net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   2
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 /*
 106  * These LE scan and inquiry parameters were chosen according to LE General
 107  * Discovery Procedure specification.
 108  */
 109 #define LE_SCAN_TYPE                    0x01
 110 #define LE_SCAN_WIN                     0x12
 111 #define LE_SCAN_INT                     0x12
 112 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 113 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 114
 115 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 116 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 117
 118 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 119
 120 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 121                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 122
 123 struct pending_cmd {
 124         struct list_head list;
 125         u16 opcode;
 126         int index;
 127         void *param;
 128         struct sock *sk;
 129         void *user_data;
 130 };
 131
 132 /* HCI to MGMT error code conversion table */
 133 static u8 mgmt_status_table[] = {
 134         MGMT_STATUS_SUCCESS,
 135         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 136         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 137         MGMT_STATUS_FAILED,             /* Hardware Failure */
 138         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 139         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 140         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 141         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 142         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 145         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 146         MGMT_STATUS_BUSY,               /* Command Disallowed */
 147         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 148         MGMT_STATUS_REJECTED,           /* Rejected Security */
 149         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 150         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 151         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 153         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 154         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 155         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 156         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 157         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 158         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 159         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 161         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 162         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 163         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 165         MGMT_STATUS_FAILED,             /* Unspecified Error */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 167         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 168         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 169         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 170         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 171         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 172         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 174         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 176         MGMT_STATUS_FAILED,             /* Transaction Collision */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 178         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 180         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 181         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 182         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 183         MGMT_STATUS_FAILED,             /* Slot Violation */
 184         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 185         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 187         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 188         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 189         MGMT_STATUS_BUSY,               /* Controller Busy */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 191         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 192         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 193         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 194         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 195 };
 196
 197 bool mgmt_valid_hdev(struct hci_dev *hdev)
 198 {
 199         return hdev->dev_type == HCI_BREDR;
 200 }
 201
 202 static u8 mgmt_status(u8 hci_status)
 203 {
 204         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 205                 return mgmt_status_table[hci_status];
 206
 207         return MGMT_STATUS_FAILED;
 208 }
 209
 210 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 211 {
 212         struct sk_buff *skb;
 213         struct mgmt_hdr *hdr;
 214         struct mgmt_ev_cmd_status *ev;
 215         int err;
 216
 217         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 218
 219         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 220         if (!skb)
 221                 return -ENOMEM;
 222
 223         hdr = (void *) skb_put(skb, sizeof(*hdr));
 224
 225         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 226         hdr->index = cpu_to_le16(index);
 227         hdr->len = cpu_to_le16(sizeof(*ev));
 228
 229         ev = (void *) skb_put(skb, sizeof(*ev));
 230         ev->status = status;
 231         ev->opcode = cpu_to_le16(cmd);
 232
 233         err = sock_queue_rcv_skb(sk, skb);
 234         if (err < 0)
 235                 kfree_skb(skb);
 236
 237         return err;
 238 }
 239
 240 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 241                         void *rp, size_t rp_len)
 242 {
 243         struct sk_buff *skb;
 244         struct mgmt_hdr *hdr;
 245         struct mgmt_ev_cmd_complete *ev;
 246         int err;
 247
 248         BT_DBG("sock %p", sk);
 249
 250         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 251         if (!skb)
 252                 return -ENOMEM;
 253
 254         hdr = (void *) skb_put(skb, sizeof(*hdr));
 255
 256         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 257         hdr->index = cpu_to_le16(index);
 258         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 259
 260         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 261         ev->opcode = cpu_to_le16(cmd);
 262         ev->status = status;
 263
 264         if (rp)
 265                 memcpy(ev->data, rp, rp_len);
 266
 267         err = sock_queue_rcv_skb(sk, skb);
 268         if (err < 0)
 269                 kfree_skb(skb);
 270
 271         return err;
 272 }
 273
 274 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 275                         u16 data_len)
 276 {
 277         struct mgmt_rp_read_version rp;
 278
 279         BT_DBG("sock %p", sk);
 280
 281         rp.version = MGMT_VERSION;
 282         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 283
 284         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 285                             sizeof(rp));
 286 }
 287
 288 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 289                          u16 data_len)
 290 {
 291         struct mgmt_rp_read_commands *rp;
 292         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 293         const u16 num_events = ARRAY_SIZE(mgmt_events);
 294         __le16 *opcode;
 295         size_t rp_size;
 296         int i, err;
 297
 298         BT_DBG("sock %p", sk);
 299
 300         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 301
 302         rp = kmalloc(rp_size, GFP_KERNEL);
 303         if (!rp)
 304                 return -ENOMEM;
 305
 306         rp->num_commands = __constant_cpu_to_le16(num_commands);
 307         rp->num_events = __constant_cpu_to_le16(num_events);
 308
 309         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 310                 put_unaligned_le16(mgmt_commands[i], opcode);
 311
 312         for (i = 0; i < num_events; i++, opcode++)
 313                 put_unaligned_le16(mgmt_events[i], opcode);
 314
 315         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 316                            rp_size);
 317         kfree(rp);
 318
 319         return err;
 320 }
 321
 322 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 323                            u16 data_len)
 324 {
 325         struct mgmt_rp_read_index_list *rp;
 326         struct hci_dev *d;
 327         size_t rp_len;
 328         u16 count;
 329         int err;
 330
 331         BT_DBG("sock %p", sk);
 332
 333         read_lock(&hci_dev_list_lock);
 334
 335         count = 0;
 336         list_for_each_entry(d, &hci_dev_list, list) {
 337                 if (!mgmt_valid_hdev(d))
 338                         continue;
 339
 340                 count++;
 341         }
 342
 343         rp_len = sizeof(*rp) + (2 * count);
 344         rp = kmalloc(rp_len, GFP_ATOMIC);
 345         if (!rp) {
 346                 read_unlock(&hci_dev_list_lock);
 347                 return -ENOMEM;
 348         }
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (test_bit(HCI_SETUP, &d->dev_flags))
 353                         continue;
 354
 355                 if (!mgmt_valid_hdev(d))
 356                         continue;
 357
 358                 rp->index[count++] = cpu_to_le16(d->id);
 359                 BT_DBG("Added hci%u", d->id);
 360         }
 361
 362         rp->num_controllers = cpu_to_le16(count);
 363         rp_len = sizeof(*rp) + (2 * count);
 364
 365         read_unlock(&hci_dev_list_lock);
 366
 367         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 368                            rp_len);
 369
 370         kfree(rp);
 371
 372         return err;
 373 }
 374
 375 static u32 get_supported_settings(struct hci_dev *hdev)
 376 {
 377         u32 settings = 0;
 378
 379         settings |= MGMT_SETTING_POWERED;
 380         settings |= MGMT_SETTING_PAIRABLE;
 381
 382         if (lmp_ssp_capable(hdev))
 383                 settings |= MGMT_SETTING_SSP;
 384
 385         if (lmp_bredr_capable(hdev)) {
 386                 settings |= MGMT_SETTING_CONNECTABLE;
 387                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 388                 settings |= MGMT_SETTING_DISCOVERABLE;
 389                 settings |= MGMT_SETTING_BREDR;
 390                 settings |= MGMT_SETTING_LINK_SECURITY;
 391         }
 392
 393         if (enable_hs)
 394                 settings |= MGMT_SETTING_HS;
 395
 396         if (lmp_le_capable(hdev))
 397                 settings |= MGMT_SETTING_LE;
 398
 399         return settings;
 400 }
 401
 402 static u32 get_current_settings(struct hci_dev *hdev)
 403 {
 404         u32 settings = 0;
 405
 406         if (hdev_is_powered(hdev))
 407                 settings |= MGMT_SETTING_POWERED;
 408
 409         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 410                 settings |= MGMT_SETTING_CONNECTABLE;
 411
 412         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 413                 settings |= MGMT_SETTING_DISCOVERABLE;
 414
 415         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 416                 settings |= MGMT_SETTING_PAIRABLE;
 417
 418         if (lmp_bredr_capable(hdev))
 419                 settings |= MGMT_SETTING_BREDR;
 420
 421         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 422                 settings |= MGMT_SETTING_LE;
 423
 424         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 425                 settings |= MGMT_SETTING_LINK_SECURITY;
 426
 427         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 428                 settings |= MGMT_SETTING_SSP;
 429
 430         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 431                 settings |= MGMT_SETTING_HS;
 432
 433         return settings;
 434 }
 435
 436 #define PNP_INFO_SVCLASS_ID             0x1200
 437
 438 static void create_eir(struct hci_dev *hdev, u8 *data)
 439 {
 440         u8 *ptr = data;
 441         u8 *uuids_start;
 442         u16 eir_len = 0;
 443         struct bt_uuid *uuid;
 444         size_t name_len;
 445
 446         name_len = strlen(hdev->dev_name);
 447
 448         if (name_len > 0) {
 449                 /* EIR Data type */
 450                 if (name_len > 48) {
 451                         name_len = 48;
 452                         ptr[1] = EIR_NAME_SHORT;
 453                 } else
 454                         ptr[1] = EIR_NAME_COMPLETE;
 455
 456                 /* EIR Data length */
 457                 ptr[0] = name_len + 1;
 458
 459                 memcpy(ptr + 2, hdev->dev_name, name_len);
 460
 461                 eir_len += (name_len + 2);
 462                 ptr += (name_len + 2);
 463         }
 464
 465         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 466                 ptr[0] = 2;
 467                 ptr[1] = EIR_TX_POWER;
 468                 ptr[2] = (u8) hdev->inq_tx_power;
 469
 470                 eir_len += 3;
 471                 ptr += 3;
 472         }
 473
 474         if (hdev->devid_source > 0) {
 475                 ptr[0] = 9;
 476                 ptr[1] = EIR_DEVICE_ID;
 477
 478                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 479                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 480                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 481                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 482
 483                 eir_len += 10;
 484                 ptr += 10;
 485         }
 486
 487         uuids_start = NULL;
 488
 489         /* Group all UUID16 types */
 490         list_for_each_entry(uuid, &hdev->uuids, list) {
 491                 u16 uuid16;
 492
 493                 if (uuid->size != 16)
 494                         continue;
 495
 496                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 497                 if (uuid16 < 0x1100)
 498                         continue;
 499
 500                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 501                         continue;
 502
 503                 if (!uuids_start) {
 504                         uuids_start = ptr;
 505                         uuids_start[0] = 1;
 506                         uuids_start[1] = EIR_UUID16_ALL;
 507                         ptr += 2;
 508                         eir_len += 2;
 509                 }
 510
 511                 /* Stop if not enough space to put next UUID */
 512                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 513                         uuids_start[1] = EIR_UUID16_SOME;
 514                         break;
 515                 }
 516
 517                 *ptr++ = (uuid16 & 0x00ff);
 518                 *ptr++ = (uuid16 & 0xff00) >> 8;
 519                 eir_len += sizeof(uuid16);
 520                 uuids_start[0] += sizeof(uuid16);
 521         }
 522 }
 523
 524 static int update_eir(struct hci_dev *hdev)
 525 {
 526         struct hci_cp_write_eir cp;
 527
 528         if (!hdev_is_powered(hdev))
 529                 return 0;
 530
 531         if (!lmp_ext_inq_capable(hdev))
 532                 return 0;
 533
 534         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 535                 return 0;
 536
 537         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 538                 return 0;
 539
 540         memset(&cp, 0, sizeof(cp));
 541
 542         create_eir(hdev, cp.data);
 543
 544         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 545                 return 0;
 546
 547         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 548
 549         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 550 }
 551
 552 static u8 get_service_classes(struct hci_dev *hdev)
 553 {
 554         struct bt_uuid *uuid;
 555         u8 val = 0;
 556
 557         list_for_each_entry(uuid, &hdev->uuids, list)
 558                 val |= uuid->svc_hint;
 559
 560         return val;
 561 }
