net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   2
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 /*
 106  * These LE scan and inquiry parameters were chosen according to LE General
 107  * Discovery Procedure specification.
 108  */
 109 #define LE_SCAN_TYPE                    0x01
 110 #define LE_SCAN_WIN                     0x12
 111 #define LE_SCAN_INT                     0x12
 112 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 113 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 114
 115 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 116 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 117
 118 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 119
 120 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 121                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 122
 123 struct pending_cmd {
 124         struct list_head list;
 125         u16 opcode;
 126         int index;
 127         void *param;
 128         struct sock *sk;
 129         void *user_data;
 130 };
 131
 132 /* HCI to MGMT error code conversion table */
 133 static u8 mgmt_status_table[] = {
 134         MGMT_STATUS_SUCCESS,
 135         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 136         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 137         MGMT_STATUS_FAILED,             /* Hardware Failure */
 138         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 139         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 140         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 141         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 142         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 145         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 146         MGMT_STATUS_BUSY,               /* Command Disallowed */
 147         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 148         MGMT_STATUS_REJECTED,           /* Rejected Security */
 149         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 150         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 151         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 153         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 154         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 155         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 156         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 157         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 158         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 159         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 161         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 162         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 163         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 165         MGMT_STATUS_FAILED,             /* Unspecified Error */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 167         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 168         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 169         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 170         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 171         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 172         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 174         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 176         MGMT_STATUS_FAILED,             /* Transaction Collision */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 178         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 180         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 181         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 182         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 183         MGMT_STATUS_FAILED,             /* Slot Violation */
 184         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 185         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 187         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 188         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 189         MGMT_STATUS_BUSY,               /* Controller Busy */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 191         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 192         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 193         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 194         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 195 };
 196
 197 bool mgmt_valid_hdev(struct hci_dev *hdev)
 198 {
 199         return hdev->dev_type == HCI_BREDR;
 200 }
 201
 202 static u8 mgmt_status(u8 hci_status)
 203 {
 204         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 205                 return mgmt_status_table[hci_status];
 206
 207         return MGMT_STATUS_FAILED;
 208 }
 209
 210 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 211 {
 212         struct sk_buff *skb;
 213         struct mgmt_hdr *hdr;
 214         struct mgmt_ev_cmd_status *ev;
 215         int err;
 216
 217         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 218
 219         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 220         if (!skb)
 221                 return -ENOMEM;
 222
 223         hdr = (void *) skb_put(skb, sizeof(*hdr));
 224
 225         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 226         hdr->index = cpu_to_le16(index);
 227         hdr->len = cpu_to_le16(sizeof(*ev));
 228
 229         ev = (void *) skb_put(skb, sizeof(*ev));
 230         ev->status = status;
 231         ev->opcode = cpu_to_le16(cmd);
 232
 233         err = sock_queue_rcv_skb(sk, skb);
 234         if (err < 0)
 235                 kfree_skb(skb);
 236
 237         return err;
 238 }
 239
 240 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 241                         void *rp, size_t rp_len)
 242 {
 243         struct sk_buff *skb;
 244         struct mgmt_hdr *hdr;
 245         struct mgmt_ev_cmd_complete *ev;
 246         int err;
 247
 248         BT_DBG("sock %p", sk);
 249
 250         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 251         if (!skb)
 252                 return -ENOMEM;
 253
 254         hdr = (void *) skb_put(skb, sizeof(*hdr));
 255
 256         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 257         hdr->index = cpu_to_le16(index);
 258         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 259
 260         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 261         ev->opcode = cpu_to_le16(cmd);
 262         ev->status = status;
 263
 264         if (rp)
 265                 memcpy(ev->data, rp, rp_len);
 266
 267         err = sock_queue_rcv_skb(sk, skb);
 268         if (err < 0)
 269                 kfree_skb(skb);
 270
 271         return err;
 272 }
 273
 274 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 275                         u16 data_len)
 276 {
 277         struct mgmt_rp_read_version rp;
 278
 279         BT_DBG("sock %p", sk);
 280
 281         rp.version = MGMT_VERSION;
 282         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 283
 284         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 285                             sizeof(rp));
 286 }
 287
 288 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 289                          u16 data_len)
 290 {
 291         struct mgmt_rp_read_commands *rp;
 292         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 293         const u16 num_events = ARRAY_SIZE(mgmt_events);
 294         __le16 *opcode;
 295         size_t rp_size;
 296         int i, err;
 297
 298         BT_DBG("sock %p", sk);
 299
 300         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 301
 302         rp = kmalloc(rp_size, GFP_KERNEL);
 303         if (!rp)
 304                 return -ENOMEM;
 305
 306         rp->num_commands = __constant_cpu_to_le16(num_commands);
 307         rp->num_events = __constant_cpu_to_le16(num_events);
 308
 309         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 310                 put_unaligned_le16(mgmt_commands[i], opcode);
 311
 312         for (i = 0; i < num_events; i++, opcode++)
 313                 put_unaligned_le16(mgmt_events[i], opcode);
 314
 315         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 316                            rp_size);
 317         kfree(rp);
 318
 319         return err;
 320 }
 321
 322 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 323                            u16 data_len)
 324 {
 325         struct mgmt_rp_read_index_list *rp;
 326         struct hci_dev *d;
 327         size_t rp_len;
 328         u16 count;
 329         int err;
 330
 331         BT_DBG("sock %p", sk);
 332
 333         read_lock(&hci_dev_list_lock);
 334
 335         count = 0;
 336         list_for_each_entry(d, &hci_dev_list, list) {
 337                 if (!mgmt_valid_hdev(d))
 338                         continue;
 339
 340                 count++;
 341         }
 342
 343         rp_len = sizeof(*rp) + (2 * count);
 344         rp = kmalloc(rp_len, GFP_ATOMIC);
 345         if (!rp) {
 346                 read_unlock(&hci_dev_list_lock);
 347                 return -ENOMEM;
 348         }
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (test_bit(HCI_SETUP, &d->dev_flags))
 353                         continue;
 354
 355                 if (!mgmt_valid_hdev(d))
 356                         continue;
 357
 358                 rp->index[count++] = cpu_to_le16(d->id);
 359                 BT_DBG("Added hci%u", d->id);
 360         }
 361
 362         rp->num_controllers = cpu_to_le16(count);
 363         rp_len = sizeof(*rp) + (2 * count);
 364
 365         read_unlock(&hci_dev_list_lock);
 366
 367         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 368                            rp_len);
 369
 370         kfree(rp);
 371
 372         return err;
 373 }
 374
 375 static u32 get_supported_settings(struct hci_dev *hdev)
 376 {
 377         u32 settings = 0;
 378
 379         settings |= MGMT_SETTING_POWERED;
 380         settings |= MGMT_SETTING_PAIRABLE;
 381
 382         if (lmp_ssp_capable(hdev))
 383                 settings |= MGMT_SETTING_SSP;
 384
 385         if (lmp_bredr_capable(hdev)) {
 386                 settings |= MGMT_SETTING_CONNECTABLE;
 387                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 388                 settings |= MGMT_SETTING_DISCOVERABLE;
 389                 settings |= MGMT_SETTING_BREDR;
 390                 settings |= MGMT_SETTING_LINK_SECURITY;
 391         }
 392
 393         if (enable_hs)
 394                 settings |= MGMT_SETTING_HS;
 395
 396         if (lmp_le_capable(hdev))
 397                 settings |= MGMT_SETTING_LE;
 398
 399         return settings;
 400 }
 401
 402 static u32 get_current_settings(struct hci_dev *hdev)
 403 {
 404         u32 settings = 0;
 405
 406         if (hdev_is_powered(hdev))
 407                 settings |= MGMT_SETTING_POWERED;
 408
 409         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 410                 settings |= MGMT_SETTING_CONNECTABLE;
 411
 412         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 413                 settings |= MGMT_SETTING_DISCOVERABLE;
 414
 415         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 416                 settings |= MGMT_SETTING_PAIRABLE;
 417
 418         if (lmp_bredr_capable(hdev))
 419                 settings |= MGMT_SETTING_BREDR;
 420
 421         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 422                 settings |= MGMT_SETTING_LE;
 423
 424         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 425                 settings |= MGMT_SETTING_LINK_SECURITY;
 426
 427         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 428                 settings |= MGMT_SETTING_SSP;
 429
 430         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 431                 settings |= MGMT_SETTING_HS;
 432
 433         return settings;
 434 }
 435
 436 #define PNP_INFO_SVCLASS_ID             0x1200
 437
 438 static u8 bluetooth_base_uuid[] = {
 439                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 440                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 441 };
 442
 443 static u16 get_uuid16(u8 *uuid128)
 444 {
 445         u32 val;
 446         int i;
 447
 448         for (i = 0; i < 12; i++) {
 449                 if (bluetooth_base_uuid[i] != uuid128[i])
 450                         return 0;
 451         }
 452
 453         val = get_unaligned_le32(&uuid128[12]);
 454         if (val > 0xffff)
 455                 return 0;
 456
 457         return (u16) val;
 458 }
 459
 460 static void create_eir(struct hci_dev *hdev, u8 *data)
 461 {
 462         u8 *ptr = data;
 463         u16 eir_len = 0;
 464         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 465         int i, truncated = 0;
 466         struct bt_uuid *uuid;
 467         size_t name_len;
 468
 469         name_len = strlen(hdev->dev_name);
 470
 471         if (name_len > 0) {
 472                 /* EIR Data type */
 473                 if (name_len > 48) {
 474                         name_len = 48;
 475                         ptr[1] = EIR_NAME_SHORT;
 476                 } else
 477                         ptr[1] = EIR_NAME_COMPLETE;
 478
 479                 /* EIR Data length */
 480                 ptr[0] = name_len + 1;
 481
 482                 memcpy(ptr + 2, hdev->dev_name, name_len);
 483
 484                 eir_len += (name_len + 2);
 485                 ptr += (name_len + 2);
 486         }
 487
 488         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 489                 ptr[0] = 2;
 490                 ptr[1] = EIR_TX_POWER;
 491                 ptr[2] = (u8) hdev->inq_tx_power;
 492
 493                 eir_len += 3;
 494                 ptr += 3;
 495         }
 496
 497         if (hdev->devid_source > 0) {
 498                 ptr[0] = 9;
 499                 ptr[1] = EIR_DEVICE_ID;
 500
 501                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 502                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 503                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 504                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 505
 506                 eir_len += 10;
 507                 ptr += 10;
 508         }
 509
 510         memset(uuid16_list, 0, sizeof(uuid16_list));
 511
 512         /* Group all UUID16 types */
 513         list_for_each_entry(uuid, &hdev->uuids, list) {
 514                 u16 uuid16;
 515
 516                 uuid16 = get_uuid16(uuid->uuid);
 517                 if (uuid16 == 0)
 518                         return;
 519
 520                 if (uuid16 < 0x1100)
 521                         continue;
 522
 523                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 524                         continue;
 525
 526                 /* Stop if not enough space to put next UUID */
 527                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 528                         truncated = 1;
 529                         break;
 530                 }
 531
 532                 /* Check for duplicates */
 533                 for (i = 0; uuid16_list[i] != 0; i++)
 534                         if (uuid16_list[i] == uuid16)
 535                                 break;
 536
 537                 if (uuid16_list[i] == 0) {
 538                         uuid16_list[i] = uuid16;
 539                         eir_len += sizeof(u16);
 540                 }
 541         }
 542
 543         if (uuid16_list[0] != 0) {
 544                 u8 *length = ptr;
 545
 546                 /* EIR Data type */
 547                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 548
 549                 ptr += 2;
 550                 eir_len += 2;
 551
 552                 for (i = 0; uuid16_list[i] != 0; i++) {
 553                         *ptr++ = (uuid16_list[i] & 0x00ff);
 554                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 555                 }
 556
 557                 /* EIR Data length */
 558                 *length = (i * sizeof(u16)) + 1;
