err;
1570
1571         BT_DBG("");
1572
1573         hci_dev_lock(hdev);
1574
1575         if (!test_bit(HCI_UP, &hdev->flags)) {
1576                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1577                                  MGMT_STATUS_NOT_POWERED);
1578                 goto failed;
1579         }
1580
1581         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1582                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1583                                  MGMT_STATUS_BUSY);
1584                 goto failed;
1585         }
1586
1587         if (cp->addr.type == MGMT_ADDR_BREDR)
1588                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1589         else
1590                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1591
1592         if (!conn) {
1593                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1594                                  MGMT_STATUS_NOT_CONNECTED);
1595                 goto failed;
1596         }
1597
1598         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1599         if (!cmd) {
1600                 err = -ENOMEM;
1601                 goto failed;
1602         }
1603
1604         put_unaligned_le16(conn->handle, &dc.handle);
1605         dc.reason = 0x13; /* Remote User Terminated Connection */
1606
1607         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1608         if (err < 0)
1609                 mgmt_pending_remove(cmd);
1610
1611 failed:
1612         hci_dev_unlock(hdev);
1613         return err;
1614 }
1615
1616 static u8 link_to_mgmt(u8 link_type, u8 addr_type)
1617 {
1618         switch (link_type) {
1619         case LE_LINK:
1620                 switch (addr_type) {
1621                 case ADDR_LE_DEV_PUBLIC:
1622                         return MGMT_ADDR_LE_PUBLIC;
1623                 case ADDR_LE_DEV_RANDOM:
1624                         return MGMT_ADDR_LE_RANDOM;
1625                 default:
1626                         return MGMT_ADDR_INVALID;
1627                 }
1628         case ACL_LINK:
1629                 return MGMT_ADDR_BREDR;
1630         default:
1631                 return MGMT_ADDR_INVALID;
1632         }
1633 }
1634
1635 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1636                            u16 data_len)
1637 {
1638         struct mgmt_rp_get_connections *rp;
1639         struct hci_conn *c;
1640         size_t rp_len;
1641         int err;
1642         u16 i;
1643
1644         BT_DBG("");
1645
1646         hci_dev_lock(hdev);
1647
1648         if (!hdev_is_powered(hdev)) {
1649                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1650                                  MGMT_STATUS_NOT_POWERED);
1651                 goto unlock;
1652         }
1653
1654         i = 0;
1655         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1656                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1657                         i++;
1658         }
1659
1660         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1661         rp = kmalloc(rp_len, GFP_ATOMIC);
1662         if (!rp) {
1663                 err = -ENOMEM;
1664                 goto unlock;
1665         }
1666
1667         i = 0;
1668         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1669                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1670                         continue;
1671                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1672                 rp->addr[i].type = link_to_mgmt(c->type, c->dst_type);
1673                 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1674                         continue;
1675                 i++;
1676         }
1677
1678         put_unaligned_le16(i, &rp->conn_count);
1679
1680         /* Recalculate length in case of filtered SCO connections, etc */
1681         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1682
1683         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1684                            rp_len);
1685
1686         kfree(rp);
1687
1688 unlock:
1689         hci_dev_unlock(hdev);
1690         return err;
1691 }
1692
1693 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1694                                    struct mgmt_cp_pin_code_neg_reply *cp)
1695 {
1696         struct pending_cmd *cmd;
1697         int err;
1698
1699         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1700                                sizeof(*cp));
1701         if (!cmd)
1702                 return -ENOMEM;
1703
1704         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1705                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1706         if (err < 0)
1707                 mgmt_pending_remove(cmd);
1708
1709         return err;
1710 }
1711
1712 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1713                           u16 len)
1714 {
1715         struct hci_conn *conn;
1716         struct mgmt_cp_pin_code_reply *cp = data;
1717         struct hci_cp_pin_code_reply reply;
1718         struct pending_cmd *cmd;
1719         int err;
1720
1721         BT_DBG("");
1722
1723         hci_dev_lock(hdev);
1724
1725         if (!hdev_is_powered(hdev)) {
1726                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1727                                  MGMT_STATUS_NOT_POWERED);
1728                 goto failed;
1729         }
1730
1731         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1732         if (!conn) {
1733                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1734                                  MGMT_STATUS_NOT_CONNECTED);
1735                 goto failed;
1736         }
1737
1738         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1739                 struct mgmt_cp_pin_code_neg_reply ncp;
1740
1741                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1742
1743                 BT_ERR("PIN code is not 16 bytes long");
1744
1745                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1746                 if (err >= 0)
1747                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1748                                          MGMT_STATUS_INVALID_PARAMS);
1749
1750                 goto failed;
1751         }
1752
1753         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1754         if (!cmd) {
1755                 err = -ENOMEM;
1756                 goto failed;
1757         }
1758
1759         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1760         reply.pin_len = cp->pin_len;
1761         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1762
1763         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1764         if (err < 0)
1765                 mgmt_pending_remove(cmd);
1766
1767 failed:
1768         hci_dev_unlock(hdev);
1769         return err;
1770 }
1771
1772 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1773                               void *data, u16 len)
1774 {
1775         struct mgmt_cp_pin_code_neg_reply *cp = data;
1776         int err;
1777
1778         BT_DBG("");
1779
1780         hci_dev_lock(hdev);
1781
1782         if (!hdev_is_powered(hdev)) {
1783                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
1784                                  MGMT_STATUS_NOT_POWERED);
1785                 goto failed;
1786         }
1787
1788         err = send_pin_code_neg_reply(sk, hdev, cp);
1789
1790 failed:
1791         hci_dev_unlock(hdev);
1792         return err;
1793 }
1794
1795 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1796                              u16 len)
1797 {
1798         struct mgmt_cp_set_io_capability *cp = data;
1799
1800         BT_DBG("");
1801
1802         hci_dev_lock(hdev);
1803
1804         hdev->io_capability = cp->io_capability;
1805
1806         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1807                                                         hdev->io_capability);
1808
1809         hci_dev_unlock(hdev);
1810
1811         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1812                             0);
1813 }
1814
1815 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1816 {
1817         struct hci_dev *hdev = conn->hdev;
1818         struct pending_cmd *cmd;
1819
1820         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1821                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1822                         continue;
1823
1824                 if (cmd->user_data != conn)
1825                         continue;
1826
1827                 return cmd;
1828         }
1829
1830         return NULL;
1831 }
1832
