net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/kernel.h>
  28 #include <linux/uaccess.h>
  29 #include <linux/module.h>
  30 #include <asm/unaligned.h>
  31
  32 #include <net/bluetooth/bluetooth.h>
  33 #include <net/bluetooth/hci_core.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #include <net/bluetooth/smp.h>
  36
  37 bool enable_hs;
  38 bool enable_le;
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   0
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_PAIRABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81 };
  82
  83 static const u16 mgmt_events[] = {
  84         MGMT_EV_CONTROLLER_ERROR,
  85         MGMT_EV_INDEX_ADDED,
  86         MGMT_EV_INDEX_REMOVED,
  87         MGMT_EV_NEW_SETTINGS,
  88         MGMT_EV_CLASS_OF_DEV_CHANGED,
  89         MGMT_EV_LOCAL_NAME_CHANGED,
  90         MGMT_EV_NEW_LINK_KEY,
  91         MGMT_EV_NEW_LONG_TERM_KEY,
  92         MGMT_EV_DEVICE_CONNECTED,
  93         MGMT_EV_DEVICE_DISCONNECTED,
  94         MGMT_EV_CONNECT_FAILED,
  95         MGMT_EV_PIN_CODE_REQUEST,
  96         MGMT_EV_USER_CONFIRM_REQUEST,
  97         MGMT_EV_USER_PASSKEY_REQUEST,
  98         MGMT_EV_AUTH_FAILED,
  99         MGMT_EV_DEVICE_FOUND,
 100         MGMT_EV_DISCOVERING,
 101         MGMT_EV_DEVICE_BLOCKED,
 102         MGMT_EV_DEVICE_UNBLOCKED,
 103         MGMT_EV_DEVICE_UNPAIRED,
 104 };
 105
 106 /*
 107  * These LE scan and inquiry parameters were chosen according to LE General
 108  * Discovery Procedure specification.
 109  */
 110 #define LE_SCAN_TYPE                    0x01
 111 #define LE_SCAN_WIN                     0x12
 112 #define LE_SCAN_INT                     0x12
 113 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 114 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 115
 116 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 117 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 118
 119 #define SERVICE_CACHE_TIMEOUT (5 * 1000)
 120
 121 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 122                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 123
 124 struct pending_cmd {
 125         struct list_head list;
 126         u16 opcode;
 127         int index;
 128         void *param;
 129         struct sock *sk;
 130         void *user_data;
 131 };
 132
 133 /* HCI to MGMT error code conversion table */
 134 static u8 mgmt_status_table[] = {
 135         MGMT_STATUS_SUCCESS,
 136         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 137         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 138         MGMT_STATUS_FAILED,             /* Hardware Failure */
 139         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 140         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 141         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 142         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 143         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 145         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 146         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 147         MGMT_STATUS_BUSY,               /* Command Disallowed */
 148         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 149         MGMT_STATUS_REJECTED,           /* Rejected Security */
 150         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 151         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 152         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 153         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 154         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 155         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 156         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 157         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 158         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 159         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 160         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 161         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 162         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 163         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 164         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 165         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 166         MGMT_STATUS_FAILED,             /* Unspecified Error */
 167         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 168         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 169         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 170         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 171         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 172         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 173         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 175         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 176         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 177         MGMT_STATUS_FAILED,             /* Transaction Collision */
 178         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 179         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 180         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 181         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 182         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 183         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 184         MGMT_STATUS_FAILED,             /* Slot Violation */
 185         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 186         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 187         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 188         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 189         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 190         MGMT_STATUS_BUSY,               /* Controller Busy */
 191         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 192         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 193         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 194         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 195         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 196 };
 197
 198 static u8 mgmt_status(u8 hci_status)
 199 {
 200         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 201                 return mgmt_status_table[hci_status];
 202
 203         return MGMT_STATUS_FAILED;
 204 }
 205
 206 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 207 {
 208         struct sk_buff *skb;
 209         struct mgmt_hdr *hdr;
 210         struct mgmt_ev_cmd_status *ev;
 211         int err;
 212
 213         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 214
 215         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
 216         if (!skb)
 217                 return -ENOMEM;
 218
 219         hdr = (void *) skb_put(skb, sizeof(*hdr));
 220
 221         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 222         hdr->index = cpu_to_le16(index);
 223         hdr->len = cpu_to_le16(sizeof(*ev));
 224
 225         ev = (void *) skb_put(skb, sizeof(*ev));
 226         ev->status = status;
 227         put_unaligned_le16(cmd, &ev->opcode);
 228
 229         err = sock_queue_rcv_skb(sk, skb);
 230         if (err < 0)
 231                 kfree_skb(skb);
 232
 233         return err;
 234 }
 235
 236 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 237                                                 void *rp, size_t rp_len)
 238 {
 239         struct sk_buff *skb;
 240         struct mgmt_hdr *hdr;
 241         struct mgmt_ev_cmd_complete *ev;
 242         int err;
 243
 244         BT_DBG("sock %p", sk);
 245
 246         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
 247         if (!skb)
 248                 return -ENOMEM;
 249
 250         hdr = (void *) skb_put(skb, sizeof(*hdr));
 251
 252         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 253         hdr->index = cpu_to_le16(index);
 254         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 255
 256         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 257         put_unaligned_le16(cmd, &ev->opcode);
 258         ev->status = status;
 259
 260         if (rp)
 261                 memcpy(ev->data, rp, rp_len);
 262
 263         err = sock_queue_rcv_skb(sk, skb);
 264         if (err < 0)
 265                 kfree_skb(skb);
 266
 267         return err;
 268 }
 269
 270 static int read_version(struct sock *sk)
 271 {
 272         struct mgmt_rp_read_version rp;
 273
 274         BT_DBG("sock %p", sk);
 275
 276         rp.version = MGMT_VERSION;
 277         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 278
 279         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 280                                                                 sizeof(rp));
 281 }
 282
 283 static int read_commands(struct sock *sk)
 284 {
 285         struct mgmt_rp_read_commands *rp;
 286         u16 num_commands = ARRAY_SIZE(mgmt_commands);
 287         u16 num_events = ARRAY_SIZE(mgmt_events);
 288         u16 *opcode;
 289         size_t rp_size;
 290         int i, err;
 291
 292         BT_DBG("sock %p", sk);
 293
 294         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 295
 296         rp = kmalloc(rp_size, GFP_KERNEL);
 297         if (!rp)
 298                 return -ENOMEM;
 299
 300         put_unaligned_le16(num_commands, &rp->num_commands);
 301         put_unaligned_le16(num_events, &rp->num_events);
 302
 303         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 304                 put_unaligned_le16(mgmt_commands[i], opcode);
 305
 306         for (i = 0; i < num_events; i++, opcode++)
 307                 put_unaligned_le16(mgmt_events[i], opcode);
 308
 309         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 310                                                                 rp_size);
 311         kfree(rp);
 312
 313         return err;
 314 }
 315
 316 static int read_index_list(struct sock *sk)
 317 {
 318         struct mgmt_rp_read_index_list *rp;
 319         struct list_head *p;
 320         struct hci_dev *d;
 321         size_t rp_len;
 322         u16 count;
 323         int i, err;
 324
 325         BT_DBG("sock %p", sk);
 326
 327         read_lock(&hci_dev_list_lock);
 328
 329         count = 0;
 330         list_for_each(p, &hci_dev_list) {
 331                 count++;
 332         }
 333
 334         rp_len = sizeof(*rp) + (2 * count);
 335         rp = kmalloc(rp_len, GFP_ATOMIC);
 336         if (!rp) {
 337                 read_unlock(&hci_dev_list_lock);
 338                 return -ENOMEM;
 339         }
 340
 341         put_unaligned_le16(count, &rp->num_controllers);
 342
 343         i = 0;
 344         list_for_each_entry(d, &hci_dev_list, list) {
 345                 if (test_bit(HCI_SETUP, &d->dev_flags))
 346                         continue;
 347
 348                 put_unaligned_le16(d->id, &rp->index[i++]);
 349                 BT_DBG("Added hci%u", d->id);
 350         }
 351
 352         read_unlock(&hci_dev_list_lock);
 353
 354         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 355                                                                         rp_len);
 356
 357         kfree(rp);
 358
 359         return err;
 360 }
 361
 362 static u32 get_supported_settings(struct hci_dev *hdev)
 363 {
 364         u32 settings = 0;
 365
 366         settings |= MGMT_SETTING_POWERED;
 367         settings |= MGMT_SETTING_CONNECTABLE;
 368         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 369         settings |= MGMT_SETTING_DISCOVERABLE;
 370         settings |= MGMT_SETTING_PAIRABLE;
 371
 372         if (hdev->features[6] & LMP_SIMPLE_PAIR)
 373                 settings |= MGMT_SETTING_SSP;
 374
 375         if (!(hdev->features[4] & LMP_NO_BREDR)) {
 376                 settings |= MGMT_SETTING_BREDR;
 377                 settings |= MGMT_SETTING_LINK_SECURITY;
 378         }
 379
 380         if (enable_hs)
 381                 settings |= MGMT_SETTING_HS;
 382
 383         if (enable_le) {
 384                 if (hdev->features[4] & LMP_LE)
 385                         settings |= MGMT_SETTING_LE;
 386         }
 387
 388         return settings;
 389 }
 390
 391 static u32 get_current_settings(struct hci_dev *hdev)
 392 {
 393         u32 settings = 0;
 394
 395         if (hdev_is_powered(hdev))
 396                 settings |= MGMT_SETTING_POWERED;
 397
 398         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 399                 settings |= MGMT_SETTING_CONNECTABLE;
 400
 401         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 402                 settings |= MGMT_SETTING_DISCOVERABLE;
 403
 404         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 405                 settings |= MGMT_SETTING_PAIRABLE;
 406
 407         if (!(hdev->features[4] & LMP_NO_BREDR))
 408                 settings |= MGMT_SETTING_BREDR;
 409
 410         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 411                 settings |= MGMT_SETTING_LE;
 412
 413         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 414                 settings |= MGMT_SETTING_LINK_SECURITY;
 415
 416         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 417                 settings |= MGMT_SETTING_SSP;
 418
 419         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 420                 settings |= MGMT_SETTING_HS;
 421
 422         return settings;
 423 }
 424
 425 #define PNP_INFO_SVCLASS_ID             0x1200
 426
 427 static u8 bluetooth_base_uuid[] = {
 428                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 429                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 430 };
 431
 432 static u16 get_uuid16(u8 *uuid128)
 433 {
 434         u32 val;
 435         int i;
 436
 437         for (i = 0; i < 12; i++) {
 438                 if (bluetooth_base_uuid[i] != uuid128[i])
 439                         return 0;
 440         }
 441
 442         memcpy(&val, &uuid128[12], 4);
 443
 444         val = le32_to_cpu(val);
 445         if (val > 0xffff)
 446                 return 0;
 447
 448         return (u16) val;
 449 }
 450
 451 static void create_eir(struct hci_dev *hdev, u8 *data)
 452 {
 453         u8 *ptr = data;
 454         u16 eir_len = 0;
 455         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 456         int i, truncated = 0;
 457         struct bt_uuid *uuid;
 458         size_t name_len;
 459
 460         name_len = strlen(hdev->dev_name);
 461
 462         if (name_len > 0) {
 463                 /* EIR Data type */
 464                 if (name_len > 48) {
 465                         name_len = 48;
 466                         ptr[1] = EIR_NAME_SHORT;
 467                 } else
 468                         ptr[1] = EIR_NAME_COMPLETE;
 469
 470                 /* EIR Data length */
 471                 ptr[0] = name_len + 1;
 472
 473                 memcpy(ptr + 2, hdev->dev_name, name_len);
 474
 475                 eir_len += (name_len + 2);
 476                 ptr += (name_len + 2);
 477         }
 478
 479         memset(uuid16_list, 0, sizeof(uuid16_list));
 480
 481         /* Group all UUID16 types */
 482         list_for_each_entry(uuid, &hdev->uuids, list) {
 483                 u16 uuid16;
 484
 485                 uuid16 = get_uuid16(uuid->uuid);
 486                 if (uuid16 == 0)
 487                         return;
 488
 489                 if (uuid16 < 0x1100)
 490                         continue;
 491
 492                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 493                         continue;
 494
 495                 /* Stop if not enough space to put next UUID */
 496                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 497                         truncated = 1;
 498                         break;
 499                 }
 500
 501                 /* Check for duplicates */
 502                 for (i = 0; uuid16_list[i] != 0; i++)
 503                         if (uuid16_list[i] == uuid16)
 504                                 break;
 505
 506                 if (uuid16_list[i] == 0) {
 507                         uuid16_list[i] = uuid16;
 508                         eir_len += sizeof(u16);
 509                 }
 510         }
 511
 512         if (uuid16_list[0] != 0) {
 513                 u8 *length = ptr;
 514
 515                 /* EIR Data type */
 516                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 517
 518                 ptr += 2;
 519                 eir_len += 2;
 520
 521                 for (i = 0; uuid16_list[i] != 0; i++) {
 522                         *ptr++ = (uuid16_list[i] & 0x00ff);
 523                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 524                 }
 525
 526                 /* EIR Data length */
 527                 *length = (i * sizeof(u16)) + 1;
 528         }
 529 }
 530
 531 static int update_eir(struct hci_dev *hdev)
 532 {
 533         struct hci_cp_write_eir cp;
 534
 535         if (!hdev_is_powered(hdev))
 536                 return 0;
 537
 538         if (!(hdev->features[6] & LMP_EXT_INQ))
 539                 return 0;
 540
 541         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 542                 return 0;
 543
 544         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 545                 return 0;
 546
 547         memset(&cp, 0, sizeof(cp));
 548
 549         create_eir(hdev, cp.data);
 550