 559         }
 560 }
 561
 562 static int update_eir(struct hci_dev *hdev)
 563 {
 564         struct hci_cp_write_eir cp;
 565
 566         if (!hdev_is_powered(hdev))
 567                 return 0;
 568
 569         if (!lmp_ext_inq_capable(hdev))
 570                 return 0;
 571
 572         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 573                 return 0;
 574
 575         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 576                 return 0;
 577
 578         memset(&cp, 0, sizeof(cp));
 579
 580         create_eir(hdev, cp.data);
 581
 582         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 583                 return 0;
 584
 585         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 586
 587         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 588 }
 589
 590 static u8 get_service_classes(struct hci_dev *hdev)
 591 {
 592         struct bt_uuid *uuid;
 593         u8 val = 0;
 594
 595         list_for_each_entry(uuid, &hdev->uuids, list)
 596                 val |= uuid->svc_hint;
 597
 598         return val;
 599 }
 600
 601 static int update_class(struct hci_dev *hdev)
 602 {
 603         u8 cod[3];
 604         int err;
 605
 606         BT_DBG("%s", hdev->name);
 607
 608         if (!hdev_is_powered(hdev))
 609                 return 0;
 610
 611         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 612                 return 0;
 613
 614         cod[0] = hdev->minor_class;
 615         cod[1] = hdev->major_class;
 616         cod[2] = get_service_classes(hdev);
 617
 618         if (memcmp(cod, hdev->dev_class, 3) == 0)
 619                 return 0;
 620
 621         err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 622         if (err == 0)
 623                 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
 624
 625         return err;
 626 }
 627
 628 static void service_cache_off(struct work_struct *work)
 629 {
 630         struct hci_dev *hdev = container_of(work, struct hci_dev,
 631                                             service_cache.work);
 632
 633         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 634                 return;
 635
 636         hci_dev_lock(hdev);
 637
 638         update_eir(hdev);
 639         update_class(hdev);
 640
 641         hci_dev_unlock(hdev);
 642 }
 643
 644 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 645 {
 646         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 647                 return;
 648
 649         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 650
 651         /* Non-mgmt controlled devices get this bit set
 652          * implicitly so that pairing works for them, however
 653          * for mgmt we require user-space to explicitly enable
 654          * it
 655          */
 656         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 657 }
 658
 659 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 660                                 void *data, u16 data_len)
 661 {
 662         struct mgmt_rp_read_info rp;
 663
 664         BT_DBG("sock %p %s", sk, hdev->name);
 665
 666         hci_dev_lock(hdev);
 667
 668         memset(&rp, 0, sizeof(rp));
 669
 670         bacpy(&rp.bdaddr, &hdev->bdaddr);
 671
 672         rp.version = hdev->hci_ver;
 673         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 674
 675         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 676         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 677
 678         memcpy(rp.dev_class, hdev->dev_class, 3);
 679
 680         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 681         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 682
 683         hci_dev_unlock(hdev);
 684
 685         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 686                             sizeof(rp));
 687 }
 688
 689 static void mgmt_pending_free(struct pending_cmd *cmd)
 690 {
 691         sock_put(cmd->sk);
 692         kfree(cmd->param);
 693         kfree(cmd);
 694 }
 695
 696 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 697                                             struct hci_dev *hdev, void *data,
 698                                             u16 len)
 699 {
 700         struct pending_cmd *cmd;
 701
 702         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 703         if (!cmd)
 704                 return NULL;
 705
 706         cmd->opcode = opcode;
 707         cmd->index = hdev->id;
 708
 709         cmd->param = kmalloc(len, GFP_KERNEL);
 710         if (!cmd->param) {
 711                 kfree(cmd);
 712                 return NULL;
 713         }
 714
 715         if (data)
 716                 memcpy(cmd->param, data, len);
 717
 718         cmd->sk = sk;
 719         sock_hold(sk);
 720
 721         list_add(&cmd->list, &hdev->mgmt_pending);
 722
 723         return cmd;
 724 }
 725
 726 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 727                                  void (*cb)(struct pending_cmd *cmd,
 728                                             void *data),
 729                                  void *data)
 730 {
 731         struct list_head *p, *n;
 732
 733         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 734                 struct pending_cmd *cmd;
 735
 736                 cmd = list_entry(p, struct pending_cmd, list);
 737
 738                 if (opcode > 0 && cmd->opcode != opcode)
 739                         continue;
 740
 741                 cb(cmd, data);
 742         }
 743 }
 744
 745 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 746 {
 747         struct pending_cmd *cmd;
 748
 749         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 750                 if (cmd->opcode == opcode)
 751                         return cmd;
 752         }
 753
 754         return NULL;
 755 }
 756
 757 static void mgmt_pending_remove(struct pending_cmd *cmd)
 758 {
 759         list_del(&cmd->list);
 760         mgmt_pending_free(cmd);
 761 }
 762
 763 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 764 {
 765         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 766
 767         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 768                             sizeof(settings));
 769 }
 770
 771 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 772                        u16 len)
 773 {
 774         struct mgmt_mode *cp = data;
 775         struct pending_cmd *cmd;
 776         int err;
 777
 778         BT_DBG("request for %s", hdev->name);
 779
 780         if (cp->val != 0x00 && cp->val != 0x01)
 781                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 782                                   MGMT_STATUS_INVALID_PARAMS);
 783
 784         hci_dev_lock(hdev);
 785
 786         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 787                 cancel_delayed_work(&hdev->power_off);
 788
 789                 if (cp->val) {
 790                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 791                                          data, len);
 792                         err = mgmt_powered(hdev, 1);
 793                         goto failed;
 794                 }
 795         }
 796
 797         if (!!cp->val == hdev_is_powered(hdev)) {
 798                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 799                 goto failed;
 800         }
 801
 802         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 803                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 804                                  MGMT_STATUS_BUSY);
 805                 goto failed;
 806         }
 807
 808         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 809         if (!cmd) {
 810                 err = -ENOMEM;
 811                 goto failed;
 812         }
 813
 814         if (cp->val)
 815                 queue_work(hdev->req_workqueue, &hdev->power_on);
 816         else
 817                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 818
 819         err = 0;
 820
 821 failed:
 822         hci_dev_unlock(hdev);
 823         return err;
 824 }
 825
 826 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 827                       struct sock *skip_sk)
 828 {
 829         struct sk_buff *skb;
 830         struct mgmt_hdr *hdr;
 831
 832         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 833         if (!skb)
 834                 return -ENOMEM;
 835
 836         hdr = (void *) skb_put(skb, sizeof(*hdr));
 837         hdr->opcode = cpu_to_le16(event);
 838         if (hdev)
 839                 hdr->index = cpu_to_le16(hdev->id);
 840         else
 841                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 842         hdr->len = cpu_to_le16(data_len);
 843
 844         if (data)
 845                 memcpy(skb_put(skb, data_len), data, data_len);
 846
 847         /* Time stamp */
 848         __net_timestamp(skb);
 849
 850         hci_send_to_control(skb, skip_sk);
 851         kfree_skb(skb);
 852
 853         return 0;
 854 }
 855
 856 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 857 {
 858         __le32 ev;
 859
 860         ev = cpu_to_le32(get_current_settings(hdev));
 861
 862         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 863 }
 864
 865 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 866                             u16 len)
 867 {
 868         struct mgmt_cp_set_discoverable *cp = data;
 869         struct pending_cmd *cmd;
 870         u16 timeout;
 871         u8 scan;
 872         int err;
 873
 874         BT_DBG("request for %s", hdev->name);
 875
 876         if (!lmp_bredr_capable(hdev))
 877                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 878                                  MGMT_STATUS_NOT_SUPPORTED);
 879
 880         if (cp->val != 0x00 && cp->val != 0x01)
 881                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 882                                   MGMT_STATUS_INVALID_PARAMS);
 883
 884         timeout = __le16_to_cpu(cp->timeout);
 885         if (!cp->val && timeout > 0)
 886                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 887                                   MGMT_STATUS_INVALID_PARAMS);
 888
 889         hci_dev_lock(hdev);
 890
 891         if (!hdev_is_powered(hdev) && timeout > 0) {
 892                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 893                                  MGMT_STATUS_NOT_POWERED);
 894                 goto failed;
 895         }
 896
 897         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 898             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 899                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 900                                  MGMT_STATUS_BUSY);
 901                 goto failed;
 902         }
 903
 904         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 905                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 906                                  MGMT_STATUS_REJECTED);
 907                 goto failed;
 908         }
 909
 910         if (!hdev_is_powered(hdev)) {
 911                 bool changed = false;
 912
 913                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 914                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 915                         changed = true;
 916                 }
 917
 918                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 919                 if (err < 0)
 920                         goto failed;
 921
 922                 if (changed)
 923                         err = new_settings(hdev, sk);
 924
 925                 goto failed;
 926         }
 927
 928         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 929                 if (hdev->discov_timeout > 0) {
 930                         cancel_delayed_work(&hdev->discov_off);
 931                         hdev->discov_timeout = 0;
 932                 }
 933
 934                 if (cp->val && timeout > 0) {
 935                         hdev->discov_timeout = timeout;
 936                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 937                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 938                 }
 939
 940                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 941                 goto failed;
 942         }
 943
 944         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 945         if (!cmd) {
 946                 err = -ENOMEM;
 947                 goto failed;
 948         }
 949
 950         scan = SCAN_PAGE;
 951
 952         if (cp->val)
 953                 scan |= SCAN_INQUIRY;
 954         else
 955                 cancel_delayed_work(&hdev->discov_off);
 956
 957         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 958         if (err < 0)
 959                 mgmt_pending_remove(cmd);
 960
 961         if (cp->val)
 962                 hdev->discov_timeout = timeout;
 963
 964 failed:
 965         hci_dev_unlock(hdev);
 966         return err;
 967 }
 968
 969 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
 970                            u16 len)
 971 {
 972         struct mgmt_mode *cp = data;
 973         struct pending_cmd *cmd;
 974         u8 scan;
 975         int err;
 976
 977         BT_DBG("request for %s", hdev->name);
 978
 979         if (!lmp_bredr_capable(hdev))
 980                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
 981                                   MGMT_STATUS_NOT_SUPPORTED);
 982
 983         if (cp->val != 0x00 && cp->val != 0x01)
 984                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
 985                                   MGMT_STATUS_INVALID_PARAMS);
 986
 987         hci_dev_lock(hdev);
 988
 989         if (!hdev_is_powered(hdev)) {
 990                 bool changed = false;
 991
 992                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 993                         changed = true;
 994
 995                 if (cp->val) {
 996                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 997                 } else {
 998                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 999                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1000                 }
1001
1002                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1003                 if (err < 0)
1004                         goto failed;
1005
1006                 if (changed)
1007                         err = new_settings(hdev, sk);
1008
1009                 goto failed;
1010         }
1011
1012         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1013             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1014                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1015                                  MGMT_STATUS_BUSY);
1016                 goto failed;
1017         }
1018
1019         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1020                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1021                 goto failed;
1022         }
1023
1024         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1025         if (!cmd) {
1026                 err = -ENOMEM;
1027                 goto failed;
1028         }
1029
1030         if (cp->val) {
1031                 scan = SCAN_PAGE;
1032         } else {
1033                 scan = 0;
1034
1035                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1036                     hdev->discov_timeout > 0)
1037                         cancel_delayed_work(&hdev->discov_off);
1038         }
1039
1040         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1041         if (err < 0)
1042                 mgmt_pending_remove(cmd);
1043
1044 failed:
1045         hci_dev_unlock(hdev);
1046         return err;
1047 }
1048
1049 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1050                         u16 len)
1051 {
1052         struct mgmt_mode *cp = data;
1053         int err;
1054
1055         BT_DBG("request for %s", hdev->name);
1056
1057         if (cp->val != 0x00 && cp->val != 0x01)
1058                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1059                                   MGMT_STATUS_INVALID_PARAMS);
