net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   3
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79         MGMT_OP_SET_ADVERTISING,
  80 };
  81
  82 static const u16 mgmt_events[] = {
  83         MGMT_EV_CONTROLLER_ERROR,
  84         MGMT_EV_INDEX_ADDED,
  85         MGMT_EV_INDEX_REMOVED,
  86         MGMT_EV_NEW_SETTINGS,
  87         MGMT_EV_CLASS_OF_DEV_CHANGED,
  88         MGMT_EV_LOCAL_NAME_CHANGED,
  89         MGMT_EV_NEW_LINK_KEY,
  90         MGMT_EV_NEW_LONG_TERM_KEY,
  91         MGMT_EV_DEVICE_CONNECTED,
  92         MGMT_EV_DEVICE_DISCONNECTED,
  93         MGMT_EV_CONNECT_FAILED,
  94         MGMT_EV_PIN_CODE_REQUEST,
  95         MGMT_EV_USER_CONFIRM_REQUEST,
  96         MGMT_EV_USER_PASSKEY_REQUEST,
  97         MGMT_EV_AUTH_FAILED,
  98         MGMT_EV_DEVICE_FOUND,
  99         MGMT_EV_DISCOVERING,
 100         MGMT_EV_DEVICE_BLOCKED,
 101         MGMT_EV_DEVICE_UNBLOCKED,
 102         MGMT_EV_DEVICE_UNPAIRED,
 103         MGMT_EV_PASSKEY_NOTIFY,
 104 };
 105
 106 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 107
 108 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 109                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 110
 111 struct pending_cmd {
 112         struct list_head list;
 113         u16 opcode;
 114         int index;
 115         void *param;
 116         struct sock *sk;
 117         void *user_data;
 118 };
 119
 120 /* HCI to MGMT error code conversion table */
 121 static u8 mgmt_status_table[] = {
 122         MGMT_STATUS_SUCCESS,
 123         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 124         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 125         MGMT_STATUS_FAILED,             /* Hardware Failure */
 126         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 127         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 128         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 129         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 130         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 131         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 132         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 133         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 134         MGMT_STATUS_BUSY,               /* Command Disallowed */
 135         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 136         MGMT_STATUS_REJECTED,           /* Rejected Security */
 137         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 138         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 139         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 140         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 141         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 142         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 143         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 144         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 145         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 146         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 147         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 148         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 149         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 150         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 151         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 153         MGMT_STATUS_FAILED,             /* Unspecified Error */
 154         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 155         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 156         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 157         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 158         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 159         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 160         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 161         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 162         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 164         MGMT_STATUS_FAILED,             /* Transaction Collision */
 165         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 166         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 167         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 168         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 169         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 170         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 171         MGMT_STATUS_FAILED,             /* Slot Violation */
 172         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 173         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 175         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 176         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 177         MGMT_STATUS_BUSY,               /* Controller Busy */
 178         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 179         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 180         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 181         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 182         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 183 };
 184
 185 bool mgmt_valid_hdev(struct hci_dev *hdev)
 186 {
 187         return hdev->dev_type == HCI_BREDR;
 188 }
 189
 190 static u8 mgmt_status(u8 hci_status)
 191 {
 192         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 193                 return mgmt_status_table[hci_status];