 551         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 552                 return 0;
 553
 554         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 555
 556         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 557 }
 558
 559 static u8 get_service_classes(struct hci_dev *hdev)
 560 {
 561         struct bt_uuid *uuid;
 562         u8 val = 0;
 563
 564         list_for_each_entry(uuid, &hdev->uuids, list)
 565                 val |= uuid->svc_hint;
 566
 567         return val;
 568 }
 569
 570 static int update_class(struct hci_dev *hdev)
 571 {
 572         u8 cod[3];
 573         int err;
 574
 575         BT_DBG("%s", hdev->name);
 576
 577         if (!hdev_is_powered(hdev))
 578                 return 0;
 579
 580         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 581                 return 0;
 582
 583         cod[0] = hdev->minor_class;
 584         cod[1] = hdev->major_class;
 585         cod[2] = get_service_classes(hdev);
 586
 587         if (memcmp(cod, hdev->dev_class, 3) == 0)
 588                 return 0;
 589
 590         err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 591         if (err == 0)
 592                 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
 593
 594         return err;
 595 }
 596
 597 static void service_cache_off(struct work_struct *work)
 598 {
 599         struct hci_dev *hdev = container_of(work, struct hci_dev,
 600                                                         service_cache.work);
 601
 602         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 603                 return;
 604
 605         hci_dev_lock(hdev);
 606
 607         update_eir(hdev);
 608         update_class(hdev);
 609
 610         hci_dev_unlock(hdev);
 611 }
 612
 613 static void mgmt_init_hdev(struct hci_dev *hdev)
 614 {
 615         if (!test_and_set_bit(HCI_MGMT, &hdev->dev_flags)) {
 616                 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 617
 618                 /* Non-mgmt controlled devices get this bit set
 619                  * implicitly so that pairing works for them, however
 620                  * for mgmt we require user-space to explicitly enable
 621                  * it
 622                  */
 623                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 624         }
 625 }
 626
 627 static int read_controller_info(struct sock *sk, u16 index)
 628 {
 629         struct mgmt_rp_read_info rp;
 630         struct hci_dev *hdev;
 631
 632         BT_DBG("sock %p hci%u", sk, index);
 633
 634         hdev = hci_dev_get(index);
 635         if (!hdev)
 636                 return cmd_status(sk, index, MGMT_OP_READ_INFO,
 637                                                 MGMT_STATUS_INVALID_PARAMS);
 638
 639         hci_dev_lock(hdev);
 640
 641         if (test_and_clear_bit(HCI_PI_MGMT_INIT, &hci_pi(sk)->flags))
 642                 mgmt_init_hdev(hdev);
 643
 644         memset(&rp, 0, sizeof(rp));
 645
 646         bacpy(&rp.bdaddr, &hdev->bdaddr);
 647
 648         rp.version = hdev->hci_ver;
 649
 650         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 651
 652         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 653         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 654
 655         memcpy(rp.dev_class, hdev->dev_class, 3);
 656
 657         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 658         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 659
 660         hci_dev_unlock(hdev);
 661         hci_dev_put(hdev);
 662
 663         return cmd_complete(sk, index, MGMT_OP_READ_INFO, 0, &rp, sizeof(rp));
 664 }
 665
 666 static void mgmt_pending_free(struct pending_cmd *cmd)
 667 {
 668         sock_put(cmd->sk);
 669         kfree(cmd->param);
 670         kfree(cmd);
 671 }
 672
 673 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 674                                                         struct hci_dev *hdev,
 675                                                         void *data, u16 len)
 676 {
 677         struct pending_cmd *cmd;
 678
 679         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 680         if (!cmd)
 681                 return NULL;
 682
 683         cmd->opcode = opcode;
 684         cmd->index = hdev->id;
 685
 686         cmd->param = kmalloc(len, GFP_ATOMIC);
 687         if (!cmd->param) {
 688                 kfree(cmd);
 689                 return NULL;
 690         }
 691
 692         if (data)
 693                 memcpy(cmd->param, data, len);
 694
 695         cmd->sk = sk;
 696         sock_hold(sk);
 697
 698         list_add(&cmd->list, &hdev->mgmt_pending);
 699
 700         return cmd;
 701 }
 702
 703 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 704                                 void (*cb)(struct pending_cmd *cmd, void *data),
 705                                 void *data)
 706 {
 707         struct list_head *p, *n;
 708
 709         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 710                 struct pending_cmd *cmd;
 711
 712                 cmd = list_entry(p, struct pending_cmd, list);
 713
 714                 if (opcode > 0 && cmd->opcode != opcode)
 715                         continue;
 716
 717                 cb(cmd, data);
 718         }
 719 }
 720
 721 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 722 {
 723         struct pending_cmd *cmd;
 724
 725         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 726                 if (cmd->opcode == opcode)
 727                         return cmd;
 728         }
 729
 730         return NULL;
 731 }
 732
 733 static void mgmt_pending_remove(struct pending_cmd *cmd)
 734 {
 735         list_del(&cmd->list);
 736         mgmt_pending_free(cmd);
 737 }
 738
 739 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 740 {
 741         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 742
 743         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 744                                                         sizeof(settings));
 745 }
 746
 747 static int set_powered(struct sock *sk, u16 index, void *data, u16 len)
 748 {
 749         struct mgmt_mode *cp = data;
 750         struct hci_dev *hdev;
 751         struct pending_cmd *cmd;
 752         int err;
 753
 754         BT_DBG("request for hci%u", index);
 755
 756         if (len != sizeof(*cp))
 757                 return cmd_status(sk, index, MGMT_OP_SET_POWERED,
 758                                                 MGMT_STATUS_INVALID_PARAMS);
 759
 760         hdev = hci_dev_get(index);
 761         if (!hdev)
 762                 return cmd_status(sk, index, MGMT_OP_SET_POWERED,
 763                                                 MGMT_STATUS_INVALID_PARAMS);
 764
 765         hci_dev_lock(hdev);
 766
 767         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 768                 cancel_delayed_work(&hdev->power_off);
 769
 770                 if (cp->val) {
 771                         err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 772                         mgmt_powered(hdev, 1);
 773                         goto failed;
 774                 }
 775         }
 776
 777         if (!!cp->val == hdev_is_powered(hdev)) {
 778                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 779                 goto failed;
 780         }
 781
 782         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 783                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED,
 784                                                         MGMT_STATUS_BUSY);
 785                 goto failed;
 786         }
 787
 788         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 789         if (!cmd) {
 790                 err = -ENOMEM;
 791                 goto failed;
 792         }
 793
 794         if (cp->val)
 795                 schedule_work(&hdev->power_on);
 796         else
 797                 schedule_work(&hdev->power_off.work);
 798
 799         err = 0;
 800
 801 failed:
 802         hci_dev_unlock(hdev);
 803         hci_dev_put(hdev);
 804         return err;
 805 }
 806
 807 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data,
 808                                         u16 data_len, struct sock *skip_sk)
 809 {
 810         struct sk_buff *skb;
 811         struct mgmt_hdr *hdr;
 812
 813         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 814         if (!skb)
 815                 return -ENOMEM;
 816
 817         hdr = (void *) skb_put(skb, sizeof(*hdr));
 818         hdr->opcode = cpu_to_le16(event);
 819         if (hdev)
 820                 hdr->index = cpu_to_le16(hdev->id);
 821         else
 822                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 823         hdr->len = cpu_to_le16(data_len);
 824
 825         if (data)
 826                 memcpy(skb_put(skb, data_len), data, data_len);
 827
 828         /* Time stamp */
 829         __net_timestamp(skb);
 830
 831         hci_send_to_control(skb, skip_sk);
 832         kfree_skb(skb);
 833
 834         return 0;
 835 }
 836
 837 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 838 {
 839         __le32 ev;
 840
 841         ev = cpu_to_le32(get_current_settings(hdev));
 842
 843         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 844 }
 845
 846 static int set_discoverable(struct sock *sk, u16 index, void *data, u16 len)
 847 {
 848         struct mgmt_cp_set_discoverable *cp = data;
 849         struct hci_dev *hdev;
 850         struct pending_cmd *cmd;
 851         u16 timeout;
 852         u8 scan;
 853         int err;
 854
 855         BT_DBG("request for hci%u", index);
 856
 857         if (len != sizeof(*cp))
 858                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 859                                                 MGMT_STATUS_INVALID_PARAMS);
 860
 861         timeout = get_unaligned_le16(&cp->timeout);
 862         if (!cp->val && timeout > 0)
 863                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 864                                                 MGMT_STATUS_INVALID_PARAMS);
 865
 866         hdev = hci_dev_get(index);
 867         if (!hdev)
 868                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 869                                                 MGMT_STATUS_INVALID_PARAMS);
 870
 871         hci_dev_lock(hdev);
 872
 873         if (!hdev_is_powered(hdev) && timeout > 0) {
 874                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 875                                                 MGMT_STATUS_NOT_POWERED);
 876                 goto failed;
 877         }
 878
 879         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 880                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 881                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 882                                                         MGMT_STATUS_BUSY);
 883                 goto failed;
 884         }
 885
 886         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 887                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 888                                                         MGMT_STATUS_REJECTED);
 889                 goto failed;
 890         }
 891
 892         if (!hdev_is_powered(hdev)) {
 893                 bool changed = false;
 894
 895                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 896                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 897                         changed = true;
 898                 }
 899
 900                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 901                 if (err < 0)
 902                         goto failed;
 903
 904                 if (changed)
 905                         err = new_settings(hdev, sk);
 906
 907                 goto failed;
 908         }
 909
 910         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 911                 if (hdev->discov_timeout > 0) {
 912                         cancel_delayed_work(&hdev->discov_off);
 913                         hdev->discov_timeout = 0;
 914                 }
 915
 916                 if (cp->val && timeout > 0) {
 917                         hdev->discov_timeout = timeout;
 918                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 919                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 920                 }
 921
 922                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 923                 goto failed;
 924         }
 925
 926         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 927         if (!cmd) {
 928                 err = -ENOMEM;
 929                 goto failed;
 930         }
 931
 932         scan = SCAN_PAGE;
 933
 934         if (cp->val)
 935                 scan |= SCAN_INQUIRY;
 936         else
 937                 cancel_delayed_work(&hdev->discov_off);
 938
 939         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 940         if (err < 0)
 941                 mgmt_pending_remove(cmd);
 942
 943         if (cp->val)
 944                 hdev->discov_timeout = timeout;
 945
 946 failed:
 947         hci_dev_unlock(hdev);
 948         hci_dev_put(hdev);
 949
 950         return err;
 951 }
 952
 953 static int set_connectable(struct sock *sk, u16 index, void *data, u16 len)
 954 {
 955         struct mgmt_mode *cp = data;
 956         struct hci_dev *hdev;
 957         struct pending_cmd *cmd;
 958         u8 scan;
 959         int err;
 960
 961         BT_DBG("request for hci%u", index);
 962
 963         if (len != sizeof(*cp))
 964                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 965                                                 MGMT_STATUS_INVALID_PARAMS);
 966
 967         hdev = hci_dev_get(index);
 968         if (!hdev)
 969                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 970                                                 MGMT_STATUS_INVALID_PARAMS);
 971
 972         hci_dev_lock(hdev);
 973
 974         if (!hdev_is_powered(hdev)) {
 975                 bool changed = false;
 976
 977                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 978                         changed = true;
 979
 980                 if (cp->val) {
 981                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 982                 } else {
 983                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 984                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 985                 }
 986
 987                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 988                 if (err < 0)
 989                         goto failed;
 990
 991                 if (changed)
 992                         err = new_settings(hdev, sk);
 993
 994                 goto failed;
 995         }
 996
 997         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 998                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 999                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
1000                                                         MGMT_STATUS_BUSY);
1001                 goto failed;
1002         }
1003
1004         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1005                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1006                 goto failed;
1007         }
1008
1009         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1010         if (!cmd) {
1011                 err = -ENOMEM;
1012                 goto failed;
1013         }
1014
1015         if (cp->val) {
1016                 scan = SCAN_PAGE;
1017         } else {
1018                 scan = 0;
1019
1020                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1021                                                 hdev->discov_timeout > 0)
1022                         cancel_delayed_work(&hdev->discov_off);
1023         }
1024
1025         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1026         if (err < 0)
1027                 mgmt_pending_remove(cmd);
1028
1029 failed:
1030         hci_dev_unlock(hdev);
1031         hci_dev_put(hdev);
1032
1033         return err;
1034 }
1035
1036 static int set_pairable(struct sock *sk, u16 index, void *data, u16 len)
1037 {
1038         struct mgmt_mode *cp = data;
1039         struct hci_dev *hdev;
1040         int err;
1041
1042         BT_DBG("request for hci%u", index);
1043
1044         if (len != sizeof(*cp))
1045                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
1046                                                 MGMT_STATUS_INVALID_PARAMS);
1047
1048         hdev = hci_dev_get(index);
1049         if (!hdev)
1050                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
1051                                                 MGMT_STATUS_INVALID_PARAMS);
1052
1053         hci_dev_lock(hdev);
1054
1055         if (cp->val)
1056                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1057         else
1058                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1059
1060         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1061         if (err < 0)
1062                 goto failed;
1063
1064         err = new_settings(hdev, sk);
1065
1066 failed:
1067         hci_dev_unlock(hdev);
1068         hci_dev_put(hdev);
1069
1070         return err;
1071 }
1072
1073 static int set_link_security(struct sock *sk, u16 index, void *data, u16 len)
1074 {
1075         struct mgmt_mode *cp = data;
1076         struct pending_cmd *cmd;
1077         struct hci_dev *hdev;
1078         uint8_t val;
1079         int err;