1060
1061         hci_dev_lock(hdev);
1062
1063         if (cp->val)
1064                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1065         else
1066                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1067
1068         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1069         if (err < 0)
1070                 goto failed;
1071
1072         err = new_settings(hdev, sk);
1073
1074 failed:
1075         hci_dev_unlock(hdev);
1076         return err;
1077 }
1078
1079 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1080                              u16 len)
1081 {
1082         struct mgmt_mode *cp = data;
1083         struct pending_cmd *cmd;
1084         u8 val;
1085         int err;
1086
1087         BT_DBG("request for %s", hdev->name);
1088
1089         if (!lmp_bredr_capable(hdev))
1090                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1091                                   MGMT_STATUS_NOT_SUPPORTED);
1092
1093         if (cp->val != 0x00 && cp->val != 0x01)
1094                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1095                                   MGMT_STATUS_INVALID_PARAMS);
1096
1097         hci_dev_lock(hdev);
1098
1099         if (!hdev_is_powered(hdev)) {
1100                 bool changed = false;
1101
1102                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1103                                           &hdev->dev_flags)) {
1104                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1105                         changed = true;
1106                 }
1107
1108                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1109                 if (err < 0)
1110                         goto failed;
1111
1112                 if (changed)
1113                         err = new_settings(hdev, sk);
1114
1115                 goto failed;
1116         }
1117
1118         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1119                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1120                                  MGMT_STATUS_BUSY);
1121                 goto failed;
1122         }
1123
1124         val = !!cp->val;
1125
1126         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1127                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1128                 goto failed;
1129         }
1130
1131         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1132         if (!cmd) {
1133                 err = -ENOMEM;
1134                 goto failed;
1135         }
1136
1137         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1138         if (err < 0) {
1139                 mgmt_pending_remove(cmd);
1140                 goto failed;
1141         }
1142
1143 failed:
1144         hci_dev_unlock(hdev);
1145         return err;
1146 }
1147
1148 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1149 {
1150         struct mgmt_mode *cp = data;
1151         struct pending_cmd *cmd;
1152         u8 val;
1153         int err;
1154
1155         BT_DBG("request for %s", hdev->name);
1156
1157         if (!lmp_ssp_capable(hdev))
1158                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1159                                   MGMT_STATUS_NOT_SUPPORTED);
1160
1161         if (cp->val != 0x00 && cp->val != 0x01)
1162                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1163                                   MGMT_STATUS_INVALID_PARAMS);
1164
1165         hci_dev_lock(hdev);
1166
1167         val = !!cp->val;
1168
1169         if (!hdev_is_powered(hdev)) {
1170                 bool changed = false;
1171
1172                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1173                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1174                         changed = true;
1175                 }
1176
1177                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1178                 if (err < 0)
1179                         goto failed;
1180
1181                 if (changed)
1182                         err = new_settings(hdev, sk);
1183
1184                 goto failed;
1185         }
1186
1187         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1188                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1189                                  MGMT_STATUS_BUSY);
1190                 goto failed;
1191         }
1192
1193         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1194                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1195                 goto failed;
1196         }
1197
1198         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1199         if (!cmd) {
1200                 err = -ENOMEM;
1201                 goto failed;
1202         }
1203
1204         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1205         if (err < 0) {
1206                 mgmt_pending_remove(cmd);
1207                 goto failed;
1208         }
1209
1210 failed:
1211         hci_dev_unlock(hdev);
1212         return err;
1213 }
1214
1215 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1216 {
1217         struct mgmt_mode *cp = data;
1218
1219         BT_DBG("request for %s", hdev->name);
1220
1221         if (!enable_hs)
1222                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1223                                   MGMT_STATUS_NOT_SUPPORTED);
1224
1225         if (cp->val != 0x00 && cp->val != 0x01)
1226                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1227                                   MGMT_STATUS_INVALID_PARAMS);
1228
1229         if (cp->val)
1230                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1231         else
1232                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1233
1234         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1235 }
1236
1237 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1238 {
1239         struct mgmt_mode *cp = data;
1240         struct hci_cp_write_le_host_supported hci_cp;
1241         struct pending_cmd *cmd;
1242         int err;
1243         u8 val, enabled;
1244
1245         BT_DBG("request for %s", hdev->name);
1246
1247         if (!lmp_le_capable(hdev))
1248                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1249                                   MGMT_STATUS_NOT_SUPPORTED);
1250
1251         if (cp->val != 0x00 && cp->val != 0x01)
1252                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1253                                   MGMT_STATUS_INVALID_PARAMS);
1254
1255         hci_dev_lock(hdev);
1256
1257         val = !!cp->val;
1258         enabled = lmp_host_le_capable(hdev);
1259
1260         if (!hdev_is_powered(hdev) || val == enabled) {
1261                 bool changed = false;
1262
1263                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1264                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1265                         changed = true;
1266                 }
1267
1268                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1269                 if (err < 0)
1270                         goto unlock;
1271
1272                 if (changed)
1273                         err = new_settings(hdev, sk);
1274
1275                 goto unlock;
1276         }
1277
1278         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1279                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1280                                  MGMT_STATUS_BUSY);
1281                 goto unlock;
1282         }
1283
1284         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1285         if (!cmd) {
1286                 err = -ENOMEM;
1287                 goto unlock;
1288         }
1289
1290         memset(&hci_cp, 0, sizeof(hci_cp));
1291
1292         if (val) {
1293                 hci_cp.le = val;
1294                 hci_cp.simul = lmp_le_br_capable(hdev);
1295         }
1296
1297         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1298                            &hci_cp);
1299         if (err < 0)
1300                 mgmt_pending_remove(cmd);
1301
1302 unlock:
1303         hci_dev_unlock(hdev);
1304         return err;
1305 }
1306
1307 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1308 {
1309         struct mgmt_cp_add_uuid *cp = data;
1310         struct pending_cmd *cmd;
1311         struct bt_uuid *uuid;
1312         int err;
1313
1314         BT_DBG("request for %s", hdev->name);
1315
1316         hci_dev_lock(hdev);
1317
1318         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1319                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1320                                  MGMT_STATUS_BUSY);
1321                 goto failed;
1322         }
1323
1324         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1325         if (!uuid) {
1326                 err = -ENOMEM;
1327                 goto failed;
1328         }
1329
1330         memcpy(uuid->uuid, cp->uuid, 16);
1331         uuid->svc_hint = cp->svc_hint;
1332
1333         list_add(&uuid->list, &hdev->uuids);
1334
1335         err = update_class(hdev);
1336         if (err < 0)
1337                 goto failed;
1338
1339         err = update_eir(hdev);
1340         if (err < 0)
1341                 goto failed;
1342
1343         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1344                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1345                                    hdev->dev_class, 3);
1346                 goto failed;
1347         }
1348
1349         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1350         if (!cmd)
1351                 err = -ENOMEM;
1352
1353 failed:
1354         hci_dev_unlock(hdev);
1355         return err;
1356 }
1357
1358 static bool enable_service_cache(struct hci_dev *hdev)
1359 {
1360         if (!hdev_is_powered(hdev))
1361                 return false;
1362
1363         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1364                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1365                                    CACHE_TIMEOUT);
1366                 return true;
1367         }
1368
1369         return false;
1370 }
1371
1372 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1373                        u16 len)
1374 {
1375         struct mgmt_cp_remove_uuid *cp = data;
1376         struct pending_cmd *cmd;
1377         struct list_head *p, *n;
1378         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1379         int err, found;
1380
1381         BT_DBG("request for %s", hdev->name);
1382
1383         hci_dev_lock(hdev);
1384
1385         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1386                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1387                                  MGMT_STATUS_BUSY);
1388                 goto unlock;
1389         }
1390
1391         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1392                 err = hci_uuids_clear(hdev);
1393
1394                 if (enable_service_cache(hdev)) {
1395                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1396                                            0, hdev->dev_class, 3);
1397                         goto unlock;
1398                 }
1399
1400                 goto update_class;
1401         }
1402
1403         found = 0;
1404
1405         list_for_each_safe(p, n, &hdev->uuids) {
1406                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1407
1408                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1409                         continue;
1410
1411                 list_del(&match->list);
1412                 kfree(match);
1413                 found++;
1414         }
1415
1416         if (found == 0) {
1417                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1418                                  MGMT_STATUS_INVALID_PARAMS);
1419                 goto unlock;
1420         }
1421
1422 update_class:
1423         err = update_class(hdev);
1424         if (err < 0)
1425                 goto unlock;
1426
1427         err = update_eir(hdev);
1428         if (err < 0)
1429                 goto unlock;
1430
1431         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1432                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1433                                    hdev->dev_class, 3);
1434                 goto unlock;
1435         }
1436
1437         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1438         if (!cmd)
1439                 err = -ENOMEM;
1440
1441 unlock:
1442         hci_dev_unlock(hdev);
1443         return err;
1444 }
1445
1446 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1447                          u16 len)
1448 {
1449         struct mgmt_cp_set_dev_class *cp = data;
1450         struct pending_cmd *cmd;
1451         int err;
1452
1453         BT_DBG("request for %s", hdev->name);
1454
1455         if (!lmp_bredr_capable(hdev))
1456                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1457                                   MGMT_STATUS_NOT_SUPPORTED);
1458
1459         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags))
1460                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1461                                   MGMT_STATUS_BUSY);
1462
1463         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0)
1464                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1465                                   MGMT_STATUS_INVALID_PARAMS);
1466
1467         hci_dev_lock(hdev);
1468
1469         hdev->major_class = cp->major;
1470         hdev->minor_class = cp->minor;
1471
1472         if (!hdev_is_powered(hdev)) {
1473                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1474                                    hdev->dev_class, 3);
1475                 goto unlock;
1476         }
1477
1478         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1479                 hci_dev_unlock(hdev);
1480                 cancel_delayed_work_sync(&hdev->service_cache);
1481                 hci_dev_lock(hdev);
1482                 update_eir(hdev);
1483         }
1484
1485         err = update_class(hdev);
1486         if (err < 0)
1487                 goto unlock;
1488
1489         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1490                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1491                                    hdev->dev_class, 3);
1492                 goto unlock;
1493         }
1494
1495         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1496         if (!cmd)
1497                 err = -ENOMEM;
1498
1499 unlock:
1500         hci_dev_unlock(hdev);
1501         return err;
1502 }
1503
1504 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1505                           u16 len)
1506 {
1507         struct mgmt_cp_load_link_keys *cp = data;
1508         u16 key_count, expected_len;
1509         int i;
1510
1511         key_count = __le16_to_cpu(cp->key_count);
1512
1513         expected_len = sizeof(*cp) + key_count *
1514                                         sizeof(struct mgmt_link_key_info);
1515         if (expected_len != len) {
1516                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1517                        len, expected_len);
1518                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1519                                   MGMT_STATUS_INVALID_PARAMS);
1520         }
1521
1522         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1523                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1524                                   MGMT_STATUS_INVALID_PARAMS);
1525
1526         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1527                key_count);
1528
1529         for (i = 0; i < key_count; i++) {
1530                 struct mgmt_link_key_info *key = &cp->keys[i];
1531
1532                 if (key->addr.type != BDADDR_BREDR)
1533                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1534                                           MGMT_STATUS_INVALID_PARAMS);
1535         }
1536
1537         hci_dev_lock(hdev);
1538