 562
 563 static int update_class(struct hci_dev *hdev)
 564 {
 565         u8 cod[3];
 566         int err;
 567
 568         BT_DBG("%s", hdev->name);
 569
 570         if (!hdev_is_powered(hdev))
 571                 return 0;
 572
 573         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 574                 return 0;
 575
 576         cod[0] = hdev->minor_class;
 577         cod[1] = hdev->major_class;
 578         cod[2] = get_service_classes(hdev);
 579
 580         if (memcmp(cod, hdev->dev_class, 3) == 0)
 581                 return 0;
 582
 583         err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 584         if (err == 0)
 585                 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
 586
 587         return err;
 588 }
 589
 590 static void service_cache_off(struct work_struct *work)
 591 {
 592         struct hci_dev *hdev = container_of(work, struct hci_dev,
 593                                             service_cache.work);
 594
 595         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 596                 return;
 597
 598         hci_dev_lock(hdev);
 599
 600         update_eir(hdev);
 601         update_class(hdev);
 602
 603         hci_dev_unlock(hdev);
 604 }
 605
 606 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 607 {
 608         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 609                 return;
 610
 611         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 612
 613         /* Non-mgmt controlled devices get this bit set
 614          * implicitly so that pairing works for them, however
 615          * for mgmt we require user-space to explicitly enable
 616          * it
 617          */
 618         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 619 }
 620
 621 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 622                                 void *data, u16 data_len)
 623 {
 624         struct mgmt_rp_read_info rp;
 625
 626         BT_DBG("sock %p %s", sk, hdev->name);
 627
 628         hci_dev_lock(hdev);
 629
 630         memset(&rp, 0, sizeof(rp));
 631
 632         bacpy(&rp.bdaddr, &hdev->bdaddr);
 633
 634         rp.version = hdev->hci_ver;
 635         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 636
 637         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 638         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 639
 640         memcpy(rp.dev_class, hdev->dev_class, 3);
 641
 642         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 643         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 644
 645         hci_dev_unlock(hdev);
 646
 647         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 648                             sizeof(rp));
 649 }
 650
 651 static void mgmt_pending_free(struct pending_cmd *cmd)
 652 {
 653         sock_put(cmd->sk);
 654         kfree(cmd->param);
 655         kfree(cmd);
 656 }
 657
 658 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 659                                             struct hci_dev *hdev, void *data,
 660                                             u16 len)
 661 {
 662         struct pending_cmd *cmd;
 663
 664         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 665         if (!cmd)
 666                 return NULL;
 667
 668         cmd->opcode = opcode;
 669         cmd->index = hdev->id;
 670
 671         cmd->param = kmalloc(len, GFP_KERNEL);
 672         if (!cmd->param) {
 673                 kfree(cmd);
 674                 return NULL;
 675         }
 676
 677         if (data)
 678                 memcpy(cmd->param, data, len);
 679
 680         cmd->sk = sk;
 681         sock_hold(sk);
 682
 683         list_add(&cmd->list, &hdev->mgmt_pending);
 684
 685         return cmd;
 686 }
 687
 688 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 689                                  void (*cb)(struct pending_cmd *cmd,
 690                                             void *data),
 691                                  void *data)
 692 {
 693         struct list_head *p, *n;
 694
 695         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 696                 struct pending_cmd *cmd;
 697
 698                 cmd = list_entry(p, struct pending_cmd, list);
 699
 700                 if (opcode > 0 && cmd->opcode != opcode)
 701                         continue;
 702
 703                 cb(cmd, data);
 704         }
 705 }
 706
 707 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 708 {
 709         struct pending_cmd *cmd;
 710
 711         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 712                 if (cmd->opcode == opcode)
 713                         return cmd;
 714         }
 715
 716         return NULL;
 717 }
 718
 719 static void mgmt_pending_remove(struct pending_cmd *cmd)
 720 {
 721         list_del(&cmd->list);
 722         mgmt_pending_free(cmd);
 723 }
 724
 725 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 726 {
 727         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 728
 729         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 730                             sizeof(settings));
 731 }
 732
 733 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 734                        u16 len)
 735 {
 736         struct mgmt_mode *cp = data;
 737         struct pending_cmd *cmd;
 738         int err;
 739
 740         BT_DBG("request for %s", hdev->name);
 741
 742         if (cp->val != 0x00 && cp->val != 0x01)
 743                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 744                                   MGMT_STATUS_INVALID_PARAMS);
 745
 746         hci_dev_lock(hdev);
 747
 748         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 749                 cancel_delayed_work(&hdev->power_off);
 750
 751                 if (cp->val) {
 752                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 753                                          data, len);
 754                         err = mgmt_powered(hdev, 1);
 755                         goto failed;
 756                 }
 757         }
 758
 759         if (!!cp->val == hdev_is_powered(hdev)) {
 760                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 761                 goto failed;
 762         }
 763
 764         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 765                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 766                                  MGMT_STATUS_BUSY);
 767                 goto failed;
 768         }
 769
 770         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 771         if (!cmd) {
 772                 err = -ENOMEM;
 773                 goto failed;
 774         }
 775
 776         if (cp->val)
 777                 queue_work(hdev->req_workqueue, &hdev->power_on);
 778         else
 779                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 780
 781         err = 0;
 782
 783 failed:
 784         hci_dev_unlock(hdev);
 785         return err;
 786 }
 787
 788 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 789                       struct sock *skip_sk)
 790 {
 791         struct sk_buff *skb;
 792         struct mgmt_hdr *hdr;
 793
 794         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 795         if (!skb)
 796                 return -ENOMEM;
 797
 798         hdr = (void *) skb_put(skb, sizeof(*hdr));
 799         hdr->opcode = cpu_to_le16(event);
 800         if (hdev)
 801                 hdr->index = cpu_to_le16(hdev->id);
 802         else
 803                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 804         hdr->len = cpu_to_le16(data_len);
 805
 806         if (data)
 807                 memcpy(skb_put(skb, data_len), data, data_len);
 808
 809         /* Time stamp */
 810         __net_timestamp(skb);
 811
 812         hci_send_to_control(skb, skip_sk);
 813         kfree_skb(skb);
 814
 815         return 0;
 816 }
 817
 818 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 819 {
 820         __le32 ev;
 821
 822         ev = cpu_to_le32(get_current_settings(hdev));
 823
 824         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 825 }
 826
 827 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 828                             u16 len)
 829 {
 830         struct mgmt_cp_set_discoverable *cp = data;
 831         struct pending_cmd *cmd;
 832         u16 timeout;
 833         u8 scan;
 834         int err;
 835
 836         BT_DBG("request for %s", hdev->name);
 837
 838         if (!lmp_bredr_capable(hdev))
 839                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 840                                  MGMT_STATUS_NOT_SUPPORTED);
 841
 842         if (cp->val != 0x00 && cp->val != 0x01)
 843                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 844                                   MGMT_STATUS_INVALID_PARAMS);
 845
 846         timeout = __le16_to_cpu(cp->timeout);
 847         if (!cp->val && timeout > 0)
 848                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 849                                   MGMT_STATUS_INVALID_PARAMS);
 850
 851         hci_dev_lock(hdev);
 852
 853         if (!hdev_is_powered(hdev) && timeout > 0) {
 854                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 855                                  MGMT_STATUS_NOT_POWERED);
 856                 goto failed;
 857         }
 858
 859         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 860             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 861                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 862                                  MGMT_STATUS_BUSY);
 863                 goto failed;
 864         }
 865
 866         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 867                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 868                                  MGMT_STATUS_REJECTED);
 869                 goto failed;
 870         }
 871
 872         if (!hdev_is_powered(hdev)) {
 873                 bool changed = false;
 874
 875                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 876                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 877                         changed = true;
 878                 }
 879
 880                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 881                 if (err < 0)
 882                         goto failed;
 883
 884                 if (changed)
 885                         err = new_settings(hdev, sk);
 886
 887                 goto failed;
 888         }
 889
 890         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 891                 if (hdev->discov_timeout > 0) {
 892                         cancel_delayed_work(&hdev->discov_off);
 893                         hdev->discov_timeout = 0;
 894                 }
 895
 896                 if (cp->val && timeout > 0) {
 897                         hdev->discov_timeout = timeout;
 898                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 899                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 900                 }
 901
 902                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 903                 goto failed;
 904         }
 905
 906         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 907         if (!cmd) {
 908                 err = -ENOMEM;
 909                 goto failed;
 910         }
 911
 912         scan = SCAN_PAGE;
 913
 914         if (cp->val)
 915                 scan |= SCAN_INQUIRY;
 916         else
 917                 cancel_delayed_work(&hdev->discov_off);
 918
 919         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 920         if (err < 0)
 921                 mgmt_pending_remove(cmd);
 922
 923         if (cp->val)
 924                 hdev->discov_timeout = timeout;
 925
 926 failed:
 927         hci_dev_unlock(hdev);
 928         return err;
 929 }
 930
 931 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
 932                            u16 len)
 933 {
 934         struct mgmt_mode *cp = data;
 935         struct pending_cmd *cmd;
 936         u8 scan;
 937         int err;
 938
 939         BT_DBG("request for %s", hdev->name);
 940
 941         if (!lmp_bredr_capable(hdev))
 942                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
 943                                   MGMT_STATUS_NOT_SUPPORTED);
 944
 945         if (cp->val != 0x00 && cp->val != 0x01)
 946                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
 947                                   MGMT_STATUS_INVALID_PARAMS);
 948
 949         hci_dev_lock(hdev);
 950
 951         if (!hdev_is_powered(hdev)) {
 952                 bool changed = false;
 953
 954                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 955                         changed = true;
 956
 957                 if (cp->val) {
 958                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 959                 } else {
 960                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 961                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 962                 }
 963
 964                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 965                 if (err < 0)
 966                         goto failed;
 967
 968                 if (changed)
 969                         err = new_settings(hdev, sk);
 970
 971                 goto failed;
 972         }
 973
 974         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 975             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 976                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
 977                                  MGMT_STATUS_BUSY);
 978                 goto failed;
 979         }
 980
 981         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 982                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 983                 goto failed;
 984         }
 985
 986         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
 987         if (!cmd) {
 988                 err = -ENOMEM;
 989                 goto failed;
 990         }
 991
 992         if (cp->val) {
 993                 scan = SCAN_PAGE;
 994         } else {
 995                 scan = 0;
 996
 997                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
 998                     hdev->discov_timeout > 0)
 999                         cancel_delayed_work(&hdev->discov_off);
1000         }
1001
1002         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1003         if (err < 0)
1004                 mgmt_pending_remove(cmd);
1005
1006 failed:
1007         hci_dev_unlock(hdev);
1008         return err;
1009 }
1010
1011 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1012                         u16 len)
1013 {
1014         struct mgmt_mode *cp = data;
1015         int err;
1016
1017         BT_DBG("request for %s", hdev->name);
1018
1019         if (cp->val != 0x00 && cp->val != 0x01)
1020                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1021                                   MGMT_STATUS_INVALID_PARAMS);
1022
1023         hci_dev_lock(hdev);
1024
1025         if (cp->val)
1026                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1027         else
1028                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1029
1030         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1031         if (err < 0)
1032                 goto failed;
1033
1034         err = new_settings(hdev, sk);
1035
1036 failed:
1037         hci_dev_unlock(hdev);
1038         return err;
1039 }
1040
1041 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1042                              u16 len)
1043 {
1044         struct mgmt_mode *cp = data;
1045         struct pending_cmd *cmd;
1046         u8 val;
1047         int err;
1048
1049         BT_DBG("request for %s", hdev->name);
1050
1051         if (!lmp_bredr_capable(hdev))
1052                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1053                                   MGMT_STATUS_NOT_SUPPORTED);
1054
