net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   2
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 /*
 106  * These LE scan and inquiry parameters were chosen according to LE General
 107  * Discovery Procedure specification.
 108  */
 109 #define LE_SCAN_TYPE                    0x01
 110 #define LE_SCAN_WIN                     0x12
 111 #define LE_SCAN_INT                     0x12
 112 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 113 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 114
 115 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 116 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 117
 118 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 119
 120 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 121                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 122
 123 struct pending_cmd {
 124         struct list_head list;
 125         u16 opcode;
 126         int index;
 127         void *param;
 128         struct sock *sk;
 129         void *user_data;
 130 };
 131
 132 /* HCI to MGMT error code conversion table */
 133 static u8 mgmt_status_table[] = {
 134         MGMT_STATUS_SUCCESS,
 135         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 136         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 137         MGMT_STATUS_FAILED,             /* Hardware Failure */
 138         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 139         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 140         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 141         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 142         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 145         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 146         MGMT_STATUS_BUSY,               /* Command Disallowed */
 147         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 148         MGMT_STATUS_REJECTED,           /* Rejected Security */
 149         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 150         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 151         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 153         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 154         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 155         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 156         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 157         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 158         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 159         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 161         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 162         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 163         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 165         MGMT_STATUS_FAILED,             /* Unspecified Error */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 167         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 168         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 169         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 170         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 171         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 172         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 174         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 176         MGMT_STATUS_FAILED,             /* Transaction Collision */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 178         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 180         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 181         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 182         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 183         MGMT_STATUS_FAILED,             /* Slot Violation */
 184         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 185         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 187         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 188         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 189         MGMT_STATUS_BUSY,               /* Controller Busy */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 191         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 192         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 193         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 194         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 195 };
 196
 197 bool mgmt_valid_hdev(struct hci_dev *hdev)
 198 {
 199         return hdev->dev_type == HCI_BREDR;
 200 }
 201
 202 static u8 mgmt_status(u8 hci_status)
 203 {
 204         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 205                 return mgmt_status_table[hci_status];
 206
 207         return MGMT_STATUS_FAILED;
 208 }
 209
 210 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 211 {
 212         struct sk_buff *skb;
 213         struct mgmt_hdr *hdr;
 214         struct mgmt_ev_cmd_status *ev;
 215         int err;
 216
 217         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 218
 219         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 220         if (!skb)
 221                 return -ENOMEM;
 222
 223         hdr = (void *) skb_put(skb, sizeof(*hdr));
 224
 225         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 226         hdr->index = cpu_to_le16(index);
 227         hdr->len = cpu_to_le16(sizeof(*ev));
 228
 229         ev = (void *) skb_put(skb, sizeof(*ev));
 230         ev->status = status;
 231         ev->opcode = cpu_to_le16(cmd);
 232
 233         err = sock_queue_rcv_skb(sk, skb);
 234         if (err < 0)
 235                 kfree_skb(skb);
 236
 237         return err;
 238 }
 239
 240 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 241                         void *rp, size_t rp_len)
 242 {
 243         struct sk_buff *skb;
 244         struct mgmt_hdr *hdr;
 245         struct mgmt_ev_cmd_complete *ev;
 246         int err;
 247
 248         BT_DBG("sock %p", sk);
 249
 250         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 251         if (!skb)
 252                 return -ENOMEM;
 253
 254         hdr = (void *) skb_put(skb, sizeof(*hdr));
 255
 256         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 257         hdr->index = cpu_to_le16(index);
 258         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 259
 260         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 261         ev->opcode = cpu_to_le16(cmd);
 262         ev->status = status;
 263
 264         if (rp)
 265                 memcpy(ev->data, rp, rp_len);
 266
 267         err = sock_queue_rcv_skb(sk, skb);
 268         if (err < 0)
 269                 kfree_skb(skb);
 270
 271         return err;
 272 }
 273
 274 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 275                         u16 data_len)
 276 {
 277         struct mgmt_rp_read_version rp;
 278
 279         BT_DBG("sock %p", sk);
 280
 281         rp.version = MGMT_VERSION;
 282         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 283
 284         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 285                             sizeof(rp));
 286 }
 287
 288 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 289                          u16 data_len)
 290 {
 291         struct mgmt_rp_read_commands *rp;
 292         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 293         const u16 num_events = ARRAY_SIZE(mgmt_events);
 294         __le16 *opcode;
 295         size_t rp_size;
 296         int i, err;
 297
 298         BT_DBG("sock %p", sk);
 299
 300         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 301
 302         rp = kmalloc(rp_size, GFP_KERNEL);
 303         if (!rp)
 304                 return -ENOMEM;
 305
 306         rp->num_commands = __constant_cpu_to_le16(num_commands);
 307         rp->num_events = __constant_cpu_to_le16(num_events);
 308
 309         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 310                 put_unaligned_le16(mgmt_commands[i], opcode);
 311
 312         for (i = 0; i < num_events; i++, opcode++)
 313                 put_unaligned_le16(mgmt_events[i], opcode);
 314
 315         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 316                            rp_size);
 317         kfree(rp);
 318
 319         return err;
 320 }
 321
 322 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 323                            u16 data_len)
 324 {
 325         struct mgmt_rp_read_index_list *rp;
 326         struct hci_dev *d;
 327         size_t rp_len;
 328         u16 count;
 329         int err;
 330
 331         BT_DBG("sock %p", sk);
 332
 333         read_lock(&hci_dev_list_lock);
 334
 335         count = 0;
 336         list_for_each_entry(d, &hci_dev_list, list) {
 337                 if (!mgmt_valid_hdev(d))
 338                         continue;
 339
 340                 count++;
 341         }
 342
 343         rp_len = sizeof(*rp) + (2 * count);
 344         rp = kmalloc(rp_len, GFP_ATOMIC);
 345         if (!rp) {
 346                 read_unlock(&hci_dev_list_lock);
 347                 return -ENOMEM;
 348         }
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (test_bit(HCI_SETUP, &d->dev_flags))
 353                         continue;
 354
 355                 if (!mgmt_valid_hdev(d))
 356                         continue;
 357
 358                 rp->index[count++] = cpu_to_le16(d->id);
 359                 BT_DBG("Added hci%u", d->id);
 360         }
 361
 362         rp->num_controllers = cpu_to_le16(count);
 363         rp_len = sizeof(*rp) + (2 * count);
 364
 365         read_unlock(&hci_dev_list_lock);
 366
 367         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 368                            rp_len);
 369
 370         kfree(rp);
 371
 372         return err;
 373 }
 374
 375 static u32 get_supported_settings(struct hci_dev *hdev)
 376 {
 377         u32 settings = 0;
 378
 379         settings |= MGMT_SETTING_POWERED;
 380         settings |= MGMT_SETTING_PAIRABLE;
 381
 382         if (lmp_ssp_capable(hdev))
 383                 settings |= MGMT_SETTING_SSP;
 384
 385         if (lmp_bredr_capable(hdev)) {
 386                 settings |= MGMT_SETTING_CONNECTABLE;
 387                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 388                 settings |= MGMT_SETTING_DISCOVERABLE;
 389                 settings |= MGMT_SETTING_BREDR;
 390                 settings |= MGMT_SETTING_LINK_SECURITY;
 391         }
 392
 393         if (enable_hs)
 394                 settings |= MGMT_SETTING_HS;
 395
 396         if (lmp_le_capable(hdev))
 397                 settings |= MGMT_SETTING_LE;
 398
 399         return settings;
 400 }
 401
 402 static u32 get_current_settings(struct hci_dev *hdev)
 403 {
 404         u32 settings = 0;
 405
 406         if (hdev_is_powered(hdev))
 407                 settings |= MGMT_SETTING_POWERED;
 408
 409         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 410                 settings |= MGMT_SETTING_CONNECTABLE;
 411
 412         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 413                 settings |= MGMT_SETTING_DISCOVERABLE;
 414
 415         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 416                 settings |= MGMT_SETTING_PAIRABLE;
 417
 418         if (lmp_bredr_capable(hdev))
 419                 settings |= MGMT_SETTING_BREDR;
 420
 421         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 422                 settings |= MGMT_SETTING_LE;
 423
 424         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 425                 settings |= MGMT_SETTING_LINK_SECURITY;
 426
 427         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 428                 settings |= MGMT_SETTING_SSP;
 429
 430         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 431                 settings |= MGMT_SETTING_HS;
 432
 433         return settings;
 434 }
 435
 436 #define PNP_INFO_SVCLASS_ID             0x1200
 437
 438 static u8 bluetooth_base_uuid[] = {
 439                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 440                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 441 };
 442
 443 static u16 get_uuid16(u8 *uuid128)
 444 {
 445         u32 val;
 446         int i;
 447
 448         for (i = 0; i < 12; i++) {
 449                 if (bluetooth_base_uuid[i] != uuid128[i])
 450                         return 0;
 451         }
 452
 453         val = get_unaligned_le32(&uuid128[12]);
 454         if (val > 0xffff)
 455                 return 0;
 456
 457         return (u16) val;
 458 }
 459
 460 static void create_eir(struct hci_dev *hdev, u8 *data)
 461 {
 462         u8 *ptr = data;
 463         u16 eir_len = 0;
 464         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 465         int i, truncated = 0;
 466         struct bt_uuid *uuid;
 467         size_t name_len;
 468
 469         name_len = strlen(hdev->dev_name);
 470
 471         if (name_len > 0) {
 472                 /* EIR Data type */
 473                 if (name_len > 48) {
 474                         name_len = 48;
 475                         ptr[1] = EIR_NAME_SHORT;
 476                 } else
 477                         ptr[1] = EIR_NAME_COMPLETE;
 478
 479                 /* EIR Data length */
 480                 ptr[0] = name_len + 1;
 481
 482                 memcpy(ptr + 2, hdev->dev_name, name_len);
 483
 484                 eir_len += (name_len + 2);
 485                 ptr += (name_len + 2);
 486         }
 487
 488         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 489                 ptr[0] = 2;
 490                 ptr[1] = EIR_TX_POWER;
 491                 ptr[2] = (u8) hdev->inq_tx_power;
 492
 493                 eir_len += 3;
 494                 ptr += 3;
 495         }
 496
 497         if (hdev->devid_source > 0) {
 498                 ptr[0] = 9;
 499                 ptr[1] = EIR_DEVICE_ID;
 500
 501                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 502                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 503                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 504                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 505
 506                 eir_len += 10;
 507                 ptr += 10;
 508         }
 509
 510         memset(uuid16_list, 0, sizeof(uuid16_list));
 511
 512         /* Group all UUID16 types */
 513         list_for_each_entry(uuid, &hdev->uuids, list) {
 514                 u16 uuid16;
 515
 516                 uuid16 = get_uuid16(uuid->uuid);
 517                 if (uuid16 == 0)
 518                         return;
 519
 520                 if (uuid16 < 0x1100)
 521                         continue;
 522
 523                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 524                         continue;
 525
 526                 /* Stop if not enough space to put next UUID */
 527                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 528                         truncated = 1;
 529                         break;
 530                 }
 531
 532                 /* Check for duplicates */
 533                 for (i = 0; uuid16_list[i] != 0; i++)
 534                         if (uuid16_list[i] == uuid16)
 535                                 break;
 536
 537                 if (uuid16_list[i] == 0) {