1539         hci_link_keys_clear(hdev);
1540
1541         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1542
1543         if (cp->debug_keys)
1544                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1545         else
1546                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1547
1548         for (i = 0; i < key_count; i++) {
1549                 struct mgmt_link_key_info *key = &cp->keys[i];
1550
1551                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1552                                  key->type, key->pin_len);
1553         }
1554
1555         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1556
1557         hci_dev_unlock(hdev);
1558
1559         return 0;
1560 }
1561
1562 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1563                            u8 addr_type, struct sock *skip_sk)
1564 {
1565         struct mgmt_ev_device_unpaired ev;
1566
1567         bacpy(&ev.addr.bdaddr, bdaddr);
1568         ev.addr.type = addr_type;
1569
1570         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1571                           skip_sk);
1572 }
1573
1574 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1575                          u16 len)
1576 {
1577         struct mgmt_cp_unpair_device *cp = data;
1578         struct mgmt_rp_unpair_device rp;
1579         struct hci_cp_disconnect dc;
1580         struct pending_cmd *cmd;
1581         struct hci_conn *conn;
1582         int err;
1583
1584         memset(&rp, 0, sizeof(rp));
1585         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1586         rp.addr.type = cp->addr.type;
1587
1588         if (!bdaddr_type_is_valid(cp->addr.type))
1589                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1590                                     MGMT_STATUS_INVALID_PARAMS,
1591                                     &rp, sizeof(rp));
1592
1593         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1594                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1595                                     MGMT_STATUS_INVALID_PARAMS,
1596                                     &rp, sizeof(rp));
1597
1598         hci_dev_lock(hdev);
1599
1600         if (!hdev_is_powered(hdev)) {
1601                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1602                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1603                 goto unlock;
1604         }
1605
1606         if (cp->addr.type == BDADDR_BREDR)
1607                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1608         else
1609                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1610
1611         if (err < 0) {
1612                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1613                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1614                 goto unlock;
1615         }
1616
1617         if (cp->disconnect) {
1618                 if (cp->addr.type == BDADDR_BREDR)
1619                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1620                                                        &cp->addr.bdaddr);
1621                 else
1622                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1623                                                        &cp->addr.bdaddr);
1624         } else {
1625                 conn = NULL;
1626         }
1627
1628         if (!conn) {
1629                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1630                                    &rp, sizeof(rp));
1631                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1632                 goto unlock;
1633         }
1634
1635         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1636                                sizeof(*cp));
1637         if (!cmd) {
1638                 err = -ENOMEM;
1639                 goto unlock;
1640         }
1641
1642         dc.handle = cpu_to_le16(conn->handle);
1643         dc.reason = 0x13; /* Remote User Terminated Connection */
1644         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1645         if (err < 0)
1646                 mgmt_pending_remove(cmd);
1647
1648 unlock:
1649         hci_dev_unlock(hdev);
1650         return err;
1651 }
1652
1653 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1654                       u16 len)
1655 {
1656         struct mgmt_cp_disconnect *cp = data;
1657         struct mgmt_rp_disconnect rp;
1658         struct hci_cp_disconnect dc;
1659         struct pending_cmd *cmd;
1660         struct hci_conn *conn;
1661         int err;
1662
1663         BT_DBG("");
1664
1665         memset(&rp, 0, sizeof(rp));
1666         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1667         rp.addr.type = cp->addr.type;
1668
1669         if (!bdaddr_type_is_valid(cp->addr.type))
1670                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1671                                     MGMT_STATUS_INVALID_PARAMS,
1672                                     &rp, sizeof(rp));
1673
1674         hci_dev_lock(hdev);
1675
1676         if (!test_bit(HCI_UP, &hdev->flags)) {
1677                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1678                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1679                 goto failed;
1680         }
1681
1682         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1683                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1684                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1685                 goto failed;
1686         }
1687
1688         if (cp->addr.type == BDADDR_BREDR)
1689                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1690                                                &cp->addr.bdaddr);
1691         else
1692                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1693
1694         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1695                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1696                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1697                 goto failed;
1698         }
1699
1700         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1701         if (!cmd) {
1702                 err = -ENOMEM;
1703                 goto failed;
1704         }
1705
1706         dc.handle = cpu_to_le16(conn->handle);
1707         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1708
1709         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1710         if (err < 0)
1711                 mgmt_pending_remove(cmd);
1712
1713 failed:
1714         hci_dev_unlock(hdev);
1715         return err;
1716 }
1717
1718 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1719 {
1720         switch (link_type) {
1721         case LE_LINK:
1722                 switch (addr_type) {
1723                 case ADDR_LE_DEV_PUBLIC:
1724                         return BDADDR_LE_PUBLIC;
1725
1726                 default:
1727                         /* Fallback to LE Random address type */
1728                         return BDADDR_LE_RANDOM;
1729                 }
1730
1731         default:
1732                 /* Fallback to BR/EDR type */
1733                 return BDADDR_BREDR;
1734         }
1735 }
1736
1737 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1738                            u16 data_len)
1739 {
1740         struct mgmt_rp_get_connections *rp;
1741         struct hci_conn *c;
1742         size_t rp_len;
1743         int err;
1744         u16 i;
1745
1746         BT_DBG("");
1747
1748         hci_dev_lock(hdev);
1749
1750         if (!hdev_is_powered(hdev)) {
1751                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1752                                  MGMT_STATUS_NOT_POWERED);
1753                 goto unlock;
1754         }
1755
1756         i = 0;
1757         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1758                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1759                         i++;
1760         }
1761
1762         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1763         rp = kmalloc(rp_len, GFP_KERNEL);
1764         if (!rp) {
1765                 err = -ENOMEM;
1766                 goto unlock;
1767         }
1768
1769         i = 0;
1770         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1771                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1772                         continue;
1773                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1774                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1775                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1776                         continue;
1777                 i++;
1778         }
1779
1780         rp->conn_count = cpu_to_le16(i);
1781
1782         /* Recalculate length in case of filtered SCO connections, etc */
1783         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1784
1785         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1786                            rp_len);
1787
1788         kfree(rp);
1789
1790 unlock:
1791         hci_dev_unlock(hdev);
1792         return err;
1793 }
1794
1795 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1796                                    struct mgmt_cp_pin_code_neg_reply *cp)
1797 {
1798         struct pending_cmd *cmd;
1799         int err;
1800
1801         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1802                                sizeof(*cp));
1803         if (!cmd)
1804                 return -ENOMEM;
1805
1806         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1807                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1808         if (err < 0)
1809                 mgmt_pending_remove(cmd);
1810
1811         return err;
1812 }
1813
1814 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1815                           u16 len)
1816 {
1817         struct hci_conn *conn;
1818         struct mgmt_cp_pin_code_reply *cp = data;
1819         struct hci_cp_pin_code_reply reply;
1820         struct pending_cmd *cmd;
1821         int err;
1822
1823         BT_DBG("");
1824
1825         hci_dev_lock(hdev);
1826
1827         if (!hdev_is_powered(hdev)) {
1828                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1829                                  MGMT_STATUS_NOT_POWERED);
1830                 goto failed;
1831         }
1832
1833         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1834         if (!conn) {
1835                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1836                                  MGMT_STATUS_NOT_CONNECTED);
1837                 goto failed;
1838         }
1839
1840         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1841                 struct mgmt_cp_pin_code_neg_reply ncp;
1842
1843                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1844
1845                 BT_ERR("PIN code is not 16 bytes long");
1846
1847                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1848                 if (err >= 0)
1849                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1850                                          MGMT_STATUS_INVALID_PARAMS);
1851
1852                 goto failed;
1853         }
1854
1855         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1856         if (!cmd) {
1857                 err = -ENOMEM;
1858                 goto failed;
1859         }
1860
1861         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1862         reply.pin_len = cp->pin_len;
1863         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1864
1865         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1866         if (err < 0)
1867                 mgmt_pending_remove(cmd);
1868
1869 failed:
1870         hci_dev_unlock(hdev);
1871         return err;
1872 }
1873
1874 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1875                              u16 len)
1876 {
1877         struct mgmt_cp_set_io_capability *cp = data;
1878
1879         BT_DBG("");
1880
1881         hci_dev_lock(hdev);
1882
1883         hdev->io_capability = cp->io_capability;
1884
1885         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1886                hdev->io_capability);
1887
1888         hci_dev_unlock(hdev);
1889
1890         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1891                             0);
1892 }
1893
1894 static struct pending_cmd *find_pairing(struct hci_conn *conn)
1895 {
1896         struct hci_dev *hdev = conn->hdev;
1897         struct pending_cmd *cmd;
1898
1899         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1900                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1901                         continue;
1902
1903                 if (cmd->user_data != conn)
1904                         continue;
1905
1906                 return cmd;
1907         }
1908
1909         return NULL;
1910 }
1911
1912 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1913 {
1914         struct mgmt_rp_pair_device rp;
1915         struct hci_conn *conn = cmd->user_data;
1916
1917         bacpy(&rp.addr.bdaddr, &conn->dst);
1918         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
1919
1920         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1921                      &rp, sizeof(rp));
1922
1923         /* So we don't get further callbacks for this connection */
1924         conn->connect_cfm_cb = NULL;
1925         conn->security_cfm_cb = NULL;
1926         conn->disconn_cfm_cb = NULL;
1927
1928         hci_conn_put(conn);
1929
1930         mgmt_pending_remove(cmd);
1931 }
1932
1933 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1934 {
1935         struct pending_cmd *cmd;
1936
1937         BT_DBG("status %u", status);
1938
1939         cmd = find_pairing(conn);
1940         if (!cmd)
1941                 BT_DBG("Unable to find a pending command");
1942         else
1943                 pairing_complete(cmd, mgmt_status(status));
1944 }
1945
1946 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
1947 {
1948         struct pending_cmd *cmd;
1949
1950         BT_DBG("status %u", status);
1951
1952         if (!status)
1953                 return;
1954
1955         cmd = find_pairing(conn);
1956         if (!cmd)
1957                 BT_DBG("Unable to find a pending command");
1958         else
1959                 pairing_complete(cmd, mgmt_status(status));
1960 }
1961
1962 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1963                        u16 len)
1964 {
1965         struct mgmt_cp_pair_device *cp = data;
1966         struct mgmt_rp_pair_device rp;
1967         struct pending_cmd *cmd;
1968         u8 sec_level, auth_type;
1969         struct hci_conn *conn;
1970         int err;
1971
1972         BT_DBG("");
1973
1974         memset(&rp, 0, sizeof(rp));
1975         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1976         rp.addr.type = cp->addr.type;
1977
1978         if (!bdaddr_type_is_valid(cp->addr.type))
1979                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1980                                     MGMT_STATUS_INVALID_PARAMS,
1981                                     &rp, sizeof(rp));
1982
1983         hci_dev_lock(hdev);
1984
1985         if (!hdev_is_powered(hdev)) {
1986                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1987                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1988                 goto unlock;
1989         }
1990
1991         sec_level = BT_SECURITY_MEDIUM;
1992         if (cp->io_cap == 0x03)
1993                 auth_type = HCI_AT_DEDICATED_BONDING;
1994         else
1995                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1996
1997         if (cp->addr.type == BDADDR_BREDR)
1998                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
1999                                    cp->addr.type, sec_level, auth_type);
2000         else
2001                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2002                                    cp->addr.type, sec_level, auth_type);
2003
2004         if (IS_ERR(conn)) {
2005                 int status;
2006