1833 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1834 {
1835         struct mgmt_rp_pair_device rp;
1836         struct hci_conn *conn = cmd->user_data;
1837
1838         bacpy(&rp.addr.bdaddr, &conn->dst);
1839         rp.addr.type = link_to_mgmt(conn->type, conn->dst_type);
1840
1841         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1842                      &rp, sizeof(rp));
1843
1844         /* So we don't get further callbacks for this connection */
1845         conn->connect_cfm_cb = NULL;
1846         conn->security_cfm_cb = NULL;
1847         conn->disconn_cfm_cb = NULL;
1848
1849         hci_conn_put(conn);
1850
1851         mgmt_pending_remove(cmd);
1852 }
1853
1854 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1855 {
1856         struct pending_cmd *cmd;
1857
1858         BT_DBG("status %u", status);
1859
1860         cmd = find_pairing(conn);
1861         if (!cmd)
1862                 BT_DBG("Unable to find a pending command");
1863         else
1864                 pairing_complete(cmd, mgmt_status(status));
1865 }
1866
1867 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1868                        u16 len)
1869 {
1870         struct mgmt_cp_pair_device *cp = data;
1871         struct mgmt_rp_pair_device rp;
1872         struct pending_cmd *cmd;
1873         u8 sec_level, auth_type;
1874         struct hci_conn *conn;
1875         int err;
1876
1877         BT_DBG("");
1878
1879         hci_dev_lock(hdev);
1880
1881         if (!hdev_is_powered(hdev)) {
1882                 err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1883                                  MGMT_STATUS_NOT_POWERED);
1884                 goto unlock;
1885         }
1886
1887         sec_level = BT_SECURITY_MEDIUM;
1888         if (cp->io_cap == 0x03)
1889                 auth_type = HCI_AT_DEDICATED_BONDING;
1890         else
1891                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1892
1893         if (cp->addr.type == MGMT_ADDR_BREDR)
1894                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr, sec_level,
1895                                    auth_type);
1896         else
1897                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr, sec_level,
1898                                    auth_type);
1899
1900         memset(&rp, 0, sizeof(rp));
1901         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1902         rp.addr.type = cp->addr.type;
1903
1904         if (IS_ERR(conn)) {
1905                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1906                                    MGMT_STATUS_CONNECT_FAILED, &rp,
1907                                    sizeof(rp));
1908                 goto unlock;
1909         }
1910
1911         if (conn->connect_cfm_cb) {
1912                 hci_conn_put(conn);
1913                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1914                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1915                 goto unlock;
1916         }
1917
1918         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1919         if (!cmd) {
1920                 err = -ENOMEM;
1921                 hci_conn_put(conn);
1922                 goto unlock;
1923         }
1924
1925         /* For LE, just connecting isn't a proof that the pairing finished */
1926         if (cp->addr.type == MGMT_ADDR_BREDR)
1927                 conn->connect_cfm_cb = pairing_complete_cb;
1928
1929         conn->security_cfm_cb = pairing_complete_cb;
1930         conn->disconn_cfm_cb = pairing_complete_cb;
1931         conn->io_capability = cp->io_cap;
1932         cmd->user_data = conn;
1933
1934         if (conn->state == BT_CONNECTED &&
1935                                 hci_conn_security(conn, sec_level, auth_type))
1936                 pairing_complete(cmd, 0);
1937
1938         err = 0;
1939
1940 unlock:
1941         hci_dev_unlock(hdev);
1942         return err;
1943 }
1944
1945 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1946                               u16 len)
1947 {
1948         struct mgmt_addr_info *addr = data;
1949         struct pending_cmd *cmd;
1950         struct hci_conn *conn;
1951         int err;
1952
1953         BT_DBG("");
1954
1955         hci_dev_lock(hdev);
1956
1957         if (!hdev_is_powered(hdev)) {
1958                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1959                                  MGMT_STATUS_NOT_POWERED);
1960                 goto unlock;
1961         }
1962
1963         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
1964         if (!cmd) {
1965                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1966                                  MGMT_STATUS_INVALID_PARAMS);
1967                 goto unlock;
1968         }
1969
1970         conn = cmd->user_data;
1971
1972         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
1973                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1974                                  MGMT_STATUS_INVALID_PARAMS);
1975                 goto unlock;
1976         }
1977
1978         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
1979
1980         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
1981                            addr, sizeof(*addr));
1982 unlock:
1983         hci_dev_unlock(hdev);
1984         return err;
1985 }
1986
1987 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
1988                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
1989                              u16 hci_op, __le32 passkey)
1990 {
1991         struct pending_cmd *cmd;
1992         struct hci_conn *conn;
1993         int err;
1994
1995         hci_dev_lock(hdev);
1996
1997         if (!hdev_is_powered(hdev)) {
1998                 err = cmd_status(sk, hdev->id, mgmt_op,
1999                                  MGMT_STATUS_NOT_POWERED);
2000                 goto done;
2001         }
2002
2003         if (type == MGMT_ADDR_BREDR)
2004                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2005         else
2006                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2007
2008         if (!conn) {
2009                 err = cmd_status(sk, hdev->id, mgmt_op,
2010                                  MGMT_STATUS_NOT_CONNECTED);
2011                 goto done;
2012         }
2013
2014         if (type == MGMT_ADDR_LE_PUBLIC || type == MGMT_ADDR_LE_RANDOM) {
2015                 /* Continue with pairing via SMP */
2016                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2017
2018                 if (!err)
2019                         err = cmd_status(sk, hdev->id, mgmt_op,
2020                                          MGMT_STATUS_SUCCESS);
2021                 else
2022                         err = cmd_status(sk, hdev->id, mgmt_op,
2023                                          MGMT_STATUS_FAILED);
2024
2025                 goto done;
2026         }
2027
2028         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2029         if (!cmd) {
2030                 err = -ENOMEM;
2031                 goto done;
2032         }
2033
2034         /* Continue with pairing via HCI */
2035         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2036                 struct hci_cp_user_passkey_reply cp;
2037
2038                 bacpy(&cp.bdaddr, bdaddr);
2039                 cp.passkey = passkey;
2040                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2041         } else
2042                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2043
2044         if (err < 0)
2045                 mgmt_pending_remove(cmd);
2046
2047 done:
2048         hci_dev_unlock(hdev);
2049         return err;
2050 }
2051
2052 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2053                               u16 len)
2054 {
2055         struct mgmt_cp_user_confirm_reply *cp = data;
2056
2057         BT_DBG("");
2058
2059         if (len != sizeof(*cp))
2060                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2061                                   MGMT_STATUS_INVALID_PARAMS);
2062
2063         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2064                                  MGMT_OP_USER_CONFIRM_REPLY,
2065                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2066 }
2067
2068 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2069                                   void *data, u16 len)
2070 {
2071         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2072
2073         BT_DBG("");
2074
2075         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2076                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2077                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2078 }