 538                         uuid16_list[i] = uuid16;
 539                         eir_len += sizeof(u16);
 540                 }
 541         }
 542
 543         if (uuid16_list[0] != 0) {
 544                 u8 *length = ptr;
 545
 546                 /* EIR Data type */
 547                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 548
 549                 ptr += 2;
 550                 eir_len += 2;
 551
 552                 for (i = 0; uuid16_list[i] != 0; i++) {
 553                         *ptr++ = (uuid16_list[i] & 0x00ff);
 554                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 555                 }
 556
 557                 /* EIR Data length */
 558                 *length = (i * sizeof(u16)) + 1;
 559         }
 560 }
 561
 562 static int update_eir(struct hci_dev *hdev)
 563 {
 564         struct hci_cp_write_eir cp;
 565
 566         if (!hdev_is_powered(hdev))
 567                 return 0;
 568
 569         if (!lmp_ext_inq_capable(hdev))
 570                 return 0;
 571
 572         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 573                 return 0;
 574
 575         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 576                 return 0;
 577
 578         memset(&cp, 0, sizeof(cp));
 579
 580         create_eir(hdev, cp.data);
 581
 582         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 583                 return 0;
 584
 585         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 586
 587         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 588 }
 589
 590 static u8 get_service_classes(struct hci_dev *hdev)
 591 {
 592         struct bt_uuid *uuid;
 593         u8 val = 0;
 594
 595         list_for_each_entry(uuid, &hdev->uuids, list)
 596                 val |= uuid->svc_hint;
 597
 598         return val;
 599 }
 600
 601 static int update_class(struct hci_dev *hdev)
 602 {
 603         u8 cod[3];
 604         int err;
 605
 606         BT_DBG("%s", hdev->name);
 607
 608         if (!hdev_is_powered(hdev))
 609                 return 0;
 610
 611         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 612                 return 0;
 613
 614         cod[0] = hdev->minor_class;
 615         cod[1] = hdev->major_class;
 616         cod[2] = get_service_classes(hdev);
 617
 618         if (memcmp(cod, hdev->dev_class, 3) == 0)
 619                 return 0;
 620
 621         err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 622         if (err == 0)
 623                 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
 624
 625         return err;
 626 }
 627
 628 static void service_cache_off(struct work_struct *work)
 629 {
 630         struct hci_dev *hdev = container_of(work, struct hci_dev,
 631                                             service_cache.work);
 632
 633         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 634                 return;
 635
 636         hci_dev_lock(hdev);
 637
 638         update_eir(hdev);
 639         update_class(hdev);
 640
 641         hci_dev_unlock(hdev);
 642 }
 643
 644 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 645 {
 646         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 647                 return;
 648
 649         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 650
 651         /* Non-mgmt controlled devices get this bit set
 652          * implicitly so that pairing works for them, however
 653          * for mgmt we require user-space to explicitly enable
 654          * it
 655          */
 656         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 657 }
 658
 659 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 660                                 void *data, u16 data_len)
 661 {
 662         struct mgmt_rp_read_info rp;
 663
 664         BT_DBG("sock %p %s", sk, hdev->name);
 665
 666         hci_dev_lock(hdev);
 667
 668         memset(&rp, 0, sizeof(rp));
 669
 670         bacpy(&rp.bdaddr, &hdev->bdaddr);
 671
 672         rp.version = hdev->hci_ver;
 673         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 674
 675         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 676         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 677
 678         memcpy(rp.dev_class, hdev->dev_class, 3);
 679
 680         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 681         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 682
 683         hci_dev_unlock(hdev);
 684
 685         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 686                             sizeof(rp));
 687 }
 688
 689 static void mgmt_pending_free(struct pending_cmd *cmd)
 690 {
 691         sock_put(cmd->sk);
 692         kfree(cmd->param);
 693         kfree(cmd);
 694 }
 695
 696 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 697                                             struct hci_dev *hdev, void *data,
 698                                             u16 len)
 699 {
 700         struct pending_cmd *cmd;
 701
 702         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 703         if (!cmd)
 704                 return NULL;
 705
 706         cmd->opcode = opcode;
 707         cmd->index = hdev->id;
 708
 709         cmd->param = kmalloc(len, GFP_KERNEL);
 710         if (!cmd->param) {
 711                 kfree(cmd);
 712                 return NULL;
 713         }
 714
 715         if (data)
 716                 memcpy(cmd->param, data, len);
 717
 718         cmd->sk = sk;
 719         sock_hold(sk);
 720
 721         list_add(&cmd->list, &hdev->mgmt_pending);
 722
 723         return cmd;
 724 }
 725
 726 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 727                                  void (*cb)(struct pending_cmd *cmd,
 728                                             void *data),
 729                                  void *data)
 730 {
 731         struct list_head *p, *n;
 732
 733         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 734                 struct pending_cmd *cmd;
 735
 736                 cmd = list_entry(p, struct pending_cmd, list);
 737
 738                 if (opcode > 0 && cmd->opcode != opcode)
 739                         continue;
 740
 741                 cb(cmd, data);
 742         }
 743 }
 744
 745 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 746 {
 747         struct pending_cmd *cmd;
 748
 749         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 750                 if (cmd->opcode == opcode)
 751                         return cmd;
 752         }
 753
 754         return NULL;
 755 }
 756
 757 static void mgmt_pending_remove(struct pending_cmd *cmd)
 758 {
 759         list_del(&cmd->list);
 760         mgmt_pending_free(cmd);
 761 }
 762
 763 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 764 {
 765         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 766
 767         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 768                             sizeof(settings));
 769 }
 770
 771 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 772                        u16 len)
 773 {
 774         struct mgmt_mode *cp = data;
 775         struct pending_cmd *cmd;
 776         int err;
 777
 778         BT_DBG("request for %s", hdev->name);
 779
 780         hci_dev_lock(hdev);
 781
 782         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 783                 cancel_delayed_work(&hdev->power_off);
 784
 785                 if (cp->val) {
 786                         err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 787                         mgmt_powered(hdev, 1);
 788                         goto failed;
 789                 }
 790         }
 791
 792         if (!!cp->val == hdev_is_powered(hdev)) {
 793                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 794                 goto failed;
 795         }
 796
 797         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 798                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 799                                  MGMT_STATUS_BUSY);
 800                 goto failed;
 801         }
 802
 803         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 804         if (!cmd) {
 805                 err = -ENOMEM;
 806                 goto failed;
 807         }
 808
 809         if (cp->val)
 810                 schedule_work(&hdev->power_on);
 811         else
 812                 schedule_work(&hdev->power_off.work);
 813
 814         err = 0;
 815
 816 failed:
 817         hci_dev_unlock(hdev);
 818         return err;
 819 }
 820
 821 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 822                       struct sock *skip_sk)
 823 {
 824         struct sk_buff *skb;
 825         struct mgmt_hdr *hdr;
 826
 827         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 828         if (!skb)
 829                 return -ENOMEM;
 830
 831         hdr = (void *) skb_put(skb, sizeof(*hdr));
 832         hdr->opcode = cpu_to_le16(event);
 833         if (hdev)
 834                 hdr->index = cpu_to_le16(hdev->id);
 835         else
 836                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 837         hdr->len = cpu_to_le16(data_len);
 838
 839         if (data)
 840                 memcpy(skb_put(skb, data_len), data, data_len);
 841
 842         /* Time stamp */
 843         __net_timestamp(skb);
 844
 845         hci_send_to_control(skb, skip_sk);
 846         kfree_skb(skb);
 847
 848         return 0;
 849 }
 850
 851 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 852 {
 853         __le32 ev;
 854
 855         ev = cpu_to_le32(get_current_settings(hdev));
 856
 857         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 858 }
 859
 860 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 861                             u16 len)
 862 {
 863         struct mgmt_cp_set_discoverable *cp = data;
 864         struct pending_cmd *cmd;
 865         u16 timeout;
 866         u8 scan;
 867         int err;
 868
 869         BT_DBG("request for %s", hdev->name);
 870
 871         if (!lmp_bredr_capable(hdev))
 872                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 873                                  MGMT_STATUS_NOT_SUPPORTED);
 874
 875         timeout = __le16_to_cpu(cp->timeout);
 876         if (!cp->val && timeout > 0)
 877                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 878                                   MGMT_STATUS_INVALID_PARAMS);
 879
 880         hci_dev_lock(hdev);
 881
 882         if (!hdev_is_powered(hdev) && timeout > 0) {
 883                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 884                                  MGMT_STATUS_NOT_POWERED);
 885                 goto failed;
 886         }
 887
 888         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 889             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 890                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 891                                  MGMT_STATUS_BUSY);
 892                 goto failed;
 893         }
 894
 895         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 896                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 897                                  MGMT_STATUS_REJECTED);
 898                 goto failed;
 899         }
 900
 901         if (!hdev_is_powered(hdev)) {
 902                 bool changed = false;
 903
 904                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 905                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 906                         changed = true;
 907                 }
 908
 909                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 910                 if (err < 0)
 911                         goto failed;
 912
 913                 if (changed)
 914                         err = new_settings(hdev, sk);
 915
 916                 goto failed;
 917         }
 918
 919         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 920                 if (hdev->discov_timeout > 0) {
 921                         cancel_delayed_work(&hdev->discov_off);
 922                         hdev->discov_timeout = 0;
 923                 }
 924
 925                 if (cp->val && timeout > 0) {
 926                         hdev->discov_timeout = timeout;
 927                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 928                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 929                 }
 930
 931                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 932                 goto failed;
 933         }
 934
 935         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 936         if (!cmd) {
 937                 err = -ENOMEM;
 938                 goto failed;
 939         }
 940
 941         scan = SCAN_PAGE;
 942
 943         if (cp->val)
 944                 scan |= SCAN_INQUIRY;
 945         else
 946                 cancel_delayed_work(&hdev->discov_off);
 947
 948         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 949         if (err < 0)
 950                 mgmt_pending_remove(cmd);
 951
 952         if (cp->val)
 953                 hdev->discov_timeout = timeout;
 954
 955 failed:
 956         hci_dev_unlock(hdev);
 957         return err;
 958 }
 959
 960 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
 961                            u16 len)
 962 {
 963         struct mgmt_mode *cp = data;
 964         struct pending_cmd *cmd;
 965         u8 scan;
 966         int err;
 967
 968         BT_DBG("request for %s", hdev->name);
 969
 970         if (!lmp_bredr_capable(hdev))
 971                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
 972                                   MGMT_STATUS_NOT_SUPPORTED);
 973
 974         hci_dev_lock(hdev);
 975
 976         if (!hdev_is_powered(hdev)) {
 977                 bool changed = false;
 978
 979                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 980                         changed = true;
 981
 982                 if (cp->val) {
 983                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 984                 } else {
 985                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 986                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 987                 }
 988
 989                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 990                 if (err < 0)
 991                         goto failed;
 992
 993                 if (changed)
 994                         err = new_settings(hdev, sk);
 995
 996                 goto failed;
 997         }
 998
 999         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1000             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1001                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1002                                  MGMT_STATUS_BUSY);
1003                 goto failed;
1004         }
1005
1006         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1007                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1008                 goto failed;
1009         }
1010
1011         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1012         if (!cmd) {
1013                 err = -ENOMEM;
1014                 goto failed;
1015         }
1016
1017         if (cp->val) {
1018                 scan = SCAN_PAGE;
1019         } else {
1020                 scan = 0;