1055         if (cp->val != 0x00 && cp->val != 0x01)
1056                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1057                                   MGMT_STATUS_INVALID_PARAMS);
1058
1059         hci_dev_lock(hdev);
1060
1061         if (!hdev_is_powered(hdev)) {
1062                 bool changed = false;
1063
1064                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1065                                           &hdev->dev_flags)) {
1066                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1067                         changed = true;
1068                 }
1069
1070                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1071                 if (err < 0)
1072                         goto failed;
1073
1074                 if (changed)
1075                         err = new_settings(hdev, sk);
1076
1077                 goto failed;
1078         }
1079
1080         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1081                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1082                                  MGMT_STATUS_BUSY);
1083                 goto failed;
1084         }
1085
1086         val = !!cp->val;
1087
1088         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1089                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1090                 goto failed;
1091         }
1092
1093         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1094         if (!cmd) {
1095                 err = -ENOMEM;
1096                 goto failed;
1097         }
1098
1099         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1100         if (err < 0) {
1101                 mgmt_pending_remove(cmd);
1102                 goto failed;
1103         }
1104
1105 failed:
1106         hci_dev_unlock(hdev);
1107         return err;
1108 }
1109
1110 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1111 {
1112         struct mgmt_mode *cp = data;
1113         struct pending_cmd *cmd;
1114         u8 val;
1115         int err;
1116
1117         BT_DBG("request for %s", hdev->name);
1118
1119         if (!lmp_ssp_capable(hdev))
1120                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1121                                   MGMT_STATUS_NOT_SUPPORTED);
1122
1123         if (cp->val != 0x00 && cp->val != 0x01)
1124                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1125                                   MGMT_STATUS_INVALID_PARAMS);
1126
1127         hci_dev_lock(hdev);
1128
1129         val = !!cp->val;
1130
1131         if (!hdev_is_powered(hdev)) {
1132                 bool changed = false;
1133
1134                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1135                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1136                         changed = true;
1137                 }
1138
1139                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1140                 if (err < 0)
1141                         goto failed;
1142
1143                 if (changed)
1144                         err = new_settings(hdev, sk);
1145
1146                 goto failed;
1147         }
1148
1149         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1150                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1151                                  MGMT_STATUS_BUSY);
1152                 goto failed;
1153         }
1154
1155         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1156                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1157                 goto failed;
1158         }
1159
1160         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1161         if (!cmd) {
1162                 err = -ENOMEM;
1163                 goto failed;
1164         }
1165
1166         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1167         if (err < 0) {
1168                 mgmt_pending_remove(cmd);
1169                 goto failed;
1170         }
1171
1172 failed:
1173         hci_dev_unlock(hdev);
1174         return err;
1175 }
1176
1177 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1178 {
1179         struct mgmt_mode *cp = data;
1180
1181         BT_DBG("request for %s", hdev->name);
1182
1183         if (!enable_hs)
1184                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1185                                   MGMT_STATUS_NOT_SUPPORTED);
1186
1187         if (cp->val != 0x00 && cp->val != 0x01)
1188                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1189                                   MGMT_STATUS_INVALID_PARAMS);
1190
1191         if (cp->val)
1192                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1193         else
1194                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1195
1196         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1197 }
1198
1199 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1200 {
1201         struct mgmt_mode *cp = data;
1202         struct hci_cp_write_le_host_supported hci_cp;
1203         struct pending_cmd *cmd;
1204         int err;
1205         u8 val, enabled;
1206
1207         BT_DBG("request for %s", hdev->name);
1208
1209         if (!lmp_le_capable(hdev))
1210                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1211                                   MGMT_STATUS_NOT_SUPPORTED);
1212
1213         if (cp->val != 0x00 && cp->val != 0x01)
1214                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1215                                   MGMT_STATUS_INVALID_PARAMS);
1216
1217         hci_dev_lock(hdev);
1218
1219         val = !!cp->val;
1220         enabled = lmp_host_le_capable(hdev);
1221
1222         if (!hdev_is_powered(hdev) || val == enabled) {
1223                 bool changed = false;
1224
1225                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1226                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1227                         changed = true;
1228                 }
1229
1230                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1231                 if (err < 0)
1232                         goto unlock;
1233
1234                 if (changed)
1235                         err = new_settings(hdev, sk);
1236
1237                 goto unlock;
1238         }
1239
1240         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1241                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1242                                  MGMT_STATUS_BUSY);
1243                 goto unlock;
1244         }
1245
1246         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1247         if (!cmd) {
1248                 err = -ENOMEM;
1249                 goto unlock;
1250         }
1251
1252         memset(&hci_cp, 0, sizeof(hci_cp));
1253
1254         if (val) {
1255                 hci_cp.le = val;
1256                 hci_cp.simul = lmp_le_br_capable(hdev);
1257         }
1258
1259         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1260                            &hci_cp);
1261         if (err < 0)
1262                 mgmt_pending_remove(cmd);
1263
1264 unlock:
1265         hci_dev_unlock(hdev);
1266         return err;
1267 }
1268
1269 static const u8 bluetooth_base_uuid[] = {
1270                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1271                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1272 };
1273
1274 static u8 get_uuid_size(const u8 *uuid)
1275 {
1276         u32 val;
1277
1278         if (memcmp(uuid, bluetooth_base_uuid, 12))
1279                 return 128;
1280
1281         val = get_unaligned_le32(&uuid[12]);
1282         if (val > 0xffff)
1283                 return 32;
1284
1285         return 16;
1286 }
1287
1288 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1289 {
1290         struct mgmt_cp_add_uuid *cp = data;
1291         struct pending_cmd *cmd;
1292         struct bt_uuid *uuid;
1293         int err;
1294
1295         BT_DBG("request for %s", hdev->name);
1296
1297         hci_dev_lock(hdev);
1298
1299         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1300                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1301                                  MGMT_STATUS_BUSY);
1302                 goto failed;
1303         }
1304
1305         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1306         if (!uuid) {
1307                 err = -ENOMEM;
1308                 goto failed;
1309         }
1310
1311         memcpy(uuid->uuid, cp->uuid, 16);
1312         uuid->svc_hint = cp->svc_hint;
1313         uuid->size = get_uuid_size(cp->uuid);
1314
1315         list_add_tail(&uuid->list, &hdev->uuids);
1316
1317         err = update_class(hdev);
1318         if (err < 0)
1319                 goto failed;
1320
1321         err = update_eir(hdev);
1322         if (err < 0)
1323                 goto failed;
1324
1325         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1326                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1327                                    hdev->dev_class, 3);
1328                 goto failed;
1329         }
1330
1331         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1332         if (!cmd)
1333                 err = -ENOMEM;
1334
1335 failed:
1336         hci_dev_unlock(hdev);
1337         return err;
1338 }
1339
1340 static bool enable_service_cache(struct hci_dev *hdev)
1341 {
1342         if (!hdev_is_powered(hdev))
1343                 return false;
1344
1345         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1346                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1347                                    CACHE_TIMEOUT);
1348                 return true;
1349         }
1350
1351         return false;
1352 }
1353
1354 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1355                        u16 len)
1356 {
1357         struct mgmt_cp_remove_uuid *cp = data;
1358         struct pending_cmd *cmd;
1359         struct bt_uuid *match, *tmp;
1360         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1361         int err, found;
1362
1363         BT_DBG("request for %s", hdev->name);
1364
1365         hci_dev_lock(hdev);
1366
1367         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1368                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1369                                  MGMT_STATUS_BUSY);
1370                 goto unlock;
1371         }
1372
1373         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1374                 err = hci_uuids_clear(hdev);
1375
1376                 if (enable_service_cache(hdev)) {
1377                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1378                                            0, hdev->dev_class, 3);
1379                         goto unlock;
1380                 }
1381
1382                 goto update_class;
1383         }
1384
1385         found = 0;
1386
1387         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1388                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1389                         continue;
1390
1391                 list_del(&match->list);
1392                 kfree(match);
1393                 found++;
1394         }
1395
1396         if (found == 0) {
1397                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1398                                  MGMT_STATUS_INVALID_PARAMS);
1399                 goto unlock;
1400         }
1401
1402 update_class:
1403         err = update_class(hdev);
1404         if (err < 0)
1405                 goto unlock;
1406
1407         err = update_eir(hdev);
1408         if (err < 0)
1409                 goto unlock;
1410
1411         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1412                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1413                                    hdev->dev_class, 3);
1414                 goto unlock;
1415         }
1416
1417         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1418         if (!cmd)
1419                 err = -ENOMEM;
1420
1421 unlock:
1422         hci_dev_unlock(hdev);
1423         return err;
1424 }
1425
1426 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1427                          u16 len)
1428 {
1429         struct mgmt_cp_set_dev_class *cp = data;
1430         struct pending_cmd *cmd;
1431         int err;
1432
1433         BT_DBG("request for %s", hdev->name);
1434
1435         if (!lmp_bredr_capable(hdev))
1436                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1437                                   MGMT_STATUS_NOT_SUPPORTED);
1438
1439         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags))
1440                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1441                                   MGMT_STATUS_BUSY);
1442
1443         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0)
1444                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1445                                   MGMT_STATUS_INVALID_PARAMS);
1446
1447         hci_dev_lock(hdev);
1448
1449         hdev->major_class = cp->major;
1450         hdev->minor_class = cp->minor;
1451
1452         if (!hdev_is_powered(hdev)) {
1453                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1454                                    hdev->dev_class, 3);
1455                 goto unlock;
1456         }
1457
1458         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1459                 hci_dev_unlock(hdev);
1460                 cancel_delayed_work_sync(&hdev->service_cache);
1461                 hci_dev_lock(hdev);
1462                 update_eir(hdev);
1463         }
1464
1465         err = update_class(hdev);
1466         if (err < 0)
1467                 goto unlock;
1468
1469         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1470                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1471                                    hdev->dev_class, 3);
1472                 goto unlock;
1473         }
1474
1475         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1476         if (!cmd)
1477                 err = -ENOMEM;
1478
1479 unlock:
1480         hci_dev_unlock(hdev);
1481         return err;
1482 }
1483
1484 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1485                           u16 len)
1486 {
1487         struct mgmt_cp_load_link_keys *cp = data;
1488         u16 key_count, expected_len;
1489         int i;
1490
1491         key_count = __le16_to_cpu(cp->key_count);
1492
1493         expected_len = sizeof(*cp) + key_count *
1494                                         sizeof(struct mgmt_link_key_info);
1495         if (expected_len != len) {
1496                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1497                        len, expected_len);
1498                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1499                                   MGMT_STATUS_INVALID_PARAMS);
1500         }
1501
1502         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1503                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1504                                   MGMT_STATUS_INVALID_PARAMS);
1505
1506         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1507                key_count);
1508
1509         for (i = 0; i < key_count; i++) {
1510                 struct mgmt_link_key_info *key = &cp->keys[i];
1511
1512                 if (key->addr.type != BDADDR_BREDR)
1513                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1514                                           MGMT_STATUS_INVALID_PARAMS);
1515         }
1516
1517         hci_dev_lock(hdev);
1518
1519         hci_link_keys_clear(hdev);
1520
1521         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1522
1523         if (cp->debug_keys)
1524                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1525         else
1526                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1527
1528         for (i = 0; i < key_count; i++) {
1529                 struct mgmt_link_key_info *key = &cp->keys[i];
1530