 194
 195         return MGMT_STATUS_FAILED;
 196 }
 197
 198 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 199 {
 200         struct sk_buff *skb;
 201         struct mgmt_hdr *hdr;
 202         struct mgmt_ev_cmd_status *ev;
 203         int err;
 204
 205         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 206
 207         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 208         if (!skb)
 209                 return -ENOMEM;
 210
 211         hdr = (void *) skb_put(skb, sizeof(*hdr));
 212
 213         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 214         hdr->index = cpu_to_le16(index);
 215         hdr->len = cpu_to_le16(sizeof(*ev));
 216
 217         ev = (void *) skb_put(skb, sizeof(*ev));
 218         ev->status = status;
 219         ev->opcode = cpu_to_le16(cmd);
 220
 221         err = sock_queue_rcv_skb(sk, skb);
 222         if (err < 0)
 223                 kfree_skb(skb);
 224
 225         return err;
 226 }
 227
 228 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 229                         void *rp, size_t rp_len)
 230 {
 231         struct sk_buff *skb;
 232         struct mgmt_hdr *hdr;
 233         struct mgmt_ev_cmd_complete *ev;
 234         int err;
 235
 236         BT_DBG("sock %p", sk);
 237
 238         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 239         if (!skb)
 240                 return -ENOMEM;
 241
 242         hdr = (void *) skb_put(skb, sizeof(*hdr));
 243
 244         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 245         hdr->index = cpu_to_le16(index);
 246         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 247
 248         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 249         ev->opcode = cpu_to_le16(cmd);
 250         ev->status = status;
 251
 252         if (rp)
 253                 memcpy(ev->data, rp, rp_len);
 254
 255         err = sock_queue_rcv_skb(sk, skb);
 256         if (err < 0)
 257                 kfree_skb(skb);
 258
 259         return err;
 260 }
 261
 262 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 263                         u16 data_len)
 264 {
 265         struct mgmt_rp_read_version rp;
 266
 267         BT_DBG("sock %p", sk);
 268
 269         rp.version = MGMT_VERSION;
 270         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 271
 272         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 273                             sizeof(rp));
 274 }
 275
 276 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 277                          u16 data_len)
 278 {
 279         struct mgmt_rp_read_commands *rp;
 280         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 281         const u16 num_events = ARRAY_SIZE(mgmt_events);
 282         __le16 *opcode;
 283         size_t rp_size;
 284         int i, err;
 285
 286         BT_DBG("sock %p", sk);
 287
 288         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 289
 290         rp = kmalloc(rp_size, GFP_KERNEL);
 291         if (!rp)
 292                 return -ENOMEM;
 293
 294         rp->num_commands = __constant_cpu_to_le16(num_commands);
 295         rp->num_events = __constant_cpu_to_le16(num_events);
 296
 297         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 298                 put_unaligned_le16(mgmt_commands[i], opcode);
 299
 300         for (i = 0; i < num_events; i++, opcode++)
 301                 put_unaligned_le16(mgmt_events[i], opcode);
 302
 303         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 304                            rp_size);
 305         kfree(rp);
 306
 307         return err;
 308 }
 309
 310 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 311                            u16 data_len)
 312 {
 313         struct mgmt_rp_read_index_list *rp;
 314         struct hci_dev *d;
 315         size_t rp_len;
 316         u16 count;
 317         int err;
 318
 319         BT_DBG("sock %p", sk);
 320
 321         read_lock(&hci_dev_list_lock);
 322
 323         count = 0;
 324         list_for_each_entry(d, &hci_dev_list, list) {
 325                 if (!mgmt_valid_hdev(d))
 326                         continue;
 327
 328                 count++;
 329         }
 330
 331         rp_len = sizeof(*rp) + (2 * count);
 332         rp = kmalloc(rp_len, GFP_ATOMIC);
 333         if (!rp) {
 334                 read_unlock(&hci_dev_list_lock);
 335                 return -ENOMEM;
 336         }
 337
 338         count = 0;
 339         list_for_each_entry(d, &hci_dev_list, list) {
 340                 if (test_bit(HCI_SETUP, &d->dev_flags))
 341                         continue;
 342
 343                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 344                         continue;
 345
 346                 if (!mgmt_valid_hdev(d))
 347                         continue;
 348
 349                 rp->index[count++] = cpu_to_le16(d->id);
 350                 BT_DBG("Added hci%u", d->id);
 351         }
 352
 353         rp->num_controllers = cpu_to_le16(count);
 354         rp_len = sizeof(*rp) + (2 * count);
 355
 356         read_unlock(&hci_dev_list_lock);
 357
 358         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 359                            rp_len);
 360
 361         kfree(rp);
 362
 363         return err;
 364 }
 365
 366 static u32 get_supported_settings(struct hci_dev *hdev)
 367 {
 368         u32 settings = 0;
 369
 370         settings |= MGMT_SETTING_POWERED;
 371         settings |= MGMT_SETTING_PAIRABLE;
 372
 373         if (lmp_ssp_capable(hdev))
 374                 settings |= MGMT_SETTING_SSP;
 375