1021
1022                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1023                     hdev->discov_timeout > 0)
1024                         cancel_delayed_work(&hdev->discov_off);
1025         }
1026
1027         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1028         if (err < 0)
1029                 mgmt_pending_remove(cmd);
1030
1031 failed:
1032         hci_dev_unlock(hdev);
1033         return err;
1034 }
1035
1036 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1037                         u16 len)
1038 {
1039         struct mgmt_mode *cp = data;
1040         int err;
1041
1042         BT_DBG("request for %s", hdev->name);
1043
1044         hci_dev_lock(hdev);
1045
1046         if (cp->val)
1047                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1048         else
1049                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1050
1051         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1052         if (err < 0)
1053                 goto failed;
1054
1055         err = new_settings(hdev, sk);
1056
1057 failed:
1058         hci_dev_unlock(hdev);
1059         return err;
1060 }
1061
1062 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1063                              u16 len)
1064 {
1065         struct mgmt_mode *cp = data;
1066         struct pending_cmd *cmd;
1067         u8 val;
1068         int err;
1069
1070         BT_DBG("request for %s", hdev->name);
1071
1072         if (!lmp_bredr_capable(hdev))
1073                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1074                                   MGMT_STATUS_NOT_SUPPORTED);
1075
1076         hci_dev_lock(hdev);
1077
1078         if (!hdev_is_powered(hdev)) {
1079                 bool changed = false;
1080
1081                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1082                                           &hdev->dev_flags)) {
1083                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1084                         changed = true;
1085                 }
1086
1087                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1088                 if (err < 0)
1089                         goto failed;
1090
1091                 if (changed)
1092                         err = new_settings(hdev, sk);
1093
1094                 goto failed;
1095         }
1096
1097         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1098                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1099                                  MGMT_STATUS_BUSY);
1100                 goto failed;
1101         }
1102
1103         val = !!cp->val;
1104
1105         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1106                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1107                 goto failed;
1108         }
1109
1110         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1111         if (!cmd) {
1112                 err = -ENOMEM;
1113                 goto failed;
1114         }
1115
1116         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1117         if (err < 0) {
1118                 mgmt_pending_remove(cmd);
1119                 goto failed;
1120         }
1121
1122 failed:
1123         hci_dev_unlock(hdev);
1124         return err;
1125 }
1126
1127 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1128 {
1129         struct mgmt_mode *cp = data;
1130         struct pending_cmd *cmd;
1131         u8 val;
1132         int err;
1133
1134         BT_DBG("request for %s", hdev->name);
1135
1136         if (!lmp_ssp_capable(hdev))
1137                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1138                                   MGMT_STATUS_NOT_SUPPORTED);
1139
1140         hci_dev_lock(hdev);
1141
1142         val = !!cp->val;
1143
1144         if (!hdev_is_powered(hdev)) {
1145                 bool changed = false;
1146
1147                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1148                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1149                         changed = true;
1150                 }
1151
1152                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1153                 if (err < 0)
1154                         goto failed;
1155
1156                 if (changed)
1157                         err = new_settings(hdev, sk);
1158
1159                 goto failed;
1160         }
1161
1162         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1163                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1164                                  MGMT_STATUS_BUSY);
1165                 goto failed;
1166         }
1167
1168         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1169                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1170                 goto failed;
1171         }
1172
1173         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1174         if (!cmd) {
1175                 err = -ENOMEM;
1176                 goto failed;
1177         }
1178
1179         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1180         if (err < 0) {
1181                 mgmt_pending_remove(cmd);
1182                 goto failed;
1183         }
1184
1185 failed:
1186         hci_dev_unlock(hdev);
1187         return err;
1188 }
1189
1190 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1191 {
1192         struct mgmt_mode *cp = data;
1193
1194         BT_DBG("request for %s", hdev->name);
1195
1196         if (!enable_hs)
1197                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1198                                   MGMT_STATUS_NOT_SUPPORTED);
1199
1200         if (cp->val)
1201                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1202         else
1203                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1204
1205         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1206 }
1207
1208 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1209 {
1210         struct mgmt_mode *cp = data;
1211         struct hci_cp_write_le_host_supported hci_cp;
1212         struct pending_cmd *cmd;
1213         int err;
1214         u8 val, enabled;
1215
1216         BT_DBG("request for %s", hdev->name);
1217
1218         if (!lmp_le_capable(hdev))
1219                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1220                                   MGMT_STATUS_NOT_SUPPORTED);
1221
1222         hci_dev_lock(hdev);
1223
1224         val = !!cp->val;
1225         enabled = lmp_host_le_capable(hdev);
1226
1227         if (!hdev_is_powered(hdev) || val == enabled) {
1228                 bool changed = false;
1229
1230                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1231                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1232                         changed = true;
1233                 }
1234
1235                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1236                 if (err < 0)
1237                         goto unlock;
1238
1239                 if (changed)
1240                         err = new_settings(hdev, sk);
1241
1242                 goto unlock;
1243         }
1244
1245         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1246                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1247                                  MGMT_STATUS_BUSY);
1248                 goto unlock;
1249         }
1250
1251         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1252         if (!cmd) {
1253                 err = -ENOMEM;
1254                 goto unlock;
1255         }
1256
1257         memset(&hci_cp, 0, sizeof(hci_cp));
1258
1259         if (val) {
1260                 hci_cp.le = val;
1261                 hci_cp.simul = lmp_le_br_capable(hdev);
1262         }
1263
1264         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1265                            &hci_cp);
1266         if (err < 0)
1267                 mgmt_pending_remove(cmd);
1268
1269 unlock:
1270         hci_dev_unlock(hdev);
1271         return err;
1272 }
1273
1274 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1275 {
1276         struct mgmt_cp_add_uuid *cp = data;
1277         struct pending_cmd *cmd;
1278         struct bt_uuid *uuid;
1279         int err;
1280
1281         BT_DBG("request for %s", hdev->name);
1282
1283         hci_dev_lock(hdev);
1284
1285         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1286                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1287                                  MGMT_STATUS_BUSY);
1288                 goto failed;
1289         }
1290
1291         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1292         if (!uuid) {
1293                 err = -ENOMEM;
1294                 goto failed;
1295         }
1296
1297         memcpy(uuid->uuid, cp->uuid, 16);
1298         uuid->svc_hint = cp->svc_hint;
1299
1300         list_add(&uuid->list, &hdev->uuids);
1301
1302         err = update_class(hdev);
1303         if (err < 0)
1304                 goto failed;
1305
1306         err = update_eir(hdev);
1307         if (err < 0)
1308                 goto failed;
1309
1310         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1311                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1312                                    hdev->dev_class, 3);
1313                 goto failed;
1314         }
1315
1316         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1317         if (!cmd)
1318                 err = -ENOMEM;
1319
1320 failed:
1321         hci_dev_unlock(hdev);
1322         return err;
1323 }
1324
1325 static bool enable_service_cache(struct hci_dev *hdev)
1326 {
1327         if (!hdev_is_powered(hdev))
1328                 return false;
1329
1330         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1331                 schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
1332                 return true;
1333         }
1334
1335         return false;
1336 }
1337
1338 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1339                        u16 len)
1340 {
1341         struct mgmt_cp_remove_uuid *cp = data;
1342         struct pending_cmd *cmd;
1343         struct list_head *p, *n;
1344         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1345         int err, found;
1346
1347         BT_DBG("request for %s", hdev->name);
1348
1349         hci_dev_lock(hdev);
1350
1351         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1352                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1353                                  MGMT_STATUS_BUSY);
1354                 goto unlock;
1355         }
1356
1357         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1358                 err = hci_uuids_clear(hdev);
1359
1360                 if (enable_service_cache(hdev)) {
1361                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1362                                            0, hdev->dev_class, 3);
1363                         goto unlock;
1364                 }
1365
1366                 goto update_class;
1367         }
1368
1369         found = 0;
1370
1371         list_for_each_safe(p, n, &hdev->uuids) {
1372                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1373
1374                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1375                         continue;
1376
1377                 list_del(&match->list);
1378                 kfree(match);
1379                 found++;
1380         }
1381
1382         if (found == 0) {
1383                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1384                                  MGMT_STATUS_INVALID_PARAMS);
1385                 goto unlock;
1386         }
1387
1388 update_class:
1389         err = update_class(hdev);
1390         if (err < 0)
1391                 goto unlock;
1392
1393         err = update_eir(hdev);
1394         if (err < 0)
1395                 goto unlock;
1396
1397         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1398                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1399                                    hdev->dev_class, 3);
1400                 goto unlock;
1401         }
1402
1403         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1404         if (!cmd)
1405                 err = -ENOMEM;
1406
1407 unlock:
1408         hci_dev_unlock(hdev);
1409         return err;
1410 }
1411
1412 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1413                          u16 len)
1414 {
1415         struct mgmt_cp_set_dev_class *cp = data;
1416         struct pending_cmd *cmd;
1417         int err;
1418
1419         BT_DBG("request for %s", hdev->name);
1420
1421         if (!lmp_bredr_capable(hdev))
1422                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1423                                   MGMT_STATUS_NOT_SUPPORTED);
1424
1425         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags))
1426                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1427                                   MGMT_STATUS_BUSY);
1428
1429         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0)
1430                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1431                                   MGMT_STATUS_INVALID_PARAMS);
1432
1433         hci_dev_lock(hdev);
1434
1435         hdev->major_class = cp->major;
1436         hdev->minor_class = cp->minor;
1437
1438         if (!hdev_is_powered(hdev)) {
1439                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1440                                    hdev->dev_class, 3);
1441                 goto unlock;
1442         }
1443
1444         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1445                 hci_dev_unlock(hdev);
1446                 cancel_delayed_work_sync(&hdev->service_cache);
1447                 hci_dev_lock(hdev);
1448                 update_eir(hdev);
1449         }
1450
1451         err = update_class(hdev);
1452         if (err < 0)
1453                 goto unlock;
1454
1455         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1456                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1457                                    hdev->dev_class, 3);
1458                 goto unlock;
1459         }
1460
1461         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1462         if (!cmd)
1463                 err = -ENOMEM;
1464
1465 unlock:
1466         hci_dev_unlock(hdev);
1467         return err;
1468 }
1469
1470 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1471                           u16 len)
1472 {
1473         struct mgmt_cp_load_link_keys *cp = data;
1474         u16 key_count, expected_len;
1475         int i;
1476
1477         key_count = __le16_to_cpu(cp->key_count);
1478
1479         expected_len = sizeof(*cp) + key_count *
1480                                         sizeof(struct mgmt_link_key_info);
1481         if (expected_len != len) {
1482                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1483                        len, expected_len);
1484                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1485                                   MGMT_STATUS_INVALID_PARAMS);
1486         }
1487
1488         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1489                key_count);
1490
1491         hci_dev_lock(hdev);
1492
1493         hci_link_keys_clear(hdev);