1080
1081         BT_DBG("request for hci%u", index);
1082
1083         if (len != sizeof(*cp))
1084                 return cmd_status(sk, index, MGMT_OP_SET_LINK_SECURITY,
1085                                                 MGMT_STATUS_INVALID_PARAMS);
1086
1087         hdev = hci_dev_get(index);
1088         if (!hdev)
1089                 return cmd_status(sk, index, MGMT_OP_SET_LINK_SECURITY,
1090                                                 MGMT_STATUS_INVALID_PARAMS);
1091
1092         hci_dev_lock(hdev);
1093
1094         if (!hdev_is_powered(hdev)) {
1095                 bool changed = false;
1096
1097                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1098                                                         &hdev->dev_flags)) {
1099                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1100                         changed = true;
1101                 }
1102
1103                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1104                 if (err < 0)
1105                         goto failed;
1106
1107                 if (changed)
1108                         err = new_settings(hdev, sk);
1109
1110                 goto failed;
1111         }
1112
1113         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1114                 err = cmd_status(sk, index, MGMT_OP_SET_LINK_SECURITY,
1115                                                         MGMT_STATUS_BUSY);
1116                 goto failed;
1117         }
1118
1119         val = !!cp->val;
1120
1121         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1122                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1123                 goto failed;
1124         }
1125
1126         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1127         if (!cmd) {
1128                 err = -ENOMEM;
1129                 goto failed;
1130         }
1131
1132         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1133         if (err < 0) {
1134                 mgmt_pending_remove(cmd);
1135                 goto failed;
1136         }
1137
1138 failed:
1139         hci_dev_unlock(hdev);
1140         hci_dev_put(hdev);
1141
1142         return err;
1143 }
1144
1145 static int set_ssp(struct sock *sk, u16 index, void *data, u16 len)
1146 {
1147         struct mgmt_mode *cp = data;
1148         struct pending_cmd *cmd;
1149         struct hci_dev *hdev;
1150         uint8_t val;
1151         int err;
1152
1153         BT_DBG("request for hci%u", index);
1154
1155         if (len != sizeof(*cp))
1156                 return cmd_status(sk, index, MGMT_OP_SET_SSP,
1157                                                 MGMT_STATUS_INVALID_PARAMS);
1158
1159         hdev = hci_dev_get(index);
1160         if (!hdev)
1161                 return cmd_status(sk, index, MGMT_OP_SET_SSP,
1162                                                 MGMT_STATUS_INVALID_PARAMS);
1163
1164         hci_dev_lock(hdev);
1165
1166         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1167                 err = cmd_status(sk, index, MGMT_OP_SET_SSP,
1168                                                 MGMT_STATUS_NOT_SUPPORTED);
1169                 goto failed;
1170         }
1171
1172         val = !!cp->val;
1173
1174         if (!hdev_is_powered(hdev)) {
1175                 bool changed = false;
1176
1177                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1178                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1179                         changed = true;
1180                 }
1181
1182                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1183                 if (err < 0)
1184                         goto failed;
1185
1186                 if (changed)
1187                         err = new_settings(hdev, sk);
1188
1189                 goto failed;
1190         }
1191
1192         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1193                 err = cmd_status(sk, index, MGMT_OP_SET_SSP, MGMT_STATUS_BUSY);
1194                 goto failed;
1195         }
1196
1197         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1198                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1199                 goto failed;
1200         }
1201
1202         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1203         if (!cmd) {
1204                 err = -ENOMEM;
1205                 goto failed;
1206         }
1207
1208         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1209         if (err < 0) {
1210                 mgmt_pending_remove(cmd);
1211                 goto failed;
1212         }
1213
1214 failed:
1215         hci_dev_unlock(hdev);
1216         hci_dev_put(hdev);
1217
1218         return err;
1219 }
1220
1221 static int set_hs(struct sock *sk, u16 index, void *data, u16 len)
1222 {
1223         struct mgmt_mode *cp = data;
1224         struct hci_dev *hdev;
1225         int err;
1226
1227         BT_DBG("request for hci%u", index);
1228
1229         if (len != sizeof(*cp))
1230                 return cmd_status(sk, index, MGMT_OP_SET_HS,
1231                                                 MGMT_STATUS_INVALID_PARAMS);
1232
1233         hdev = hci_dev_get(index);
1234         if (!hdev)
1235                 return cmd_status(sk, index, MGMT_OP_SET_HS,
1236                                                 MGMT_STATUS_INVALID_PARAMS);
1237
1238         if (!enable_hs) {
1239                 err = cmd_status(sk, index, MGMT_OP_SET_HS,
1240                                         MGMT_STATUS_NOT_SUPPORTED);
1241                 goto failed;
1242         }
1243
1244         if (cp->val)
1245                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1246         else
1247                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1248
1249         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1250
1251 failed:
1252         hci_dev_put(hdev);
1253         return err;
1254 }
1255
1256 static int set_le(struct sock *sk, u16 index, void *data, u16 len)
1257 {
1258         struct mgmt_mode *cp = data;
1259         struct hci_cp_write_le_host_supported hci_cp;
1260         struct pending_cmd *cmd;
1261         struct hci_dev *hdev;
1262         int err;
1263         u8 val;
1264
1265         BT_DBG("request for hci%u", index);
1266
1267         if (len != sizeof(*cp))
1268                 return cmd_status(sk, index, MGMT_OP_SET_LE,
1269                                                 MGMT_STATUS_INVALID_PARAMS);
1270
1271         hdev = hci_dev_get(index);
1272         if (!hdev)
1273                 return cmd_status(sk, index, MGMT_OP_SET_LE,
1274                                                 MGMT_STATUS_INVALID_PARAMS);
1275
1276         if (!enable_le || !(hdev->features[4] & LMP_LE)) {
1277                 err = cmd_status(sk, index, MGMT_OP_SET_LE,
1278                                                 MGMT_STATUS_NOT_SUPPORTED);
1279                 goto failed;
1280         }
1281
1282         val = !!cp->val;
1283
1284         if (!hdev_is_powered(hdev)) {
1285                 bool changed = false;
1286
1287                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1288                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1289                         changed = true;
1290                 }
1291
1292                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1293                 if (err < 0)
1294                         goto failed;
1295
1296                 if (changed)
1297                         err = new_settings(hdev, sk);
1298
1299                 goto failed;
1300         }
1301
1302         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1303                 err = cmd_status(sk, index, MGMT_OP_SET_LE, MGMT_STATUS_BUSY);
1304                 goto failed;
1305         }
1306
1307         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1308         if (!cmd) {
1309                 err = -ENOMEM;
1310                 goto failed;
1311         }
1312
1313         memset(&hci_cp, 0, sizeof(hci_cp));
1314
1315         if (val) {
1316                 hci_cp.le = val;
1317                 hci_cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
1318         }
1319
1320         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED,
1321                                                 sizeof(hci_cp), &hci_cp);
1322         if (err < 0) {
1323                 mgmt_pending_remove(cmd);
1324                 goto failed;
1325         }
1326
1327 failed:
1328         hci_dev_put(hdev);
1329         return err;
1330 }
1331
1332 static int add_uuid(struct sock *sk, u16 index, void *data, u16 len)
1333 {
1334         struct mgmt_cp_add_uuid *cp = data;
1335         struct pending_cmd *cmd;
1336         struct hci_dev *hdev;
1337         struct bt_uuid *uuid;
1338         int err;
1339
1340         BT_DBG("request for hci%u", index);
1341
1342         if (len != sizeof(*cp))
1343                 return cmd_status(sk, index, MGMT_OP_ADD_UUID,
1344                                                 MGMT_STATUS_INVALID_PARAMS);
1345
1346         hdev = hci_dev_get(index);
1347         if (!hdev)
1348                 return cmd_status(sk, index, MGMT_OP_ADD_UUID,
1349                                                 MGMT_STATUS_INVALID_PARAMS);
1350
1351         hci_dev_lock(hdev);
1352
1353         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1354                 err = cmd_status(sk, index, MGMT_OP_ADD_UUID,
1355                                                         MGMT_STATUS_BUSY);
1356                 goto failed;
1357         }
1358
1359         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
1360         if (!uuid) {
1361                 err = -ENOMEM;
1362                 goto failed;
1363         }
1364
1365         memcpy(uuid->uuid, cp->uuid, 16);
1366         uuid->svc_hint = cp->svc_hint;
1367
1368         list_add(&uuid->list, &hdev->uuids);
1369
1370         err = update_class(hdev);
1371         if (err < 0)
1372                 goto failed;
1373
1374         err = update_eir(hdev);
1375         if (err < 0)
1376                 goto failed;
1377
1378         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1379                 err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, 0,
1380                                                         hdev->dev_class, 3);
1381                 goto failed;
1382         }
1383
1384         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1385         if (!cmd) {
1386                 err = -ENOMEM;
1387                 goto failed;
1388         }
1389
1390 failed:
1391         hci_dev_unlock(hdev);
1392         hci_dev_put(hdev);
1393
1394         return err;
1395 }
1396
1397 static bool enable_service_cache(struct hci_dev *hdev)
1398 {
1399         if (!hdev_is_powered(hdev))
1400                 return false;
1401
1402         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1403                 schedule_delayed_work(&hdev->service_cache,
1404                                 msecs_to_jiffies(SERVICE_CACHE_TIMEOUT));
1405                 return true;
1406         }
1407
1408         return false;
1409 }
1410
1411 static int remove_uuid(struct sock *sk, u16 index, void *data, u16 len)
1412 {
1413         struct mgmt_cp_remove_uuid *cp = data;
1414         struct pending_cmd *cmd;
1415         struct list_head *p, *n;
1416         struct hci_dev *hdev;
1417         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1418         int err, found;
1419
1420         BT_DBG("request for hci%u", index);
1421
1422         if (len != sizeof(*cp))
1423                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
1424                                                 MGMT_STATUS_INVALID_PARAMS);
1425
1426         hdev = hci_dev_get(index);
1427         if (!hdev)
1428                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
1429                                                 MGMT_STATUS_INVALID_PARAMS);
1430
1431         hci_dev_lock(hdev);
1432
1433         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1434                 err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
1435                                                         MGMT_STATUS_BUSY);
1436                 goto unlock;
1437         }
1438
1439         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1440                 err = hci_uuids_clear(hdev);
1441
1442                 if (enable_service_cache(hdev)) {
1443                         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, 0,
1444                                                         hdev->dev_class, 3);
1445                         goto unlock;
1446                 }
1447
1448                 goto update_class;
1449         }
1450
1451         found = 0;
1452
1453         list_for_each_safe(p, n, &hdev->uuids) {
1454                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1455
1456                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1457                         continue;
1458
1459                 list_del(&match->list);
1460                 found++;
1461         }
1462
1463         if (found == 0) {
1464                 err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
1465                                                 MGMT_STATUS_INVALID_PARAMS);
1466                 goto unlock;
1467         }
1468
1469 update_class:
1470         err = update_class(hdev);
1471         if (err < 0)
1472                 goto unlock;
1473
1474         err = update_eir(hdev);
1475         if (err < 0)
1476                 goto unlock;
1477
1478         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1479                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, 0,
1480                                                         hdev->dev_class, 3);
1481                 goto unlock;
1482         }
1483
1484         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1485         if (!cmd) {
1486                 err = -ENOMEM;
1487                 goto unlock;
1488         }
1489
1490 unlock:
1491         hci_dev_unlock(hdev);
1492         hci_dev_put(hdev);
1493
1494         return err;
1495 }
1496
1497 static int set_dev_class(struct sock *sk, u16 index, void *data, u16 len)
1498 {
1499         struct hci_dev *hdev;
1500         struct mgmt_cp_set_dev_class *cp = data;
1501         struct pending_cmd *cmd;
1502         int err;
1503
1504         BT_DBG("request for hci%u", index);
1505
1506         if (len != sizeof(*cp))
1507                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
1508                                                 MGMT_STATUS_INVALID_PARAMS);
1509
1510         hdev = hci_dev_get(index);
1511         if (!hdev)
1512                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
1513                                                 MGMT_STATUS_INVALID_PARAMS);
1514
1515         hci_dev_lock(hdev);
1516
1517         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1518                 err = cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
1519                                                         MGMT_STATUS_BUSY);
1520                 goto unlock;
1521         }
1522
1523         hdev->major_class = cp->major;
1524         hdev->minor_class = cp->minor;
1525
1526         if (!hdev_is_powered(hdev)) {
1527                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, 0,
1528                                                         hdev->dev_class, 3);
1529                 goto unlock;
1530         }
1531
1532         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1533                 hci_dev_unlock(hdev);
1534                 cancel_delayed_work_sync(&hdev->service_cache);
1535                 hci_dev_lock(hdev);
1536                 update_eir(hdev);
1537         }
1538
1539         err = update_class(hdev);
1540         if (err < 0)
1541                 goto unlock;
1542
1543         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1544                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, 0,
1545                                                         hdev->dev_class, 3);
1546                 goto unlock;
1547         }
1548
1549         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1550         if (!cmd) {
1551                 err = -ENOMEM;
1552                 goto unlock;
1553         }
1554
1555 unlock:
1556         hci_dev_unlock(hdev);
1557         hci_dev_put(hdev);
1558
1559         return err;
1560 }
1561
1562 static int load_link_keys(struct sock *sk, u16 index, void *data, u16 len)
1563 {
1564         struct hci_dev *hdev;
1565         struct mgmt_cp_load_link_keys *cp = data;
1566         u16 key_count, expected_len;
1567         int i;
1568
1569         if (len < sizeof(*cp))
1570                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1571                                                 MGMT_STATUS_INVALID_PARAMS);
1572
1573         key_count = get_unaligned_le16(&cp->key_count);
1574
1575         expected_len = sizeof(*cp) + key_count *
1576                                         sizeof(struct mgmt_link_key_info);
1577         if (expected_len != len) {
1578                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1579                                                         len, expected_len);
1580                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1581                                                 MGMT_STATUS_INVALID_PARAMS);
1582         }
1583
1584         hdev = hci_dev_get(index);