2079
2080 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2081                               u16 len)
2082 {
2083         struct mgmt_cp_user_passkey_reply *cp = data;
2084
2085         BT_DBG("");
2086
2087         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2088                                  MGMT_OP_USER_PASSKEY_REPLY,
2089                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2090 }
2091
2092 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2093                                   void *data, u16 len)
2094 {
2095         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2096
2097         BT_DBG("");
2098
2099         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2100                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2101                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2102 }
2103
2104 static int update_name(struct hci_dev *hdev, const char *name)
2105 {
2106         struct hci_cp_write_local_name cp;
2107
2108         memcpy(cp.name, name, sizeof(cp.name));
2109
2110         return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2111 }
2112
2113 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2114                           u16 len)
2115 {
2116         struct mgmt_cp_set_local_name *cp = data;
2117         struct pending_cmd *cmd;
2118         int err;
2119
2120         BT_DBG("");
2121
2122         hci_dev_lock(hdev);
2123
2124         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2125
2126         if (!hdev_is_powered(hdev)) {
2127                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2128
2129                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2130                                    data, len);
2131                 if (err < 0)
2132                         goto failed;
2133
2134                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2135                                  sk);
2136
2137                 goto failed;
2138         }
2139
2140         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2141         if (!cmd) {
2142                 err = -ENOMEM;
2143                 goto failed;
2144         }
2145
2146         err = update_name(hdev, cp->name);
2147         if (err < 0)
2148                 mgmt_pending_remove(cmd);
2149
2150 failed:
2151         hci_dev_unlock(hdev);
2152         return err;
2153 }
2154
2155 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2156                                void *data, u16 data_len)
2157 {
2158         struct pending_cmd *cmd;
2159         int err;
2160
2161         BT_DBG("%s", hdev->name);
2162
2163         hci_dev_lock(hdev);
2164
2165         if (!hdev_is_powered(hdev)) {
2166                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2167                                  MGMT_STATUS_NOT_POWERED);
2168                 goto unlock;
2169         }
2170
2171         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
2172                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2173                                  MGMT_STATUS_NOT_SUPPORTED);
2174                 goto unlock;
2175         }
2176
2177         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2178                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2179                                  MGMT_STATUS_BUSY);
2180                 goto unlock;
2181         }
2182
2183         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2184         if (!cmd) {
2185                 err = -ENOMEM;
2186                 goto unlock;
2187         }
2188
2189         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2190         if (err < 0)
2191                 mgmt_pending_remove(cmd);
2192
2193 unlock:
2194         hci_dev_unlock(hdev);
2195         return err;
2196 }
2197
2198 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2199                                void *data, u16 len)
2200 {
2201         struct mgmt_cp_add_remote_oob_data *cp = data;
2202         u8 status;
2203         int err;
2204
2205         BT_DBG("%s ", hdev->name);
2206
2207         hci_dev_lock(hdev);
2208
2209         if (!hdev_is_powered(hdev)) {
2210                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
2211                                    MGMT_STATUS_NOT_POWERED, &cp->addr,
2212                                    sizeof(cp->addr));
2213                 goto unlock;
2214         }
2215
2216         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2217                                       cp->randomizer);
2218         if (err < 0)
2219                 status = MGMT_STATUS_FAILED;
2220         else
2221                 status = 0;
2222
2223         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2224                            &cp->addr, sizeof(cp->addr));
2225
2226 unlock:
2227         hci_dev_unlock(hdev);
2228         return err;
2229 }
2230
2231 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2232                                                 void *data, u16 len)
2233 {
2234         struct mgmt_cp_remove_remote_oob_data *cp = data;
2235         u8 status;
2236         int err;
2237
2238         BT_DBG("%s", hdev->name);
2239
2240         hci_dev_lock(hdev);
2241
2242         if (!hdev_is_powered(hdev)) {
2243                 err = cmd_complete(sk, hdev->id,
2244                                    MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2245                                    MGMT_STATUS_NOT_POWERED, &cp->addr,
2246                                    sizeof(cp->addr));
2247                 goto unlock;
2248         }
2249
2250         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2251         if (err < 0)
2252                 status = MGMT_STATUS_INVALID_PARAMS;
2253         else
2254                 status = 0;
2255
2256         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2257                            status, &cp->addr, sizeof(cp->addr));
2258
2259 unlock:
2260         hci_dev_unlock(hdev);
2261         return err;
2262 }
2263
2264 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2265 {
2266         int err;
2267
2268         BT_DBG("%s", hdev->name);
2269
2270         hci_dev_lock(hdev);
2271
2272         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2273         if (err < 0)
2274                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2275
2276         hci_dev_unlock(hdev);
2277
2278         return err;
2279 }
2280
2281 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2282                            void *data, u16 len)
2283 {
2284         struct mgmt_cp_start_discovery *cp = data;
2285         struct pending_cmd *cmd;
2286         int err;
2287
2288         BT_DBG("%s", hdev->name);
2289
2290         hci_dev_lock(hdev);
2291
2292         if (!hdev_is_powered(hdev)) {
2293                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2294                                  MGMT_STATUS_NOT_POWERED);
2295                 goto failed;
2296         }
2297
2298         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2299                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2300                                  MGMT_STATUS_BUSY);
2301                 goto failed;
2302         }
2303
2304         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2305         if (!cmd) {
2306                 err = -ENOMEM;
2307                 goto failed;
2308         }
2309
2310         hdev->discovery.type = cp->type;
2311
2312         switch (hdev->discovery.type) {
2313         case DISCOV_TYPE_BREDR:
2314                 if (lmp_bredr_capable(hdev))
2315                         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2316                 else
2317                         err = -ENOTSUPP;
2318                 break;
2319
2320         case DISCOV_TYPE_LE:
2321                 if (lmp_host_le_capable(hdev))
2322                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2323                                           LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2324                 else
2325                         err = -ENOTSUPP;
2326                 break;
2327
2328         case DISCOV_TYPE_INTERLEAVED:
2329                 if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
2330                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2331                                           LE_SCAN_WIN,
2332                                           LE_SCAN_TIMEOUT_BREDR_LE);
2333                 else