1494
1495         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1496
1497         if (cp->debug_keys)
1498                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1499         else
1500                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1501
1502         for (i = 0; i < key_count; i++) {
1503                 struct mgmt_link_key_info *key = &cp->keys[i];
1504
1505                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1506                                  key->type, key->pin_len);
1507         }
1508
1509         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1510
1511         hci_dev_unlock(hdev);
1512
1513         return 0;
1514 }
1515
1516 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1517                            u8 addr_type, struct sock *skip_sk)
1518 {
1519         struct mgmt_ev_device_unpaired ev;
1520
1521         bacpy(&ev.addr.bdaddr, bdaddr);
1522         ev.addr.type = addr_type;
1523
1524         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1525                           skip_sk);
1526 }
1527
1528 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1529                          u16 len)
1530 {
1531         struct mgmt_cp_unpair_device *cp = data;
1532         struct mgmt_rp_unpair_device rp;
1533         struct hci_cp_disconnect dc;
1534         struct pending_cmd *cmd;
1535         struct hci_conn *conn;
1536         int err;
1537
1538         hci_dev_lock(hdev);
1539
1540         memset(&rp, 0, sizeof(rp));
1541         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1542         rp.addr.type = cp->addr.type;
1543
1544         if (!hdev_is_powered(hdev)) {
1545                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1546                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1547                 goto unlock;
1548         }
1549
1550         if (cp->addr.type == BDADDR_BREDR)
1551                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1552         else
1553                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1554
1555         if (err < 0) {
1556                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1557                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1558                 goto unlock;
1559         }
1560
1561         if (cp->disconnect) {
1562                 if (cp->addr.type == BDADDR_BREDR)
1563                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1564                                                        &cp->addr.bdaddr);
1565                 else
1566                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1567                                                        &cp->addr.bdaddr);
1568         } else {
1569                 conn = NULL;
1570         }
1571
1572         if (!conn) {
1573                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1574                                    &rp, sizeof(rp));
1575                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1576                 goto unlock;
1577         }
1578
1579         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1580                                sizeof(*cp));
1581         if (!cmd) {
1582                 err = -ENOMEM;
1583                 goto unlock;
1584         }
1585
1586         dc.handle = cpu_to_le16(conn->handle);
1587         dc.reason = 0x13; /* Remote User Terminated Connection */
1588         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1589         if (err < 0)
1590                 mgmt_pending_remove(cmd);
1591
1592 unlock:
1593         hci_dev_unlock(hdev);
1594         return err;
1595 }
1596
1597 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1598                       u16 len)
1599 {
1600         struct mgmt_cp_disconnect *cp = data;
1601         struct hci_cp_disconnect dc;
1602         struct pending_cmd *cmd;
1603         struct hci_conn *conn;
1604         int err;
1605
1606         BT_DBG("");
1607
1608         hci_dev_lock(hdev);
1609
1610         if (!test_bit(HCI_UP, &hdev->flags)) {
1611                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1612                                  MGMT_STATUS_NOT_POWERED);
1613                 goto failed;
1614         }
1615
1616         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1617                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1618                                  MGMT_STATUS_BUSY);
1619                 goto failed;
1620         }
1621
1622         if (cp->addr.type == BDADDR_BREDR)
1623                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1624                                                &cp->addr.bdaddr);
1625         else
1626                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1627
1628         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1629                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1630                                  MGMT_STATUS_NOT_CONNECTED);
1631                 goto failed;
1632         }
1633
1634         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1635         if (!cmd) {
1636                 err = -ENOMEM;
1637                 goto failed;
1638         }
1639
1640         dc.handle = cpu_to_le16(conn->handle);
1641         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1642
1643         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1644         if (err < 0)
1645                 mgmt_pending_remove(cmd);
1646
1647 failed:
1648         hci_dev_unlock(hdev);
1649         return err;
1650 }
1651
1652 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1653 {
1654         switch (link_type) {
1655         case LE_LINK:
1656                 switch (addr_type) {
1657                 case ADDR_LE_DEV_PUBLIC:
1658                         return BDADDR_LE_PUBLIC;
1659
1660                 default:
1661                         /* Fallback to LE Random address type */
1662                         return BDADDR_LE_RANDOM;
1663                 }
1664
1665         default:
1666                 /* Fallback to BR/EDR type */
1667                 return BDADDR_BREDR;
1668         }
1669 }
1670
1671 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1672                            u16 data_len)
1673 {
1674         struct mgmt_rp_get_connections *rp;
1675         struct hci_conn *c;
1676         size_t rp_len;
1677         int err;
1678         u16 i;
1679
1680         BT_DBG("");
1681
1682         hci_dev_lock(hdev);
1683
1684         if (!hdev_is_powered(hdev)) {
1685                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1686                                  MGMT_STATUS_NOT_POWERED);
1687                 goto unlock;
1688         }
1689
1690         i = 0;
1691         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1692                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1693                         i++;
1694         }
1695
1696         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1697         rp = kmalloc(rp_len, GFP_KERNEL);
1698         if (!rp) {
1699                 err = -ENOMEM;
1700                 goto unlock;
1701         }
1702
1703         i = 0;
1704         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1705                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1706                         continue;
1707                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1708                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1709                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1710                         continue;
1711                 i++;
1712         }
1713
1714         rp->conn_count = cpu_to_le16(i);
1715
1716         /* Recalculate length in case of filtered SCO connections, etc */
1717         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1718
1719         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1720                            rp_len);
1721
1722         kfree(rp);
1723
1724 unlock:
1725         hci_dev_unlock(hdev);
1726         return err;
1727 }
1728
1729 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1730                                    struct mgmt_cp_pin_code_neg_reply *cp)
1731 {
1732         struct pending_cmd *cmd;
1733         int err;
1734
1735         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1736                                sizeof(*cp));
1737         if (!cmd)
1738                 return -ENOMEM;
1739
1740         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1741                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1742         if (err < 0)
1743                 mgmt_pending_remove(cmd);
1744
1745         return err;
1746 }
1747
1748 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1749                           u16 len)
1750 {
1751         struct hci_conn *conn;
1752         struct mgmt_cp_pin_code_reply *cp = data;
1753         struct hci_cp_pin_code_reply reply;
1754         struct pending_cmd *cmd;
1755         int err;
1756
1757         BT_DBG("");
1758
1759         hci_dev_lock(hdev);
1760
1761         if (!hdev_is_powered(hdev)) {
1762                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1763                                  MGMT_STATUS_NOT_POWERED);
1764                 goto failed;
1765         }
1766
1767         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1768         if (!conn) {
1769                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1770                                  MGMT_STATUS_NOT_CONNECTED);
1771                 goto failed;
1772         }
1773
1774         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1775                 struct mgmt_cp_pin_code_neg_reply ncp;
1776
1777                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1778
1779                 BT_ERR("PIN code is not 16 bytes long");
1780
1781                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1782                 if (err >= 0)
1783                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1784                                          MGMT_STATUS_INVALID_PARAMS);
1785
1786                 goto failed;
1787         }
1788
1789         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1790         if (!cmd) {
1791                 err = -ENOMEM;
1792                 goto failed;
1793         }
1794
1795         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1796         reply.pin_len = cp->pin_len;
1797         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1798
1799         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1800         if (err < 0)
1801                 mgmt_pending_remove(cmd);
1802
1803 failed:
1804         hci_dev_unlock(hdev);
1805         return err;
1806 }
1807
1808 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1809                              u16 len)
1810 {
1811         struct mgmt_cp_set_io_capability *cp = data;
1812
1813         BT_DBG("");
1814
1815         hci_dev_lock(hdev);
1816
1817         hdev->io_capability = cp->io_capability;
1818
1819         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1820                hdev->io_capability);
1821
1822         hci_dev_unlock(hdev);
1823
1824         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1825                             0);
1826 }
1827
1828 static struct pending_cmd *find_pairing(struct hci_conn *conn)
1829 {
1830         struct hci_dev *hdev = conn->hdev;
1831         struct pending_cmd *cmd;
1832
1833         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1834                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1835                         continue;
1836
1837                 if (cmd->user_data != conn)
1838                         continue;
1839
1840                 return cmd;
1841         }
1842
1843         return NULL;
1844 }
1845
1846 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1847 {
1848         struct mgmt_rp_pair_device rp;
1849         struct hci_conn *conn = cmd->user_data;
1850
1851         bacpy(&rp.addr.bdaddr, &conn->dst);
1852         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
1853
1854         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1855                      &rp, sizeof(rp));
1856
1857         /* So we don't get further callbacks for this connection */
1858         conn->connect_cfm_cb = NULL;
1859         conn->security_cfm_cb = NULL;
1860         conn->disconn_cfm_cb = NULL;
1861
1862         hci_conn_put(conn);
1863
1864         mgmt_pending_remove(cmd);
1865 }
1866
1867 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1868 {
1869         struct pending_cmd *cmd;
1870
1871         BT_DBG("status %u", status);
1872
1873         cmd = find_pairing(conn);
1874         if (!cmd)
1875                 BT_DBG("Unable to find a pending command");
1876         else
1877                 pairing_complete(cmd, mgmt_status(status));
1878 }
1879
1880 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
1881 {
1882         struct pending_cmd *cmd;
1883
1884         BT_DBG("status %u", status);
1885
1886         if (!status)
1887                 return;
1888
1889         cmd = find_pairing(conn);
1890         if (!cmd)
1891                 BT_DBG("Unable to find a pending command");
1892         else
1893                 pairing_complete(cmd, mgmt_status(status));
1894 }
1895
1896 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1897                        u16 len)
1898 {
1899         struct mgmt_cp_pair_device *cp = data;
1900         struct mgmt_rp_pair_device rp;
1901         struct pending_cmd *cmd;
1902         u8 sec_level, auth_type;
1903         struct hci_conn *conn;
1904         int err;
1905
1906         BT_DBG("");
1907
1908         hci_dev_lock(hdev);
1909
1910         if (!hdev_is_powered(hdev)) {
1911                 err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1912                                  MGMT_STATUS_NOT_POWERED);
1913                 goto unlock;
1914         }
1915
1916         sec_level = BT_SECURITY_MEDIUM;
1917         if (cp->io_cap == 0x03)
1918                 auth_type = HCI_AT_DEDICATED_BONDING;
1919         else
1920                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1921
1922         if (cp->addr.type == BDADDR_BREDR)
1923                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
1924                                    cp->addr.type, sec_level, auth_type);
1925         else
1926                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
1927                                    cp->addr.type, sec_level, auth_type);
1928
1929         memset(&rp, 0, sizeof(rp));
1930         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1931         rp.addr.type = cp->addr.type;
1932
1933         if (IS_ERR(conn)) {
1934                 int status;
1935
1936                 if (PTR_ERR(conn) == -EBUSY)
1937                         status = MGMT_STATUS_BUSY;
1938                 else
1939                         status = MGMT_STATUS_CONNECT_FAILED;
1940
1941                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1942                                    status, &rp,
1943                                    sizeof(rp));
1944                 goto unlock;
1945         }
1946
1947         if (conn->connect_cfm_cb) {
1948                 hci_conn_put(conn);