1585         if (!hdev)
1586                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1587                                                 MGMT_STATUS_INVALID_PARAMS);
1588
1589         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
1590                                                                 key_count);
1591
1592         hci_dev_lock(hdev);
1593
1594         hci_link_keys_clear(hdev);
1595
1596         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1597
1598         if (cp->debug_keys)
1599                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1600         else
1601                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1602
1603         for (i = 0; i < key_count; i++) {
1604                 struct mgmt_link_key_info *key = &cp->keys[i];
1605
1606                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1607                                                 key->type, key->pin_len);
1608         }
1609
1610         cmd_complete(sk, index, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1611
1612         hci_dev_unlock(hdev);
1613         hci_dev_put(hdev);
1614
1615         return 0;
1616 }
1617
1618 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1619                                         u8 addr_type, struct sock *skip_sk)
1620 {
1621         struct mgmt_ev_device_unpaired ev;
1622
1623         bacpy(&ev.addr.bdaddr, bdaddr);
1624         ev.addr.type = addr_type;
1625
1626         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1627                                                                 skip_sk);
1628 }
1629
1630 static int unpair_device(struct sock *sk, u16 index, void *data, u16 len)
1631 {
1632         struct hci_dev *hdev;
1633         struct mgmt_cp_unpair_device *cp = data;
1634         struct mgmt_rp_unpair_device rp;
1635         struct hci_cp_disconnect dc;
1636         struct pending_cmd *cmd;
1637         struct hci_conn *conn;
1638         int err;
1639
1640         if (len != sizeof(*cp))
1641                 return cmd_status(sk, index, MGMT_OP_UNPAIR_DEVICE,
1642                                                 MGMT_STATUS_INVALID_PARAMS);
1643
1644         hdev = hci_dev_get(index);
1645         if (!hdev)
1646                 return cmd_status(sk, index, MGMT_OP_UNPAIR_DEVICE,
1647                                                 MGMT_STATUS_INVALID_PARAMS);
1648
1649         hci_dev_lock(hdev);
1650
1651         memset(&rp, 0, sizeof(rp));
1652         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1653         rp.addr.type = cp->addr.type;
1654
1655         if (!hdev_is_powered(hdev)) {
1656                 err = cmd_complete(sk, index, MGMT_OP_UNPAIR_DEVICE,
1657                                                 MGMT_STATUS_NOT_POWERED,
1658                                                 &rp, sizeof(rp));
1659                 goto unlock;
1660         }
1661
1662         if (cp->addr.type == MGMT_ADDR_BREDR)
1663                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1664         else
1665                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1666
1667         if (err < 0) {
1668                 err = cmd_complete(sk, index, MGMT_OP_UNPAIR_DEVICE,
1669                                                 MGMT_STATUS_NOT_PAIRED,
1670                                                 &rp, sizeof(rp));
1671                 goto unlock;
1672         }
1673
1674         if (cp->disconnect) {
1675                 if (cp->addr.type == MGMT_ADDR_BREDR)
1676                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1677                                                         &cp->addr.bdaddr);
1678                 else
1679                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1680                                                         &cp->addr.bdaddr);
1681         } else {
1682                 conn = NULL;
1683         }
1684
1685         if (!conn) {
1686                 err = cmd_complete(sk, index, MGMT_OP_UNPAIR_DEVICE, 0,
1687                                                         &rp, sizeof(rp));
1688                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1689                 goto unlock;
1690         }
1691
1692         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1693                                                                 sizeof(*cp));
1694         if (!cmd) {
1695                 err = -ENOMEM;
1696                 goto unlock;
1697         }
1698
1699         put_unaligned_le16(conn->handle, &dc.handle);
1700         dc.reason = 0x13; /* Remote User Terminated Connection */
1701         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1702         if (err < 0)
1703                 mgmt_pending_remove(cmd);
1704
1705 unlock:
1706         hci_dev_unlock(hdev);
1707         hci_dev_put(hdev);
1708
1709         return err;
1710 }
1711
1712 static int disconnect(struct sock *sk, u16 index, void *data, u16 len)
1713 {
1714         struct hci_dev *hdev;
1715         struct mgmt_cp_disconnect *cp = data;
1716         struct hci_cp_disconnect dc;
1717         struct pending_cmd *cmd;
1718         struct hci_conn *conn;
1719         int err;
1720
1721         BT_DBG("");
1722
1723         if (len != sizeof(*cp))
1724                 return cmd_status(sk, index, MGMT_OP_DISCONNECT,
1725                                                 MGMT_STATUS_INVALID_PARAMS);
1726
1727         hdev = hci_dev_get(index);
1728         if (!hdev)
1729                 return cmd_status(sk, index, MGMT_OP_DISCONNECT,
1730                                                 MGMT_STATUS_INVALID_PARAMS);
1731
1732         hci_dev_lock(hdev);
1733
1734         if (!test_bit(HCI_UP, &hdev->flags)) {
1735                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1736                                                 MGMT_STATUS_NOT_POWERED);
1737                 goto failed;
1738         }
1739
1740         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1741                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1742                                                         MGMT_STATUS_BUSY);
1743                 goto failed;
1744         }
1745
1746         if (cp->addr.type == MGMT_ADDR_BREDR)
1747                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1748         else
1749                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1750
1751         if (!conn) {
1752                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1753                                                 MGMT_STATUS_NOT_CONNECTED);
1754                 goto failed;
1755         }
1756
1757         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1758         if (!cmd) {
1759                 err = -ENOMEM;
1760                 goto failed;
1761         }
1762
1763         put_unaligned_le16(conn->handle, &dc.handle);
1764         dc.reason = 0x13; /* Remote User Terminated Connection */
1765
1766         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1767         if (err < 0)
1768                 mgmt_pending_remove(cmd);
1769
1770 failed:
1771         hci_dev_unlock(hdev);
1772         hci_dev_put(hdev);
1773
1774         return err;
1775 }
1776
1777 static u8 link_to_mgmt(u8 link_type, u8 addr_type)
1778 {
1779         switch (link_type) {
1780         case LE_LINK:
1781                 switch (addr_type) {
1782                 case ADDR_LE_DEV_PUBLIC:
1783                         return MGMT_ADDR_LE_PUBLIC;
1784                 case ADDR_LE_DEV_RANDOM:
1785                         return MGMT_ADDR_LE_RANDOM;
1786                 default:
1787                         return MGMT_ADDR_INVALID;
1788                 }
1789         case ACL_LINK:
1790                 return MGMT_ADDR_BREDR;
1791         default:
1792                 return MGMT_ADDR_INVALID;
1793         }
1794 }
1795
1796 static int get_connections(struct sock *sk, u16 index)
1797 {
1798         struct mgmt_rp_get_connections *rp;
1799         struct hci_dev *hdev;
1800         struct hci_conn *c;
1801         size_t rp_len;
1802         int err;
1803         u16 i;
1804
1805         BT_DBG("");
1806
1807         hdev = hci_dev_get(index);
1808         if (!hdev)
1809                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS,
1810                                                 MGMT_STATUS_INVALID_PARAMS);
1811
1812         hci_dev_lock(hdev);
1813
1814         if (!hdev_is_powered(hdev)) {
1815                 err = cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS,
1816                                                 MGMT_STATUS_NOT_POWERED);
1817                 goto unlock;
1818         }
1819
1820         i = 0;
1821         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1822                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1823                         i++;
1824         }
1825
1826         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1827         rp = kmalloc(rp_len, GFP_ATOMIC);
1828         if (!rp) {
1829                 err = -ENOMEM;
1830                 goto unlock;
1831         }
1832
1833         i = 0;
1834         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1835                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1836                         continue;
1837                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1838                 rp->addr[i].type = link_to_mgmt(c->type, c->dst_type);
1839                 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1840                         continue;
1841                 i++;
1842         }
1843
1844         put_unaligned_le16(i, &rp->conn_count);
1845
1846         /* Recalculate length in case of filtered SCO connections, etc */
1847         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1848
1849         err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, 0, rp, rp_len);
1850
1851         kfree(rp);
1852
1853 unlock:
1854         hci_dev_unlock(hdev);
1855         hci_dev_put(hdev);
1856         return err;
1857 }
1858
1859 static int send_pin_code_neg_reply(struct sock *sk, u16 index,
1860                 struct hci_dev *hdev, struct mgmt_cp_pin_code_neg_reply *cp)
1861 {
1862         struct pending_cmd *cmd;
1863         int err;
1864
1865         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1866                                                                 sizeof(*cp));
1867         if (!cmd)
1868                 return -ENOMEM;
1869
1870         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1871                                 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1872         if (err < 0)
1873                 mgmt_pending_remove(cmd);
1874
1875         return err;
1876 }
1877
1878 static int pin_code_reply(struct sock *sk, u16 index, void *data, u16 len)
1879 {
1880         struct hci_dev *hdev;
1881         struct hci_conn *conn;
1882         struct mgmt_cp_pin_code_reply *cp = data;
1883         struct hci_cp_pin_code_reply reply;
1884         struct pending_cmd *cmd;
1885         int err;
1886
1887         BT_DBG("");
1888
1889         if (len != sizeof(*cp))
1890                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1891                                                 MGMT_STATUS_INVALID_PARAMS);
1892
1893         hdev = hci_dev_get(index);
1894         if (!hdev)
1895                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1896                                                 MGMT_STATUS_INVALID_PARAMS);
1897
1898         hci_dev_lock(hdev);
1899
1900         if (!hdev_is_powered(hdev)) {
1901                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1902                                                 MGMT_STATUS_NOT_POWERED);
1903                 goto failed;
1904         }
1905
1906         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1907         if (!conn) {
1908                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1909                                                 MGMT_STATUS_NOT_CONNECTED);
1910                 goto failed;
1911         }
1912
1913         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1914                 struct mgmt_cp_pin_code_neg_reply ncp;
1915
1916                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1917
1918                 BT_ERR("PIN code is not 16 bytes long");
1919
1920                 err = send_pin_code_neg_reply(sk, index, hdev, &ncp);
1921                 if (err >= 0)
1922                         err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1923                                                 MGMT_STATUS_INVALID_PARAMS);
1924
1925                 goto failed;
1926         }
1927
1928         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data,
1929                                                                         len);
1930         if (!cmd) {
1931                 err = -ENOMEM;
1932                 goto failed;
1933         }
1934
1935         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1936         reply.pin_len = cp->pin_len;
1937         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1938
1939         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1940         if (err < 0)
1941                 mgmt_pending_remove(cmd);
1942
1943 failed:
1944         hci_dev_unlock(hdev);
1945         hci_dev_put(hdev);
1946
1947         return err;
1948 }
1949
1950 static int pin_code_neg_reply(struct sock *sk, u16 index, void *data, u16 len)
1951 {
1952         struct hci_dev *hdev;
1953         struct mgmt_cp_pin_code_neg_reply *cp = data;
1954         int err;
1955
1956         BT_DBG("");
1957
1958         if (len != sizeof(*cp))
1959                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1960                                                 MGMT_STATUS_INVALID_PARAMS);
1961
1962         hdev = hci_dev_get(index);
1963         if (!hdev)
1964                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1965                                                 MGMT_STATUS_INVALID_PARAMS);
1966
1967         hci_dev_lock(hdev);
1968
1969         if (!hdev_is_powered(hdev)) {
1970                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1971                                                 MGMT_STATUS_NOT_POWERED);
1972                 goto failed;
1973         }
1974
1975         err = send_pin_code_neg_reply(sk, index, hdev, cp);
1976
1977 failed:
1978         hci_dev_unlock(hdev);
1979         hci_dev_put(hdev);
1980
1981         return err;
1982 }
1983
1984 static int set_io_capability(struct sock *sk, u16 index, void *data, u16 len)
1985 {
1986         struct hci_dev *hdev;
1987         struct mgmt_cp_set_io_capability *cp = data;
1988
1989         BT_DBG("");
1990
1991         if (len != sizeof(*cp))
1992                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
1993                                                 MGMT_STATUS_INVALID_PARAMS);
1994
1995         hdev = hci_dev_get(index);
1996         if (!hdev)
1997                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
1998                                                 MGMT_STATUS_INVALID_PARAMS);
1999
2000         hci_dev_lock(hdev);
2001
2002         hdev->io_capability = cp->io_capability;
2003
2004         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2005                                                         hdev->io_capability);
2006
2007         hci_dev_unlock(hdev);
2008         hci_dev_put(hdev);
2009
2010         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, 0, NULL, 0);
2011 }
2012
2013 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
2014 {
2015         struct hci_dev *hdev = conn->hdev;
2016         struct pending_cmd *cmd;
2017
2018         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2019                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2020                         continue;
2021
2022                 if (cmd->user_data != conn)
2023                         continue;
2024
2025                 return cmd;
2026         }
2027
2028         return NULL;
2029 }
2030
2031 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2032 {
2033         struct mgmt_rp_pair_device rp;
2034         struct hci_conn *conn = cmd->user_data;
2035
2036         bacpy(&rp.addr.bdaddr, &conn->dst);
2037         rp.addr.type = link_to_mgmt(conn->type, conn->dst_type);
2038
2039         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2040                                                         &rp, sizeof(rp));
2041
2042         /* So we don't get further callbacks for this connection */
2043         conn->connect_cfm_cb = NULL;
2044         conn->security_cfm_cb = NULL;
2045         conn->disconn_cfm_cb = NULL;
2046
2047         hci_conn_put(conn);
2048
2049         mgmt_pending_remove(cmd);
2050 }
2051
2052 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2053 {
2054         struct pending_cmd *cmd;
2055
2056         BT_DBG("status %u", status);
2057
2058         cmd = find_pairing(conn);
2059         if (!cmd)
2060                 BT_DBG("Unable to find a pending command");
2061         else
2062                 pairing_complete(cmd, mgmt_status(status));
2063 }
2064
2065 static int pair_device(struct sock *sk, u16 index, void *data, u16 len)
2066 {
2067         struct hci_dev *hdev;
2068         struct mgmt_cp_pair_device *cp = data;
2069         struct mgmt_rp_pair_device rp;
2070         struct pending_cmd *cmd;
2071         u8 sec_level, auth_type;
2072         struct hci_conn *conn;