2334                         err = -ENOTSUPP;
2335                 break;
2336
2337         default:
2338                 err = -EINVAL;
2339         }
2340
2341         if (err < 0)
2342                 mgmt_pending_remove(cmd);
2343         else
2344                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2345
2346 failed:
2347         hci_dev_unlock(hdev);
2348         return err;
2349 }
2350
2351 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2352                           u16 len)
2353 {
2354         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2355         struct pending_cmd *cmd;
2356         struct hci_cp_remote_name_req_cancel cp;
2357         struct inquiry_entry *e;
2358         int err;
2359
2360         BT_DBG("%s", hdev->name);
2361
2362         hci_dev_lock(hdev);
2363
2364         if (!hci_discovery_active(hdev)) {
2365                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2366                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2367                                    sizeof(mgmt_cp->type));
2368                 goto unlock;
2369         }
2370
2371         if (hdev->discovery.type != mgmt_cp->type) {
2372                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2373                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2374                                    sizeof(mgmt_cp->type));
2375                 goto unlock;
2376         }
2377
2378         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2379         if (!cmd) {
2380                 err = -ENOMEM;
2381                 goto unlock;
2382         }
2383
2384         if (hdev->discovery.state == DISCOVERY_FINDING) {
2385                 err = hci_cancel_inquiry(hdev);
2386                 if (err < 0)
2387                         mgmt_pending_remove(cmd);
2388                 else
2389                         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2390                 goto unlock;
2391         }
2392
2393         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_PENDING);
2394         if (!e) {
2395                 mgmt_pending_remove(cmd);
2396                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
2397                                    &mgmt_cp->type, sizeof(mgmt_cp->type));
2398                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2399                 goto unlock;
2400         }
2401
2402         bacpy(&cp.bdaddr, &e->data.bdaddr);
2403         err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
2404                            &cp);
2405         if (err < 0)
2406                 mgmt_pending_remove(cmd);
2407         else
2408                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2409
2410 unlock:
2411         hci_dev_unlock(hdev);
2412         return err;
2413 }
2414
2415 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2416                         u16 len)
2417 {
2418         struct mgmt_cp_confirm_name *cp = data;
2419         struct inquiry_entry *e;
2420         int err;
2421
2422         BT_DBG("%s", hdev->name);
2423
2424         hci_dev_lock(hdev);
2425
2426         if (!hci_discovery_active(hdev)) {
2427                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2428                                  MGMT_STATUS_FAILED);
2429                 goto failed;
2430         }
2431
2432         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2433         if (!e) {
2434                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2435                                  MGMT_STATUS_INVALID_PARAMS);
2436                 goto failed;
2437         }
2438
2439         if (cp->name_known) {
2440                 e->name_state = NAME_KNOWN;
2441                 list_del(&e->list);
2442         } else {
2443                 e->name_state = NAME_NEEDED;
2444                 hci_inquiry_cache_update_resolve(hdev, e);
2445         }
2446
2447         err = 0;
2448
2449 failed:
2450         hci_dev_unlock(hdev);
2451         return err;
2452 }
2453
2454 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2455                         u16 len)
2456 {
2457         struct mgmt_cp_block_device *cp = data;
2458         u8 status;
2459         int err;
2460
2461         BT_DBG("%s", hdev->name);
2462
2463         hci_dev_lock(hdev);
2464
2465         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2466         if (err < 0)
2467                 status = MGMT_STATUS_FAILED;
2468         else
2469                 status = 0;
2470
2471         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2472                            &cp->addr, sizeof(cp->addr));
2473
2474         hci_dev_unlock(hdev);
2475
2476         return err;
2477 }
2478
2479 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2480                           u16 len)
2481 {
2482         struct mgmt_cp_unblock_device *cp = data;
2483         u8 status;
2484         int err;
2485
2486         BT_DBG("%s", hdev->name);
2487
2488         hci_dev_lock(hdev);
2489
2490         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2491         if (err < 0)
2492                 status = MGMT_STATUS_INVALID_PARAMS;
2493         else
2494                 status = 0;
2495
2496         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2497                            &cp->addr, sizeof(cp->addr));
2498
2499         hci_dev_unlock(hdev);
2500
2501         return err;
2502 }
2503
2504 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2505                                 void *data, u16 len)
2506 {
2507         struct mgmt_mode *cp = data;
2508         struct hci_cp_write_page_scan_activity acp;
2509         u8 type;
2510         int err;
2511
2512         BT_DBG("%s", hdev->name);
2513
2514         if (!hdev_is_powered(hdev))
2515                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2516                                   MGMT_STATUS_NOT_POWERED);
2517
2518         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2519                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2520                                   MGMT_STATUS_REJECTED);
2521
2522         hci_dev_lock(hdev);
2523
2524         if (cp->val) {
2525                 type = PAGE_SCAN_TYPE_INTERLACED;
2526                 acp.interval = 0x0024;  /* 22.5 msec page scan interval */
2527         } else {
2528                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2529                 acp.interval = 0x0800;  /* default 1.28 sec page scan */
2530         }
2531
2532         acp.window = 0x0012;    /* default 11.25 msec page scan window */
2533
2534         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2535                            &acp);
2536         if (err < 0) {
2537                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2538                                  MGMT_STATUS_FAILED);
2539                 goto done;
2540         }
2541
2542         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2543         if (err < 0) {
2544                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2545                                  MGMT_STATUS_FAILED);
2546                 goto done;
2547         }
2548
2549         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2550                            NULL, 0);
2551 done:
2552         hci_dev_unlock(hdev);
2553         return err;
2554 }
2555
2556 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2557                                void *cp_data, u16 len)
2558 {
2559         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2560         u16 key_count, expected_len;
2561         int i;
2562
2563         key_count = get_unaligned_le16(&cp->key_count);
2564
2565         expected_len = sizeof(*cp) + key_count *
2566                                         sizeof(struct mgmt_ltk_info);
2567         if (expected_len != len) {
2568                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2569                                                         len, expected_len);
2570                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2571                                   EINVAL);
2572         }
2573
2574         BT_DBG("%s key_count %u", hdev->name, key_count);
2575
2576         hci_dev_lock(hdev);
2577
2578         hci_smp_ltks_clear(hdev);
2579
2580         for (i = 0; i < key_count; i++) {
2581                 struct mgmt_ltk_info *key = &cp->keys[i];
2582                 u8 type;
2583
2584                 if (key->master)
2585                         type = HCI_SMP_LTK;
2586                 else
2587                         type = HCI_SMP_LTK_SLAVE;
2588