2007                 if (PTR_ERR(conn) == -EBUSY)
2008                         status = MGMT_STATUS_BUSY;
2009                 else
2010                         status = MGMT_STATUS_CONNECT_FAILED;
2011
2012                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2013                                    status, &rp,
2014                                    sizeof(rp));
2015                 goto unlock;
2016         }
2017
2018         if (conn->connect_cfm_cb) {
2019                 hci_conn_put(conn);
2020                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2021                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2022                 goto unlock;
2023         }
2024
2025         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2026         if (!cmd) {
2027                 err = -ENOMEM;
2028                 hci_conn_put(conn);
2029                 goto unlock;
2030         }
2031
2032         /* For LE, just connecting isn't a proof that the pairing finished */
2033         if (cp->addr.type == BDADDR_BREDR)
2034                 conn->connect_cfm_cb = pairing_complete_cb;
2035         else
2036                 conn->connect_cfm_cb = le_connect_complete_cb;
2037
2038         conn->security_cfm_cb = pairing_complete_cb;
2039         conn->disconn_cfm_cb = pairing_complete_cb;
2040         conn->io_capability = cp->io_cap;
2041         cmd->user_data = conn;
2042
2043         if (conn->state == BT_CONNECTED &&
2044             hci_conn_security(conn, sec_level, auth_type))
2045                 pairing_complete(cmd, 0);
2046
2047         err = 0;
2048
2049 unlock:
2050         hci_dev_unlock(hdev);
2051         return err;
2052 }
2053
2054 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2055                               u16 len)
2056 {
2057         struct mgmt_addr_info *addr = data;
2058         struct pending_cmd *cmd;
2059         struct hci_conn *conn;
2060         int err;
2061
2062         BT_DBG("");
2063
2064         hci_dev_lock(hdev);
2065
2066         if (!hdev_is_powered(hdev)) {
2067                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2068                                  MGMT_STATUS_NOT_POWERED);
2069                 goto unlock;
2070         }
2071
2072         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2073         if (!cmd) {
2074                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2075                                  MGMT_STATUS_INVALID_PARAMS);
2076                 goto unlock;
2077         }
2078
2079         conn = cmd->user_data;
2080
2081         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2082                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2083                                  MGMT_STATUS_INVALID_PARAMS);
2084                 goto unlock;
2085         }
2086
2087         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2088
2089         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2090                            addr, sizeof(*addr));
2091 unlock:
2092         hci_dev_unlock(hdev);
2093         return err;
2094 }
2095
2096 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2097                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2098                              u16 hci_op, __le32 passkey)
2099 {
2100         struct pending_cmd *cmd;
2101         struct hci_conn *conn;
2102         int err;
2103
2104         hci_dev_lock(hdev);
2105
2106         if (!hdev_is_powered(hdev)) {
2107                 err = cmd_status(sk, hdev->id, mgmt_op,
2108                                  MGMT_STATUS_NOT_POWERED);
2109                 goto done;
2110         }
2111
2112         if (type == BDADDR_BREDR)
2113                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2114         else
2115                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2116
2117         if (!conn) {
2118                 err = cmd_status(sk, hdev->id, mgmt_op,
2119                                  MGMT_STATUS_NOT_CONNECTED);
2120                 goto done;
2121         }
2122
2123         if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2124                 /* Continue with pairing via SMP */
2125                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2126
2127                 if (!err)
2128                         err = cmd_status(sk, hdev->id, mgmt_op,
2129                                          MGMT_STATUS_SUCCESS);
2130                 else
2131                         err = cmd_status(sk, hdev->id, mgmt_op,
2132                                          MGMT_STATUS_FAILED);
2133
2134                 goto done;
2135         }
2136
2137         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2138         if (!cmd) {
2139                 err = -ENOMEM;
2140                 goto done;
2141         }
2142
2143         /* Continue with pairing via HCI */
2144         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2145                 struct hci_cp_user_passkey_reply cp;
2146
2147                 bacpy(&cp.bdaddr, bdaddr);
2148                 cp.passkey = passkey;
2149                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2150         } else
2151                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2152
2153         if (err < 0)
2154                 mgmt_pending_remove(cmd);
2155
2156 done:
2157         hci_dev_unlock(hdev);
2158         return err;
2159 }
2160
2161 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2162                               void *data, u16 len)
2163 {
2164         struct mgmt_cp_pin_code_neg_reply *cp = data;
2165
2166         BT_DBG("");
2167
2168         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2169                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2170                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2171 }
2172
2173 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2174                               u16 len)
2175 {
2176         struct mgmt_cp_user_confirm_reply *cp = data;
2177
2178         BT_DBG("");
2179
2180         if (len != sizeof(*cp))
2181                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2182                                   MGMT_STATUS_INVALID_PARAMS);
2183
2184         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2185                                  MGMT_OP_USER_CONFIRM_REPLY,
2186                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2187 }
2188
2189 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2190                                   void *data, u16 len)
2191 {
2192         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2193
2194         BT_DBG("");
2195
2196         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2197                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2198                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2199 }
2200
2201 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2202                               u16 len)
2203 {
2204         struct mgmt_cp_user_passkey_reply *cp = data;
2205
2206         BT_DBG("");
2207
2208         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2209                                  MGMT_OP_USER_PASSKEY_REPLY,
2210                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2211 }
2212
2213 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2214                                   void *data, u16 len)
2215 {
2216         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2217
2218         BT_DBG("");
2219
2220         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2221                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2222                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2223 }
2224
2225 static int update_name(struct hci_dev *hdev, const char *name)
2226 {
2227         struct hci_cp_write_local_name cp;
2228
2229         memcpy(cp.name, name, sizeof(cp.name));
2230
2231         return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2232 }
2233
2234 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2235                           u16 len)
2236 {
2237         struct mgmt_cp_set_local_name *cp = data;
2238         struct pending_cmd *cmd;
2239         int err;
2240
2241         BT_DBG("");
2242
2243         hci_dev_lock(hdev);
2244
2245         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2246
2247         if (!hdev_is_powered(hdev)) {
2248                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2249
2250                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2251                                    data, len);
2252                 if (err < 0)
2253                         goto failed;
2254
2255                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2256                                  sk);
2257
2258                 goto failed;
2259         }
2260
2261         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2262         if (!cmd) {
2263                 err = -ENOMEM;
2264                 goto failed;
2265         }
2266
2267         err = update_name(hdev, cp->name);
2268         if (err < 0)
2269                 mgmt_pending_remove(cmd);
2270
2271 failed:
2272         hci_dev_unlock(hdev);
2273         return err;
2274 }
2275
2276 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2277                                void *data, u16 data_len)
2278 {
2279         struct pending_cmd *cmd;
2280         int err;
2281
2282         BT_DBG("%s", hdev->name);
2283
2284         hci_dev_lock(hdev);
2285
2286         if (!hdev_is_powered(hdev)) {
2287                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2288                                  MGMT_STATUS_NOT_POWERED);
2289                 goto unlock;
2290         }
2291
2292         if (!lmp_ssp_capable(hdev)) {
2293                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2294                                  MGMT_STATUS_NOT_SUPPORTED);
2295                 goto unlock;
2296         }
2297
2298         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2299                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2300                                  MGMT_STATUS_BUSY);
2301                 goto unlock;
2302         }
2303
2304         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2305         if (!cmd) {
2306                 err = -ENOMEM;
2307                 goto unlock;
2308         }
2309
2310         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2311         if (err < 0)
2312                 mgmt_pending_remove(cmd);
2313
2314 unlock:
2315         hci_dev_unlock(hdev);
2316         return err;
2317 }
2318
2319 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2320                                void *data, u16 len)
2321 {
2322         struct mgmt_cp_add_remote_oob_data *cp = data;
2323         u8 status;
2324         int err;
2325
2326         BT_DBG("%s ", hdev->name);
2327
2328         hci_dev_lock(hdev);
2329
2330         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2331                                       cp->randomizer);
2332         if (err < 0)
2333                 status = MGMT_STATUS_FAILED;
2334         else
2335                 status = MGMT_STATUS_SUCCESS;
2336
2337         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2338                            &cp->addr, sizeof(cp->addr));
2339
2340         hci_dev_unlock(hdev);
2341         return err;
2342 }
2343
2344 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2345                                   void *data, u16 len)
2346 {
2347         struct mgmt_cp_remove_remote_oob_data *cp = data;
2348         u8 status;
2349         int err;
2350
2351         BT_DBG("%s", hdev->name);
2352
2353         hci_dev_lock(hdev);
2354
2355         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2356         if (err < 0)
2357                 status = MGMT_STATUS_INVALID_PARAMS;
2358         else
2359                 status = MGMT_STATUS_SUCCESS;
2360
2361         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2362                            status, &cp->addr, sizeof(cp->addr));
2363
2364         hci_dev_unlock(hdev);
2365         return err;
2366 }
2367
2368 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2369 {
2370         int err;
2371
2372         BT_DBG("%s", hdev->name);
2373
2374         hci_dev_lock(hdev);
2375
2376         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2377         if (err < 0)
2378                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2379
2380         hci_dev_unlock(hdev);
2381
2382         return err;
2383 }
2384
2385 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2386                            void *data, u16 len)
2387 {
2388         struct mgmt_cp_start_discovery *cp = data;
2389         struct pending_cmd *cmd;
2390         int err;
2391
2392         BT_DBG("%s", hdev->name);
2393
2394         hci_dev_lock(hdev);
2395
2396         if (!hdev_is_powered(hdev)) {
2397                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2398                                  MGMT_STATUS_NOT_POWERED);
2399                 goto failed;
2400         }
2401
2402         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2403                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2404                                  MGMT_STATUS_BUSY);
2405                 goto failed;
2406         }
2407
2408         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2409                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2410                                  MGMT_STATUS_BUSY);
2411                 goto failed;
2412         }
2413
2414         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2415         if (!cmd) {
2416                 err = -ENOMEM;
2417                 goto failed;
2418         }
2419
2420         hdev->discovery.type = cp->type;
2421
2422         switch (hdev->discovery.type) {
2423         case DISCOV_TYPE_BREDR:
2424                 if (!lmp_bredr_capable(hdev)) {
2425                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2426                                          MGMT_STATUS_NOT_SUPPORTED);
2427                         mgmt_pending_remove(cmd);
2428                         goto failed;
2429                 }
2430
2431                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2432                 break;
2433
2434         case DISCOV_TYPE_LE:
2435                 if (!lmp_host_le_capable(hdev)) {
2436                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2437                                          MGMT_STATUS_NOT_SUPPORTED);
2438                         mgmt_pending_remove(cmd);
2439                         goto failed;
2440                 }
2441
2442                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2443                                   LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2444                 break;
2445
2446         case DISCOV_TYPE_INTERLEAVED:
2447                 if (!lmp_host_le_capable(hdev) || !lmp_bredr_capable(hdev)) {
2448                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2449                                          MGMT_STATUS_NOT_SUPPORTED);
2450                         mgmt_pending_remove(cmd);
2451                         goto failed;
2452                 }
2453
2454                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT, LE_SCAN_WIN,
2455                                   LE_SCAN_TIMEOUT_BREDR_LE);
2456                 break;
2457
2458         default:
2459                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2460                                  MGMT_STATUS_INVALID_PARAMS);
2461                 mgmt_pending_remove(cmd);
2462                 goto failed;
2463         }
2464
2465         if (err < 0)
2466                 mgmt_pending_remove(cmd);
2467         else
2468                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2469
2470 failed:
2471         hci_dev_unlock(hdev);
2472         return err;
2473 }
2474
2475 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2476                           u16 len)
2477 {