1531                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1532                                  key->type, key->pin_len);
1533         }
1534
1535         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1536
1537         hci_dev_unlock(hdev);
1538
1539         return 0;
1540 }
1541
1542 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1543                            u8 addr_type, struct sock *skip_sk)
1544 {
1545         struct mgmt_ev_device_unpaired ev;
1546
1547         bacpy(&ev.addr.bdaddr, bdaddr);
1548         ev.addr.type = addr_type;
1549
1550         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1551                           skip_sk);
1552 }
1553
1554 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1555                          u16 len)
1556 {
1557         struct mgmt_cp_unpair_device *cp = data;
1558         struct mgmt_rp_unpair_device rp;
1559         struct hci_cp_disconnect dc;
1560         struct pending_cmd *cmd;
1561         struct hci_conn *conn;
1562         int err;
1563
1564         memset(&rp, 0, sizeof(rp));
1565         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1566         rp.addr.type = cp->addr.type;
1567
1568         if (!bdaddr_type_is_valid(cp->addr.type))
1569                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1570                                     MGMT_STATUS_INVALID_PARAMS,
1571                                     &rp, sizeof(rp));
1572
1573         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1574                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1575                                     MGMT_STATUS_INVALID_PARAMS,
1576                                     &rp, sizeof(rp));
1577
1578         hci_dev_lock(hdev);
1579
1580         if (!hdev_is_powered(hdev)) {
1581                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1582                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1583                 goto unlock;
1584         }
1585
1586         if (cp->addr.type == BDADDR_BREDR)
1587                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1588         else
1589                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1590
1591         if (err < 0) {
1592                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1593                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1594                 goto unlock;
1595         }
1596
1597         if (cp->disconnect) {
1598                 if (cp->addr.type == BDADDR_BREDR)
1599                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1600                                                        &cp->addr.bdaddr);
1601                 else
1602                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1603                                                        &cp->addr.bdaddr);
1604         } else {
1605                 conn = NULL;
1606         }
1607
1608         if (!conn) {
1609                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1610                                    &rp, sizeof(rp));
1611                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1612                 goto unlock;
1613         }
1614
1615         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1616                                sizeof(*cp));
1617         if (!cmd) {
1618                 err = -ENOMEM;
1619                 goto unlock;
1620         }
1621
1622         dc.handle = cpu_to_le16(conn->handle);
1623         dc.reason = 0x13; /* Remote User Terminated Connection */
1624         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1625         if (err < 0)
1626                 mgmt_pending_remove(cmd);
1627
1628 unlock:
1629         hci_dev_unlock(hdev);
1630         return err;
1631 }
1632
1633 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1634                       u16 len)
1635 {
1636         struct mgmt_cp_disconnect *cp = data;
1637         struct mgmt_rp_disconnect rp;
1638         struct hci_cp_disconnect dc;
1639         struct pending_cmd *cmd;
1640         struct hci_conn *conn;
1641         int err;
1642
1643         BT_DBG("");
1644
1645         memset(&rp, 0, sizeof(rp));
1646         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1647         rp.addr.type = cp->addr.type;
1648
1649         if (!bdaddr_type_is_valid(cp->addr.type))
1650                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1651                                     MGMT_STATUS_INVALID_PARAMS,
1652                                     &rp, sizeof(rp));
1653
1654         hci_dev_lock(hdev);
1655
1656         if (!test_bit(HCI_UP, &hdev->flags)) {
1657                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1658                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1659                 goto failed;
1660         }
1661
1662         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1663                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1664                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1665                 goto failed;
1666         }
1667
1668         if (cp->addr.type == BDADDR_BREDR)
1669                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1670                                                &cp->addr.bdaddr);
1671         else
1672                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1673
1674         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1675                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1676                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1677                 goto failed;
1678         }
1679
1680         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1681         if (!cmd) {
1682                 err = -ENOMEM;
1683                 goto failed;
1684         }
1685
1686         dc.handle = cpu_to_le16(conn->handle);
1687         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1688
1689         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1690         if (err < 0)
1691                 mgmt_pending_remove(cmd);
1692
1693 failed:
1694         hci_dev_unlock(hdev);
1695         return err;
1696 }
1697
1698 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1699 {
1700         switch (link_type) {
1701         case LE_LINK:
1702                 switch (addr_type) {
1703                 case ADDR_LE_DEV_PUBLIC:
1704                         return BDADDR_LE_PUBLIC;
1705
1706                 default:
1707                         /* Fallback to LE Random address type */
1708                         return BDADDR_LE_RANDOM;
1709                 }
1710
1711         default:
1712                 /* Fallback to BR/EDR type */
1713                 return BDADDR_BREDR;
1714         }
1715 }
1716
1717 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1718                            u16 data_len)
1719 {
1720         struct mgmt_rp_get_connections *rp;
1721         struct hci_conn *c;
1722         size_t rp_len;
1723         int err;
1724         u16 i;
1725
1726         BT_DBG("");
1727
1728         hci_dev_lock(hdev);
1729
1730         if (!hdev_is_powered(hdev)) {
1731                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1732                                  MGMT_STATUS_NOT_POWERED);
1733                 goto unlock;
1734         }
1735
1736         i = 0;
1737         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1738                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1739                         i++;
1740         }
1741
1742         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1743         rp = kmalloc(rp_len, GFP_KERNEL);
1744         if (!rp) {
1745                 err = -ENOMEM;
1746                 goto unlock;
1747         }
1748
1749         i = 0;
1750         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1751                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1752                         continue;
1753                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1754                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1755                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1756                         continue;
1757                 i++;
1758         }
1759
1760         rp->conn_count = cpu_to_le16(i);
1761
1762         /* Recalculate length in case of filtered SCO connections, etc */
1763         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1764
1765         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1766                            rp_len);
1767
1768         kfree(rp);
1769
1770 unlock:
1771         hci_dev_unlock(hdev);
1772         return err;
1773 }
1774
1775 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1776                                    struct mgmt_cp_pin_code_neg_reply *cp)
1777 {
1778         struct pending_cmd *cmd;
1779         int err;
1780
1781         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1782                                sizeof(*cp));
1783         if (!cmd)
1784                 return -ENOMEM;
1785
1786         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1787                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1788         if (err < 0)
1789                 mgmt_pending_remove(cmd);
1790
1791         return err;
1792 }
1793
1794 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1795                           u16 len)
1796 {
1797         struct hci_conn *conn;
1798         struct mgmt_cp_pin_code_reply *cp = data;
1799         struct hci_cp_pin_code_reply reply;
1800         struct pending_cmd *cmd;
1801         int err;
1802
1803         BT_DBG("");
1804
1805         hci_dev_lock(hdev);
1806
1807         if (!hdev_is_powered(hdev)) {
1808                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1809                                  MGMT_STATUS_NOT_POWERED);
1810                 goto failed;
1811         }
1812
1813         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1814         if (!conn) {
1815                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1816                                  MGMT_STATUS_NOT_CONNECTED);
1817                 goto failed;
1818         }
1819
1820         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1821                 struct mgmt_cp_pin_code_neg_reply ncp;
1822
1823                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1824
1825                 BT_ERR("PIN code is not 16 bytes long");
1826
1827                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1828                 if (err >= 0)
1829                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1830                                          MGMT_STATUS_INVALID_PARAMS);
1831
1832                 goto failed;
1833         }
1834
1835         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1836         if (!cmd) {
1837                 err = -ENOMEM;
1838                 goto failed;
1839         }
1840
1841         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1842         reply.pin_len = cp->pin_len;
1843         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1844
1845         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1846         if (err < 0)
1847                 mgmt_pending_remove(cmd);
1848
1849 failed:
1850         hci_dev_unlock(hdev);
1851         return err;
1852 }
1853
1854 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1855                              u16 len)
1856 {
1857         struct mgmt_cp_set_io_capability *cp = data;
1858
1859         BT_DBG("");
1860
1861         hci_dev_lock(hdev);
1862
1863         hdev->io_capability = cp->io_capability;
1864
1865         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1866                hdev->io_capability);
1867
1868         hci_dev_unlock(hdev);
1869
1870         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1871                             0);
1872 }
1873
1874 static struct pending_cmd *find_pairing(struct hci_conn *conn)
1875 {
1876         struct hci_dev *hdev = conn->hdev;
1877         struct pending_cmd *cmd;
1878
1879         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1880                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1881                         continue;
1882
1883                 if (cmd->user_data != conn)
1884                         continue;
1885
1886                 return cmd;
1887         }
1888
1889         return NULL;
1890 }
1891
1892 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1893 {
1894         struct mgmt_rp_pair_device rp;
1895         struct hci_conn *conn = cmd->user_data;
1896
1897         bacpy(&rp.addr.bdaddr, &conn->dst);
1898         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
1899
1900         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1901                      &rp, sizeof(rp));
1902
1903         /* So we don't get further callbacks for this connection */
1904         conn->connect_cfm_cb = NULL;
1905         conn->security_cfm_cb = NULL;
1906         conn->disconn_cfm_cb = NULL;
1907
1908         hci_conn_put(conn);
1909
1910         mgmt_pending_remove(cmd);
1911 }
1912
1913 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1914 {
1915         struct pending_cmd *cmd;
1916
1917         BT_DBG("status %u", status);
1918
1919         cmd = find_pairing(conn);
1920         if (!cmd)
1921                 BT_DBG("Unable to find a pending command");
1922         else
1923                 pairing_complete(cmd, mgmt_status(status));
1924 }
1925
1926 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
1927 {
1928         struct pending_cmd *cmd;
1929
1930         BT_DBG("status %u", status);
1931
1932         if (!status)
1933                 return;
1934
1935         cmd = find_pairing(conn);
1936         if (!cmd)
1937                 BT_DBG("Unable to find a pending command");
1938         else
1939                 pairing_complete(cmd, mgmt_status(status));
1940 }
1941
1942 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1943                        u16 len)
1944 {
1945         struct mgmt_cp_pair_device *cp = data;
1946         struct mgmt_rp_pair_device rp;
1947         struct pending_cmd *cmd;
1948         u8 sec_level, auth_type;
1949         struct hci_conn *conn;
1950         int err;
1951
1952         BT_DBG("");
1953
1954         memset(&rp, 0, sizeof(rp));
1955         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1956         rp.addr.type = cp->addr.type;
1957
1958         if (!bdaddr_type_is_valid(cp->addr.type))
1959                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1960                                     MGMT_STATUS_INVALID_PARAMS,
1961                                     &rp, sizeof(rp));
1962
1963         hci_dev_lock(hdev);
1964
1965         if (!hdev_is_powered(hdev)) {
1966                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1967                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1968                 goto unlock;
1969         }
1970
1971         sec_level = BT_SECURITY_MEDIUM;
1972         if (cp->io_cap == 0x03)
1973                 auth_type = HCI_AT_DEDICATED_BONDING;
1974         else
1975                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1976
1977         if (cp->addr.type == BDADDR_BREDR)
1978                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
1979                                    cp->addr.type, sec_level, auth_type);
1980         else
1981                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
1982                                    cp->addr.type, sec_level, auth_type);
1983
1984         if (IS_ERR(conn)) {
1985                 int status;
1986
1987                 if (PTR_ERR(conn) == -EBUSY)
1988                         status = MGMT_STATUS_BUSY;
1989                 else
1990                         status = MGMT_STATUS_CONNECT_FAILED;
1991
1992                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1993                                    status, &rp,
1994                                    sizeof(rp));