2589                 hci_add_ltk(hdev, &key->addr.bdaddr, key->addr.type,
2590                             type, 0, key->authenticated, key->val,
2591                             key->enc_size, key->ediv, key->rand);
2592         }
2593
2594         hci_dev_unlock(hdev);
2595
2596         return 0;
2597 }
2598
2599 struct mgmt_handler {
2600         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2601                      u16 data_len);
2602         bool var_len;
2603         size_t data_len;
2604 } mgmt_handlers[] = {
2605         { NULL }, /* 0x0000 (no command) */
2606         { read_version,           false, MGMT_READ_VERSION_SIZE },
2607         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
2608         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
2609         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
2610         { set_powered,            false, MGMT_SETTING_SIZE },
2611         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
2612         { set_connectable,        false, MGMT_SETTING_SIZE },
2613         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
2614         { set_pairable,           false, MGMT_SETTING_SIZE },
2615         { set_link_security,      false, MGMT_SETTING_SIZE },
2616         { set_ssp,                false, MGMT_SETTING_SIZE },
2617         { set_hs,                 false, MGMT_SETTING_SIZE },
2618         { set_le,                 false, MGMT_SETTING_SIZE },
2619         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
2620         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
2621         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
2622         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
2623         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
2624         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2625         { disconnect,             false, MGMT_DISCONNECT_SIZE },
2626         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
2627         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
2628         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2629         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
2630         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
2631         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2632         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
2633         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
2634         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2635         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
2636         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2637         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2638         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2639         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2640         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
2641         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
2642         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
2643         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
2644         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
2645 };
2646
2647
2648 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2649 {
2650         void *buf;
2651         u8 *cp;
2652         struct mgmt_hdr *hdr;
2653         u16 opcode, index, len;
2654         struct hci_dev *hdev = NULL;
2655         struct mgmt_handler *handler;
2656         int err;
2657
2658         BT_DBG("got %zu bytes", msglen);
2659
2660         if (msglen < sizeof(*hdr))
2661                 return -EINVAL;
2662
2663         buf = kmalloc(msglen, GFP_KERNEL);
2664         if (!buf)
2665                 return -ENOMEM;
2666
2667         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2668                 err = -EFAULT;
2669                 goto done;
2670         }
2671
2672         hdr = buf;
2673         opcode = get_unaligned_le16(&hdr->opcode);
2674         index = get_unaligned_le16(&hdr->index);
2675         len = get_unaligned_le16(&hdr->len);
2676
2677         if (len != msglen - sizeof(*hdr)) {
2678                 err = -EINVAL;
2679                 goto done;
2680         }
2681
2682         if (index != MGMT_INDEX_NONE) {
2683                 hdev = hci_dev_get(index);
2684                 if (!hdev) {
2685                         err = cmd_status(sk, index, opcode,
2686                                          MGMT_STATUS_INVALID_INDEX);
2687                         goto done;
2688                 }
2689         }
2690
2691         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2692                                         mgmt_handlers[opcode].func == NULL) {
2693                 BT_DBG("Unknown op %u", opcode);
2694                 err = cmd_status(sk, index, opcode,
2695                                  MGMT_STATUS_UNKNOWN_COMMAND);
2696                 goto done;
2697         }
2698
2699         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2700                         (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2701                 err = cmd_status(sk, index, opcode,
2702                                  MGMT_STATUS_INVALID_INDEX);
2703                 goto done;
2704         }
2705
2706         handler = &mgmt_handlers[opcode];
2707
2708         if ((handler->var_len && len < handler->data_len) ||
2709                         (!handler->var_len && len != handler->data_len)) {
2710                 err = cmd_status(sk, index, opcode,
2711                                  MGMT_STATUS_INVALID_PARAMS);
2712                 goto done;
2713         }
2714
2715         if (hdev)
2716                 mgmt_init_hdev(sk, hdev);
2717
2718         cp = buf + sizeof(*hdr);
2719
2720         err = handler->func(sk, hdev, cp, len);
2721         if (err < 0)
2722                 goto done;
2723
2724         err = msglen;
2725
2726 done:
2727         if (hdev)
2728                 hci_dev_put(hdev);
2729
2730         kfree(buf);
2731         return err;
2732 }
2733
2734 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2735 {
2736         u8 *status = data;
2737
2738         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2739         mgmt_pending_remove(cmd);
2740 }
2741
2742 int mgmt_index_added(struct hci_dev *hdev)
2743 {
2744         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2745 }
2746
2747 int mgmt_index_removed(struct hci_dev *hdev)
2748 {
2749         u8 status = MGMT_STATUS_INVALID_INDEX;
2750
2751         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2752
2753         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2754 }
2755
2756 struct cmd_lookup {
2757         struct sock *sk;
2758         struct hci_dev *hdev;
2759         u8 mgmt_status;
2760 };
2761
2762 static void settings_rsp(struct pending_cmd *cmd, void *data)
2763 {
2764         struct cmd_lookup *match = data;
2765
2766         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2767
2768         list_del(&cmd->list);
2769
2770         if (match->sk == NULL) {
2771                 match->sk = cmd->sk;
2772                 sock_hold(match->sk);
2773         }
2774
2775         mgmt_pending_free(cmd);
2776 }
2777
2778 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2779 {
2780         struct cmd_lookup match = { NULL, hdev };
2781         int err;
2782
2783         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2784                 return 0;
2785
2786         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2787
2788         if (powered) {
2789                 u8 scan = 0;
2790
2791                 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2792                         scan |= SCAN_PAGE;
2793                 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2794                         scan |= SCAN_INQUIRY;
2795
2796                 if (scan)
2797                         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2798
2799                 update_class(hdev);
2800                 update_name(hdev, hdev->dev_name);
2801                 update_eir(hdev);
2802         } else {
2803                 u8 status = MGMT_STATUS_NOT_POWERED;
2804                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2805         }
2806
2807         err = new_settings(hdev, match.sk);
2808
2809         if (match.sk)
2810                 sock_put(match.sk);
2811
2812         return err;
2813 }
2814
2815 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2816 {
2817         struct cmd_lookup match = { NULL, hdev };
2818         bool changed = false;
2819         int err = 0;
2820
2821         if (discoverable) {