2073         int err;
2074
2075         BT_DBG("");
2076
2077         if (len != sizeof(*cp))
2078                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
2079                                                 MGMT_STATUS_INVALID_PARAMS);
2080
2081         hdev = hci_dev_get(index);
2082         if (!hdev)
2083                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
2084                                                 MGMT_STATUS_INVALID_PARAMS);
2085
2086         hci_dev_lock(hdev);
2087
2088         if (!hdev_is_powered(hdev)) {
2089                 err = cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
2090                                                 MGMT_STATUS_NOT_POWERED);
2091                 goto unlock;
2092         }
2093
2094         sec_level = BT_SECURITY_MEDIUM;
2095         if (cp->io_cap == 0x03)
2096                 auth_type = HCI_AT_DEDICATED_BONDING;
2097         else
2098                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2099
2100         if (cp->addr.type == MGMT_ADDR_BREDR)
2101                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr, sec_level,
2102                                                                 auth_type);
2103         else
2104                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr, sec_level,
2105                                                                 auth_type);
2106
2107         memset(&rp, 0, sizeof(rp));
2108         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2109         rp.addr.type = cp->addr.type;
2110
2111         if (IS_ERR(conn)) {
2112                 err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
2113                                                 MGMT_STATUS_CONNECT_FAILED,
2114                                                 &rp, sizeof(rp));
2115                 goto unlock;
2116         }
2117
2118         if (conn->connect_cfm_cb) {
2119                 hci_conn_put(conn);
2120                 err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
2121                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2122                 goto unlock;
2123         }
2124
2125         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2126         if (!cmd) {
2127                 err = -ENOMEM;
2128                 hci_conn_put(conn);
2129                 goto unlock;
2130         }
2131
2132         /* For LE, just connecting isn't a proof that the pairing finished */
2133         if (cp->addr.type == MGMT_ADDR_BREDR)
2134                 conn->connect_cfm_cb = pairing_complete_cb;
2135
2136         conn->security_cfm_cb = pairing_complete_cb;
2137         conn->disconn_cfm_cb = pairing_complete_cb;
2138         conn->io_capability = cp->io_cap;
2139         cmd->user_data = conn;
2140
2141         if (conn->state == BT_CONNECTED &&
2142                                 hci_conn_security(conn, sec_level, auth_type))
2143                 pairing_complete(cmd, 0);
2144
2145         err = 0;
2146
2147 unlock:
2148         hci_dev_unlock(hdev);
2149         hci_dev_put(hdev);
2150
2151         return err;
2152 }
2153
2154 static int cancel_pair_device(struct sock *sk, u16 index,
2155                                                 unsigned char *data, u16 len)
2156 {
2157         struct mgmt_addr_info *addr = (void *) data;
2158         struct hci_dev *hdev;
2159         struct pending_cmd *cmd;
2160         struct hci_conn *conn;
2161         int err;
2162
2163         BT_DBG("");
2164
2165         if (len != sizeof(*addr))
2166                 return cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
2167                                                 MGMT_STATUS_INVALID_PARAMS);
2168
2169         hdev = hci_dev_get(index);
2170         if (!hdev)
2171                 return cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
2172                                                 MGMT_STATUS_INVALID_PARAMS);
2173
2174         hci_dev_lock(hdev);
2175
2176         if (!hdev_is_powered(hdev)) {
2177                 err = cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
2178                                                 MGMT_STATUS_NOT_POWERED);
2179                 goto unlock;
2180         }
2181
2182         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2183         if (!cmd) {
2184                 err = cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
2185                                                 MGMT_STATUS_INVALID_PARAMS);
2186                 goto unlock;
2187         }
2188
2189         conn = cmd->user_data;
2190
2191         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2192                 err = cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
2193                                                 MGMT_STATUS_INVALID_PARAMS);
2194                 goto unlock;
2195         }
2196
2197         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2198
2199         err = cmd_complete(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE, 0, addr,
2200                                                                 sizeof(*addr));
2201 unlock:
2202         hci_dev_unlock(hdev);
2203         hci_dev_put(hdev);
2204
2205         return err;
2206 }
2207
2208 static int user_pairing_resp(struct sock *sk, u16 index, bdaddr_t *bdaddr,
2209                                         u8 type, u16 mgmt_op, u16 hci_op,
2210                                         __le32 passkey)
2211 {
2212         struct pending_cmd *cmd;
2213         struct hci_dev *hdev;
2214         struct hci_conn *conn;
2215         int err;
2216
2217         hdev = hci_dev_get(index);
2218         if (!hdev)
2219                 return cmd_status(sk, index, mgmt_op,
2220                                                 MGMT_STATUS_INVALID_PARAMS);
2221
2222         hci_dev_lock(hdev);
2223
2224         if (!hdev_is_powered(hdev)) {
2225                 err = cmd_status(sk, index, mgmt_op, MGMT_STATUS_NOT_POWERED);
2226                 goto done;
2227         }
2228
2229         if (type == MGMT_ADDR_BREDR)
2230                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2231         else
2232                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2233
2234         if (!conn) {
2235                 err = cmd_status(sk, index, mgmt_op,
2236                                                 MGMT_STATUS_NOT_CONNECTED);
2237                 goto done;
2238         }
2239
2240         if (type == MGMT_ADDR_LE_PUBLIC || type == MGMT_ADDR_LE_RANDOM) {
2241                 /* Continue with pairing via SMP */
2242                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2243
2244                 if (!err)
2245                         err = cmd_status(sk, index, mgmt_op,
2246                                                         MGMT_STATUS_SUCCESS);
2247                 else
2248                         err = cmd_status(sk, index, mgmt_op,
2249                                                         MGMT_STATUS_FAILED);
2250
2251                 goto done;
2252         }
2253
2254         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2255         if (!cmd) {
2256                 err = -ENOMEM;
2257                 goto done;
2258         }
2259
2260         /* Continue with pairing via HCI */
2261         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2262                 struct hci_cp_user_passkey_reply cp;
2263
2264                 bacpy(&cp.bdaddr, bdaddr);
2265                 cp.passkey = passkey;
2266                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2267         } else
2268                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2269
2270         if (err < 0)
2271                 mgmt_pending_remove(cmd);
2272
2273 done:
2274         hci_dev_unlock(hdev);
2275         hci_dev_put(hdev);
2276
2277         return err;
2278 }
2279
2280 static int user_confirm_reply(struct sock *sk, u16 index, void *data, u16 len)
2281 {
2282         struct mgmt_cp_user_confirm_reply *cp = data;
2283
2284         BT_DBG("");
2285
2286         if (len != sizeof(*cp))
2287                 return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_REPLY,
2288                                                 MGMT_STATUS_INVALID_PARAMS);
2289
2290         return user_pairing_resp(sk, index, &cp->addr.bdaddr, cp->addr.type,
2291                                                 MGMT_OP_USER_CONFIRM_REPLY,
2292                                                 HCI_OP_USER_CONFIRM_REPLY, 0);
2293 }
2294
2295 static int user_confirm_neg_reply(struct sock *sk, u16 index, void *data,
2296                                                                         u16 len)
2297 {
2298         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2299
2300         BT_DBG("");
2301
2302         if (len != sizeof(*cp))
2303                 return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_NEG_REPLY,
2304                                                 MGMT_STATUS_INVALID_PARAMS);
2305
2306         return user_pairing_resp(sk, index, &cp->addr.bdaddr, cp->addr.type,
2307                                         MGMT_OP_USER_CONFIRM_NEG_REPLY,
2308                                         HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2309 }
2310
2311 static int user_passkey_reply(struct sock *sk, u16 index, void *data, u16 len)
2312 {
2313         struct mgmt_cp_user_passkey_reply *cp = data;
2314
2315         BT_DBG("");
2316
2317         if (len != sizeof(*cp))
2318                 return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_REPLY,
2319                                                                         EINVAL);
2320
2321         return user_pairing_resp(sk, index, &cp->addr.bdaddr, cp->addr.type,
2322                                                 MGMT_OP_USER_PASSKEY_REPLY,
2323                                                 HCI_OP_USER_PASSKEY_REPLY,
2324                                                 cp->passkey);
2325 }
2326
2327 static int user_passkey_neg_reply(struct sock *sk, u16 index, void *data,
2328                                                                         u16 len)
2329 {
2330         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2331
2332         BT_DBG("");
2333
2334         if (len != sizeof(*cp))
2335                 return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_NEG_REPLY,
2336                                                                         EINVAL);
2337
2338         return user_pairing_resp(sk, index, &cp->addr.bdaddr, cp->addr.type,
2339                                         MGMT_OP_USER_PASSKEY_NEG_REPLY,
2340                                         HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2341 }
2342
2343 static int set_local_name(struct sock *sk, u16 index, void *data,
2344                                                                 u16 len)
2345 {
2346         struct mgmt_cp_set_local_name *mgmt_cp = data;
2347         struct hci_cp_write_local_name hci_cp;
2348         struct hci_dev *hdev;
2349         struct pending_cmd *cmd;
2350         int err;
2351
2352         BT_DBG("");
2353
2354         if (len != sizeof(*mgmt_cp))
2355                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
2356                                                 MGMT_STATUS_INVALID_PARAMS);
2357
2358         hdev = hci_dev_get(index);
2359         if (!hdev)
2360                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
2361                                                 MGMT_STATUS_INVALID_PARAMS);
2362
2363         hci_dev_lock(hdev);
2364
2365         memcpy(hdev->short_name, mgmt_cp->short_name,
2366                                                 sizeof(hdev->short_name));
2367
2368         if (!hdev_is_powered(hdev)) {
2369                 memcpy(hdev->dev_name, mgmt_cp->name, sizeof(hdev->dev_name));
2370
2371                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2372                                                                 data, len);
2373                 if (err < 0)
2374                         goto failed;
2375
2376                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2377                                                                         sk);
2378
2379                 goto failed;
2380         }
2381
2382         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2383         if (!cmd) {
2384                 err = -ENOMEM;
2385                 goto failed;
2386         }
2387
2388         memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
2389         err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
2390                                                                 &hci_cp);
2391         if (err < 0)
2392                 mgmt_pending_remove(cmd);
2393
2394 failed:
2395         hci_dev_unlock(hdev);
2396         hci_dev_put(hdev);
2397
2398         return err;
2399 }
2400
2401 static int read_local_oob_data(struct sock *sk, u16 index)
2402 {
2403         struct hci_dev *hdev;
2404         struct pending_cmd *cmd;
2405         int err;
2406
2407         BT_DBG("hci%u", index);
2408
2409         hdev = hci_dev_get(index);
2410         if (!hdev)
2411                 return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
2412                                                 MGMT_STATUS_INVALID_PARAMS);
2413
2414         hci_dev_lock(hdev);
2415
2416         if (!hdev_is_powered(hdev)) {
2417                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
2418                                                 MGMT_STATUS_NOT_POWERED);
2419                 goto unlock;
2420         }
2421
2422         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
2423                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
2424                                                 MGMT_STATUS_NOT_SUPPORTED);
2425                 goto unlock;
2426         }
2427
2428         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2429                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
2430                                                         MGMT_STATUS_BUSY);
2431                 goto unlock;
2432         }
2433
2434         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2435         if (!cmd) {
2436                 err = -ENOMEM;
2437                 goto unlock;
2438         }
2439
2440         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2441         if (err < 0)
2442                 mgmt_pending_remove(cmd);
2443
2444 unlock:
2445         hci_dev_unlock(hdev);
2446         hci_dev_put(hdev);
2447
2448         return err;
2449 }
2450
2451 static int add_remote_oob_data(struct sock *sk, u16 index, void *data,
2452                                                                 u16 len)
2453 {
2454         struct hci_dev *hdev;
2455         struct mgmt_cp_add_remote_oob_data *cp = data;
2456         u8 status;
2457         int err;
2458
2459         BT_DBG("hci%u ", index);
2460
2461         if (len != sizeof(*cp))
2462                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
2463                                                 MGMT_STATUS_INVALID_PARAMS);
2464
2465         hdev = hci_dev_get(index);
2466         if (!hdev)
2467                 return cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
2468                                                 MGMT_STATUS_INVALID_PARAMS,
2469                                                 &cp->addr, sizeof(cp->addr));
2470
2471         hci_dev_lock(hdev);
2472
2473         if (!hdev_is_powered(hdev)) {
2474                 err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
2475                                                 MGMT_STATUS_NOT_POWERED,
2476                                                 &cp->addr, sizeof(cp->addr));
2477                 goto unlock;
2478         }
2479
2480         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2481                                                                 cp->randomizer);
2482         if (err < 0)
2483                 status = MGMT_STATUS_FAILED;
2484         else
2485                 status = 0;
2486
2487         err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2488                                                 &cp->addr, sizeof(cp->addr));
2489
2490 unlock:
2491         hci_dev_unlock(hdev);
2492         hci_dev_put(hdev);
2493
2494         return err;
2495 }
2496
2497 static int remove_remote_oob_data(struct sock *sk, u16 index,
2498                                                 void *data, u16 len)
2499 {
2500         struct hci_dev *hdev;
2501         struct mgmt_cp_remove_remote_oob_data *cp = data;
2502         u8 status;
2503         int err;
2504
2505         BT_DBG("hci%u ", index);
2506
2507         if (len != sizeof(*cp))
2508                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2509                                                 MGMT_STATUS_INVALID_PARAMS);
2510
2511         hdev = hci_dev_get(index);
2512         if (!hdev)
2513                 return cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2514                                                 MGMT_STATUS_INVALID_PARAMS,
2515                                                 &cp->addr, sizeof(cp->addr));
2516
2517         hci_dev_lock(hdev);
2518
2519         if (!hdev_is_powered(hdev)) {
2520                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2521                                                 MGMT_STATUS_NOT_POWERED,
2522                                                 &cp->addr, sizeof(cp->addr));