1949                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1950                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1951                 goto unlock;
1952         }
1953
1954         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1955         if (!cmd) {
1956                 err = -ENOMEM;
1957                 hci_conn_put(conn);
1958                 goto unlock;
1959         }
1960
1961         /* For LE, just connecting isn't a proof that the pairing finished */
1962         if (cp->addr.type == BDADDR_BREDR)
1963                 conn->connect_cfm_cb = pairing_complete_cb;
1964         else
1965                 conn->connect_cfm_cb = le_connect_complete_cb;
1966
1967         conn->security_cfm_cb = pairing_complete_cb;
1968         conn->disconn_cfm_cb = pairing_complete_cb;
1969         conn->io_capability = cp->io_cap;
1970         cmd->user_data = conn;
1971
1972         if (conn->state == BT_CONNECTED &&
1973             hci_conn_security(conn, sec_level, auth_type))
1974                 pairing_complete(cmd, 0);
1975
1976         err = 0;
1977
1978 unlock:
1979         hci_dev_unlock(hdev);
1980         return err;
1981 }
1982
1983 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1984                               u16 len)
1985 {
1986         struct mgmt_addr_info *addr = data;
1987         struct pending_cmd *cmd;
1988         struct hci_conn *conn;
1989         int err;
1990
1991         BT_DBG("");
1992
1993         hci_dev_lock(hdev);
1994
1995         if (!hdev_is_powered(hdev)) {
1996                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1997                                  MGMT_STATUS_NOT_POWERED);
1998                 goto unlock;
1999         }
2000
2001         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2002         if (!cmd) {
2003                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2004                                  MGMT_STATUS_INVALID_PARAMS);
2005                 goto unlock;
2006         }
2007
2008         conn = cmd->user_data;
2009
2010         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2011                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2012                                  MGMT_STATUS_INVALID_PARAMS);
2013                 goto unlock;
2014         }
2015
2016         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2017
2018         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2019                            addr, sizeof(*addr));
2020 unlock:
2021         hci_dev_unlock(hdev);
2022         return err;
2023 }
2024
2025 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2026                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2027                              u16 hci_op, __le32 passkey)
2028 {
2029         struct pending_cmd *cmd;
2030         struct hci_conn *conn;
2031         int err;
2032
2033         hci_dev_lock(hdev);
2034
2035         if (!hdev_is_powered(hdev)) {
2036                 err = cmd_status(sk, hdev->id, mgmt_op,
2037                                  MGMT_STATUS_NOT_POWERED);
2038                 goto done;
2039         }
2040
2041         if (type == BDADDR_BREDR)
2042                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2043         else
2044                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2045
2046         if (!conn) {
2047                 err = cmd_status(sk, hdev->id, mgmt_op,
2048                                  MGMT_STATUS_NOT_CONNECTED);
2049                 goto done;
2050         }
2051
2052         if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2053                 /* Continue with pairing via SMP */
2054                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2055
2056                 if (!err)
2057                         err = cmd_status(sk, hdev->id, mgmt_op,
2058                                          MGMT_STATUS_SUCCESS);
2059                 else
2060                         err = cmd_status(sk, hdev->id, mgmt_op,
2061                                          MGMT_STATUS_FAILED);
2062
2063                 goto done;
2064         }
2065
2066         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2067         if (!cmd) {
2068                 err = -ENOMEM;
2069                 goto done;
2070         }
2071
2072         /* Continue with pairing via HCI */
2073         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2074                 struct hci_cp_user_passkey_reply cp;
2075
2076                 bacpy(&cp.bdaddr, bdaddr);
2077                 cp.passkey = passkey;
2078                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2079         } else
2080                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2081
2082         if (err < 0)
2083                 mgmt_pending_remove(cmd);
2084
2085 done:
2086         hci_dev_unlock(hdev);
2087         return err;
2088 }
2089
2090 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2091                               void *data, u16 len)
2092 {
2093         struct mgmt_cp_pin_code_neg_reply *cp = data;
2094
2095         BT_DBG("");
2096
2097         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2098                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2099                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2100 }
2101
2102 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2103                               u16 len)
2104 {
2105         struct mgmt_cp_user_confirm_reply *cp = data;
2106
2107         BT_DBG("");
2108
2109         if (len != sizeof(*cp))
2110                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2111                                   MGMT_STATUS_INVALID_PARAMS);
2112
2113         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2114                                  MGMT_OP_USER_CONFIRM_REPLY,
2115                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2116 }
2117
2118 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2119                                   void *data, u16 len)
2120 {
2121         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2122
2123         BT_DBG("");
2124
2125         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2126                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2127                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2128 }
2129
2130 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2131                               u16 len)
2132 {
2133         struct mgmt_cp_user_passkey_reply *cp = data;
2134
2135         BT_DBG("");
2136
2137         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2138                                  MGMT_OP_USER_PASSKEY_REPLY,
2139                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2140 }
2141
2142 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2143                                   void *data, u16 len)
2144 {
2145         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2146
2147         BT_DBG("");
2148
2149         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2150                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2151                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2152 }
2153
2154 static int update_name(struct hci_dev *hdev, const char *name)
2155 {
2156         struct hci_cp_write_local_name cp;
2157
2158         memcpy(cp.name, name, sizeof(cp.name));
2159
2160         return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2161 }
2162
2163 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2164                           u16 len)
2165 {
2166         struct mgmt_cp_set_local_name *cp = data;
2167         struct pending_cmd *cmd;
2168         int err;
2169
2170         BT_DBG("");
2171
2172         hci_dev_lock(hdev);
2173
2174         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2175
2176         if (!hdev_is_powered(hdev)) {
2177                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2178
2179                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2180                                    data, len);
2181                 if (err < 0)
2182                         goto failed;
2183
2184                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2185                                  sk);
2186
2187                 goto failed;
2188         }
2189
2190         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2191         if (!cmd) {
2192                 err = -ENOMEM;
2193                 goto failed;
2194         }
2195
2196         err = update_name(hdev, cp->name);
2197         if (err < 0)
2198                 mgmt_pending_remove(cmd);
2199
2200 failed:
2201         hci_dev_unlock(hdev);
2202         return err;
2203 }
2204
2205 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2206                                void *data, u16 data_len)
2207 {
2208         struct pending_cmd *cmd;
2209         int err;
2210
2211         BT_DBG("%s", hdev->name);
2212
2213         hci_dev_lock(hdev);
2214
2215         if (!hdev_is_powered(hdev)) {
2216                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2217                                  MGMT_STATUS_NOT_POWERED);
2218                 goto unlock;
2219         }
2220
2221         if (!lmp_ssp_capable(hdev)) {
2222                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2223                                  MGMT_STATUS_NOT_SUPPORTED);
2224                 goto unlock;
2225         }
2226
2227         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2228                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2229                                  MGMT_STATUS_BUSY);
2230                 goto unlock;
2231         }
2232
2233         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2234         if (!cmd) {
2235                 err = -ENOMEM;
2236                 goto unlock;
2237         }
2238
2239         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2240         if (err < 0)
2241                 mgmt_pending_remove(cmd);
2242
2243 unlock:
2244         hci_dev_unlock(hdev);
2245         return err;
2246 }
2247
2248 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2249                                void *data, u16 len)
2250 {
2251         struct mgmt_cp_add_remote_oob_data *cp = data;
2252         u8 status;
2253         int err;
2254
2255         BT_DBG("%s ", hdev->name);
2256
2257         hci_dev_lock(hdev);
2258
2259         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2260                                       cp->randomizer);
2261         if (err < 0)
2262                 status = MGMT_STATUS_FAILED;
2263         else
2264                 status = MGMT_STATUS_SUCCESS;
2265
2266         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2267                            &cp->addr, sizeof(cp->addr));
2268
2269         hci_dev_unlock(hdev);
2270         return err;
2271 }
2272
2273 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2274                                   void *data, u16 len)
2275 {
2276         struct mgmt_cp_remove_remote_oob_data *cp = data;
2277         u8 status;
2278         int err;
2279
2280         BT_DBG("%s", hdev->name);
2281
2282         hci_dev_lock(hdev);
2283
2284         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2285         if (err < 0)
2286                 status = MGMT_STATUS_INVALID_PARAMS;
2287         else
2288                 status = MGMT_STATUS_SUCCESS;
2289
2290         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2291                            status, &cp->addr, sizeof(cp->addr));
2292
2293         hci_dev_unlock(hdev);
2294         return err;
2295 }
2296
2297 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2298 {
2299         int err;
2300
2301         BT_DBG("%s", hdev->name);
2302
2303         hci_dev_lock(hdev);
2304
2305         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2306         if (err < 0)
2307                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2308
2309         hci_dev_unlock(hdev);
2310
2311         return err;
2312 }
2313
2314 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2315                            void *data, u16 len)
2316 {
2317         struct mgmt_cp_start_discovery *cp = data;
2318         struct pending_cmd *cmd;
2319         int err;
2320
2321         BT_DBG("%s", hdev->name);
2322
2323         hci_dev_lock(hdev);
2324
2325         if (!hdev_is_powered(hdev)) {
2326                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2327                                  MGMT_STATUS_NOT_POWERED);
2328                 goto failed;
2329         }
2330
2331         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2332                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2333                                  MGMT_STATUS_BUSY);
2334                 goto failed;
2335         }
2336
2337         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2338                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2339                                  MGMT_STATUS_BUSY);
2340                 goto failed;
2341         }
2342
2343         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2344         if (!cmd) {
2345                 err = -ENOMEM;
2346                 goto failed;
2347         }
2348
2349         hdev->discovery.type = cp->type;
2350
2351         switch (hdev->discovery.type) {
2352         case DISCOV_TYPE_BREDR:
2353                 if (lmp_bredr_capable(hdev))
2354                         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2355                 else
2356                         err = -ENOTSUPP;
2357                 break;
2358
2359         case DISCOV_TYPE_LE:
2360                 if (lmp_host_le_capable(hdev))
2361                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2362                                           LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2363                 else
2364                         err = -ENOTSUPP;
2365                 break;
2366
2367         case DISCOV_TYPE_INTERLEAVED:
2368                 if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
2369                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2370                                           LE_SCAN_WIN,
2371                                           LE_SCAN_TIMEOUT_BREDR_LE);
2372                 else
2373                         err = -ENOTSUPP;
2374                 break;
2375
2376         default:
2377                 err = -EINVAL;
2378         }
2379
2380         if (err < 0)
2381                 mgmt_pending_remove(cmd);
2382         else
2383                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2384
2385 failed:
2386         hci_dev_unlock(hdev);
2387         return err;
2388 }
2389
2390 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2391                           u16 len)
2392 {
2393         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2394         struct pending_cmd *cmd;
2395         struct hci_cp_remote_name_req_cancel cp;
2396         struct inquiry_entry *e;
2397         int err;
2398
2399         BT_DBG("%s", hdev->name);
2400
2401         hci_dev_lock(hdev);
2402
2403         if (!hci_discovery_active(hdev)) {
2404                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2405                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2406                                    sizeof(mgmt_cp->type));