2822                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2823                         changed = true;
2824         } else {
2825                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2826                         changed = true;
2827         }
2828
2829         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
2830                              &match);
2831
2832         if (changed)
2833                 err = new_settings(hdev, match.sk);
2834
2835         if (match.sk)
2836                 sock_put(match.sk);
2837
2838         return err;
2839 }
2840
2841 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2842 {
2843         struct cmd_lookup match = { NULL, hdev };
2844         bool changed = false;
2845         int err = 0;
2846
2847         if (connectable) {
2848                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2849                         changed = true;
2850         } else {
2851                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2852                         changed = true;
2853         }
2854
2855         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
2856                              &match);
2857
2858         if (changed)
2859                 err = new_settings(hdev, match.sk);
2860
2861         if (match.sk)
2862                 sock_put(match.sk);
2863
2864         return err;
2865 }
2866
2867 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2868 {
2869         u8 mgmt_err = mgmt_status(status);
2870
2871         if (scan & SCAN_PAGE)
2872                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2873                                      cmd_status_rsp, &mgmt_err);
2874
2875         if (scan & SCAN_INQUIRY)
2876                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2877                                      cmd_status_rsp, &mgmt_err);
2878
2879         return 0;
2880 }
2881
2882 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, u8 persistent)
2883 {
2884         struct mgmt_ev_new_link_key ev;
2885
2886         memset(&ev, 0, sizeof(ev));
2887
2888         ev.store_hint = persistent;
2889         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2890         ev.key.addr.type = MGMT_ADDR_BREDR;
2891         ev.key.type = key->type;
2892         memcpy(ev.key.val, key->val, 16);
2893         ev.key.pin_len = key->pin_len;
2894
2895         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2896 }
2897
2898 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
2899 {
2900         struct mgmt_ev_new_long_term_key ev;
2901
2902         memset(&ev, 0, sizeof(ev));
2903
2904         ev.store_hint = persistent;
2905         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2906         ev.key.addr.type = key->bdaddr_type;
2907         ev.key.authenticated = key->authenticated;
2908         ev.key.enc_size = key->enc_size;
2909         ev.key.ediv = key->ediv;
2910
2911         if (key->type == HCI_SMP_LTK)
2912                 ev.key.master = 1;
2913
2914         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
2915         memcpy(ev.key.val, key->val, sizeof(key->val));
2916
2917         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
2918                           NULL);
2919 }
2920
2921 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2922                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
2923                           u8 *dev_class)
2924 {
2925         char buf[512];
2926         struct mgmt_ev_device_connected *ev = (void *) buf;
2927         u16 eir_len = 0;
2928
2929         bacpy(&ev->addr.bdaddr, bdaddr);
2930         ev->addr.type = link_to_mgmt(link_type, addr_type);
2931
2932         ev->flags = __cpu_to_le32(flags);
2933
2934         if (name_len > 0)
2935                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
2936                                           name, name_len);
2937
2938         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
2939                 eir_len = eir_append_data(&ev->eir[eir_len], eir_len,
2940                                           EIR_CLASS_OF_DEV, dev_class, 3);
2941
2942         put_unaligned_le16(eir_len, &ev->eir_len);
2943
2944         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
2945                           sizeof(*ev) + eir_len, NULL);
2946 }
2947
2948 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
2949 {
2950         struct mgmt_cp_disconnect *cp = cmd->param;
2951         struct sock **sk = data;
2952         struct mgmt_rp_disconnect rp;
2953
2954         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2955         rp.addr.type = cp->addr.type;
2956
2957         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
2958                      sizeof(rp));
2959
2960         *sk = cmd->sk;
2961         sock_hold(*sk);
2962
2963         mgmt_pending_remove(cmd);
2964 }
2965
2966 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
2967 {
2968         struct hci_dev *hdev = data;
2969         struct mgmt_cp_unpair_device *cp = cmd->param;
2970         struct mgmt_rp_unpair_device rp;
2971
2972         memset(&rp, 0, sizeof(rp));
2973         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2974         rp.addr.type = cp->addr.type;
2975
2976         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
2977
2978         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
2979
2980         mgmt_pending_remove(cmd);
2981 }
2982
2983 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
2984                              u8 link_type, u8 addr_type)
2985 {
2986         struct mgmt_addr_info ev;
2987         struct sock *sk = NULL;
2988         int err;
2989
2990         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
2991
2992         bacpy(&ev.bdaddr, bdaddr);
2993         ev.type = link_to_mgmt(link_type, addr_type);
2994
2995         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
2996                          sk);
2997
2998         if (sk)
2999           sock_put(sk);
3000
3001         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3002                              hdev);
3003
3004         return err;
3005 }
3006
3007 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3008                            u8 link_type, u8 addr_type, u8 status)
3009 {
3010         struct mgmt_rp_disconnect rp;
3011         struct pending_cmd *cmd;
3012         int err;
3013
3014         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3015         if (!cmd)
3016                 return -ENOENT;
3017
3018         bacpy(&rp.addr.bdaddr, bdaddr);
3019         rp.addr.type = link_to_mgmt(link_type, addr_type);
3020
3021         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3022                            mgmt_status(status), &rp, sizeof(rp));
3023
3024         mgmt_pending_remove(cmd);
3025
3026         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3027                                                                         hdev);
3028         return err;
3029 }
3030
3031 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3032                         u8 addr_type, u8 status)
3033 {
3034         struct mgmt_ev_connect_failed ev;
3035
3036         bacpy(&ev.addr.bdaddr, bdaddr);
3037         ev.addr.type = link_to_mgmt(link_type, addr_type);
3038         ev.status = mgmt_status(status);
3039
3040         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3041 }
3042
3043 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3044 {
3045         struct mgmt_ev_pin_code_request ev;
3046
3047         bacpy(&ev.addr.bdaddr, bdaddr);
3048         ev.addr.type = MGMT_ADDR_BREDR;
3049         ev.secure = secure;
3050
3051         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3052                           NULL);
3053 }
3054
3055 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3056                                  u8 status)
3057 {
3058         struct pending_cmd *cmd;
3059         struct mgmt_rp_pin_code_reply rp;
3060         int err;
3061
3062         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3063         if (!cmd)
3064                 return -ENOENT;
3065
3066         bacpy(&rp.addr.bdaddr, bdaddr);
3067         rp.addr.type = MGMT_ADDR_BREDR;
3068
3069         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3070                            mgmt_status(status), &rp, sizeof(rp));
3071
3072         mgmt_pending_remove(cmd);
3073
3074         return err;
3075 }
3076
3077 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3078                                      u8 status)
3079 {
3080         struct pending_cmd *cmd;