2478         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2479         struct pending_cmd *cmd;
2480         struct hci_cp_remote_name_req_cancel cp;
2481         struct inquiry_entry *e;
2482         int err;
2483
2484         BT_DBG("%s", hdev->name);
2485
2486         hci_dev_lock(hdev);
2487
2488         if (!hci_discovery_active(hdev)) {
2489                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2490                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2491                                    sizeof(mgmt_cp->type));
2492                 goto unlock;
2493         }
2494
2495         if (hdev->discovery.type != mgmt_cp->type) {
2496                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2497                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2498                                    sizeof(mgmt_cp->type));
2499                 goto unlock;
2500         }
2501
2502         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2503         if (!cmd) {
2504                 err = -ENOMEM;
2505                 goto unlock;
2506         }
2507
2508         switch (hdev->discovery.state) {
2509         case DISCOVERY_FINDING:
2510                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2511                         err = hci_cancel_inquiry(hdev);
2512                 else
2513                         err = hci_cancel_le_scan(hdev);
2514
2515                 break;
2516
2517         case DISCOVERY_RESOLVING:
2518                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2519                                                      NAME_PENDING);
2520                 if (!e) {
2521                         mgmt_pending_remove(cmd);
2522                         err = cmd_complete(sk, hdev->id,
2523                                            MGMT_OP_STOP_DISCOVERY, 0,
2524                                            &mgmt_cp->type,
2525                                            sizeof(mgmt_cp->type));
2526                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2527                         goto unlock;
2528                 }
2529
2530                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2531                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2532                                    sizeof(cp), &cp);
2533
2534                 break;
2535
2536         default:
2537                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2538                 err = -EFAULT;
2539         }
2540
2541         if (err < 0)
2542                 mgmt_pending_remove(cmd);
2543         else
2544                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2545
2546 unlock:
2547         hci_dev_unlock(hdev);
2548         return err;
2549 }
2550
2551 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2552                         u16 len)
2553 {
2554         struct mgmt_cp_confirm_name *cp = data;
2555         struct inquiry_entry *e;
2556         int err;
2557
2558         BT_DBG("%s", hdev->name);
2559
2560         hci_dev_lock(hdev);
2561
2562         if (!hci_discovery_active(hdev)) {
2563                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2564                                  MGMT_STATUS_FAILED);
2565                 goto failed;
2566         }
2567
2568         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2569         if (!e) {
2570                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2571                                  MGMT_STATUS_INVALID_PARAMS);
2572                 goto failed;
2573         }
2574
2575         if (cp->name_known) {
2576                 e->name_state = NAME_KNOWN;
2577                 list_del(&e->list);
2578         } else {
2579                 e->name_state = NAME_NEEDED;
2580                 hci_inquiry_cache_update_resolve(hdev, e);
2581         }
2582
2583         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
2584                            sizeof(cp->addr));
2585
2586 failed:
2587         hci_dev_unlock(hdev);
2588         return err;
2589 }
2590
2591 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2592                         u16 len)
2593 {
2594         struct mgmt_cp_block_device *cp = data;
2595         u8 status;
2596         int err;
2597
2598         BT_DBG("%s", hdev->name);
2599
2600         if (!bdaddr_type_is_valid(cp->addr.type))
2601                 return cmd_status(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
2602                                   MGMT_STATUS_INVALID_PARAMS);
2603
2604         hci_dev_lock(hdev);
2605
2606         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2607         if (err < 0)
2608                 status = MGMT_STATUS_FAILED;
2609         else
2610                 status = MGMT_STATUS_SUCCESS;
2611
2612         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2613                            &cp->addr, sizeof(cp->addr));
2614
2615         hci_dev_unlock(hdev);
2616
2617         return err;
2618 }
2619
2620 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2621                           u16 len)
2622 {
2623         struct mgmt_cp_unblock_device *cp = data;
2624         u8 status;
2625         int err;
2626
2627         BT_DBG("%s", hdev->name);
2628
2629         if (!bdaddr_type_is_valid(cp->addr.type))
2630                 return cmd_status(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
2631                                   MGMT_STATUS_INVALID_PARAMS);
2632
2633         hci_dev_lock(hdev);
2634
2635         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2636         if (err < 0)
2637                 status = MGMT_STATUS_INVALID_PARAMS;
2638         else
2639                 status = MGMT_STATUS_SUCCESS;
2640
2641         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2642                            &cp->addr, sizeof(cp->addr));
2643
2644         hci_dev_unlock(hdev);
2645
2646         return err;
2647 }
2648
2649 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2650                          u16 len)
2651 {
2652         struct mgmt_cp_set_device_id *cp = data;
2653         int err;
2654         __u16 source;
2655
2656         BT_DBG("%s", hdev->name);
2657
2658         source = __le16_to_cpu(cp->source);
2659
2660         if (source > 0x0002)
2661                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2662                                   MGMT_STATUS_INVALID_PARAMS);
2663
2664         hci_dev_lock(hdev);
2665
2666         hdev->devid_source = source;
2667         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2668         hdev->devid_product = __le16_to_cpu(cp->product);
2669         hdev->devid_version = __le16_to_cpu(cp->version);
2670
2671         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2672
2673         update_eir(hdev);
2674
2675         hci_dev_unlock(hdev);
2676
2677         return err;
2678 }
2679
2680 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2681                                 void *data, u16 len)
2682 {
2683         struct mgmt_mode *cp = data;
2684         struct hci_cp_write_page_scan_activity acp;
2685         u8 type;
2686         int err;
2687
2688         BT_DBG("%s", hdev->name);
2689
2690         if (!lmp_bredr_capable(hdev))
2691                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2692                                   MGMT_STATUS_NOT_SUPPORTED);
2693
2694         if (cp->val != 0x00 && cp->val != 0x01)
2695                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2696                                   MGMT_STATUS_INVALID_PARAMS);
2697
2698         if (!hdev_is_powered(hdev))
2699                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2700                                   MGMT_STATUS_NOT_POWERED);
2701
2702         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2703                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2704                                   MGMT_STATUS_REJECTED);
2705
2706         hci_dev_lock(hdev);
2707
2708         if (cp->val) {
2709                 type = PAGE_SCAN_TYPE_INTERLACED;
2710
2711                 /* 160 msec page scan interval */
2712                 acp.interval = __constant_cpu_to_le16(0x0100);
2713         } else {
2714                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2715
2716                 /* default 1.28 sec page scan */
2717                 acp.interval = __constant_cpu_to_le16(0x0800);
2718         }
2719
2720         /* default 11.25 msec page scan window */
2721         acp.window = __constant_cpu_to_le16(0x0012);
2722
2723         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2724                            &acp);
2725         if (err < 0) {
2726                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2727                                  MGMT_STATUS_FAILED);
2728                 goto done;
2729         }
2730
2731         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2732         if (err < 0) {
2733                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2734                                  MGMT_STATUS_FAILED);
2735                 goto done;
2736         }
2737
2738         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2739                            NULL, 0);
2740 done:
2741         hci_dev_unlock(hdev);
2742         return err;
2743 }
2744
2745 static bool ltk_is_valid(struct mgmt_ltk_info *key)
2746 {
2747         if (key->authenticated != 0x00 && key->authenticated != 0x01)
2748                 return false;
2749         if (key->master != 0x00 && key->master != 0x01)
2750                 return false;
2751         if (!bdaddr_type_is_le(key->addr.type))
2752                 return false;
2753         return true;
2754 }
2755
2756 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2757                                void *cp_data, u16 len)
2758 {
2759         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2760         u16 key_count, expected_len;
2761         int i, err;
2762
2763         key_count = __le16_to_cpu(cp->key_count);
2764
2765         expected_len = sizeof(*cp) + key_count *
2766                                         sizeof(struct mgmt_ltk_info);
2767         if (expected_len != len) {
2768                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2769                        len, expected_len);
2770                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2771                                   MGMT_STATUS_INVALID_PARAMS);
2772         }
2773
2774         BT_DBG("%s key_count %u", hdev->name, key_count);
2775
2776         for (i = 0; i < key_count; i++) {
2777                 struct mgmt_ltk_info *key = &cp->keys[i];
2778
2779                 if (!ltk_is_valid(key))
2780                         return cmd_status(sk, hdev->id,
2781                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
2782                                           MGMT_STATUS_INVALID_PARAMS);
2783         }
2784
2785         hci_dev_lock(hdev);
2786
2787         hci_smp_ltks_clear(hdev);
2788
2789         for (i = 0; i < key_count; i++) {
2790                 struct mgmt_ltk_info *key = &cp->keys[i];
2791                 u8 type;
2792
2793                 if (key->master)
2794                         type = HCI_SMP_LTK;
2795                 else
2796                         type = HCI_SMP_LTK_SLAVE;
2797
2798                 hci_add_ltk(hdev, &key->addr.bdaddr,
2799                             bdaddr_to_le(key->addr.type),
2800                             type, 0, key->authenticated, key->val,
2801                             key->enc_size, key->ediv, key->rand);
2802         }
2803
2804         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
2805                            NULL, 0);
2806
2807         hci_dev_unlock(hdev);
2808
2809         return err;
2810 }
2811
2812 static const struct mgmt_handler {
2813         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2814                      u16 data_len);
2815         bool var_len;
2816         size_t data_len;
2817 } mgmt_handlers[] = {
2818         { NULL }, /* 0x0000 (no command) */
2819         { read_version,           false, MGMT_READ_VERSION_SIZE },
2820         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
2821         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
2822         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
2823         { set_powered,            false, MGMT_SETTING_SIZE },
2824         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
2825         { set_connectable,        false, MGMT_SETTING_SIZE },
2826         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
2827         { set_pairable,           false, MGMT_SETTING_SIZE },
2828         { set_link_security,      false, MGMT_SETTING_SIZE },
2829         { set_ssp,                false, MGMT_SETTING_SIZE },
2830         { set_hs,                 false, MGMT_SETTING_SIZE },
2831         { set_le,                 false, MGMT_SETTING_SIZE },
2832         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
2833         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
2834         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
2835         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
2836         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
2837         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2838         { disconnect,             false, MGMT_DISCONNECT_SIZE },
2839         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
2840         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
2841         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2842         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
2843         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
2844         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2845         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
2846         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
2847         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2848         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
2849         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2850         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2851         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2852         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2853         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
2854         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
2855         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
2856         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
2857         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
2858         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
2859 };
2860
2861
2862 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2863 {
2864         void *buf;
2865         u8 *cp;
2866         struct mgmt_hdr *hdr;
2867         u16 opcode, index, len;
2868         struct hci_dev *hdev = NULL;
2869         const struct mgmt_handler *handler;
2870         int err;
2871
2872         BT_DBG("got %zu bytes", msglen);
2873
2874         if (msglen < sizeof(*hdr))
2875                 return -EINVAL;
2876
2877         buf = kmalloc(msglen, GFP_KERNEL);
2878         if (!buf)
2879                 return -ENOMEM;
2880
2881         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2882                 err = -EFAULT;
2883                 goto done;
2884         }
2885
2886         hdr = buf;
2887         opcode = __le16_to_cpu(hdr->opcode);
2888         index = __le16_to_cpu(hdr->index);
2889         len = __le16_to_cpu(hdr->len);
2890
2891         if (len != msglen - sizeof(*hdr)) {
2892                 err = -EINVAL;
2893                 goto done;
2894         }
2895
2896         if (index != MGMT_INDEX_NONE) {
2897                 hdev = hci_dev_get(index);
2898                 if (!hdev) {
2899                         err = cmd_status(sk, index, opcode,
2900                                          MGMT_STATUS_INVALID_INDEX);
2901                         goto done;
2902                 }
2903         }
2904