2407                 goto unlock;
2408         }
2409
2410         if (hdev->discovery.type != mgmt_cp->type) {
2411                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2412                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2413                                    sizeof(mgmt_cp->type));
2414                 goto unlock;
2415         }
2416
2417         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2418         if (!cmd) {
2419                 err = -ENOMEM;
2420                 goto unlock;
2421         }
2422
2423         switch (hdev->discovery.state) {
2424         case DISCOVERY_FINDING:
2425                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2426                         err = hci_cancel_inquiry(hdev);
2427                 else
2428                         err = hci_cancel_le_scan(hdev);
2429
2430                 break;
2431
2432         case DISCOVERY_RESOLVING:
2433                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2434                                                      NAME_PENDING);
2435                 if (!e) {
2436                         mgmt_pending_remove(cmd);
2437                         err = cmd_complete(sk, hdev->id,
2438                                            MGMT_OP_STOP_DISCOVERY, 0,
2439                                            &mgmt_cp->type,
2440                                            sizeof(mgmt_cp->type));
2441                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2442                         goto unlock;
2443                 }
2444
2445                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2446                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2447                                    sizeof(cp), &cp);
2448
2449                 break;
2450
2451         default:
2452                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2453                 err = -EFAULT;
2454         }
2455
2456         if (err < 0)
2457                 mgmt_pending_remove(cmd);
2458         else
2459                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2460
2461 unlock:
2462         hci_dev_unlock(hdev);
2463         return err;
2464 }
2465
2466 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2467                         u16 len)
2468 {
2469         struct mgmt_cp_confirm_name *cp = data;
2470         struct inquiry_entry *e;
2471         int err;
2472
2473         BT_DBG("%s", hdev->name);
2474
2475         hci_dev_lock(hdev);
2476
2477         if (!hci_discovery_active(hdev)) {
2478                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2479                                  MGMT_STATUS_FAILED);
2480                 goto failed;
2481         }
2482
2483         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2484         if (!e) {
2485                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2486                                  MGMT_STATUS_INVALID_PARAMS);
2487                 goto failed;
2488         }
2489
2490         if (cp->name_known) {
2491                 e->name_state = NAME_KNOWN;
2492                 list_del(&e->list);
2493         } else {
2494                 e->name_state = NAME_NEEDED;
2495                 hci_inquiry_cache_update_resolve(hdev, e);
2496         }
2497
2498         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
2499                            sizeof(cp->addr));
2500
2501 failed:
2502         hci_dev_unlock(hdev);
2503         return err;
2504 }
2505
2506 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2507                         u16 len)
2508 {
2509         struct mgmt_cp_block_device *cp = data;
2510         u8 status;
2511         int err;
2512
2513         BT_DBG("%s", hdev->name);
2514
2515         hci_dev_lock(hdev);
2516
2517         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2518         if (err < 0)
2519                 status = MGMT_STATUS_FAILED;
2520         else
2521                 status = MGMT_STATUS_SUCCESS;
2522
2523         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2524                            &cp->addr, sizeof(cp->addr));
2525
2526         hci_dev_unlock(hdev);
2527
2528         return err;
2529 }
2530
2531 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2532                           u16 len)
2533 {
2534         struct mgmt_cp_unblock_device *cp = data;
2535         u8 status;
2536         int err;
2537
2538         BT_DBG("%s", hdev->name);
2539
2540         hci_dev_lock(hdev);
2541
2542         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2543         if (err < 0)
2544                 status = MGMT_STATUS_INVALID_PARAMS;
2545         else
2546                 status = MGMT_STATUS_SUCCESS;
2547
2548         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2549                            &cp->addr, sizeof(cp->addr));
2550
2551         hci_dev_unlock(hdev);
2552
2553         return err;
2554 }
2555
2556 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2557                          u16 len)
2558 {
2559         struct mgmt_cp_set_device_id *cp = data;
2560         int err;
2561         __u16 source;
2562
2563         BT_DBG("%s", hdev->name);
2564
2565         source = __le16_to_cpu(cp->source);
2566
2567         if (source > 0x0002)
2568                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2569                                   MGMT_STATUS_INVALID_PARAMS);
2570
2571         hci_dev_lock(hdev);
2572
2573         hdev->devid_source = source;
2574         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2575         hdev->devid_product = __le16_to_cpu(cp->product);
2576         hdev->devid_version = __le16_to_cpu(cp->version);
2577
2578         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2579
2580         update_eir(hdev);
2581
2582         hci_dev_unlock(hdev);
2583
2584         return err;
2585 }
2586
2587 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2588                                 void *data, u16 len)
2589 {
2590         struct mgmt_mode *cp = data;
2591         struct hci_cp_write_page_scan_activity acp;
2592         u8 type;
2593         int err;
2594
2595         BT_DBG("%s", hdev->name);
2596
2597         if (!lmp_bredr_capable(hdev))
2598                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2599                                   MGMT_STATUS_NOT_SUPPORTED);
2600
2601         if (!hdev_is_powered(hdev))
2602                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2603                                   MGMT_STATUS_NOT_POWERED);
2604
2605         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2606                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2607                                   MGMT_STATUS_REJECTED);
2608
2609         hci_dev_lock(hdev);
2610
2611         if (cp->val) {
2612                 type = PAGE_SCAN_TYPE_INTERLACED;
2613
2614                 /* 160 msec page scan interval */
2615                 acp.interval = __constant_cpu_to_le16(0x0100);
2616         } else {
2617                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2618
2619                 /* default 1.28 sec page scan */
2620                 acp.interval = __constant_cpu_to_le16(0x0800);
2621         }
2622
2623         /* default 11.25 msec page scan window */
2624         acp.window = __constant_cpu_to_le16(0x0012);
2625
2626         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2627                            &acp);
2628         if (err < 0) {
2629                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2630                                  MGMT_STATUS_FAILED);
2631                 goto done;
2632         }
2633
2634         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2635         if (err < 0) {
2636                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2637                                  MGMT_STATUS_FAILED);
2638                 goto done;
2639         }
2640
2641         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2642                            NULL, 0);
2643 done:
2644         hci_dev_unlock(hdev);
2645         return err;
2646 }
2647
2648 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2649                                void *cp_data, u16 len)
2650 {
2651         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2652         u16 key_count, expected_len;
2653         int i, err;
2654
2655         key_count = __le16_to_cpu(cp->key_count);
2656
2657         expected_len = sizeof(*cp) + key_count *
2658                                         sizeof(struct mgmt_ltk_info);
2659         if (expected_len != len) {
2660                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2661                        len, expected_len);
2662                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2663                                   EINVAL);
2664         }
2665
2666         BT_DBG("%s key_count %u", hdev->name, key_count);
2667
2668         hci_dev_lock(hdev);
2669
2670         hci_smp_ltks_clear(hdev);
2671
2672         for (i = 0; i < key_count; i++) {
2673                 struct mgmt_ltk_info *key = &cp->keys[i];
2674                 u8 type;
2675
2676                 if (key->master)
2677                         type = HCI_SMP_LTK;
2678                 else
2679                         type = HCI_SMP_LTK_SLAVE;
2680
2681                 hci_add_ltk(hdev, &key->addr.bdaddr,
2682                             bdaddr_to_le(key->addr.type),
2683                             type, 0, key->authenticated, key->val,
2684                             key->enc_size, key->ediv, key->rand);
2685         }
2686
2687         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
2688                            NULL, 0);
2689
2690         hci_dev_unlock(hdev);
2691
2692         return err;
2693 }
2694
2695 static const struct mgmt_handler {
2696         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2697                      u16 data_len);
2698         bool var_len;
2699         size_t data_len;
2700 } mgmt_handlers[] = {
2701         { NULL }, /* 0x0000 (no command) */
2702         { read_version,           false, MGMT_READ_VERSION_SIZE },
2703         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
2704         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
2705         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
2706         { set_powered,            false, MGMT_SETTING_SIZE },
2707         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
2708         { set_connectable,        false, MGMT_SETTING_SIZE },
2709         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
2710         { set_pairable,           false, MGMT_SETTING_SIZE },
2711         { set_link_security,      false, MGMT_SETTING_SIZE },
2712         { set_ssp,                false, MGMT_SETTING_SIZE },
2713         { set_hs,                 false, MGMT_SETTING_SIZE },
2714         { set_le,                 false, MGMT_SETTING_SIZE },
2715         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
2716         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
2717         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
2718         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
2719         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
2720         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2721         { disconnect,             false, MGMT_DISCONNECT_SIZE },
2722         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
2723         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
2724         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2725         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
2726         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
2727         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2728         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
2729         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
2730         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2731         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
2732         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2733         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2734         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2735         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2736         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
2737         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
2738         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
2739         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
2740         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
2741         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
2742 };
2743
2744
2745 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2746 {
2747         void *buf;
2748         u8 *cp;
2749         struct mgmt_hdr *hdr;
2750         u16 opcode, index, len;
2751         struct hci_dev *hdev = NULL;
2752         const struct mgmt_handler *handler;
2753         int err;
2754
2755         BT_DBG("got %zu bytes", msglen);
2756
2757         if (msglen < sizeof(*hdr))
2758                 return -EINVAL;
2759
2760         buf = kmalloc(msglen, GFP_KERNEL);
2761         if (!buf)
2762                 return -ENOMEM;
2763
2764         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2765                 err = -EFAULT;
2766                 goto done;
2767         }
2768
2769         hdr = buf;
2770         opcode = __le16_to_cpu(hdr->opcode);
2771         index = __le16_to_cpu(hdr->index);
2772         len = __le16_to_cpu(hdr->len);
2773
2774         if (len != msglen - sizeof(*hdr)) {
2775                 err = -EINVAL;
2776                 goto done;
2777         }
2778
2779         if (index != MGMT_INDEX_NONE) {
2780                 hdev = hci_dev_get(index);
2781                 if (!hdev) {
2782                         err = cmd_status(sk, index, opcode,
2783                                          MGMT_STATUS_INVALID_INDEX);
2784                         goto done;
2785                 }
2786         }
2787
2788         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2789             mgmt_handlers[opcode].func == NULL) {
2790                 BT_DBG("Unknown op %u", opcode);
2791                 err = cmd_status(sk, index, opcode,
2792                                  MGMT_STATUS_UNKNOWN_COMMAND);
2793                 goto done;
2794         }
2795
2796         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2797             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2798                 err = cmd_status(sk, index, opcode,
2799                                  MGMT_STATUS_INVALID_INDEX);
2800                 goto done;
2801         }
2802
2803         handler = &mgmt_handlers[opcode];
2804
2805         if ((handler->var_len && len < handler->data_len) ||
2806             (!handler->var_len && len != handler->data_len)) {
2807                 err = cmd_status(sk, index, opcode,
2808                                  MGMT_STATUS_INVALID_PARAMS);
2809                 goto done;
2810         }
2811
2812         if (hdev)
2813                 mgmt_init_hdev(sk, hdev);
2814
2815         cp = buf + sizeof(*hdr);
2816
2817         err = handler->func(sk, hdev, cp, len);
2818         if (err < 0)
2819                 goto done;
2820