3081         struct mgmt_rp_pin_code_reply rp;
3082         int err;
3083
3084         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3085         if (!cmd)
3086                 return -ENOENT;
3087
3088         bacpy(&rp.addr.bdaddr, bdaddr);
3089         rp.addr.type = MGMT_ADDR_BREDR;
3090
3091         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3092                            mgmt_status(status), &rp, sizeof(rp));
3093
3094         mgmt_pending_remove(cmd);
3095
3096         return err;
3097 }
3098
3099 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3100                               u8 link_type, u8 addr_type, __le32 value,
3101                               u8 confirm_hint)
3102 {
3103         struct mgmt_ev_user_confirm_request ev;
3104
3105         BT_DBG("%s", hdev->name);
3106
3107         bacpy(&ev.addr.bdaddr, bdaddr);
3108         ev.addr.type = link_to_mgmt(link_type, addr_type);
3109         ev.confirm_hint = confirm_hint;
3110         put_unaligned_le32(value, &ev.value);
3111
3112         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3113                           NULL);
3114 }
3115
3116 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3117                                                 u8 link_type, u8 addr_type)
3118 {
3119         struct mgmt_ev_user_passkey_request ev;
3120
3121         BT_DBG("%s", hdev->name);
3122
3123         bacpy(&ev.addr.bdaddr, bdaddr);
3124         ev.addr.type = link_to_mgmt(link_type, addr_type);
3125
3126         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3127                           NULL);
3128 }
3129
3130 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3131                                         u8 link_type, u8 addr_type, u8 status,
3132                                         u8 opcode)
3133 {
3134         struct pending_cmd *cmd;
3135         struct mgmt_rp_user_confirm_reply rp;
3136         int err;
3137
3138         cmd = mgmt_pending_find(opcode, hdev);
3139         if (!cmd)
3140                 return -ENOENT;
3141
3142         bacpy(&rp.addr.bdaddr, bdaddr);
3143         rp.addr.type = link_to_mgmt(link_type, addr_type);
3144         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3145                            &rp, sizeof(rp));
3146
3147         mgmt_pending_remove(cmd);
3148
3149         return err;
3150 }
3151
3152 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3153                                      u8 link_type, u8 addr_type, u8 status)
3154 {
3155         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3156                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3157 }
3158
3159 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3160                                          u8 link_type, u8 addr_type, u8 status)
3161 {
3162         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3163                                           status, MGMT_OP_USER_CONFIRM_NEG_REPLY);
3164 }
3165
3166 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3167                                      u8 link_type, u8 addr_type, u8 status)
3168 {
3169         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3170                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3171 }
3172
3173 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3174                                          u8 link_type, u8 addr_type, u8 status)
3175 {
3176         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3177                                           status, MGMT_OP_USER_PASSKEY_NEG_REPLY);
3178 }
3179
3180 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3181                      u8 addr_type, u8 status)
3182 {
3183         struct mgmt_ev_auth_failed ev;
3184
3185         bacpy(&ev.addr.bdaddr, bdaddr);
3186         ev.addr.type = link_to_mgmt(link_type, addr_type);
3187         ev.status = mgmt_status(status);
3188
3189         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3190 }
3191
3192 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3193 {
3194         struct cmd_lookup match = { NULL, hdev };
3195         bool changed = false;
3196         int err = 0;
3197
3198         if (status) {
3199                 u8 mgmt_err = mgmt_status(status);
3200                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3201                                      cmd_status_rsp, &mgmt_err);
3202                 return 0;
3203         }
3204
3205         if (test_bit(HCI_AUTH, &hdev->flags)) {
3206                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3207                         changed = true;
3208         } else {
3209                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3210                         changed = true;
3211         }
3212
3213         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3214                              &match);
3215
3216         if (changed)
3217                 err = new_settings(hdev, match.sk);
3218
3219         if (match.sk)
3220                 sock_put(match.sk);
3221
3222         return err;
3223 }
3224
3225 static int clear_eir(struct hci_dev *hdev)
3226 {
3227         struct hci_cp_write_eir cp;
3228
3229         if (!(hdev->features[6] & LMP_EXT_INQ))
3230                 return 0;
3231
3232         memset(hdev->eir, 0, sizeof(hdev->eir));
3233
3234         memset(&cp, 0, sizeof(cp));
3235
3236         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3237 }
3238
3239 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3240 {
3241         struct cmd_lookup match = { NULL, hdev };
3242         bool changed = false;
3243         int err = 0;
3244
3245         if (status) {
3246                 u8 mgmt_err = mgmt_status(status);
3247
3248                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3249                                                  &hdev->dev_flags))
3250                         err = new_settings(hdev, NULL);
3251
3252                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3253                                      &mgmt_err);
3254
3255                 return err;
3256         }
3257
3258         if (enable) {
3259                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3260                         changed = true;
3261         } else {
3262                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3263                         changed = true;
3264         }
3265
3266         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3267
3268         if (changed)
3269                 err = new_settings(hdev, match.sk);
3270
3271         if (match.sk)
3272                 sock_put(match.sk);
3273
3274         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3275                 update_eir(hdev);
3276         else
3277                 clear_eir(hdev);
3278
3279         return err;
3280 }
3281
3282 static void class_rsp(struct pending_cmd *cmd, void *data)
3283 {
3284         struct cmd_lookup *match = data;
3285
3286         cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3287                      match->hdev->dev_class, 3);
3288
3289         list_del(&cmd->list);
3290
3291         if (match->sk == NULL) {
3292                 match->sk = cmd->sk;
3293                 sock_hold(match->sk);
3294         }
3295
3296         mgmt_pending_free(cmd);
3297 }
3298
3299 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3300                                    u8 status)
3301 {
3302         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3303         int err = 0;
3304
3305         clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3306
3307         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3308         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3309         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3310
3311         if (!status)
3312                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3313                                  3, NULL);
3314
3315         if (match.sk)
3316                 sock_put(match.sk);
3317
3318         return err;
3319 }
3320
3321 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3322 {
3323         struct pending_cmd *cmd;
3324         struct mgmt_cp_set_local_name ev;
3325         bool changed = false;
3326         int err = 0;
3327
3328         if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3329                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3330                 changed = true;
3331         }
3332
3333         memset(&ev, 0, sizeof(ev));
3334         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3335         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3336