1995                 goto unlock;
1996         }
1997
1998         if (conn->connect_cfm_cb) {
1999                 hci_conn_put(conn);
2000                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2001                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2002                 goto unlock;
2003         }
2004
2005         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2006         if (!cmd) {
2007                 err = -ENOMEM;
2008                 hci_conn_put(conn);
2009                 goto unlock;
2010         }
2011
2012         /* For LE, just connecting isn't a proof that the pairing finished */
2013         if (cp->addr.type == BDADDR_BREDR)
2014                 conn->connect_cfm_cb = pairing_complete_cb;
2015         else
2016                 conn->connect_cfm_cb = le_connect_complete_cb;
2017
2018         conn->security_cfm_cb = pairing_complete_cb;
2019         conn->disconn_cfm_cb = pairing_complete_cb;
2020         conn->io_capability = cp->io_cap;
2021         cmd->user_data = conn;
2022
2023         if (conn->state == BT_CONNECTED &&
2024             hci_conn_security(conn, sec_level, auth_type))
2025                 pairing_complete(cmd, 0);
2026
2027         err = 0;
2028
2029 unlock:
2030         hci_dev_unlock(hdev);
2031         return err;
2032 }
2033
2034 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2035                               u16 len)
2036 {
2037         struct mgmt_addr_info *addr = data;
2038         struct pending_cmd *cmd;
2039         struct hci_conn *conn;
2040         int err;
2041
2042         BT_DBG("");
2043
2044         hci_dev_lock(hdev);
2045
2046         if (!hdev_is_powered(hdev)) {
2047                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2048                                  MGMT_STATUS_NOT_POWERED);
2049                 goto unlock;
2050         }
2051
2052         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2053         if (!cmd) {
2054                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2055                                  MGMT_STATUS_INVALID_PARAMS);
2056                 goto unlock;
2057         }
2058
2059         conn = cmd->user_data;
2060
2061         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2062                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2063                                  MGMT_STATUS_INVALID_PARAMS);
2064                 goto unlock;
2065         }
2066
2067         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2068
2069         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2070                            addr, sizeof(*addr));
2071 unlock:
2072         hci_dev_unlock(hdev);
2073         return err;
2074 }
2075
2076 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2077                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2078                              u16 hci_op, __le32 passkey)
2079 {
2080         struct pending_cmd *cmd;
2081         struct hci_conn *conn;
2082         int err;
2083
2084         hci_dev_lock(hdev);
2085
2086         if (!hdev_is_powered(hdev)) {
2087                 err = cmd_status(sk, hdev->id, mgmt_op,
2088                                  MGMT_STATUS_NOT_POWERED);
2089                 goto done;
2090         }
2091
2092         if (type == BDADDR_BREDR)
2093                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2094         else
2095                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2096
2097         if (!conn) {
2098                 err = cmd_status(sk, hdev->id, mgmt_op,
2099                                  MGMT_STATUS_NOT_CONNECTED);
2100                 goto done;
2101         }
2102
2103         if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2104                 /* Continue with pairing via SMP */
2105                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2106
2107                 if (!err)
2108                         err = cmd_status(sk, hdev->id, mgmt_op,
2109                                          MGMT_STATUS_SUCCESS);
2110                 else
2111                         err = cmd_status(sk, hdev->id, mgmt_op,
2112                                          MGMT_STATUS_FAILED);
2113
2114                 goto done;
2115         }
2116
2117         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2118         if (!cmd) {
2119                 err = -ENOMEM;
2120                 goto done;
2121         }
2122
2123         /* Continue with pairing via HCI */
2124         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2125                 struct hci_cp_user_passkey_reply cp;
2126
2127                 bacpy(&cp.bdaddr, bdaddr);
2128                 cp.passkey = passkey;
2129                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2130         } else
2131                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2132
2133         if (err < 0)
2134                 mgmt_pending_remove(cmd);
2135
2136 done:
2137         hci_dev_unlock(hdev);
2138         return err;
2139 }
2140
2141 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2142                               void *data, u16 len)
2143 {
2144         struct mgmt_cp_pin_code_neg_reply *cp = data;
2145
2146         BT_DBG("");
2147
2148         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2149                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2150                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2151 }
2152
2153 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2154                               u16 len)
2155 {
2156         struct mgmt_cp_user_confirm_reply *cp = data;
2157
2158         BT_DBG("");
2159
2160         if (len != sizeof(*cp))
2161                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2162                                   MGMT_STATUS_INVALID_PARAMS);
2163
2164         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2165                                  MGMT_OP_USER_CONFIRM_REPLY,
2166                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2167 }
2168
2169 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2170                                   void *data, u16 len)
2171 {
2172         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2173
2174         BT_DBG("");
2175
2176         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2177                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2178                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2179 }
2180
2181 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2182                               u16 len)
2183 {
2184         struct mgmt_cp_user_passkey_reply *cp = data;
2185
2186         BT_DBG("");
2187
2188         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2189                                  MGMT_OP_USER_PASSKEY_REPLY,
2190                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2191 }
2192
2193 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2194                                   void *data, u16 len)
2195 {
2196         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2197
2198         BT_DBG("");
2199
2200         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2201                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2202                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2203 }
2204
2205 static int update_name(struct hci_dev *hdev, const char *name)
2206 {
2207         struct hci_cp_write_local_name cp;
2208
2209         memcpy(cp.name, name, sizeof(cp.name));
2210
2211         return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2212 }
2213
2214 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2215                           u16 len)
2216 {
2217         struct mgmt_cp_set_local_name *cp = data;
2218         struct pending_cmd *cmd;
2219         int err;
2220
2221         BT_DBG("");
2222
2223         hci_dev_lock(hdev);
2224
2225         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2226
2227         if (!hdev_is_powered(hdev)) {
2228                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2229
2230                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2231                                    data, len);
2232                 if (err < 0)
2233                         goto failed;
2234
2235                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2236                                  sk);
2237
2238                 goto failed;
2239         }
2240
2241         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2242         if (!cmd) {
2243                 err = -ENOMEM;
2244                 goto failed;
2245         }
2246
2247         err = update_name(hdev, cp->name);
2248         if (err < 0)
2249                 mgmt_pending_remove(cmd);
2250
2251 failed:
2252         hci_dev_unlock(hdev);
2253         return err;
2254 }
2255
2256 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2257                                void *data, u16 data_len)
2258 {
2259         struct pending_cmd *cmd;
2260         int err;
2261
2262         BT_DBG("%s", hdev->name);
2263
2264         hci_dev_lock(hdev);
2265
2266         if (!hdev_is_powered(hdev)) {
2267                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2268                                  MGMT_STATUS_NOT_POWERED);
2269                 goto unlock;
2270         }
2271
2272         if (!lmp_ssp_capable(hdev)) {
2273                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2274                                  MGMT_STATUS_NOT_SUPPORTED);
2275                 goto unlock;
2276         }
2277
2278         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2279                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2280                                  MGMT_STATUS_BUSY);
2281                 goto unlock;
2282         }
2283
2284         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2285         if (!cmd) {
2286                 err = -ENOMEM;
2287                 goto unlock;
2288         }
2289
2290         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2291         if (err < 0)
2292                 mgmt_pending_remove(cmd);
2293
2294 unlock:
2295         hci_dev_unlock(hdev);
2296         return err;
2297 }
2298
2299 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2300                                void *data, u16 len)
2301 {
2302         struct mgmt_cp_add_remote_oob_data *cp = data;
2303         u8 status;
2304         int err;
2305
2306         BT_DBG("%s ", hdev->name);
2307
2308         hci_dev_lock(hdev);
2309
2310         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2311                                       cp->randomizer);
2312         if (err < 0)
2313                 status = MGMT_STATUS_FAILED;
2314         else
2315                 status = MGMT_STATUS_SUCCESS;
2316
2317         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2318                            &cp->addr, sizeof(cp->addr));
2319
2320         hci_dev_unlock(hdev);
2321         return err;
2322 }
2323
2324 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2325                                   void *data, u16 len)
2326 {
2327         struct mgmt_cp_remove_remote_oob_data *cp = data;
2328         u8 status;
2329         int err;
2330
2331         BT_DBG("%s", hdev->name);
2332
2333         hci_dev_lock(hdev);
2334
2335         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2336         if (err < 0)
2337                 status = MGMT_STATUS_INVALID_PARAMS;
2338         else
2339                 status = MGMT_STATUS_SUCCESS;
2340
2341         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2342                            status, &cp->addr, sizeof(cp->addr));
2343
2344         hci_dev_unlock(hdev);
2345         return err;
2346 }
2347
2348 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2349 {
2350         int err;
2351
2352         BT_DBG("%s", hdev->name);
2353
2354         hci_dev_lock(hdev);
2355
2356         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2357         if (err < 0)
2358                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2359
2360         hci_dev_unlock(hdev);
2361
2362         return err;
2363 }
2364
2365 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2366                            void *data, u16 len)
2367 {
2368         struct mgmt_cp_start_discovery *cp = data;
2369         struct pending_cmd *cmd;
2370         int err;
2371
2372         BT_DBG("%s", hdev->name);
2373
2374         hci_dev_lock(hdev);
2375
2376         if (!hdev_is_powered(hdev)) {
2377                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2378                                  MGMT_STATUS_NOT_POWERED);
2379                 goto failed;
2380         }
2381
2382         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2383                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2384                                  MGMT_STATUS_BUSY);
2385                 goto failed;
2386         }
2387
2388         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2389                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2390                                  MGMT_STATUS_BUSY);
2391                 goto failed;
2392         }
2393
2394         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2395         if (!cmd) {
2396                 err = -ENOMEM;
2397                 goto failed;
2398         }
2399
2400         hdev->discovery.type = cp->type;
2401
2402         switch (hdev->discovery.type) {
2403         case DISCOV_TYPE_BREDR:
2404                 if (!lmp_bredr_capable(hdev)) {
2405                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2406                                          MGMT_STATUS_NOT_SUPPORTED);
2407                         mgmt_pending_remove(cmd);
2408                         goto failed;
2409                 }
2410
2411                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2412                 break;
2413
2414         case DISCOV_TYPE_LE:
2415                 if (!lmp_host_le_capable(hdev)) {
2416                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2417                                          MGMT_STATUS_NOT_SUPPORTED);
2418                         mgmt_pending_remove(cmd);
2419                         goto failed;
2420                 }
2421
2422                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2423                                   LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2424                 break;
2425
2426         case DISCOV_TYPE_INTERLEAVED:
2427                 if (!lmp_host_le_capable(hdev) || !lmp_bredr_capable(hdev)) {
2428                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2429                                          MGMT_STATUS_NOT_SUPPORTED);
2430                         mgmt_pending_remove(cmd);
2431                         goto failed;
2432                 }
2433
2434                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT, LE_SCAN_WIN,
2435                                   LE_SCAN_TIMEOUT_BREDR_LE);
2436                 break;
2437
2438         default:
2439                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2440                                  MGMT_STATUS_INVALID_PARAMS);
2441                 mgmt_pending_remove(cmd);
2442                 goto failed;
2443         }
2444
2445         if (err < 0)
2446                 mgmt_pending_remove(cmd);
2447         else
2448                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2449
2450 failed:
2451         hci_dev_unlock(hdev);
2452         return err;
2453 }
2454
2455 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2456                           u16 len)
2457 {
2458         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2459         struct pending_cmd *cmd;
2460         struct hci_cp_remote_name_req_cancel cp;
2461         struct inquiry_entry *e;
2462         int err;
2463
2464         BT_DBG("%s", hdev->name);
2465
2466         hci_dev_lock(hdev);
2467