2821         err = msglen;
2822
2823 done:
2824         if (hdev)
2825                 hci_dev_put(hdev);
2826
2827         kfree(buf);
2828         return err;
2829 }
2830
2831 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2832 {
2833         u8 *status = data;
2834
2835         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2836         mgmt_pending_remove(cmd);
2837 }
2838
2839 int mgmt_index_added(struct hci_dev *hdev)
2840 {
2841         if (!mgmt_valid_hdev(hdev))
2842                 return -ENOTSUPP;
2843
2844         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2845 }
2846
2847 int mgmt_index_removed(struct hci_dev *hdev)
2848 {
2849         u8 status = MGMT_STATUS_INVALID_INDEX;
2850
2851         if (!mgmt_valid_hdev(hdev))
2852                 return -ENOTSUPP;
2853
2854         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2855
2856         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2857 }
2858
2859 struct cmd_lookup {
2860         struct sock *sk;
2861         struct hci_dev *hdev;
2862         u8 mgmt_status;
2863 };
2864
2865 static void settings_rsp(struct pending_cmd *cmd, void *data)
2866 {
2867         struct cmd_lookup *match = data;
2868
2869         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2870
2871         list_del(&cmd->list);
2872
2873         if (match->sk == NULL) {
2874                 match->sk = cmd->sk;
2875                 sock_hold(match->sk);
2876         }
2877
2878         mgmt_pending_free(cmd);
2879 }
2880
2881 static int set_bredr_scan(struct hci_dev *hdev)
2882 {
2883         u8 scan = 0;
2884
2885         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2886                 scan |= SCAN_PAGE;
2887         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2888                 scan |= SCAN_INQUIRY;
2889
2890         if (!scan)
2891                 return 0;
2892
2893         return hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2894 }
2895
2896 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2897 {
2898         struct cmd_lookup match = { NULL, hdev };
2899         int err;
2900
2901         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2902                 return 0;
2903
2904         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2905
2906         if (powered) {
2907                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
2908                     !lmp_host_ssp_capable(hdev)) {
2909                         u8 ssp = 1;
2910
2911                         hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
2912                 }
2913
2914                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2915                         struct hci_cp_write_le_host_supported cp;
2916
2917                         cp.le = 1;
2918                         cp.simul = lmp_le_br_capable(hdev);
2919
2920                         /* Check first if we already have the right
2921                          * host state (host features set)
2922                          */
2923                         if (cp.le != lmp_host_le_capable(hdev) ||
2924                             cp.simul != lmp_host_le_br_capable(hdev))
2925                                 hci_send_cmd(hdev,
2926                                              HCI_OP_WRITE_LE_HOST_SUPPORTED,
2927                                              sizeof(cp), &cp);
2928                 }
2929
2930                 if (lmp_bredr_capable(hdev)) {
2931                         set_bredr_scan(hdev);
2932                         update_class(hdev);
2933                         update_name(hdev, hdev->dev_name);
2934                         update_eir(hdev);
2935                 }
2936         } else {
2937                 u8 status = MGMT_STATUS_NOT_POWERED;
2938                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2939         }
2940
2941         err = new_settings(hdev, match.sk);
2942
2943         if (match.sk)
2944                 sock_put(match.sk);
2945
2946         return err;
2947 }
2948
2949 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2950 {
2951         struct cmd_lookup match = { NULL, hdev };
2952         bool changed = false;
2953         int err = 0;
2954
2955         if (discoverable) {
2956                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2957                         changed = true;
2958         } else {
2959                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2960                         changed = true;
2961         }
2962
2963         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
2964                              &match);
2965
2966         if (changed)
2967                 err = new_settings(hdev, match.sk);
2968
2969         if (match.sk)
2970                 sock_put(match.sk);
2971
2972         return err;
2973 }
2974
2975 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2976 {
2977         struct cmd_lookup match = { NULL, hdev };
2978         bool changed = false;
2979         int err = 0;
2980
2981         if (connectable) {
2982                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2983                         changed = true;
2984         } else {
2985                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2986                         changed = true;
2987         }
2988
2989         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
2990                              &match);
2991
2992         if (changed)
2993                 err = new_settings(hdev, match.sk);
2994
2995         if (match.sk)
2996                 sock_put(match.sk);
2997
2998         return err;
2999 }
3000
3001 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3002 {
3003         u8 mgmt_err = mgmt_status(status);
3004
3005         if (scan & SCAN_PAGE)
3006                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3007                                      cmd_status_rsp, &mgmt_err);
3008
3009         if (scan & SCAN_INQUIRY)
3010                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3011                                      cmd_status_rsp, &mgmt_err);
3012
3013         return 0;
3014 }
3015
3016 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3017                       bool persistent)
3018 {
3019         struct mgmt_ev_new_link_key ev;
3020
3021         memset(&ev, 0, sizeof(ev));
3022
3023         ev.store_hint = persistent;
3024         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3025         ev.key.addr.type = BDADDR_BREDR;
3026         ev.key.type = key->type;
3027         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3028         ev.key.pin_len = key->pin_len;
3029
3030         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3031 }
3032
3033 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3034 {
3035         struct mgmt_ev_new_long_term_key ev;
3036
3037         memset(&ev, 0, sizeof(ev));
3038
3039         ev.store_hint = persistent;
3040         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3041         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3042         ev.key.authenticated = key->authenticated;
3043         ev.key.enc_size = key->enc_size;
3044         ev.key.ediv = key->ediv;
3045
3046         if (key->type == HCI_SMP_LTK)
3047                 ev.key.master = 1;
3048
3049         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3050         memcpy(ev.key.val, key->val, sizeof(key->val));
3051
3052         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3053                           NULL);
3054 }
3055
3056 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3057                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3058                           u8 *dev_class)
3059 {
3060         char buf[512];
3061         struct mgmt_ev_device_connected *ev = (void *) buf;
3062         u16 eir_len = 0;
3063
3064         bacpy(&ev->addr.bdaddr, bdaddr);
3065         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3066
3067         ev->flags = __cpu_to_le32(flags);
3068
3069         if (name_len > 0)
3070                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3071                                           name, name_len);
3072
3073         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3074                 eir_len = eir_append_data(ev->eir, eir_len,
3075                                           EIR_CLASS_OF_DEV, dev_class, 3);
3076
3077         ev->eir_len = cpu_to_le16(eir_len);
3078
3079         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3080                           sizeof(*ev) + eir_len, NULL);
3081 }
3082
3083 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3084 {
3085         struct mgmt_cp_disconnect *cp = cmd->param;
3086         struct sock **sk = data;
3087         struct mgmt_rp_disconnect rp;
3088
3089         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3090         rp.addr.type = cp->addr.type;
3091
3092         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3093                      sizeof(rp));
3094
3095         *sk = cmd->sk;
3096         sock_hold(*sk);
3097
3098         mgmt_pending_remove(cmd);
3099 }
3100
3101 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3102 {
3103         struct hci_dev *hdev = data;
3104         struct mgmt_cp_unpair_device *cp = cmd->param;
3105         struct mgmt_rp_unpair_device rp;
3106
3107         memset(&rp, 0, sizeof(rp));
3108         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3109         rp.addr.type = cp->addr.type;
3110
3111         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3112
3113         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3114
3115         mgmt_pending_remove(cmd);
3116 }
3117
3118 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3119                              u8 link_type, u8 addr_type, u8 reason)
3120 {
3121         struct mgmt_ev_device_disconnected ev;
3122         struct sock *sk = NULL;
3123         int err;
3124
3125         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3126
3127         bacpy(&ev.addr.bdaddr, bdaddr);
3128         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3129         ev.reason = reason;
3130
3131         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3132                          sk);
3133
3134         if (sk)
3135                 sock_put(sk);
3136
3137         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3138                              hdev);
3139
3140         return err;
3141 }
3142
3143 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3144                            u8 link_type, u8 addr_type, u8 status)
3145 {
3146         struct mgmt_rp_disconnect rp;
3147         struct pending_cmd *cmd;
3148         int err;
3149
3150         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3151                              hdev);
3152
3153         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3154         if (!cmd)
3155                 return -ENOENT;
3156
3157         bacpy(&rp.addr.bdaddr, bdaddr);
3158         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3159
3160         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3161                            mgmt_status(status), &rp, sizeof(rp));
3162
3163         mgmt_pending_remove(cmd);
3164
3165         return err;
3166 }
3167
3168 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3169                         u8 addr_type, u8 status)
3170 {
3171         struct mgmt_ev_connect_failed ev;
3172
3173         bacpy(&ev.addr.bdaddr, bdaddr);
3174         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3175         ev.status = mgmt_status(status);
3176
3177         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3178 }
3179
3180 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3181 {
3182         struct mgmt_ev_pin_code_request ev;
3183
3184         bacpy(&ev.addr.bdaddr, bdaddr);
3185         ev.addr.type = BDADDR_BREDR;
3186         ev.secure = secure;
3187
3188         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3189                           NULL);
3190 }
3191
3192 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3193                                  u8 status)
3194 {
3195         struct pending_cmd *cmd;
3196         struct mgmt_rp_pin_code_reply rp;
3197         int err;
3198
3199         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3200         if (!cmd)
3201                 return -ENOENT;
3202
3203         bacpy(&rp.addr.bdaddr, bdaddr);
3204         rp.addr.type = BDADDR_BREDR;
3205
3206         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3207                            mgmt_status(status), &rp, sizeof(rp));
3208
3209         mgmt_pending_remove(cmd);
3210
3211         return err;
3212 }
3213
3214 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3215                                      u8 status)
3216 {
3217         struct pending_cmd *cmd;
3218         struct mgmt_rp_pin_code_reply rp;
3219         int err;
3220
3221         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3222         if (!cmd)
3223                 return -ENOENT;
3224
3225         bacpy(&rp.addr.bdaddr, bdaddr);
3226         rp.addr.type = BDADDR_BREDR;
3227
3228         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3229                            mgmt_status(status), &rp, sizeof(rp));
3230
3231         mgmt_pending_remove(cmd);
3232
3233         return err;
3234 }
3235
3236 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3237                               u8 link_type, u8 addr_type, __le32 value,
3238                               u8 confirm_hint)
3239 {
3240         struct mgmt_ev_user_confirm_request ev;
3241
3242         BT_DBG("%s", hdev->name);
3243
3244         bacpy(&ev.addr.bdaddr, bdaddr);
3245         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3246         ev.confirm_hint = confirm_hint;
3247         ev.value = value;
3248
3249         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3250                           NULL);
3251 }
3252
3253 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3254                               u8 link_type, u8 addr_type)
3255 {
3256         struct mgmt_ev_user_passkey_request ev;
3257
3258         BT_DBG("%s", hdev->name);
3259
3260         bacpy(&ev.addr.bdaddr, bdaddr);
3261         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3262
3263         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3264                           NULL);
3265 }
3266
3267 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3268                                       u8 link_type, u8 addr_type, u8 status,
3269                                       u8 opcode)
3270 {
3271         struct pending_cmd *cmd;
3272         struct mgmt_rp_user_confirm_reply rp;
3273         int err;
3274
3275         cmd = mgmt_pending_find(opcode, hdev);
3276         if (!cmd)
3277                 return -ENOENT;
3278
3279         bacpy(&rp.addr.bdaddr, bdaddr);
3280         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3281         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3282                            &rp, sizeof(rp));
3283
3284         mgmt_pending_remove(cmd);
3285
3286         return err;
3287 }
3288
3289 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3290                                      u8 link_type, u8 addr_type, u8 status)
3291 {
3292         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3293                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3294 }