3337         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3338         if (!cmd)
3339                 goto send_event;
3340
3341         /* Always assume that either the short or the complete name has
3342          * changed if there was a pending mgmt command */
3343         changed = true;
3344
3345         if (status) {
3346                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3347                                  mgmt_status(status));
3348                 goto failed;
3349         }
3350
3351         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3352                            sizeof(ev));
3353         if (err < 0)
3354                 goto failed;
3355
3356 send_event:
3357         if (changed)
3358                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3359                                  sizeof(ev), cmd ? cmd->sk : NULL);
3360
3361         update_eir(hdev);
3362
3363 failed:
3364         if (cmd)
3365                 mgmt_pending_remove(cmd);
3366         return err;
3367 }
3368
3369 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3370                                             u8 *randomizer, u8 status)
3371 {
3372         struct pending_cmd *cmd;
3373         int err;
3374
3375         BT_DBG("%s status %u", hdev->name, status);
3376
3377         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3378         if (!cmd)
3379                 return -ENOENT;
3380
3381         if (status) {
3382                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3383                                  mgmt_status(status));
3384         } else {
3385                 struct mgmt_rp_read_local_oob_data rp;
3386
3387                 memcpy(rp.hash, hash, sizeof(rp.hash));
3388                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3389
3390                 err = cmd_complete(cmd->sk, hdev->id,
3391                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3392                                    sizeof(rp));
3393         }
3394
3395         mgmt_pending_remove(cmd);
3396
3397         return err;
3398 }
3399
3400 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3401 {
3402         struct cmd_lookup match = { NULL, hdev };
3403         bool changed = false;
3404         int err = 0;
3405
3406         if (status) {
3407                 u8 mgmt_err = mgmt_status(status);
3408
3409                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3410                                                  &hdev->dev_flags))
3411                   err = new_settings(hdev, NULL);
3412
3413                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev,
3414                                      cmd_status_rsp, &mgmt_err);
3415
3416                 return err;
3417         }
3418
3419         if (enable) {
3420                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3421                         changed = true;
3422         } else {
3423                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3424                         changed = true;
3425         }
3426
3427         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3428
3429         if (changed)
3430                 err = new_settings(hdev, match.sk);
3431
3432         if (match.sk)
3433                 sock_put(match.sk);
3434
3435         return err;
3436 }
3437
3438 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3439                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3440                       ssp, u8 *eir, u16 eir_len)
3441 {
3442         char buf[512];
3443         struct mgmt_ev_device_found *ev = (void *) buf;
3444         size_t ev_size;
3445
3446         /* Leave 5 bytes for a potential CoD field */
3447         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3448                 return -EINVAL;
3449
3450         memset(buf, 0, sizeof(buf));
3451
3452         bacpy(&ev->addr.bdaddr, bdaddr);
3453         ev->addr.type = link_to_mgmt(link_type, addr_type);
3454         ev->rssi = rssi;
3455         if (cfm_name)
3456                 ev->flags[0] |= MGMT_DEV_FOUND_CONFIRM_NAME;
3457         if (!ssp)
3458                 ev->flags[0] |= MGMT_DEV_FOUND_LEGACY_PAIRING;
3459
3460         if (eir_len > 0)
3461                 memcpy(ev->eir, eir, eir_len);
3462
3463         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3464                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3465                                           dev_class, 3);
3466
3467         put_unaligned_le16(eir_len, &ev->eir_len);
3468
3469         ev_size = sizeof(*ev) + eir_len;
3470
3471         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3472 }
3473
3474 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3475                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3476 {
3477         struct mgmt_ev_device_found *ev;
3478         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3479         u16 eir_len;
3480
3481         ev = (struct mgmt_ev_device_found *) buf;
3482
3483         memset(buf, 0, sizeof(buf));
3484
3485         bacpy(&ev->addr.bdaddr, bdaddr);
3486         ev->addr.type = link_to_mgmt(link_type, addr_type);
3487         ev->rssi = rssi;
3488
3489         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3490                                   name_len);
3491
3492         put_unaligned_le16(eir_len, &ev->eir_len);
3493
3494         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3495                           sizeof(*ev) + eir_len, NULL);
3496 }
3497
3498 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3499 {
3500         struct pending_cmd *cmd;
3501         u8 type;
3502         int err;
3503
3504         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3505
3506         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3507         if (!cmd)
3508                 return -ENOENT;
3509
3510         type = hdev->discovery.type;
3511
3512         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3513                            &type, sizeof(type));
3514         mgmt_pending_remove(cmd);
3515
3516         return err;
3517 }
3518
3519 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3520 {
3521         struct pending_cmd *cmd;
3522         int err;
3523
3524         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3525         if (!cmd)
3526                 return -ENOENT;
3527
3528         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3529                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3530         mgmt_pending_remove(cmd);
3531
3532         return err;
3533 }
3534
3535 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3536 {
3537         struct mgmt_ev_discovering ev;
3538         struct pending_cmd *cmd;
3539
3540         BT_DBG("%s discovering %u", hdev->name, discovering);
3541
3542         if (discovering)
3543                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3544         else
3545                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3546
3547         if (cmd != NULL) {
3548                 u8 type = hdev->discovery.type;
3549
3550                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3551                              sizeof(type));
3552                 mgmt_pending_remove(cmd);
3553         }
3554
3555         memset(&ev, 0, sizeof(ev));
3556         ev.type = hdev->discovery.type;
3557         ev.discovering = discovering;
3558
3559         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3560 }
3561
3562 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3563 {
3564         struct pending_cmd *cmd;
3565         struct mgmt_ev_device_blocked ev;
3566
3567         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3568
3569         bacpy(&ev.addr.bdaddr, bdaddr);
3570         ev.addr.type = type;
3571
3572         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3573                           cmd ? cmd->sk : NULL);
3574 }
3575
3576 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3577 {
3578         struct pending_cmd *cmd;
3579         struct mgmt_ev_device_unblocked ev;
3580
3581         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3582
3583         bacpy(&ev.addr.bdaddr, bdaddr);
3584         ev.addr.type = type;
3585
3586         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3587                           cmd ? cmd->sk : NULL);
3588 }
3589
3590 module_param(enable_hs, bool, 0644);
3591 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");
3592
3593 module_param(enable_le, bool, 0644);
3594 MODULE_PARM_DESC(enable_le, "Enable Low Energy support");