2523                 goto unlock;
2524         }
2525
2526         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2527         if (err < 0)
2528                 status = MGMT_STATUS_INVALID_PARAMS;
2529         else
2530                 status = 0;
2531
2532         err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA, status,
2533                                                 &cp->addr, sizeof(cp->addr));
2534
2535 unlock:
2536         hci_dev_unlock(hdev);
2537         hci_dev_put(hdev);
2538
2539         return err;
2540 }
2541
2542 static int discovery(struct hci_dev *hdev)
2543 {
2544         int err;
2545
2546         if (lmp_host_le_capable(hdev)) {
2547                 if (lmp_bredr_capable(hdev)) {
2548                         err = hci_le_scan(hdev, LE_SCAN_TYPE,
2549                                                 LE_SCAN_INT, LE_SCAN_WIN,
2550                                                 LE_SCAN_TIMEOUT_BREDR_LE);
2551                 } else {
2552                         hdev->discovery.type = DISCOV_TYPE_LE;
2553                         err = hci_le_scan(hdev, LE_SCAN_TYPE,
2554                                                 LE_SCAN_INT, LE_SCAN_WIN,
2555                                                 LE_SCAN_TIMEOUT_LE_ONLY);
2556                 }
2557         } else {
2558                 hdev->discovery.type = DISCOV_TYPE_BREDR;
2559                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2560         }
2561
2562         return err;
2563 }
2564
2565 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2566 {
2567         int err;
2568
2569         BT_DBG("%s", hdev->name);
2570
2571         hci_dev_lock(hdev);
2572
2573         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2574         if (err < 0)
2575                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2576
2577         hci_dev_unlock(hdev);
2578
2579         return err;
2580 }
2581
2582 static int start_discovery(struct sock *sk, u16 index,
2583                                                 void *data, u16 len)
2584 {
2585         struct mgmt_cp_start_discovery *cp = data;
2586         struct pending_cmd *cmd;
2587         struct hci_dev *hdev;
2588         int err;
2589
2590         BT_DBG("hci%u", index);
2591
2592         if (len != sizeof(*cp))
2593                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
2594                                                 MGMT_STATUS_INVALID_PARAMS);
2595
2596         hdev = hci_dev_get(index);
2597         if (!hdev)
2598                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
2599                                                 MGMT_STATUS_INVALID_PARAMS);
2600
2601         hci_dev_lock(hdev);
2602
2603         if (!hdev_is_powered(hdev)) {
2604                 err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
2605                                                 MGMT_STATUS_NOT_POWERED);
2606                 goto failed;
2607         }
2608
2609         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2610                 err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
2611                                                 MGMT_STATUS_BUSY);
2612                 goto failed;
2613         }
2614
2615         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2616         if (!cmd) {
2617                 err = -ENOMEM;
2618                 goto failed;
2619         }
2620
2621         hdev->discovery.type = cp->type;
2622
2623         switch (hdev->discovery.type) {
2624         case DISCOV_TYPE_BREDR:
2625                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2626                 break;
2627
2628         case DISCOV_TYPE_LE:
2629                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2630                                         LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2631                 break;
2632
2633         case DISCOV_TYPE_INTERLEAVED:
2634                 err = discovery(hdev);
2635                 break;
2636
2637         default:
2638                 err = -EINVAL;
2639         }
2640
2641         if (err < 0)
2642                 mgmt_pending_remove(cmd);
2643         else
2644                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2645
2646 failed:
2647         hci_dev_unlock(hdev);
2648         hci_dev_put(hdev);
2649
2650         return err;
2651 }
2652
2653 static int stop_discovery(struct sock *sk, u16 index, void *data, u16 len)
2654 {
2655         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2656         struct hci_dev *hdev;
2657         struct pending_cmd *cmd;
2658         struct hci_cp_remote_name_req_cancel cp;
2659         struct inquiry_entry *e;
2660         int err;
2661
2662         BT_DBG("hci%u", index);
2663
2664         if (len != sizeof(*mgmt_cp))
2665                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY,
2666                                                 MGMT_STATUS_INVALID_PARAMS);
2667
2668         hdev = hci_dev_get(index);
2669         if (!hdev)
2670                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY,
2671                                                 MGMT_STATUS_INVALID_PARAMS);
2672
2673         hci_dev_lock(hdev);
2674
2675         if (!hci_discovery_active(hdev)) {
2676                 err = cmd_complete(sk, index, MGMT_OP_STOP_DISCOVERY,
2677                                         MGMT_STATUS_REJECTED,
2678                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
2679                 goto unlock;
2680         }
2681
2682         if (hdev->discovery.type != mgmt_cp->type) {
2683                 err = cmd_complete(sk, index, MGMT_OP_STOP_DISCOVERY,
2684                                         MGMT_STATUS_INVALID_PARAMS,
2685                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
2686                 goto unlock;
2687         }
2688
2689         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2690         if (!cmd) {
2691                 err = -ENOMEM;
2692                 goto unlock;
2693         }
2694
2695         if (hdev->discovery.state == DISCOVERY_FINDING) {
2696                 err = hci_cancel_inquiry(hdev);
2697                 if (err < 0)
2698                         mgmt_pending_remove(cmd);
2699                 else
2700                         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2701                 goto unlock;
2702         }
2703
2704         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_PENDING);
2705         if (!e) {
2706                 mgmt_pending_remove(cmd);
2707                 err = cmd_complete(sk, index, MGMT_OP_STOP_DISCOVERY, 0,
2708                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
2709                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2710                 goto unlock;
2711         }
2712
2713         bacpy(&cp.bdaddr, &e->data.bdaddr);
2714         err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2715                                                         sizeof(cp), &cp);
2716         if (err < 0)
2717                 mgmt_pending_remove(cmd);
2718         else
2719                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2720
2721 unlock:
2722         hci_dev_unlock(hdev);
2723         hci_dev_put(hdev);
2724
2725         return err;
2726 }
2727
2728 static int confirm_name(struct sock *sk, u16 index, void *data, u16 len)
2729 {
2730         struct mgmt_cp_confirm_name *cp = data;
2731         struct inquiry_entry *e;
2732         struct hci_dev *hdev;
2733         int err;
2734
2735         BT_DBG("hci%u", index);
2736
2737         if (len != sizeof(*cp))
2738                 return cmd_status(sk, index, MGMT_OP_CONFIRM_NAME,
2739                                 MGMT_STATUS_INVALID_PARAMS);
2740
2741         hdev = hci_dev_get(index);
2742         if (!hdev)
2743                 return cmd_status(sk, index, MGMT_OP_CONFIRM_NAME,
2744                                 MGMT_STATUS_INVALID_PARAMS);
2745
2746         hci_dev_lock(hdev);
2747
2748         if (!hci_discovery_active(hdev)) {
2749                 err = cmd_status(sk, index, MGMT_OP_CONFIRM_NAME,
2750                                                         MGMT_STATUS_FAILED);
2751                 goto failed;
2752         }
2753
2754         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2755         if (!e) {
2756                 err = cmd_status(sk, index, MGMT_OP_CONFIRM_NAME,
2757                                 MGMT_STATUS_INVALID_PARAMS);
2758                 goto failed;
2759         }
2760
2761         if (cp->name_known) {
2762                 e->name_state = NAME_KNOWN;
2763                 list_del(&e->list);
2764         } else {
2765                 e->name_state = NAME_NEEDED;
2766                 hci_inquiry_cache_update_resolve(hdev, e);
2767         }
2768
2769         err = 0;
2770
2771 failed:
2772         hci_dev_unlock(hdev);
2773
2774         return err;
2775 }
2776
2777 static int block_device(struct sock *sk, u16 index, void *data, u16 len)
2778 {
2779         struct hci_dev *hdev;
2780         struct mgmt_cp_block_device *cp = data;
2781         u8 status;
2782         int err;
2783
2784         BT_DBG("hci%u", index);
2785
2786         if (len != sizeof(*cp))
2787                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
2788                                                 MGMT_STATUS_INVALID_PARAMS);
2789
2790         hdev = hci_dev_get(index);
2791         if (!hdev)
2792                 return cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
2793                                                 MGMT_STATUS_INVALID_PARAMS,
2794                                                 &cp->addr, sizeof(cp->addr));
2795
2796         hci_dev_lock(hdev);
2797
2798         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2799         if (err < 0)
2800                 status = MGMT_STATUS_FAILED;
2801         else
2802                 status = 0;
2803
2804         err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE, status,
2805                                                 &cp->addr, sizeof(cp->addr));
2806
2807         hci_dev_unlock(hdev);
2808         hci_dev_put(hdev);
2809
2810         return err;
2811 }
2812
2813 static int unblock_device(struct sock *sk, u16 index, void *data, u16 len)
2814 {
2815         struct hci_dev *hdev;
2816         struct mgmt_cp_unblock_device *cp = data;
2817         u8 status;
2818         int err;
2819
2820         BT_DBG("hci%u", index);
2821
2822         if (len != sizeof(*cp))
2823                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2824                                                 MGMT_STATUS_INVALID_PARAMS);
2825
2826         hdev = hci_dev_get(index);
2827         if (!hdev)
2828                 return cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2829                                                 MGMT_STATUS_INVALID_PARAMS,
2830                                                 &cp->addr, sizeof(cp->addr));
2831
2832         hci_dev_lock(hdev);
2833
2834         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2835         if (err < 0)
2836                 status = MGMT_STATUS_INVALID_PARAMS;
2837         else
2838                 status = 0;
2839
2840         err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE, status,
2841                                                 &cp->addr, sizeof(cp->addr));
2842
2843         hci_dev_unlock(hdev);
2844         hci_dev_put(hdev);
2845
2846         return err;
2847 }
2848
2849 static int set_fast_connectable(struct sock *sk, u16 index,
2850                                         void *data, u16 len)
2851 {
2852         struct hci_dev *hdev;
2853         struct mgmt_mode *cp = data;
2854         struct hci_cp_write_page_scan_activity acp;
2855         u8 type;
2856         int err;
2857
2858         BT_DBG("hci%u", index);
2859
2860         if (len != sizeof(*cp))
2861                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2862                                                 MGMT_STATUS_INVALID_PARAMS);
2863
2864         hdev = hci_dev_get(index);
2865         if (!hdev)
2866                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2867                                                 MGMT_STATUS_INVALID_PARAMS);
2868         if (!hdev_is_powered(hdev))
2869                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2870                                                 MGMT_STATUS_NOT_POWERED);
2871
2872         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2873                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2874                                                         MGMT_STATUS_REJECTED);
2875
2876         hci_dev_lock(hdev);
2877
2878         if (cp->val) {
2879                 type = PAGE_SCAN_TYPE_INTERLACED;
2880                 acp.interval = 0x0024;  /* 22.5 msec page scan interval */
2881         } else {
2882                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2883                 acp.interval = 0x0800;  /* default 1.28 sec page scan */
2884         }
2885
2886         acp.window = 0x0012;    /* default 11.25 msec page scan window */
2887
2888         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
2889                                                 sizeof(acp), &acp);
2890         if (err < 0) {
2891                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2892                                                         MGMT_STATUS_FAILED);
2893                 goto done;
2894         }
2895
2896         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2897         if (err < 0) {
2898                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2899                                                         MGMT_STATUS_FAILED);
2900                 goto done;
2901         }
2902
2903         err = cmd_complete(sk, index, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2904                                                                 NULL, 0);
2905 done:
2906         hci_dev_unlock(hdev);
2907         hci_dev_put(hdev);
2908
2909         return err;
2910 }
2911
2912 static int load_long_term_keys(struct sock *sk, u16 index,
2913                                         void *cp_data, u16 len)
2914 {
2915         struct hci_dev *hdev;
2916         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2917         u16 key_count, expected_len;
2918         int i;
2919
2920         if (len < sizeof(*cp))
2921                 return cmd_status(sk, index, MGMT_OP_LOAD_LONG_TERM_KEYS,
2922                                                                 EINVAL);
2923
2924         key_count = get_unaligned_le16(&cp->key_count);
2925
2926         expected_len = sizeof(*cp) + key_count *
2927                                         sizeof(struct mgmt_ltk_info);
2928         if (expected_len != len) {
2929                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2930                                                         len, expected_len);
2931                 return cmd_status(sk, index, MGMT_OP_LOAD_LONG_TERM_KEYS,
2932                                                                 EINVAL);
2933         }
2934
2935         hdev = hci_dev_get(index);
2936         if (!hdev)
2937                 return cmd_status(sk, index, MGMT_OP_LOAD_LONG_TERM_KEYS,
2938                                                                 ENODEV);
2939
2940         BT_DBG("hci%u key_count %u", index, key_count);
2941
2942         hci_dev_lock(hdev);
2943
2944         hci_smp_ltks_clear(hdev);
2945
2946         for (i = 0; i < key_count; i++) {
2947                 struct mgmt_ltk_info *key = &cp->keys[i];
2948                 u8 type;
2949
2950                 if (key->master)
2951                         type = HCI_SMP_LTK;
2952                 else
2953                         type = HCI_SMP_LTK_SLAVE;
2954
2955                 hci_add_ltk(hdev, &key->addr.bdaddr, key->addr.type,
2956                                         type, 0, key->authenticated, key->val,
2957                                         key->enc_size, key->ediv, key->rand);
2958         }
2959
2960         hci_dev_unlock(hdev);
2961         hci_dev_put(hdev);
2962
2963         return 0;
2964 }
2965
2966 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2967 {
2968         void *buf;
2969         u8 *cp;
2970         struct mgmt_hdr *hdr;
2971         u16 opcode, index, len;
2972         int err;
2973
2974         BT_DBG("got %zu bytes", msglen);
2975
2976         if (msglen < sizeof(*hdr))
2977                 return -EINVAL;
2978
2979         buf = kmalloc(msglen, GFP_KERNEL);
2980         if (!buf)
2981                 return -ENOMEM;
2982
2983         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2984                 err = -EFAULT;
2985                 goto done;
2986         }
2987
2988         hdr = buf;
2989         opcode = get_unaligned_le16(&hdr->opcode);
2990         index = get_unaligned_le16(&hdr->index);
2991         len = get_unaligned_le16(&hdr->len);
2992
2993         if (len != msglen - sizeof(*hdr)) {
2994                 err = -EINVAL;
2995                 goto done;
2996         }
2997
2998         cp = buf + sizeof(*hdr);
2999
3000         switch (opcode) {
3001         case MGMT_OP_READ_VERSION:
3002                 err = read_version(sk);
3003                 break;
3004         case MGMT_OP_READ_COMMANDS:
3005                 err = read_commands(sk);
3006                 break;
3007         case MGMT_OP_READ_INDEX_LIST:
3008                 err = read_index_list(sk);
3009                 break;
3010         case MGMT_OP_READ_INFO:
3011                 err = read_controller_info(sk, index);
3012                 break;
3013         case MGMT_OP_SET_POWERED:
3014                 err = set_powered(sk, index, cp, len);
3015                 break;
3016         case MGMT_OP_SET_DISCOVERABLE:
3017                 err = set_discoverable(sk, index, cp, len);
3018                 break;
3019         case MGMT_OP_SET_CONNECTABLE:
3020                 err = set_connectable(sk, index, cp, len);
3021                 break;
3022         case MGMT_OP_SET_FAST_CONNECTABLE:
3023                 err = set_fast_connectable(sk, index, cp, len);
3024                 break;
3025         case MGMT_OP_SET_PAIRABLE:
3026                 err = set_pairable(sk, index, cp, len);
3027                 break;
3028         case MGMT_OP_SET_LINK_SECURITY:
3029                 err = set_link_security(sk, index, cp, len);
3030                 break;
3031         case MGMT_OP_SET_SSP:
3032                 err = set_ssp(sk, index, cp, len);
3033                 break;
3034         case MGMT_OP_SET_HS:
3035                 err = set_hs(sk, index, cp, len);
3036                 break;
3037         case MGMT_OP_SET_LE:
3038                 err = set_le(sk, index, cp, len);
3039                 break;
3040         case MGMT_OP_ADD_UUID:
3041                 err = add_uuid(sk, index, cp, len);
3042                 break;
3043         case MGMT_OP_REMOVE_UUID:
3044                 err = remove_uuid(sk, index, cp, len);
3045                 break;
3046         case MGMT_OP_SET_DEV_CLASS:
3047                 err = set_dev_class(sk, index, cp, len);
3048                 break;
3049         case MGMT_OP_LOAD_LINK_KEYS:
3050                 err = load_link_keys(sk, index, cp, len);
3051                 break;
3052         case MGMT_OP_DISCONNECT:
3053                 err = disconnect(sk, index, cp, len);
3054                 break;
3055         case MGMT_OP_GET_CONNECTIONS:
3056                 err = get_connections(sk, index);
3057                 break;
3058         case MGMT_OP_PIN_CODE_REPLY:
3059                 err = pin_code_reply(sk, index, cp, len);
3060                 break;
3061         case MGMT_OP_PIN_CODE_NEG_REPLY:
3062                 err = pin_code_neg_reply(sk, index, cp, len);
3063                 break;
3064         case MGMT_OP_SET_IO_CAPABILITY:
3065                 err = set_io_capability(sk, index, cp, len);
3066                 break;
3067         case MGMT_OP_PAIR_DEVICE:
3068                 err = pair_device(sk, index, cp, len);
3069                 break;
3070         case MGMT_OP_CANCEL_PAIR_DEVICE:
3071                 err = cancel_pair_device(sk, index, buf + sizeof(*hdr), len);
3072                 break;
3073         case MGMT_OP_UNPAIR_DEVICE:
3074                 err = unpair_device(sk, index, cp, len);
3075                 break;
3076         case MGMT_OP_USER_CONFIRM_REPLY:
3077                 err = user_confirm_reply(sk, index, cp, len);
3078                 break;
3079         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
3080                 err = user_confirm_neg_reply(sk, index, cp, len);
3081                 break;
3082         case MGMT_OP_USER_PASSKEY_REPLY:
3083                 err = user_passkey_reply(sk, index, cp, len);
3084                 break;
3085         case MGMT_OP_USER_PASSKEY_NEG_REPLY:
3086                 err = user_passkey_neg_reply(sk, index, cp, len);
3087                 break;
3088         case MGMT_OP_SET_LOCAL_NAME:
3089                 err = set_local_name(sk, index, cp, len);
3090                 break;
3091         case MGMT_OP_READ_LOCAL_OOB_DATA:
3092                 err = read_local_oob_data(sk, index);
3093                 break;
3094         case MGMT_OP_ADD_REMOTE_OOB_DATA:
3095                 err = add_remote_oob_data(sk, index, cp, len);
3096                 break;
3097         case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
3098                 err = remove_remote_oob_data(sk, index, cp, len);
3099                 break;
3100         case MGMT_OP_START_DISCOVERY:
3101                 err = start_discovery(sk, index, cp, len);
3102                 break;
3103         case MGMT_OP_STOP_DISCOVERY:
3104                 err = stop_discovery(sk, index, cp, len);
3105                 break;
3106         case MGMT_OP_CONFIRM_NAME:
3107                 err = confirm_name(sk, index, cp, len);
3108                 break;
3109         case MGMT_OP_BLOCK_DEVICE:
3110                 err = block_device(sk, index, cp, len);
3111                 break;
3112         case MGMT_OP_UNBLOCK_DEVICE:
3113                 err = unblock_device(sk, index, cp, len);
3114                 break;
3115         case MGMT_OP_LOAD_LONG_TERM_KEYS:
3116                 err = load_long_term_keys(sk, index, cp, len);
3117                 break;
3118         default:
3119                 BT_DBG("Unknown op %u", opcode);
3120                 err = cmd_status(sk, index, opcode,
3121                                                 MGMT_STATUS_UNKNOWN_COMMAND);
3122                 break;
3123         }
3124
3125         if (err < 0)
3126                 goto done;
3127
3128         err = msglen;
3129
3130 done:
3131         kfree(buf);
3132         return err;
3133 }
3134
3135 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
3136 {
3137         u8 *status = data;
3138
3139         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
3140         mgmt_pending_remove(cmd);
3141 }
3142
3143 int mgmt_index_added(struct hci_dev *hdev)
3144 {
3145         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3146 }
3147
3148 int mgmt_index_removed(struct hci_dev *hdev)
3149 {
3150         u8 status = ENODEV;
3151
3152         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3153
3154         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3155 }
3156
3157 struct cmd_lookup {
3158         struct sock *sk;
3159         struct hci_dev *hdev;
3160         u8 mgmt_status;
3161 };
3162
3163 static void settings_rsp(struct pending_cmd *cmd, void *data)
3164 {
3165         struct cmd_lookup *match = data;
3166
3167         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
3168
3169         list_del(&cmd->list);
3170
3171         if (match->sk == NULL) {
3172                 match->sk = cmd->sk;
3173                 sock_hold(match->sk);
3174         }
3175
3176         mgmt_pending_free(cmd);
3177 }
3178
3179 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3180 {
3181         struct cmd_lookup match = { NULL, hdev };
3182         int err;
3183
3184         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3185                 return 0;
3186
3187         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3188
3189         if (powered) {
3190                 u8 scan = 0;
3191
3192                 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3193                         scan |= SCAN_PAGE;
3194                 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3195                         scan |= SCAN_INQUIRY;
3196
3197                 if (scan)
3198                         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3199
3200                 update_class(hdev);
3201                 update_eir(hdev);
3202         } else {
3203                 u8 status = ENETDOWN;
3204                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3205         }
3206
3207         err = new_settings(hdev, match.sk);
3208
3209         if (match.sk)
3210                 sock_put(match.sk);
3211
3212         return err;
3213 }
3214
3215 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3216 {
3217         struct cmd_lookup match = { NULL, hdev };
3218         bool changed = false;
3219         int err = 0;
3220
3221         if (discoverable) {
3222                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3223                         changed = true;
3224         } else {
3225                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3226                         changed = true;
3227         }
3228
3229         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3230                                                                 &match);
3231
3232         if (changed)
3233                 err = new_settings(hdev, match.sk);
3234
3235         if (match.sk)
3236                 sock_put(match.sk);
3237
3238         return err;
3239 }
3240
3241 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3242 {
3243         struct cmd_lookup match = { NULL, hdev };
3244         bool changed = false;
3245         int err = 0;
3246
3247         if (connectable) {
3248                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3249                         changed = true;
3250         } else {
3251                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3252                         changed = true;
3253         }
3254
3255         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
3256                                                                 &match);
3257
3258         if (changed)
3259                 err = new_settings(hdev, match.sk);
3260
3261         if (match.sk)
3262                 sock_put(match.sk);
3263
3264         return err;
3265 }
3266
3267 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3268 {
3269         u8 mgmt_err = mgmt_status(status);
3270
3271         if (scan & SCAN_PAGE)
3272                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3273                                                 cmd_status_rsp, &mgmt_err);
3274
3275         if (scan & SCAN_INQUIRY)
3276                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3277                                                 cmd_status_rsp, &mgmt_err);
3278
3279         return 0;
3280 }
3281
3282 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3283                                                                 u8 persistent)
3284 {
3285         struct mgmt_ev_new_link_key ev;
3286
3287         memset(&ev, 0, sizeof(ev));
3288
3289         ev.store_hint = persistent;
3290         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3291         ev.key.addr.type = MGMT_ADDR_BREDR;
3292         ev.key.type = key->type;
3293         memcpy(ev.key.val, key->val, 16);
3294         ev.key.pin_len = key->pin_len;
3295
3296         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3297 }
3298
3299 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3300 {
3301         struct mgmt_ev_new_long_term_key ev;
3302
3303         memset(&ev, 0, sizeof(ev));
3304
3305         ev.store_hint = persistent;
3306         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3307         ev.key.addr.type = key->bdaddr_type;
3308         ev.key.authenticated = key->authenticated;
3309         ev.key.enc_size = key->enc_size;
3310         ev.key.ediv = key->ediv;
3311
3312         if (key->type == HCI_SMP_LTK)
3313                 ev.key.master = 1;
3314
3315         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3316         memcpy(ev.key.val, key->val, sizeof(key->val));
3317
3318         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev,
3319                                                 &ev, sizeof(ev), NULL);
3320 }
3321
3322 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3323                                         u8 addr_type, u32 flags, u8 *name,
3324                                         u8 name_len, u8 *dev_class)
3325 {
3326         char buf[512];
3327         struct mgmt_ev_device_connected *ev = (void *) buf;
3328         u16 eir_len = 0;
3329
3330         bacpy(&ev->addr.bdaddr, bdaddr);
3331         ev->addr.type = link_to_mgmt(link_type, addr_type);
3332
3333         ev->flags = __cpu_to_le32(flags);
3334
3335         if (name_len > 0)
3336                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3337                                                                 name, name_len);
3338
3339         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3340                 eir_len = eir_append_data(&ev->eir[eir_len], eir_len,
3341                                         EIR_CLASS_OF_DEV, dev_class, 3);
3342
3343         put_unaligned_le16(eir_len, &ev->eir_len);
3344
3345         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3346                                                 sizeof(*ev) + eir_len, NULL);
3347 }
3348
3349 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3350 {
3351         struct mgmt_cp_disconnect *cp = cmd->param;
3352         struct sock **sk = data;
3353         struct mgmt_rp_disconnect rp;
3354
3355         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3356         rp.addr.type = cp->addr.type;
3357
3358         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3359                                                                 sizeof(rp));
3360
3361         *sk = cmd->sk;
3362         sock_hold(*sk);
3363
3364         mgmt_pending_remove(cmd);
3365 }
3366
3367 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3368 {
3369         struct hci_dev *hdev = data;
3370         struct mgmt_cp_unpair_device *cp = cmd->param;
3371         struct mgmt_rp_unpair_device rp;
3372
3373         memset(&rp, 0, sizeof(rp));
3374         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3375         rp.addr.type = cp->addr.type;
3376
3377         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3378
3379         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3380
3381         mgmt_pending_remove(cmd);
3382 }
3383
3384 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3385                                                 u8 link_type, u8 addr_type)
3386 {
3387         struct mgmt_addr_info ev;
3388         struct sock *sk = NULL;
3389         int err;
3390
3391         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3392
3393         bacpy(&ev.bdaddr, bdaddr);
3394         ev.type = link_to_mgmt(link_type, addr_type);
3395
3396         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3397                                                                         sk);
3398
3399         if (sk)
3400                 sock_put(sk);
3401
3402         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3403                                                                         hdev);
3404
3405         return err;
3406 }
3407
3408 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3409                                         u8 link_type, u8 addr_type, u8 status)
3410 {
3411         struct mgmt_rp_disconnect rp;
3412         struct pending_cmd *cmd;
3413         int err;
3414
3415         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3416         if (!cmd)
3417                 return -ENOENT;
3418
3419         bacpy(&rp.addr.bdaddr, bdaddr);
3420         rp.addr.type = link_to_mgmt(link_type, addr_type);
3421
3422         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3423                                         mgmt_status(status), &rp, sizeof(rp));
3424
3425         mgmt_pending_remove(cmd);
3426
3427         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3428                                                                         hdev);
3429         return err;
3430 }
3431
3432 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3433                                                 u8 addr_type, u8 status)
3434 {
3435         struct mgmt_ev_connect_failed ev;
3436
3437         bacpy(&ev.addr.bdaddr, bdaddr);
3438         ev.addr.type = link_to_mgmt(link_type, addr_type);
3439         ev.status = mgmt_status(status);
3440
3441         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3442 }
3443
3444 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3445 {
3446         struct mgmt_ev_pin_code_request ev;
3447
3448         bacpy(&ev.addr.bdaddr, bdaddr);
3449         ev.addr.type = MGMT_ADDR_BREDR;
3450         ev.secure = secure;
3451
3452         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3453                                                                         NULL);
3454 }
3455
3456 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3457                                                                 u8 status)
3458 {
3459         struct pending_cmd *cmd;
3460         struct mgmt_rp_pin_code_reply rp;
3461         int err;
3462
3463         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3464         if (!cmd)
3465                 return -ENOENT;
3466
3467         bacpy(&rp.addr.bdaddr, bdaddr);
3468         rp.addr.type = MGMT_ADDR_BREDR;
3469
3470         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3471                                         mgmt_status(status), &rp, sizeof(rp));
3472
3473         mgmt_pending_remove(cmd);
3474
3475         return err;
3476 }
3477
3478 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3479                                                                 u8 status)
3480 {
3481         struct pending_cmd *cmd;
3482         struct mgmt_rp_pin_code_reply rp;
3483         int err;
3484
3485         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3486         if (!cmd)
3487                 return -ENOENT;
3488
3489         bacpy(&rp.addr.bdaddr, bdaddr);
3490         rp.addr.type = MGMT_ADDR_BREDR;
3491
3492         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3493                                         mgmt_status(status), &rp, sizeof(rp));
3494
3495         mgmt_pending_remove(cmd);
3496
3497         return err;
3498 }
3499