2468         if (!hci_discovery_active(hdev)) {
2469                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2470                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2471                                    sizeof(mgmt_cp->type));
2472                 goto unlock;
2473         }
2474
2475         if (hdev->discovery.type != mgmt_cp->type) {
2476                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2477                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2478                                    sizeof(mgmt_cp->type));
2479                 goto unlock;
2480         }
2481
2482         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2483         if (!cmd) {
2484                 err = -ENOMEM;
2485                 goto unlock;
2486         }
2487
2488         switch (hdev->discovery.state) {
2489         case DISCOVERY_FINDING:
2490                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2491                         err = hci_cancel_inquiry(hdev);
2492                 else
2493                         err = hci_cancel_le_scan(hdev);
2494
2495                 break;
2496
2497         case DISCOVERY_RESOLVING:
2498                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2499                                                      NAME_PENDING);
2500                 if (!e) {
2501                         mgmt_pending_remove(cmd);
2502                         err = cmd_complete(sk, hdev->id,
2503                                            MGMT_OP_STOP_DISCOVERY, 0,
2504                                            &mgmt_cp->type,
2505                                            sizeof(mgmt_cp->type));
2506                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2507                         goto unlock;
2508                 }
2509
2510                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2511                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2512                                    sizeof(cp), &cp);
2513
2514                 break;
2515
2516         default:
2517                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2518                 err = -EFAULT;
2519         }
2520
2521         if (err < 0)
2522                 mgmt_pending_remove(cmd);
2523         else
2524                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2525
2526 unlock:
2527         hci_dev_unlock(hdev);
2528         return err;
2529 }
2530
2531 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2532                         u16 len)
2533 {
2534         struct mgmt_cp_confirm_name *cp = data;
2535         struct inquiry_entry *e;
2536         int err;
2537
2538         BT_DBG("%s", hdev->name);
2539
2540         hci_dev_lock(hdev);
2541
2542         if (!hci_discovery_active(hdev)) {
2543                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2544                                  MGMT_STATUS_FAILED);
2545                 goto failed;
2546         }
2547
2548         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2549         if (!e) {
2550                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2551                                  MGMT_STATUS_INVALID_PARAMS);
2552                 goto failed;
2553         }
2554
2555         if (cp->name_known) {
2556                 e->name_state = NAME_KNOWN;
2557                 list_del(&e->list);
2558         } else {
2559                 e->name_state = NAME_NEEDED;
2560                 hci_inquiry_cache_update_resolve(hdev, e);
2561         }
2562
2563         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
2564                            sizeof(cp->addr));
2565
2566 failed:
2567         hci_dev_unlock(hdev);
2568         return err;
2569 }
2570
2571 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2572                         u16 len)
2573 {
2574         struct mgmt_cp_block_device *cp = data;
2575         u8 status;
2576         int err;
2577
2578         BT_DBG("%s", hdev->name);
2579
2580         if (!bdaddr_type_is_valid(cp->addr.type))
2581                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
2582                                     MGMT_STATUS_INVALID_PARAMS,
2583                                     &cp->addr, sizeof(cp->addr));
2584
2585         hci_dev_lock(hdev);
2586
2587         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2588         if (err < 0)
2589                 status = MGMT_STATUS_FAILED;
2590         else
2591                 status = MGMT_STATUS_SUCCESS;
2592
2593         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2594                            &cp->addr, sizeof(cp->addr));
2595
2596         hci_dev_unlock(hdev);
2597
2598         return err;
2599 }
2600
2601 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2602                           u16 len)
2603 {
2604         struct mgmt_cp_unblock_device *cp = data;
2605         u8 status;
2606         int err;
2607
2608         BT_DBG("%s", hdev->name);
2609
2610         if (!bdaddr_type_is_valid(cp->addr.type))
2611                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
2612                                     MGMT_STATUS_INVALID_PARAMS,
2613                                     &cp->addr, sizeof(cp->addr));
2614
2615         hci_dev_lock(hdev);
2616
2617         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2618         if (err < 0)
2619                 status = MGMT_STATUS_INVALID_PARAMS;
2620         else
2621                 status = MGMT_STATUS_SUCCESS;
2622
2623         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2624                            &cp->addr, sizeof(cp->addr));
2625
2626         hci_dev_unlock(hdev);
2627
2628         return err;
2629 }
2630
2631 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2632                          u16 len)
2633 {
2634         struct mgmt_cp_set_device_id *cp = data;
2635         int err;
2636         __u16 source;
2637
2638         BT_DBG("%s", hdev->name);
2639
2640         source = __le16_to_cpu(cp->source);
2641
2642         if (source > 0x0002)
2643                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2644                                   MGMT_STATUS_INVALID_PARAMS);
2645
2646         hci_dev_lock(hdev);
2647
2648         hdev->devid_source = source;
2649         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2650         hdev->devid_product = __le16_to_cpu(cp->product);
2651         hdev->devid_version = __le16_to_cpu(cp->version);
2652
2653         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2654
2655         update_eir(hdev);
2656
2657         hci_dev_unlock(hdev);
2658
2659         return err;
2660 }
2661
2662 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2663                                 void *data, u16 len)
2664 {
2665         struct mgmt_mode *cp = data;
2666         struct hci_cp_write_page_scan_activity acp;
2667         u8 type;
2668         int err;
2669
2670         BT_DBG("%s", hdev->name);
2671
2672         if (!lmp_bredr_capable(hdev))
2673                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2674                                   MGMT_STATUS_NOT_SUPPORTED);
2675
2676         if (cp->val != 0x00 && cp->val != 0x01)
2677                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2678                                   MGMT_STATUS_INVALID_PARAMS);
2679
2680         if (!hdev_is_powered(hdev))
2681                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2682                                   MGMT_STATUS_NOT_POWERED);
2683
2684         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2685                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2686                                   MGMT_STATUS_REJECTED);
2687
2688         hci_dev_lock(hdev);
2689
2690         if (cp->val) {
2691                 type = PAGE_SCAN_TYPE_INTERLACED;
2692
2693                 /* 160 msec page scan interval */
2694                 acp.interval = __constant_cpu_to_le16(0x0100);
2695         } else {
2696                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2697
2698                 /* default 1.28 sec page scan */
2699                 acp.interval = __constant_cpu_to_le16(0x0800);
2700         }
2701
2702         /* default 11.25 msec page scan window */
2703         acp.window = __constant_cpu_to_le16(0x0012);
2704
2705         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2706                            &acp);
2707         if (err < 0) {
2708                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2709                                  MGMT_STATUS_FAILED);
2710                 goto done;
2711         }
2712
2713         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2714         if (err < 0) {
2715                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2716                                  MGMT_STATUS_FAILED);
2717                 goto done;
2718         }
2719
2720         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2721                            NULL, 0);
2722 done:
2723         hci_dev_unlock(hdev);
2724         return err;
2725 }
2726
2727 static bool ltk_is_valid(struct mgmt_ltk_info *key)
2728 {
2729         if (key->authenticated != 0x00 && key->authenticated != 0x01)
2730                 return false;
2731         if (key->master != 0x00 && key->master != 0x01)
2732                 return false;
2733         if (!bdaddr_type_is_le(key->addr.type))
2734                 return false;
2735         return true;
2736 }
2737
2738 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2739                                void *cp_data, u16 len)
2740 {
2741         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2742         u16 key_count, expected_len;
2743         int i, err;
2744
2745         key_count = __le16_to_cpu(cp->key_count);
2746
2747         expected_len = sizeof(*cp) + key_count *
2748                                         sizeof(struct mgmt_ltk_info);
2749         if (expected_len != len) {
2750                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2751                        len, expected_len);
2752                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2753                                   MGMT_STATUS_INVALID_PARAMS);
2754         }
2755
2756         BT_DBG("%s key_count %u", hdev->name, key_count);
2757
2758         for (i = 0; i < key_count; i++) {
2759                 struct mgmt_ltk_info *key = &cp->keys[i];
2760
2761                 if (!ltk_is_valid(key))
2762                         return cmd_status(sk, hdev->id,
2763                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
2764                                           MGMT_STATUS_INVALID_PARAMS);
2765         }
2766
2767         hci_dev_lock(hdev);
2768
2769         hci_smp_ltks_clear(hdev);
2770
2771         for (i = 0; i < key_count; i++) {
2772                 struct mgmt_ltk_info *key = &cp->keys[i];
2773                 u8 type;
2774
2775                 if (key->master)
2776                         type = HCI_SMP_LTK;
2777                 else
2778                         type = HCI_SMP_LTK_SLAVE;
2779
2780                 hci_add_ltk(hdev, &key->addr.bdaddr,
2781                             bdaddr_to_le(key->addr.type),
2782                             type, 0, key->authenticated, key->val,
2783                             key->enc_size, key->ediv, key->rand);
2784         }
2785
2786         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
2787                            NULL, 0);
2788
2789         hci_dev_unlock(hdev);
2790
2791         return err;
2792 }
2793
2794 static const struct mgmt_handler {
2795         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2796                      u16 data_len);
2797         bool var_len;
2798         size_t data_len;
2799 } mgmt_handlers[] = {
2800         { NULL }, /* 0x0000 (no command) */
2801         { read_version,           false, MGMT_READ_VERSION_SIZE },
2802         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
2803         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
2804         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
2805         { set_powered,            false, MGMT_SETTING_SIZE },
2806         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
2807         { set_connectable,        false, MGMT_SETTING_SIZE },
2808         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
2809         { set_pairable,           false, MGMT_SETTING_SIZE },
2810         { set_link_security,      false, MGMT_SETTING_SIZE },
2811         { set_ssp,                false, MGMT_SETTING_SIZE },
2812         { set_hs,                 false, MGMT_SETTING_SIZE },
2813         { set_le,                 false, MGMT_SETTING_SIZE },
2814         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
2815         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
2816         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
2817         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
2818         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
2819         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2820         { disconnect,             false, MGMT_DISCONNECT_SIZE },
2821         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
2822         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
2823         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2824         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
2825         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
2826         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2827         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
2828         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
2829         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2830         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
2831         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2832         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2833         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2834         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2835         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
2836         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
2837         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
2838         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
2839         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
2840         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
2841 };
2842
2843
2844 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2845 {
2846         void *buf;
2847         u8 *cp;
2848         struct mgmt_hdr *hdr;
2849         u16 opcode, index, len;
2850         struct hci_dev *hdev = NULL;
2851         const struct mgmt_handler *handler;
2852         int err;
2853
2854         BT_DBG("got %zu bytes", msglen);
2855
2856         if (msglen < sizeof(*hdr))
2857                 return -EINVAL;
2858
2859         buf = kmalloc(msglen, GFP_KERNEL);
2860         if (!buf)
2861                 return -ENOMEM;
2862
2863         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2864                 err = -EFAULT;
2865                 goto done;
2866         }
2867
2868         hdr = buf;
2869         opcode = __le16_to_cpu(hdr->opcode);
2870         index = __le16_to_cpu(hdr->index);
2871         len = __le16_to_cpu(hdr->len);
2872
2873         if (len != msglen - sizeof(*hdr)) {
2874                 err = -EINVAL;
2875                 goto done;
2876         }
2877
2878         if (index != MGMT_INDEX_NONE) {
2879                 hdev = hci_dev_get(index);
2880                 if (!hdev) {
2881                         err = cmd_status(sk, index, opcode,
2882                                          MGMT_STATUS_INVALID_INDEX);
2883                         goto done;
2884                 }
2885         }
2886
2887         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2888             mgmt_handlers[opcode].func == NULL) {
2889                 BT_DBG("Unknown op %u", opcode);