2905         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2906             mgmt_handlers[opcode].func == NULL) {
2907                 BT_DBG("Unknown op %u", opcode);
2908                 err = cmd_status(sk, index, opcode,
2909                                  MGMT_STATUS_UNKNOWN_COMMAND);
2910                 goto done;
2911         }
2912
2913         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2914             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2915                 err = cmd_status(sk, index, opcode,
2916                                  MGMT_STATUS_INVALID_INDEX);
2917                 goto done;
2918         }
2919
2920         handler = &mgmt_handlers[opcode];
2921
2922         if ((handler->var_len && len < handler->data_len) ||
2923             (!handler->var_len && len != handler->data_len)) {
2924                 err = cmd_status(sk, index, opcode,
2925                                  MGMT_STATUS_INVALID_PARAMS);
2926                 goto done;
2927         }
2928
2929         if (hdev)
2930                 mgmt_init_hdev(sk, hdev);
2931
2932         cp = buf + sizeof(*hdr);
2933
2934         err = handler->func(sk, hdev, cp, len);
2935         if (err < 0)
2936                 goto done;
2937
2938         err = msglen;
2939
2940 done:
2941         if (hdev)
2942                 hci_dev_put(hdev);
2943
2944         kfree(buf);
2945         return err;
2946 }
2947
2948 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2949 {
2950         u8 *status = data;
2951
2952         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2953         mgmt_pending_remove(cmd);
2954 }
2955
2956 int mgmt_index_added(struct hci_dev *hdev)
2957 {
2958         if (!mgmt_valid_hdev(hdev))
2959                 return -ENOTSUPP;
2960
2961         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2962 }
2963
2964 int mgmt_index_removed(struct hci_dev *hdev)
2965 {
2966         u8 status = MGMT_STATUS_INVALID_INDEX;
2967
2968         if (!mgmt_valid_hdev(hdev))
2969                 return -ENOTSUPP;
2970
2971         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2972
2973         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2974 }
2975
2976 struct cmd_lookup {
2977         struct sock *sk;
2978         struct hci_dev *hdev;
2979         u8 mgmt_status;
2980 };
2981
2982 static void settings_rsp(struct pending_cmd *cmd, void *data)
2983 {
2984         struct cmd_lookup *match = data;
2985
2986         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2987
2988         list_del(&cmd->list);
2989
2990         if (match->sk == NULL) {
2991                 match->sk = cmd->sk;
2992                 sock_hold(match->sk);
2993         }
2994
2995         mgmt_pending_free(cmd);
2996 }
2997
2998 static int set_bredr_scan(struct hci_dev *hdev)
2999 {
3000         u8 scan = 0;
3001
3002         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3003                 scan |= SCAN_PAGE;
3004         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3005                 scan |= SCAN_INQUIRY;
3006
3007         if (!scan)
3008                 return 0;
3009
3010         return hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3011 }
3012
3013 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3014 {
3015         struct cmd_lookup match = { NULL, hdev };
3016         int err;
3017
3018         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3019                 return 0;
3020
3021         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3022
3023         if (powered) {
3024                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3025                     !lmp_host_ssp_capable(hdev)) {
3026                         u8 ssp = 1;
3027
3028                         hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3029                 }
3030
3031                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
3032                         struct hci_cp_write_le_host_supported cp;
3033
3034                         cp.le = 1;
3035                         cp.simul = lmp_le_br_capable(hdev);
3036
3037                         /* Check first if we already have the right
3038                          * host state (host features set)
3039                          */
3040                         if (cp.le != lmp_host_le_capable(hdev) ||
3041                             cp.simul != lmp_host_le_br_capable(hdev))
3042                                 hci_send_cmd(hdev,
3043                                              HCI_OP_WRITE_LE_HOST_SUPPORTED,
3044                                              sizeof(cp), &cp);
3045                 }
3046
3047                 if (lmp_bredr_capable(hdev)) {
3048                         set_bredr_scan(hdev);
3049                         update_class(hdev);
3050                         update_name(hdev, hdev->dev_name);
3051                         update_eir(hdev);
3052                 }
3053         } else {
3054                 u8 status = MGMT_STATUS_NOT_POWERED;
3055                 u8 zero_cod[] = { 0, 0, 0 };
3056
3057                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3058
3059                 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3060                         mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3061                                    zero_cod, sizeof(zero_cod), NULL);
3062         }
3063
3064         err = new_settings(hdev, match.sk);
3065
3066         if (match.sk)
3067                 sock_put(match.sk);
3068
3069         return err;
3070 }
3071
3072 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3073 {
3074         struct cmd_lookup match = { NULL, hdev };
3075         bool changed = false;
3076         int err = 0;
3077
3078         if (discoverable) {
3079                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3080                         changed = true;
3081         } else {
3082                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3083                         changed = true;
3084         }
3085
3086         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3087                              &match);
3088
3089         if (changed)
3090                 err = new_settings(hdev, match.sk);
3091
3092         if (match.sk)
3093                 sock_put(match.sk);
3094
3095         return err;
3096 }
3097
3098 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3099 {
3100         struct cmd_lookup match = { NULL, hdev };
3101         bool changed = false;
3102         int err = 0;
3103
3104         if (connectable) {
3105                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3106                         changed = true;
3107         } else {
3108                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3109                         changed = true;
3110         }
3111
3112         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
3113                              &match);
3114
3115         if (changed)
3116                 err = new_settings(hdev, match.sk);
3117
3118         if (match.sk)
3119                 sock_put(match.sk);
3120
3121         return err;
3122 }
3123
3124 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3125 {
3126         u8 mgmt_err = mgmt_status(status);
3127
3128         if (scan & SCAN_PAGE)
3129                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3130                                      cmd_status_rsp, &mgmt_err);
3131
3132         if (scan & SCAN_INQUIRY)
3133                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3134                                      cmd_status_rsp, &mgmt_err);
3135
3136         return 0;
3137 }
3138
3139 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3140                       bool persistent)
3141 {
3142         struct mgmt_ev_new_link_key ev;
3143
3144         memset(&ev, 0, sizeof(ev));
3145
3146         ev.store_hint = persistent;
3147         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3148         ev.key.addr.type = BDADDR_BREDR;
3149         ev.key.type = key->type;
3150         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3151         ev.key.pin_len = key->pin_len;
3152
3153         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3154 }
3155
3156 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3157 {
3158         struct mgmt_ev_new_long_term_key ev;
3159
3160         memset(&ev, 0, sizeof(ev));
3161
3162         ev.store_hint = persistent;
3163         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3164         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3165         ev.key.authenticated = key->authenticated;
3166         ev.key.enc_size = key->enc_size;
3167         ev.key.ediv = key->ediv;
3168
3169         if (key->type == HCI_SMP_LTK)
3170                 ev.key.master = 1;
3171
3172         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3173         memcpy(ev.key.val, key->val, sizeof(key->val));
3174
3175         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3176                           NULL);
3177 }
3178
3179 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3180                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3181                           u8 *dev_class)
3182 {
3183         char buf[512];
3184         struct mgmt_ev_device_connected *ev = (void *) buf;
3185         u16 eir_len = 0;
3186
3187         bacpy(&ev->addr.bdaddr, bdaddr);
3188         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3189
3190         ev->flags = __cpu_to_le32(flags);
3191
3192         if (name_len > 0)
3193                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3194                                           name, name_len);
3195
3196         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3197                 eir_len = eir_append_data(ev->eir, eir_len,
3198                                           EIR_CLASS_OF_DEV, dev_class, 3);
3199
3200         ev->eir_len = cpu_to_le16(eir_len);
3201
3202         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3203                           sizeof(*ev) + eir_len, NULL);
3204 }
3205
3206 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3207 {
3208         struct mgmt_cp_disconnect *cp = cmd->param;
3209         struct sock **sk = data;
3210         struct mgmt_rp_disconnect rp;
3211
3212         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3213         rp.addr.type = cp->addr.type;
3214
3215         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3216                      sizeof(rp));
3217
3218         *sk = cmd->sk;
3219         sock_hold(*sk);
3220
3221         mgmt_pending_remove(cmd);
3222 }
3223
3224 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3225 {
3226         struct hci_dev *hdev = data;
3227         struct mgmt_cp_unpair_device *cp = cmd->param;
3228         struct mgmt_rp_unpair_device rp;
3229
3230         memset(&rp, 0, sizeof(rp));
3231         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3232         rp.addr.type = cp->addr.type;
3233
3234         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3235
3236         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3237
3238         mgmt_pending_remove(cmd);
3239 }
3240
3241 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3242                              u8 link_type, u8 addr_type, u8 reason)
3243 {
3244         struct mgmt_ev_device_disconnected ev;
3245         struct sock *sk = NULL;
3246         int err;
3247
3248         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3249
3250         bacpy(&ev.addr.bdaddr, bdaddr);
3251         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3252         ev.reason = reason;
3253
3254         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3255                          sk);
3256
3257         if (sk)
3258                 sock_put(sk);
3259
3260         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3261                              hdev);
3262
3263         return err;
3264 }
3265
3266 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3267                            u8 link_type, u8 addr_type, u8 status)
3268 {
3269         struct mgmt_rp_disconnect rp;
3270         struct pending_cmd *cmd;
3271         int err;
3272
3273         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3274                              hdev);
3275
3276         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3277         if (!cmd)
3278                 return -ENOENT;
3279
3280         bacpy(&rp.addr.bdaddr, bdaddr);
3281         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3282
3283         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3284                            mgmt_status(status), &rp, sizeof(rp));
3285
3286         mgmt_pending_remove(cmd);
3287
3288         return err;
3289 }
3290
3291 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3292                         u8 addr_type, u8 status)
3293 {
3294         struct mgmt_ev_connect_failed ev;
3295
3296         bacpy(&ev.addr.bdaddr, bdaddr);
3297         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3298         ev.status = mgmt_status(status);
3299
3300         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3301 }
3302
3303 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3304 {
3305         struct mgmt_ev_pin_code_request ev;
3306
3307         bacpy(&ev.addr.bdaddr, bdaddr);
3308         ev.addr.type = BDADDR_BREDR;
3309         ev.secure = secure;
3310
3311         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3312                           NULL);
3313 }
3314
3315 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3316                                  u8 status)
3317 {
3318         struct pending_cmd *cmd;
3319         struct mgmt_rp_pin_code_reply rp;
3320         int err;
3321
3322         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3323         if (!cmd)
3324                 return -ENOENT;
3325
3326         bacpy(&rp.addr.bdaddr, bdaddr);
3327         rp.addr.type = BDADDR_BREDR;
3328
3329         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3330                            mgmt_status(status), &rp, sizeof(rp));
3331
3332         mgmt_pending_remove(cmd);
3333
3334         return err;
3335 }
3336
3337 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3338                                      u8 status)
3339 {
3340         struct pending_cmd *cmd;
3341         struct mgmt_rp_pin_code_reply rp;
3342         int err;
3343
3344         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3345         if (!cmd)
3346                 return -ENOENT;
3347
3348         bacpy(&rp.addr.bdaddr, bdaddr);
3349         rp.addr.type = BDADDR_BREDR;
3350
3351         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3352                            mgmt_status(status), &rp, sizeof(rp));
3353
3354         mgmt_pending_remove(cmd);
3355
3356         return err;
3357 }
3358
3359 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3360                               u8 link_type, u8 addr_type, __le32 value,
3361                               u8 confirm_hint)
3362 {
3363         struct mgmt_ev_user_confirm_request ev;
3364
3365         BT_DBG("%s", hdev->name);
3366
3367         bacpy(&ev.addr.bdaddr, bdaddr);
3368         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3369         ev.confirm_hint = confirm_hint;
3370         ev.value = value;
3371
3372         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3373                           NULL);
3374 }
3375
3376 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3377                               u8 link_type, u8 addr_type)
3378 {
3379         struct mgmt_ev_user_passkey_request ev;
3380
3381         BT_DBG("%s", hdev->name);
3382
3383         bacpy(&ev.addr.bdaddr, bdaddr);
3384         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3385
3386         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3387                           NULL);
3388 }
3389
3390 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3391                                       u8 link_type, u8 addr_type, u8 status,
3392                                       u8 opcode)
3393 {
3394         struct pending_cmd *cmd;