3500 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3501                                 u8 link_type, u8 addr_type, __le32 value,
3502                                 u8 confirm_hint)
3503 {
3504         struct mgmt_ev_user_confirm_request ev;
3505
3506         BT_DBG("%s", hdev->name);
3507
3508         bacpy(&ev.addr.bdaddr, bdaddr);
3509         ev.addr.type = link_to_mgmt(link_type, addr_type);
3510         ev.confirm_hint = confirm_hint;
3511         put_unaligned_le32(value, &ev.value);
3512
3513         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3514                                                                         NULL);
3515 }
3516
3517 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3518                                                 u8 link_type, u8 addr_type)
3519 {
3520         struct mgmt_ev_user_passkey_request ev;
3521
3522         BT_DBG("%s", hdev->name);
3523
3524         bacpy(&ev.addr.bdaddr, bdaddr);
3525         ev.addr.type = link_to_mgmt(link_type, addr_type);
3526
3527         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3528                                                                         NULL);
3529 }
3530
3531 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3532                                         u8 link_type, u8 addr_type, u8 status,
3533                                         u8 opcode)
3534 {
3535         struct pending_cmd *cmd;
3536         struct mgmt_rp_user_confirm_reply rp;
3537         int err;
3538
3539         cmd = mgmt_pending_find(opcode, hdev);
3540         if (!cmd)
3541                 return -ENOENT;
3542
3543         bacpy(&rp.addr.bdaddr, bdaddr);
3544         rp.addr.type = link_to_mgmt(link_type, addr_type);
3545         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3546                                                         &rp, sizeof(rp));
3547
3548         mgmt_pending_remove(cmd);
3549
3550         return err;
3551 }
3552
3553 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3554                                         u8 link_type, u8 addr_type, u8 status)
3555 {
3556         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3557                                         status, MGMT_OP_USER_CONFIRM_REPLY);
3558 }
3559
3560 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3561                                         u8 link_type, u8 addr_type, u8 status)
3562 {
3563         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3564                                         status, MGMT_OP_USER_CONFIRM_NEG_REPLY);
3565 }
3566
3567 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3568                                         u8 link_type, u8 addr_type, u8 status)
3569 {
3570         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3571                                         status, MGMT_OP_USER_PASSKEY_REPLY);
3572 }
3573
3574 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3575                                         u8 link_type, u8 addr_type, u8 status)
3576 {
3577         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3578                                         status, MGMT_OP_USER_PASSKEY_NEG_REPLY);
3579 }
3580
3581 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3582                                                 u8 addr_type, u8 status)
3583 {
3584         struct mgmt_ev_auth_failed ev;
3585
3586         bacpy(&ev.addr.bdaddr, bdaddr);
3587         ev.addr.type = link_to_mgmt(link_type, addr_type);
3588         ev.status = mgmt_status(status);
3589
3590         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3591 }
3592
3593 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3594 {
3595         struct cmd_lookup match = { NULL, hdev };
3596         bool changed = false;
3597         int err = 0;
3598
3599         if (status) {
3600                 u8 mgmt_err = mgmt_status(status);
3601                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3602                                                 cmd_status_rsp, &mgmt_err);
3603                 return 0;
3604         }
3605
3606         if (test_bit(HCI_AUTH, &hdev->flags)) {
3607                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3608                         changed = true;
3609         } else {
3610                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3611                         changed = true;
3612         }
3613
3614         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3615                                                                 &match);
3616
3617         if (changed)
3618                 err = new_settings(hdev, match.sk);
3619
3620         if (match.sk)
3621                 sock_put(match.sk);
3622
3623         return err;
3624 }
3625
3626 static int clear_eir(struct hci_dev *hdev)
3627 {
3628         struct hci_cp_write_eir cp;
3629
3630         if (!(hdev->features[6] & LMP_EXT_INQ))
3631                 return 0;
3632
3633         memset(hdev->eir, 0, sizeof(hdev->eir));
3634
3635         memset(&cp, 0, sizeof(cp));
3636
3637         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3638 }
3639
3640 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3641 {
3642         struct cmd_lookup match = { NULL, hdev };
3643         bool changed = false;
3644         int err = 0;
3645
3646         if (status) {
3647                 u8 mgmt_err = mgmt_status(status);
3648
3649                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3650                                                         &hdev->dev_flags))
3651                         err = new_settings(hdev, NULL);
3652
3653                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev,
3654                                                 cmd_status_rsp, &mgmt_err);
3655
3656                 return err;
3657         }
3658
3659         if (enable) {
3660                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3661                         changed = true;
3662         } else {
3663                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3664                         changed = true;
3665         }
3666
3667         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3668
3669         if (changed)
3670                 err = new_settings(hdev, match.sk);
3671
3672         if (match.sk)
3673                 sock_put(match.sk);
3674
3675         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3676                 update_eir(hdev);
3677         else
3678                 clear_eir(hdev);
3679
3680         return err;
3681 }
3682
3683 static void class_rsp(struct pending_cmd *cmd, void *data)
3684 {
3685         struct cmd_lookup *match = data;
3686
3687         cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3688                                                 match->hdev->dev_class, 3);
3689
3690         list_del(&cmd->list);
3691
3692         if (match->sk == NULL) {
3693                 match->sk = cmd->sk;
3694                 sock_hold(match->sk);
3695         }
3696
3697         mgmt_pending_free(cmd);
3698 }
3699
3700 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3701                                                                 u8 status)
3702 {
3703         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3704         int err = 0;
3705
3706         clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3707
3708         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3709         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3710         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3711
3712         if (!status)
3713                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3714                                                         dev_class, 3, NULL);
3715
3716         if (match.sk)
3717                 sock_put(match.sk);
3718
3719         return err;
3720 }
3721
3722 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3723 {
3724         struct pending_cmd *cmd;
3725         struct mgmt_cp_set_local_name ev;
3726         bool changed = false;
3727         int err = 0;
3728
3729         if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3730                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3731                 changed = true;
3732         }
3733
3734         memset(&ev, 0, sizeof(ev));
3735         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3736         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3737
3738         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3739         if (!cmd)
3740                 goto send_event;
3741
3742         /* Always assume that either the short or the complete name has
3743          * changed if there was a pending mgmt command */
3744         changed = true;
3745
3746         if (status) {
3747                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3748                                                         mgmt_status(status));
3749                 goto failed;
3750         }
3751
3752         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3753                                                                 sizeof(ev));
3754         if (err < 0)
3755                 goto failed;
3756
3757 send_event:
3758         if (changed)
3759                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3760                                         sizeof(ev), cmd ? cmd->sk : NULL);
3761
3762         update_eir(hdev);
3763
3764 failed:
3765         if (cmd)
3766                 mgmt_pending_remove(cmd);
3767         return err;
3768 }
3769
3770 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3771                                                 u8 *randomizer, u8 status)
3772 {
3773         struct pending_cmd *cmd;
3774         int err;
3775
3776         BT_DBG("%s status %u", hdev->name, status);
3777
3778         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3779         if (!cmd)
3780                 return -ENOENT;
3781
3782         if (status) {
3783                 err = cmd_status(cmd->sk, hdev->id,
3784                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
3785                                                 mgmt_status(status));
3786         } else {
3787                 struct mgmt_rp_read_local_oob_data rp;
3788
3789                 memcpy(rp.hash, hash, sizeof(rp.hash));
3790                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3791
3792                 err = cmd_complete(cmd->sk, hdev->id,
3793                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
3794                                                 0, &rp, sizeof(rp));
3795         }
3796
3797         mgmt_pending_remove(cmd);
3798
3799         return err;
3800 }
3801
3802 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3803 {
3804         struct cmd_lookup match = { NULL, hdev };
3805         bool changed = false;
3806         int err = 0;
3807
3808         if (status) {
3809                 u8 mgmt_err = mgmt_status(status);
3810
3811                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3812                                                         &hdev->dev_flags))
3813                         err = new_settings(hdev, NULL);
3814
3815                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev,
3816                                                 cmd_status_rsp, &mgmt_err);
3817
3818                 return err;
3819         }
3820
3821         if (enable) {
3822                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3823                         changed = true;
3824         } else {
3825                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3826                         changed = true;
3827         }
3828
3829         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3830
3831         if (changed)
3832                 err = new_settings(hdev, match.sk);
3833
3834         if (match.sk)
3835                 sock_put(match.sk);
3836
3837         return err;
3838 }
3839
3840 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3841                                 u8 addr_type, u8 *dev_class, s8 rssi,
3842                                 u8 cfm_name, u8 ssp, u8 *eir, u16 eir_len)
3843 {
3844         char buf[512];
3845         struct mgmt_ev_device_found *ev = (void *) buf;
3846         size_t ev_size;
3847
3848         /* Leave 5 bytes for a potential CoD field */
3849         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3850                 return -EINVAL;
3851
3852         memset(buf, 0, sizeof(buf));
3853
3854         bacpy(&ev->addr.bdaddr, bdaddr);
3855         ev->addr.type = link_to_mgmt(link_type, addr_type);
3856         ev->rssi = rssi;
3857         if (cfm_name)
3858                 ev->flags[0] |= MGMT_DEV_FOUND_CONFIRM_NAME;
3859         if (!ssp)
3860                 ev->flags[0] |= MGMT_DEV_FOUND_LEGACY_PAIRING;
3861
3862         if (eir_len > 0)
3863                 memcpy(ev->eir, eir, eir_len);
3864
3865         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3866                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3867                                                                 dev_class, 3);
3868
3869         put_unaligned_le16(eir_len, &ev->eir_len);
3870
3871         ev_size = sizeof(*ev) + eir_len;
3872
3873         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3874 }
3875
3876 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3877                                 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3878 {
3879         struct mgmt_ev_device_found *ev;
3880         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3881         u16 eir_len;
3882
3883         ev = (struct mgmt_ev_device_found *) buf;
3884
3885         memset(buf, 0, sizeof(buf));
3886
3887         bacpy(&ev->addr.bdaddr, bdaddr);
3888         ev->addr.type = link_to_mgmt(link_type, addr_type);
3889         ev->rssi = rssi;
3890
3891         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3892                                                                 name_len);
3893
3894         put_unaligned_le16(eir_len, &ev->eir_len);
3895
3896         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3897                                                 sizeof(*ev) + eir_len, NULL);
3898 }
3899
3900 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3901 {
3902         struct pending_cmd *cmd;
3903         u8 type;
3904         int err;
3905
3906         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3907
3908         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3909         if (!cmd)
3910                 return -ENOENT;
3911
3912         type = hdev->discovery.type;
3913
3914         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3915                                                         &type, sizeof(type));
3916         mgmt_pending_remove(cmd);
3917
3918         return err;
3919 }
3920
3921 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3922 {
3923         struct pending_cmd *cmd;
3924         int err;
3925
3926         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3927         if (!cmd)
3928                 return -ENOENT;
3929
3930         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3931                                                 &hdev->discovery.type,
3932                                                 sizeof(hdev->discovery.type));
3933         mgmt_pending_remove(cmd);
3934
3935         return err;
3936 }
3937
3938 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3939 {
3940         struct mgmt_ev_discovering ev;
3941         struct pending_cmd *cmd;
3942
3943         BT_DBG("%s discovering %u", hdev->name, discovering);
3944
3945         if (discovering)
3946                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3947         else
3948                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3949
3950         if (cmd != NULL) {
3951                 u8 type = hdev->discovery.type;
3952
3953                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0,
3954                                                         &type, sizeof(type));
3955                 mgmt_pending_remove(cmd);
3956         }
3957
3958         memset(&ev, 0, sizeof(ev));
3959         ev.type = hdev->discovery.type;
3960         ev.discovering = discovering;
3961
3962         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3963 }
3964
3965 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3966 {
3967         struct pending_cmd *cmd;
3968         struct mgmt_ev_device_blocked ev;
3969
3970         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3971
3972         bacpy(&ev.addr.bdaddr, bdaddr);
3973         ev.addr.type = type;
3974
3975         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3976                                                         cmd ? cmd->sk : NULL);
3977 }
3978
3979 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3980 {
3981         struct pending_cmd *cmd;
3982         struct mgmt_ev_device_unblocked ev;
3983
3984         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3985
3986         bacpy(&ev.addr.bdaddr, bdaddr);
3987         ev.addr.type = type;
3988
3989         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3990                                                         cmd ? cmd->sk : NULL);
3991 }
3992
3993 module_param(enable_hs, bool, 0644);
3994 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");
3995
3996 module_param(enable_le, bool, 0644);
3997 MODULE_PARM_DESC(enable_le, "Enable Low Energy support");