2890                 err = cmd_status(sk, index, opcode,
2891                                  MGMT_STATUS_UNKNOWN_COMMAND);
2892                 goto done;
2893         }
2894
2895         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2896             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2897                 err = cmd_status(sk, index, opcode,
2898                                  MGMT_STATUS_INVALID_INDEX);
2899                 goto done;
2900         }
2901
2902         handler = &mgmt_handlers[opcode];
2903
2904         if ((handler->var_len && len < handler->data_len) ||
2905             (!handler->var_len && len != handler->data_len)) {
2906                 err = cmd_status(sk, index, opcode,
2907                                  MGMT_STATUS_INVALID_PARAMS);
2908                 goto done;
2909         }
2910
2911         if (hdev)
2912                 mgmt_init_hdev(sk, hdev);
2913
2914         cp = buf + sizeof(*hdr);
2915
2916         err = handler->func(sk, hdev, cp, len);
2917         if (err < 0)
2918                 goto done;
2919
2920         err = msglen;
2921
2922 done:
2923         if (hdev)
2924                 hci_dev_put(hdev);
2925
2926         kfree(buf);
2927         return err;
2928 }
2929
2930 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2931 {
2932         u8 *status = data;
2933
2934         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2935         mgmt_pending_remove(cmd);
2936 }
2937
2938 int mgmt_index_added(struct hci_dev *hdev)
2939 {
2940         if (!mgmt_valid_hdev(hdev))
2941                 return -ENOTSUPP;
2942
2943         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2944 }
2945
2946 int mgmt_index_removed(struct hci_dev *hdev)
2947 {
2948         u8 status = MGMT_STATUS_INVALID_INDEX;
2949
2950         if (!mgmt_valid_hdev(hdev))
2951                 return -ENOTSUPP;
2952
2953         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2954
2955         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2956 }
2957
2958 struct cmd_lookup {
2959         struct sock *sk;
2960         struct hci_dev *hdev;
2961         u8 mgmt_status;
2962 };
2963
2964 static void settings_rsp(struct pending_cmd *cmd, void *data)
2965 {
2966         struct cmd_lookup *match = data;
2967
2968         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2969
2970         list_del(&cmd->list);
2971
2972         if (match->sk == NULL) {
2973                 match->sk = cmd->sk;
2974                 sock_hold(match->sk);
2975         }
2976
2977         mgmt_pending_free(cmd);
2978 }
2979
2980 static int set_bredr_scan(struct hci_dev *hdev)
2981 {
2982         u8 scan = 0;
2983
2984         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2985                 scan |= SCAN_PAGE;
2986         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2987                 scan |= SCAN_INQUIRY;
2988
2989         if (!scan)
2990                 return 0;
2991
2992         return hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2993 }
2994
2995 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2996 {
2997         struct cmd_lookup match = { NULL, hdev };
2998         int err;
2999
3000         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3001                 return 0;
3002
3003         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3004
3005         if (powered) {
3006                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3007                     !lmp_host_ssp_capable(hdev)) {
3008                         u8 ssp = 1;
3009
3010                         hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3011                 }
3012
3013                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
3014                         struct hci_cp_write_le_host_supported cp;
3015
3016                         cp.le = 1;
3017                         cp.simul = lmp_le_br_capable(hdev);
3018
3019                         /* Check first if we already have the right
3020                          * host state (host features set)
3021                          */
3022                         if (cp.le != lmp_host_le_capable(hdev) ||
3023                             cp.simul != lmp_host_le_br_capable(hdev))
3024                                 hci_send_cmd(hdev,
3025                                              HCI_OP_WRITE_LE_HOST_SUPPORTED,
3026                                              sizeof(cp), &cp);
3027                 }
3028
3029                 if (lmp_bredr_capable(hdev)) {
3030                         set_bredr_scan(hdev);
3031                         update_class(hdev);
3032                         update_name(hdev, hdev->dev_name);
3033                         update_eir(hdev);
3034                 }
3035         } else {
3036                 u8 status = MGMT_STATUS_NOT_POWERED;
3037                 u8 zero_cod[] = { 0, 0, 0 };
3038
3039                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3040
3041                 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3042                         mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3043                                    zero_cod, sizeof(zero_cod), NULL);
3044         }
3045
3046         err = new_settings(hdev, match.sk);
3047
3048         if (match.sk)
3049                 sock_put(match.sk);
3050
3051         return err;
3052 }
3053
3054 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3055 {
3056         struct cmd_lookup match = { NULL, hdev };
3057         bool changed = false;
3058         int err = 0;
3059
3060         if (discoverable) {
3061                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3062                         changed = true;
3063         } else {
3064                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3065                         changed = true;
3066         }
3067
3068         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3069                              &match);
3070
3071         if (changed)
3072                 err = new_settings(hdev, match.sk);
3073
3074         if (match.sk)
3075                 sock_put(match.sk);
3076
3077         return err;
3078 }
3079
3080 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3081 {
3082         struct cmd_lookup match = { NULL, hdev };
3083         bool changed = false;
3084         int err = 0;
3085
3086         if (connectable) {
3087                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3088                         changed = true;
3089         } else {
3090                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3091                         changed = true;
3092         }
3093
3094         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
3095                              &match);
3096
3097         if (changed)
3098                 err = new_settings(hdev, match.sk);
3099
3100         if (match.sk)
3101                 sock_put(match.sk);
3102
3103         return err;
3104 }
3105
3106 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3107 {
3108         u8 mgmt_err = mgmt_status(status);
3109
3110         if (scan & SCAN_PAGE)
3111                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3112                                      cmd_status_rsp, &mgmt_err);
3113
3114         if (scan & SCAN_INQUIRY)
3115                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3116                                      cmd_status_rsp, &mgmt_err);
3117
3118         return 0;
3119 }
3120
3121 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3122                       bool persistent)
3123 {
3124         struct mgmt_ev_new_link_key ev;
3125
3126         memset(&ev, 0, sizeof(ev));
3127
3128         ev.store_hint = persistent;
3129         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3130         ev.key.addr.type = BDADDR_BREDR;
3131         ev.key.type = key->type;
3132         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3133         ev.key.pin_len = key->pin_len;
3134
3135         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3136 }
3137
3138 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3139 {
3140         struct mgmt_ev_new_long_term_key ev;
3141
3142         memset(&ev, 0, sizeof(ev));
3143
3144         ev.store_hint = persistent;
3145         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3146         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3147         ev.key.authenticated = key->authenticated;
3148         ev.key.enc_size = key->enc_size;
3149         ev.key.ediv = key->ediv;
3150
3151         if (key->type == HCI_SMP_LTK)
3152                 ev.key.master = 1;
3153
3154         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3155         memcpy(ev.key.val, key->val, sizeof(key->val));
3156
3157         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3158                           NULL);
3159 }
3160
3161 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3162                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3163                           u8 *dev_class)
3164 {
3165         char buf[512];
3166         struct mgmt_ev_device_connected *ev = (void *) buf;
3167         u16 eir_len = 0;
3168
3169         bacpy(&ev->addr.bdaddr, bdaddr);
3170         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3171
3172         ev->flags = __cpu_to_le32(flags);
3173
3174         if (name_len > 0)
3175                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3176                                           name, name_len);
3177
3178         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3179                 eir_len = eir_append_data(ev->eir, eir_len,
3180                                           EIR_CLASS_OF_DEV, dev_class, 3);
3181
3182         ev->eir_len = cpu_to_le16(eir_len);
3183
3184         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3185                           sizeof(*ev) + eir_len, NULL);
3186 }
3187
3188 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3189 {
3190         struct mgmt_cp_disconnect *cp = cmd->param;
3191         struct sock **sk = data;
3192         struct mgmt_rp_disconnect rp;
3193
3194         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3195         rp.addr.type = cp->addr.type;
3196
3197         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3198                      sizeof(rp));
3199
3200         *sk = cmd->sk;
3201         sock_hold(*sk);
3202
3203         mgmt_pending_remove(cmd);
3204 }
3205
3206 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3207 {
3208         struct hci_dev *hdev = data;
3209         struct mgmt_cp_unpair_device *cp = cmd->param;
3210         struct mgmt_rp_unpair_device rp;
3211
3212         memset(&rp, 0, sizeof(rp));
3213         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3214         rp.addr.type = cp->addr.type;
3215
3216         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3217
3218         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3219
3220         mgmt_pending_remove(cmd);
3221 }
3222
3223 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3224                              u8 link_type, u8 addr_type, u8 reason)
3225 {
3226         struct mgmt_ev_device_disconnected ev;
3227         struct sock *sk = NULL;
3228         int err;
3229
3230         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3231
3232         bacpy(&ev.addr.bdaddr, bdaddr);
3233         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3234         ev.reason = reason;
3235
3236         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3237                          sk);
3238
3239         if (sk)
3240                 sock_put(sk);
3241
3242         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3243                              hdev);
3244
3245         return err;
3246 }
3247
3248 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3249                            u8 link_type, u8 addr_type, u8 status)
3250 {
3251         struct mgmt_rp_disconnect rp;
3252         struct pending_cmd *cmd;
3253         int err;
3254
3255         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3256                              hdev);
3257
3258         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3259         if (!cmd)
3260                 return -ENOENT;
3261
3262         bacpy(&rp.addr.bdaddr, bdaddr);
3263         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3264
3265         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3266                            mgmt_status(status), &rp, sizeof(rp));
3267
3268         mgmt_pending_remove(cmd);
3269
3270         return err;
3271 }
3272
3273 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3274                         u8 addr_type, u8 status)
3275 {
3276         struct mgmt_ev_connect_failed ev;
3277
3278         bacpy(&ev.addr.bdaddr, bdaddr);
3279         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3280         ev.status = mgmt_status(status);
3281
3282         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3283 }
3284
3285 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3286 {
3287         struct mgmt_ev_pin_code_request ev;
3288
3289         bacpy(&ev.addr.bdaddr, bdaddr);
3290         ev.addr.type = BDADDR_BREDR;
3291         ev.secure = secure;
3292
3293         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3294                           NULL);
3295 }
3296
3297 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3298                                  u8 status)
3299 {
3300         struct pending_cmd *cmd;
3301         struct mgmt_rp_pin_code_reply rp;
3302         int err;
3303
3304         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3305         if (!cmd)
3306                 return -ENOENT;
3307
3308         bacpy(&rp.addr.bdaddr, bdaddr);
3309         rp.addr.type = BDADDR_BREDR;
3310
3311         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3312                            mgmt_status(status), &rp, sizeof(rp));
3313
3314         mgmt_pending_remove(cmd);
3315
3316         return err;
3317 }
3318
3319 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3320                                      u8 status)
3321 {
3322         struct pending_cmd *cmd;
3323         struct mgmt_rp_pin_code_reply rp;
3324         int err;
3325
3326         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3327         if (!cmd)
3328                 return -ENOENT;
3329
3330         bacpy(&rp.addr.bdaddr, bdaddr);
3331         rp.addr.type = BDADDR_BREDR;
3332
3333         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3334                            mgmt_status(status), &rp, sizeof(rp));
3335
3336         mgmt_pending_remove(cmd);
3337
3338         return err;
3339 }
3340
3341 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3342                               u8 link_type, u8 addr_type, __le32 value,
3343                               u8 confirm_hint)
3344 {
3345         struct mgmt_ev_user_confirm_request ev;
3346
3347         BT_DBG("%s", hdev->name);
3348
3349         bacpy(&ev.addr.bdaddr, bdaddr);
3350         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3351         ev.confirm_hint = confirm_hint;
3352         ev.value = value;
3353
3354         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3355                           NULL);
3356 }
3357
3358 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3359                               u8 link_type, u8 addr_type)
3360 {
3361         struct mgmt_ev_user_passkey_request ev;
3362
3363         BT_DBG("%s", hdev->name);
3364
3365         bacpy(&ev.addr.bdaddr, bdaddr);
3366         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3367
3368         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3369                           NULL);
3370 }
3371
3372 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3373                                       u8 link_type, u8 addr_type, u8 status,
3374                                       u8 opcode)
3375 {
3376         struct pending_cmd *cmd;
3377         struct mgmt_rp_user_confirm_reply rp;