3395         struct mgmt_rp_user_confirm_reply rp;
3396         int err;
3397
3398         cmd = mgmt_pending_find(opcode, hdev);
3399         if (!cmd)
3400                 return -ENOENT;
3401
3402         bacpy(&rp.addr.bdaddr, bdaddr);
3403         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3404         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3405                            &rp, sizeof(rp));
3406
3407         mgmt_pending_remove(cmd);
3408
3409         return err;
3410 }
3411
3412 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3413                                      u8 link_type, u8 addr_type, u8 status)
3414 {
3415         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3416                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3417 }
3418
3419 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3420                                          u8 link_type, u8 addr_type, u8 status)
3421 {
3422         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3423                                           status,
3424                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3425 }
3426
3427 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3428                                      u8 link_type, u8 addr_type, u8 status)
3429 {
3430         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3431                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3432 }
3433
3434 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3435                                          u8 link_type, u8 addr_type, u8 status)
3436 {
3437         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3438                                           status,
3439                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3440 }
3441
3442 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3443                              u8 link_type, u8 addr_type, u32 passkey,
3444                              u8 entered)
3445 {
3446         struct mgmt_ev_passkey_notify ev;
3447
3448         BT_DBG("%s", hdev->name);
3449
3450         bacpy(&ev.addr.bdaddr, bdaddr);
3451         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3452         ev.passkey = __cpu_to_le32(passkey);
3453         ev.entered = entered;
3454
3455         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3456 }
3457
3458 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3459                      u8 addr_type, u8 status)
3460 {
3461         struct mgmt_ev_auth_failed ev;
3462
3463         bacpy(&ev.addr.bdaddr, bdaddr);
3464         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3465         ev.status = mgmt_status(status);
3466
3467         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3468 }
3469
3470 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3471 {
3472         struct cmd_lookup match = { NULL, hdev };
3473         bool changed = false;
3474         int err = 0;
3475
3476         if (status) {
3477                 u8 mgmt_err = mgmt_status(status);
3478                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3479                                      cmd_status_rsp, &mgmt_err);
3480                 return 0;
3481         }
3482
3483         if (test_bit(HCI_AUTH, &hdev->flags)) {
3484                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3485                         changed = true;
3486         } else {
3487                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3488                         changed = true;
3489         }
3490
3491         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3492                              &match);
3493
3494         if (changed)
3495                 err = new_settings(hdev, match.sk);
3496
3497         if (match.sk)
3498                 sock_put(match.sk);
3499
3500         return err;
3501 }
3502
3503 static int clear_eir(struct hci_dev *hdev)
3504 {
3505         struct hci_cp_write_eir cp;
3506
3507         if (!lmp_ext_inq_capable(hdev))
3508                 return 0;
3509
3510         memset(hdev->eir, 0, sizeof(hdev->eir));
3511
3512         memset(&cp, 0, sizeof(cp));
3513
3514         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3515 }
3516
3517 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3518 {
3519         struct cmd_lookup match = { NULL, hdev };
3520         bool changed = false;
3521         int err = 0;
3522
3523         if (status) {
3524                 u8 mgmt_err = mgmt_status(status);
3525
3526                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3527                                                  &hdev->dev_flags))
3528                         err = new_settings(hdev, NULL);
3529
3530                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3531                                      &mgmt_err);
3532
3533                 return err;
3534         }
3535
3536         if (enable) {
3537                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3538                         changed = true;
3539         } else {
3540                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3541                         changed = true;
3542         }
3543
3544         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3545
3546         if (changed)
3547                 err = new_settings(hdev, match.sk);
3548
3549         if (match.sk)
3550                 sock_put(match.sk);
3551
3552         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3553                 update_eir(hdev);
3554         else
3555                 clear_eir(hdev);
3556
3557         return err;
3558 }
3559
3560 static void class_rsp(struct pending_cmd *cmd, void *data)
3561 {
3562         struct cmd_lookup *match = data;
3563
3564         cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3565                      match->hdev->dev_class, 3);
3566
3567         list_del(&cmd->list);
3568
3569         if (match->sk == NULL) {
3570                 match->sk = cmd->sk;
3571                 sock_hold(match->sk);
3572         }
3573
3574         mgmt_pending_free(cmd);
3575 }
3576
3577 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3578                                    u8 status)
3579 {
3580         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3581         int err = 0;
3582
3583         clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3584
3585         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3586         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3587         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3588
3589         if (!status)
3590                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3591                                  3, NULL);
3592
3593         if (match.sk)
3594                 sock_put(match.sk);
3595
3596         return err;
3597 }
3598
3599 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3600 {
3601         struct pending_cmd *cmd;
3602         struct mgmt_cp_set_local_name ev;
3603         bool changed = false;
3604         int err = 0;
3605
3606         if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3607                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3608                 changed = true;
3609         }
3610
3611         memset(&ev, 0, sizeof(ev));
3612         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3613         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3614
3615         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3616         if (!cmd)
3617                 goto send_event;
3618
3619         /* Always assume that either the short or the complete name has
3620          * changed if there was a pending mgmt command */
3621         changed = true;
3622
3623         if (status) {
3624                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3625                                  mgmt_status(status));
3626                 goto failed;
3627         }
3628
3629         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3630                            sizeof(ev));
3631         if (err < 0)
3632                 goto failed;
3633
3634 send_event:
3635         if (changed)
3636                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3637                                  sizeof(ev), cmd ? cmd->sk : NULL);
3638
3639         /* EIR is taken care of separately when powering on the
3640          * adapter so only update them here if this is a name change
3641          * unrelated to power on.
3642          */
3643         if (!test_bit(HCI_INIT, &hdev->flags))
3644                 update_eir(hdev);
3645
3646 failed:
3647         if (cmd)
3648                 mgmt_pending_remove(cmd);
3649         return err;
3650 }
3651
3652 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3653                                             u8 *randomizer, u8 status)
3654 {
3655         struct pending_cmd *cmd;
3656         int err;
3657
3658         BT_DBG("%s status %u", hdev->name, status);
3659
3660         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3661         if (!cmd)
3662                 return -ENOENT;
3663
3664         if (status) {
3665                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3666                                  mgmt_status(status));
3667         } else {
3668                 struct mgmt_rp_read_local_oob_data rp;
3669
3670                 memcpy(rp.hash, hash, sizeof(rp.hash));
3671                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3672
3673                 err = cmd_complete(cmd->sk, hdev->id,
3674                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3675                                    sizeof(rp));
3676         }
3677
3678         mgmt_pending_remove(cmd);
3679
3680         return err;
3681 }
3682
3683 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3684 {
3685         struct cmd_lookup match = { NULL, hdev };
3686         bool changed = false;
3687         int err = 0;
3688
3689         if (status) {
3690                 u8 mgmt_err = mgmt_status(status);
3691
3692                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3693                                                  &hdev->dev_flags))
3694                         err = new_settings(hdev, NULL);
3695
3696                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3697                                      &mgmt_err);
3698
3699                 return err;
3700         }
3701
3702         if (enable) {
3703                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3704                         changed = true;
3705         } else {
3706                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3707                         changed = true;
3708         }
3709
3710         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3711
3712         if (changed)
3713                 err = new_settings(hdev, match.sk);
3714
3715         if (match.sk)
3716                 sock_put(match.sk);
3717
3718         return err;
3719 }
3720
3721 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3722                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3723                       ssp, u8 *eir, u16 eir_len)
3724 {
3725         char buf[512];
3726         struct mgmt_ev_device_found *ev = (void *) buf;
3727         size_t ev_size;
3728
3729         /* Leave 5 bytes for a potential CoD field */
3730         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3731                 return -EINVAL;
3732
3733         memset(buf, 0, sizeof(buf));
3734
3735         bacpy(&ev->addr.bdaddr, bdaddr);
3736         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3737         ev->rssi = rssi;
3738         if (cfm_name)
3739                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
3740         if (!ssp)
3741                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
3742
3743         if (eir_len > 0)
3744                 memcpy(ev->eir, eir, eir_len);
3745
3746         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3747                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3748                                           dev_class, 3);
3749
3750         ev->eir_len = cpu_to_le16(eir_len);
3751         ev_size = sizeof(*ev) + eir_len;
3752
3753         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3754 }
3755
3756 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3757                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3758 {
3759         struct mgmt_ev_device_found *ev;
3760         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3761         u16 eir_len;
3762
3763         ev = (struct mgmt_ev_device_found *) buf;
3764
3765         memset(buf, 0, sizeof(buf));
3766
3767         bacpy(&ev->addr.bdaddr, bdaddr);
3768         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3769         ev->rssi = rssi;
3770
3771         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3772                                   name_len);
3773
3774         ev->eir_len = cpu_to_le16(eir_len);
3775
3776         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3777                           sizeof(*ev) + eir_len, NULL);
3778 }
3779
3780 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3781 {
3782         struct pending_cmd *cmd;
3783         u8 type;
3784         int err;
3785
3786         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3787
3788         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3789         if (!cmd)
3790                 return -ENOENT;
3791
3792         type = hdev->discovery.type;
3793
3794         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3795                            &type, sizeof(type));
3796         mgmt_pending_remove(cmd);
3797
3798         return err;
3799 }
3800
3801 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3802 {
3803         struct pending_cmd *cmd;
3804         int err;
3805
3806         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3807         if (!cmd)
3808                 return -ENOENT;
3809
3810         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3811                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3812         mgmt_pending_remove(cmd);
3813
3814         return err;
3815 }
3816
3817 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3818 {
3819         struct mgmt_ev_discovering ev;
3820         struct pending_cmd *cmd;
3821
3822         BT_DBG("%s discovering %u", hdev->name, discovering);
3823
3824         if (discovering)
3825                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3826         else
3827                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3828
3829         if (cmd != NULL) {
3830                 u8 type = hdev->discovery.type;
3831
3832                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3833                              sizeof(type));
3834                 mgmt_pending_remove(cmd);
3835         }
3836
3837         memset(&ev, 0, sizeof(ev));
3838         ev.type = hdev->discovery.type;
3839         ev.discovering = discovering;
3840
3841         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3842 }
3843
3844 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3845 {
3846         struct pending_cmd *cmd;
3847         struct mgmt_ev_device_blocked ev;
3848
3849         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3850
3851         bacpy(&ev.addr.bdaddr, bdaddr);
3852         ev.addr.type = type;
3853
3854         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3855                           cmd ? cmd->sk : NULL);
3856 }
3857
3858 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3859 {
3860         struct pending_cmd *cmd;
3861         struct mgmt_ev_device_unblocked ev;
3862
3863         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3864
3865         bacpy(&ev.addr.bdaddr, bdaddr);
3866         ev.addr.type = type;
3867
3868         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3869                           cmd ? cmd->sk : NULL);
3870 }
3871
3872 module_param(enable_hs, bool, 0644);
3873 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");