3295
3296 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3297                                          u8 link_type, u8 addr_type, u8 status)
3298 {
3299         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3300                                           status,
3301                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3302 }
3303
3304 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3305                                      u8 link_type, u8 addr_type, u8 status)
3306 {
3307         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3308                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3309 }
3310
3311 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3312                                          u8 link_type, u8 addr_type, u8 status)
3313 {
3314         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3315                                           status,
3316                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3317 }
3318
3319 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3320                              u8 link_type, u8 addr_type, u32 passkey,
3321                              u8 entered)
3322 {
3323         struct mgmt_ev_passkey_notify ev;
3324
3325         BT_DBG("%s", hdev->name);
3326
3327         bacpy(&ev.addr.bdaddr, bdaddr);
3328         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3329         ev.passkey = __cpu_to_le32(passkey);
3330         ev.entered = entered;
3331
3332         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3333 }
3334
3335 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3336                      u8 addr_type, u8 status)
3337 {
3338         struct mgmt_ev_auth_failed ev;
3339
3340         bacpy(&ev.addr.bdaddr, bdaddr);
3341         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3342         ev.status = mgmt_status(status);
3343
3344         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3345 }
3346
3347 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3348 {
3349         struct cmd_lookup match = { NULL, hdev };
3350         bool changed = false;
3351         int err = 0;
3352
3353         if (status) {
3354                 u8 mgmt_err = mgmt_status(status);
3355                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3356                                      cmd_status_rsp, &mgmt_err);
3357                 return 0;
3358         }
3359
3360         if (test_bit(HCI_AUTH, &hdev->flags)) {
3361                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3362                         changed = true;
3363         } else {
3364                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3365                         changed = true;
3366         }
3367
3368         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3369                              &match);
3370
3371         if (changed)
3372                 err = new_settings(hdev, match.sk);
3373
3374         if (match.sk)
3375                 sock_put(match.sk);
3376
3377         return err;
3378 }
3379
3380 static int clear_eir(struct hci_dev *hdev)
3381 {
3382         struct hci_cp_write_eir cp;
3383
3384         if (!lmp_ext_inq_capable(hdev))
3385                 return 0;
3386
3387         memset(hdev->eir, 0, sizeof(hdev->eir));
3388
3389         memset(&cp, 0, sizeof(cp));
3390
3391         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3392 }
3393
3394 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3395 {
3396         struct cmd_lookup match = { NULL, hdev };
3397         bool changed = false;
3398         int err = 0;
3399
3400         if (status) {
3401                 u8 mgmt_err = mgmt_status(status);
3402
3403                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3404                                                  &hdev->dev_flags))
3405                         err = new_settings(hdev, NULL);
3406
3407                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3408                                      &mgmt_err);
3409
3410                 return err;
3411         }
3412
3413         if (enable) {
3414                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3415                         changed = true;
3416         } else {
3417                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3418                         changed = true;
3419         }
3420
3421         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3422
3423         if (changed)
3424                 err = new_settings(hdev, match.sk);
3425
3426         if (match.sk)
3427                 sock_put(match.sk);
3428
3429         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3430                 update_eir(hdev);
3431         else
3432                 clear_eir(hdev);
3433
3434         return err;
3435 }
3436
3437 static void class_rsp(struct pending_cmd *cmd, void *data)
3438 {
3439         struct cmd_lookup *match = data;
3440
3441         cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3442                      match->hdev->dev_class, 3);
3443
3444         list_del(&cmd->list);
3445
3446         if (match->sk == NULL) {
3447                 match->sk = cmd->sk;
3448                 sock_hold(match->sk);
3449         }
3450
3451         mgmt_pending_free(cmd);
3452 }
3453
3454 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3455                                    u8 status)
3456 {
3457         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3458         int err = 0;
3459
3460         clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3461
3462         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3463         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3464         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3465
3466         if (!status)
3467                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3468                                  3, NULL);
3469
3470         if (match.sk)
3471                 sock_put(match.sk);
3472
3473         return err;
3474 }
3475
3476 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3477 {
3478         struct pending_cmd *cmd;
3479         struct mgmt_cp_set_local_name ev;
3480         bool changed = false;
3481         int err = 0;
3482
3483         if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3484                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3485                 changed = true;
3486         }
3487
3488         memset(&ev, 0, sizeof(ev));
3489         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3490         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3491
3492         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3493         if (!cmd)
3494                 goto send_event;
3495
3496         /* Always assume that either the short or the complete name has
3497          * changed if there was a pending mgmt command */
3498         changed = true;
3499
3500         if (status) {
3501                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3502                                  mgmt_status(status));
3503                 goto failed;
3504         }
3505
3506         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3507                            sizeof(ev));
3508         if (err < 0)
3509                 goto failed;
3510
3511 send_event:
3512         if (changed)
3513                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3514                                  sizeof(ev), cmd ? cmd->sk : NULL);
3515
3516         /* EIR is taken care of separately when powering on the
3517          * adapter so only update them here if this is a name change
3518          * unrelated to power on.
3519          */
3520         if (!test_bit(HCI_INIT, &hdev->flags))
3521                 update_eir(hdev);
3522
3523 failed:
3524         if (cmd)
3525                 mgmt_pending_remove(cmd);
3526         return err;
3527 }
3528
3529 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3530                                             u8 *randomizer, u8 status)
3531 {
3532         struct pending_cmd *cmd;
3533         int err;
3534
3535         BT_DBG("%s status %u", hdev->name, status);
3536
3537         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3538         if (!cmd)
3539                 return -ENOENT;
3540
3541         if (status) {
3542                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3543                                  mgmt_status(status));
3544         } else {
3545                 struct mgmt_rp_read_local_oob_data rp;
3546
3547                 memcpy(rp.hash, hash, sizeof(rp.hash));
3548                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3549
3550                 err = cmd_complete(cmd->sk, hdev->id,
3551                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3552                                    sizeof(rp));
3553         }
3554
3555         mgmt_pending_remove(cmd);
3556
3557         return err;
3558 }
3559
3560 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3561 {
3562         struct cmd_lookup match = { NULL, hdev };
3563         bool changed = false;
3564         int err = 0;
3565
3566         if (status) {
3567                 u8 mgmt_err = mgmt_status(status);
3568
3569                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3570                                                  &hdev->dev_flags))
3571                         err = new_settings(hdev, NULL);
3572
3573                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3574                                      &mgmt_err);
3575
3576                 return err;
3577         }
3578
3579         if (enable) {
3580                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3581                         changed = true;
3582         } else {
3583                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3584                         changed = true;
3585         }
3586
3587         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3588
3589         if (changed)
3590                 err = new_settings(hdev, match.sk);
3591
3592         if (match.sk)
3593                 sock_put(match.sk);
3594
3595         return err;
3596 }
3597
3598 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3599                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3600                       ssp, u8 *eir, u16 eir_len)
3601 {
3602         char buf[512];
3603         struct mgmt_ev_device_found *ev = (void *) buf;
3604         size_t ev_size;
3605
3606         /* Leave 5 bytes for a potential CoD field */
3607         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3608                 return -EINVAL;
3609
3610         memset(buf, 0, sizeof(buf));
3611
3612         bacpy(&ev->addr.bdaddr, bdaddr);
3613         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3614         ev->rssi = rssi;
3615         if (cfm_name)
3616                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
3617         if (!ssp)
3618                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
3619
3620         if (eir_len > 0)
3621                 memcpy(ev->eir, eir, eir_len);
3622
3623         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3624                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3625                                           dev_class, 3);
3626
3627         ev->eir_len = cpu_to_le16(eir_len);
3628         ev_size = sizeof(*ev) + eir_len;
3629
3630         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3631 }
3632
3633 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3634                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3635 {
3636         struct mgmt_ev_device_found *ev;
3637         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3638         u16 eir_len;
3639
3640         ev = (struct mgmt_ev_device_found *) buf;
3641
3642         memset(buf, 0, sizeof(buf));
3643
3644         bacpy(&ev->addr.bdaddr, bdaddr);
3645         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3646         ev->rssi = rssi;
3647
3648         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3649                                   name_len);
3650
3651         ev->eir_len = cpu_to_le16(eir_len);
3652
3653         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3654                           sizeof(*ev) + eir_len, NULL);
3655 }
3656
3657 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3658 {
3659         struct pending_cmd *cmd;
3660         u8 type;
3661         int err;
3662
3663         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3664
3665         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3666         if (!cmd)
3667                 return -ENOENT;
3668
3669         type = hdev->discovery.type;
3670
3671         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3672                            &type, sizeof(type));
3673         mgmt_pending_remove(cmd);
3674
3675         return err;
3676 }
3677
3678 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3679 {
3680         struct pending_cmd *cmd;
3681         int err;
3682
3683         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3684         if (!cmd)
3685                 return -ENOENT;
3686
3687         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3688                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3689         mgmt_pending_remove(cmd);
3690
3691         return err;
3692 }
3693
3694 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3695 {
3696         struct mgmt_ev_discovering ev;
3697         struct pending_cmd *cmd;
3698
3699         BT_DBG("%s discovering %u", hdev->name, discovering);
3700
3701         if (discovering)
3702                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3703         else
3704                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3705
3706         if (cmd != NULL) {
3707                 u8 type = hdev->discovery.type;
3708
3709                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3710                              sizeof(type));
3711                 mgmt_pending_remove(cmd);
3712         }
3713
3714         memset(&ev, 0, sizeof(ev));
3715         ev.type = hdev->discovery.type;
3716         ev.discovering = discovering;
3717
3718         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3719 }
3720
3721 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3722 {
3723         struct pending_cmd *cmd;
3724         struct mgmt_ev_device_blocked ev;
3725
3726         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3727
3728         bacpy(&ev.addr.bdaddr, bdaddr);
3729         ev.addr.type = type;
3730
3731         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3732                           cmd ? cmd->sk : NULL);
3733 }
3734
3735 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3736 {
3737         struct pending_cmd *cmd;
3738         struct mgmt_ev_device_unblocked ev;
3739
3740         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3741
3742         bacpy(&ev.addr.bdaddr, bdaddr);
3743         ev.addr.type = type;
3744
3745         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3746                           cmd ? cmd->sk : NULL);
3747 }
3748
3749 module_param(enable_hs, bool, 0644);
3750 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");