3378         int err;
3379
3380         cmd = mgmt_pending_find(opcode, hdev);
3381         if (!cmd)
3382                 return -ENOENT;
3383
3384         bacpy(&rp.addr.bdaddr, bdaddr);
3385         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3386         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3387                            &rp, sizeof(rp));
3388
3389         mgmt_pending_remove(cmd);
3390
3391         return err;
3392 }
3393
3394 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3395                                      u8 link_type, u8 addr_type, u8 status)
3396 {
3397         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3398                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3399 }
3400
3401 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3402                                          u8 link_type, u8 addr_type, u8 status)
3403 {
3404         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3405                                           status,
3406                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3407 }
3408
3409 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3410                                      u8 link_type, u8 addr_type, u8 status)
3411 {
3412         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3413                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3414 }
3415
3416 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3417                                          u8 link_type, u8 addr_type, u8 status)
3418 {
3419         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3420                                           status,
3421                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3422 }
3423
3424 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3425                              u8 link_type, u8 addr_type, u32 passkey,
3426                              u8 entered)
3427 {
3428         struct mgmt_ev_passkey_notify ev;
3429
3430         BT_DBG("%s", hdev->name);
3431
3432         bacpy(&ev.addr.bdaddr, bdaddr);
3433         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3434         ev.passkey = __cpu_to_le32(passkey);
3435         ev.entered = entered;
3436
3437         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3438 }
3439
3440 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3441                      u8 addr_type, u8 status)
3442 {
3443         struct mgmt_ev_auth_failed ev;
3444
3445         bacpy(&ev.addr.bdaddr, bdaddr);
3446         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3447         ev.status = mgmt_status(status);
3448
3449         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3450 }
3451
3452 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3453 {
3454         struct cmd_lookup match = { NULL, hdev };
3455         bool changed = false;
3456         int err = 0;
3457
3458         if (status) {
3459                 u8 mgmt_err = mgmt_status(status);
3460                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3461                                      cmd_status_rsp, &mgmt_err);
3462                 return 0;
3463         }
3464
3465         if (test_bit(HCI_AUTH, &hdev->flags)) {
3466                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3467                         changed = true;
3468         } else {
3469                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3470                         changed = true;
3471         }
3472
3473         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3474                              &match);
3475
3476         if (changed)
3477                 err = new_settings(hdev, match.sk);
3478
3479         if (match.sk)
3480                 sock_put(match.sk);
3481
3482         return err;
3483 }
3484
3485 static int clear_eir(struct hci_dev *hdev)
3486 {
3487         struct hci_cp_write_eir cp;
3488
3489         if (!lmp_ext_inq_capable(hdev))
3490                 return 0;
3491
3492         memset(hdev->eir, 0, sizeof(hdev->eir));
3493
3494         memset(&cp, 0, sizeof(cp));
3495
3496         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3497 }
3498
3499 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3500 {
3501         struct cmd_lookup match = { NULL, hdev };
3502         bool changed = false;
3503         int err = 0;
3504
3505         if (status) {
3506                 u8 mgmt_err = mgmt_status(status);
3507
3508                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3509                                                  &hdev->dev_flags))
3510                         err = new_settings(hdev, NULL);
3511
3512                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3513                                      &mgmt_err);
3514
3515                 return err;
3516         }
3517
3518         if (enable) {
3519                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3520                         changed = true;
3521         } else {
3522                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3523                         changed = true;
3524         }
3525
3526         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3527
3528         if (changed)
3529                 err = new_settings(hdev, match.sk);
3530
3531         if (match.sk)
3532                 sock_put(match.sk);
3533
3534         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3535                 update_eir(hdev);
3536         else
3537                 clear_eir(hdev);
3538
3539         return err;
3540 }
3541
3542 static void class_rsp(struct pending_cmd *cmd, void *data)
3543 {
3544         struct cmd_lookup *match = data;
3545
3546         cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3547                      match->hdev->dev_class, 3);
3548
3549         list_del(&cmd->list);
3550
3551         if (match->sk == NULL) {
3552                 match->sk = cmd->sk;
3553                 sock_hold(match->sk);
3554         }
3555
3556         mgmt_pending_free(cmd);
3557 }
3558
3559 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3560                                    u8 status)
3561 {
3562         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3563         int err = 0;
3564
3565         clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3566
3567         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3568         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3569         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3570
3571         if (!status)
3572                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3573                                  3, NULL);
3574
3575         if (match.sk)
3576                 sock_put(match.sk);
3577
3578         return err;
3579 }
3580
3581 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3582 {
3583         struct pending_cmd *cmd;
3584         struct mgmt_cp_set_local_name ev;
3585         bool changed = false;
3586         int err = 0;
3587
3588         if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3589                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3590                 changed = true;
3591         }
3592
3593         memset(&ev, 0, sizeof(ev));
3594         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3595         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3596
3597         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3598         if (!cmd)
3599                 goto send_event;
3600
3601         /* Always assume that either the short or the complete name has
3602          * changed if there was a pending mgmt command */
3603         changed = true;
3604
3605         if (status) {
3606                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3607                                  mgmt_status(status));
3608                 goto failed;
3609         }
3610
3611         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3612                            sizeof(ev));
3613         if (err < 0)
3614                 goto failed;
3615
3616 send_event:
3617         if (changed)
3618                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3619                                  sizeof(ev), cmd ? cmd->sk : NULL);
3620
3621         /* EIR is taken care of separately when powering on the
3622          * adapter so only update them here if this is a name change
3623          * unrelated to power on.
3624          */
3625         if (!test_bit(HCI_INIT, &hdev->flags))
3626                 update_eir(hdev);
3627
3628 failed:
3629         if (cmd)
3630                 mgmt_pending_remove(cmd);
3631         return err;
3632 }
3633
3634 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3635                                             u8 *randomizer, u8 status)
3636 {
3637         struct pending_cmd *cmd;
3638         int err;
3639
3640         BT_DBG("%s status %u", hdev->name, status);
3641
3642         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3643         if (!cmd)
3644                 return -ENOENT;
3645
3646         if (status) {
3647                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3648                                  mgmt_status(status));
3649         } else {
3650                 struct mgmt_rp_read_local_oob_data rp;
3651
3652                 memcpy(rp.hash, hash, sizeof(rp.hash));
3653                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3654
3655                 err = cmd_complete(cmd->sk, hdev->id,
3656                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3657                                    sizeof(rp));
3658         }
3659
3660         mgmt_pending_remove(cmd);
3661
3662         return err;
3663 }
3664
3665 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3666 {
3667         struct cmd_lookup match = { NULL, hdev };
3668         bool changed = false;
3669         int err = 0;
3670
3671         if (status) {
3672                 u8 mgmt_err = mgmt_status(status);
3673
3674                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3675                                                  &hdev->dev_flags))
3676                         err = new_settings(hdev, NULL);
3677
3678                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3679                                      &mgmt_err);
3680
3681                 return err;
3682         }
3683
3684         if (enable) {
3685                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3686                         changed = true;
3687         } else {
3688                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3689                         changed = true;
3690         }
3691
3692         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3693
3694         if (changed)
3695                 err = new_settings(hdev, match.sk);
3696
3697         if (match.sk)
3698                 sock_put(match.sk);
3699
3700         return err;
3701 }
3702
3703 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3704                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3705                       ssp, u8 *eir, u16 eir_len)
3706 {
3707         char buf[512];
3708         struct mgmt_ev_device_found *ev = (void *) buf;
3709         size_t ev_size;
3710
3711         /* Leave 5 bytes for a potential CoD field */
3712         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3713                 return -EINVAL;
3714
3715         memset(buf, 0, sizeof(buf));
3716
3717         bacpy(&ev->addr.bdaddr, bdaddr);
3718         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3719         ev->rssi = rssi;
3720         if (cfm_name)
3721                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
3722         if (!ssp)
3723                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
3724
3725         if (eir_len > 0)
3726                 memcpy(ev->eir, eir, eir_len);
3727
3728         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3729                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3730                                           dev_class, 3);
3731
3732         ev->eir_len = cpu_to_le16(eir_len);
3733         ev_size = sizeof(*ev) + eir_len;
3734
3735         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3736 }
3737
3738 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3739                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3740 {
3741         struct mgmt_ev_device_found *ev;
3742         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3743         u16 eir_len;
3744
3745         ev = (struct mgmt_ev_device_found *) buf;
3746
3747         memset(buf, 0, sizeof(buf));
3748
3749         bacpy(&ev->addr.bdaddr, bdaddr);
3750         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3751         ev->rssi = rssi;
3752
3753         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3754                                   name_len);
3755
3756         ev->eir_len = cpu_to_le16(eir_len);
3757
3758         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3759                           sizeof(*ev) + eir_len, NULL);
3760 }
3761
3762 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3763 {
3764         struct pending_cmd *cmd;
3765         u8 type;
3766         int err;
3767
3768         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3769
3770         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3771         if (!cmd)
3772                 return -ENOENT;
3773
3774         type = hdev->discovery.type;
3775
3776         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3777                            &type, sizeof(type));
3778         mgmt_pending_remove(cmd);
3779
3780         return err;
3781 }
3782
3783 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3784 {
3785         struct pending_cmd *cmd;
3786         int err;
3787
3788         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3789         if (!cmd)
3790                 return -ENOENT;
3791
3792         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3793                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3794         mgmt_pending_remove(cmd);
3795
3796         return err;
3797 }
3798
3799 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3800 {
3801         struct mgmt_ev_discovering ev;
3802         struct pending_cmd *cmd;
3803
3804         BT_DBG("%s discovering %u", hdev->name, discovering);
3805
3806         if (discovering)
3807                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3808         else
3809                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3810
3811         if (cmd != NULL) {
3812                 u8 type = hdev->discovery.type;
3813
3814                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3815                              sizeof(type));
3816                 mgmt_pending_remove(cmd);
3817         }
3818
3819         memset(&ev, 0, sizeof(ev));
3820         ev.type = hdev->discovery.type;
3821         ev.discovering = discovering;
3822
3823         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3824 }
3825
3826 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3827 {
3828         struct pending_cmd *cmd;
3829         struct mgmt_ev_device_blocked ev;
3830
3831         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3832
3833         bacpy(&ev.addr.bdaddr, bdaddr);
3834         ev.addr.type = type;
3835
3836         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3837                           cmd ? cmd->sk : NULL);
3838 }
3839
3840 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3841 {
3842         struct pending_cmd *cmd;
3843         struct mgmt_ev_device_unblocked ev;
3844
3845         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3846
3847         bacpy(&ev.addr.bdaddr, bdaddr);
3848         ev.addr.type = type;
3849
3850         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3851                           cmd ? cmd->sk : NULL);
3852 }
3853
3854 module_param(enable_hs, bool, 0644);
3855 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");