 376         if (lmp_bredr_capable(hdev)) {
 377                 settings |= MGMT_SETTING_CONNECTABLE;
 378                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 379                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 380                 settings |= MGMT_SETTING_DISCOVERABLE;
 381                 settings |= MGMT_SETTING_BREDR;
 382                 settings |= MGMT_SETTING_LINK_SECURITY;
 383         }
 384
 385         if (enable_hs)
 386                 settings |= MGMT_SETTING_HS;
 387
 388         if (lmp_le_capable(hdev)) {
 389                 settings |= MGMT_SETTING_LE;
 390                 settings |= MGMT_SETTING_ADVERTISING;
 391         }
 392
 393         return settings;
 394 }
 395
 396 static u32 get_current_settings(struct hci_dev *hdev)
 397 {
 398         u32 settings = 0;
 399
 400         if (hdev_is_powered(hdev))
 401                 settings |= MGMT_SETTING_POWERED;
 402
 403         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 404                 settings |= MGMT_SETTING_CONNECTABLE;
 405
 406         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 407                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 408
 409         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 410                 settings |= MGMT_SETTING_DISCOVERABLE;
 411
 412         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 413                 settings |= MGMT_SETTING_PAIRABLE;
 414
 415         if (lmp_bredr_capable(hdev))
 416                 settings |= MGMT_SETTING_BREDR;
 417
 418         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 419                 settings |= MGMT_SETTING_LE;
 420
 421         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 422                 settings |= MGMT_SETTING_LINK_SECURITY;
 423
 424         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 425                 settings |= MGMT_SETTING_SSP;
 426
 427         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 428                 settings |= MGMT_SETTING_HS;
 429
 430         if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
 431                 settings |= MGMT_SETTING_ADVERTISING;
 432
 433         return settings;
 434 }
 435
 436 #define PNP_INFO_SVCLASS_ID             0x1200
 437
 438 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 439 {
 440         u8 *ptr = data, *uuids_start = NULL;
 441         struct bt_uuid *uuid;
 442
 443         if (len < 4)
 444                 return ptr;
 445
 446         list_for_each_entry(uuid, &hdev->uuids, list) {
 447                 u16 uuid16;
 448
 449                 if (uuid->size != 16)
 450                         continue;
 451
 452                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 453                 if (uuid16 < 0x1100)
 454                         continue;
 455
 456                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 457                         continue;
 458
 459                 if (!uuids_start) {
 460                         uuids_start = ptr;
 461                         uuids_start[0] = 1;
 462                         uuids_start[1] = EIR_UUID16_ALL;
 463                         ptr += 2;
 464                 }
 465
 466                 /* Stop if not enough space to put next UUID */
 467                 if ((ptr - data) + sizeof(u16) > len) {
 468                         uuids_start[1] = EIR_UUID16_SOME;
 469                         break;
 470                 }
 471
 472                 *ptr++ = (uuid16 & 0x00ff);
 473                 *ptr++ = (uuid16 & 0xff00) >> 8;
 474                 uuids_start[0] += sizeof(uuid16);
 475         }
 476
 477         return ptr;
 478 }
 479
 480 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 481 {
 482         u8 *ptr = data, *uuids_start = NULL;
 483         struct bt_uuid *uuid;
 484
 485         if (len < 6)
 486                 return ptr;
 487
 488         list_for_each_entry(uuid, &hdev->uuids, list) {
 489                 if (uuid->size != 32)
 490                         continue;
 491
 492                 if (!uuids_start) {
 493                         uuids_start = ptr;
 494                         uuids_start[0] = 1;
 495                         uuids_start[1] = EIR_UUID32_ALL;
 496                         ptr += 2;
 497                 }
 498
 499                 /* Stop if not enough space to put next UUID */
 500                 if ((ptr - data) + sizeof(u32) > len) {
 501                         uuids_start[1] = EIR_UUID32_SOME;
 502                         break;
 503                 }
 504
 505                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 506                 ptr += sizeof(u32);
 507                 uuids_start[0] += sizeof(u32);
 508         }
 509
 510         return ptr;
 511 }
 512
 513 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 514 {
 515         u8 *ptr = data, *uuids_start = NULL;
 516         struct bt_uuid *uuid;
 517
 518         if (len < 18)
 519                 return ptr;
 520
 521         list_for_each_entry(uuid, &hdev->uuids, list) {
 522                 if (uuid->size != 128)
 523                         continue;
 524
 525                 if (!uuids_start) {
 526                         uuids_start = ptr;
 527                         uuids_start[0] = 1;
 528                         uuids_start[1] = EIR_UUID128_ALL;
 529                         ptr += 2;
 530                 }
 531
 532                 /* Stop if not enough space to put next UUID */
 533                 if ((ptr - data) + 16 > len) {
 534                         uuids_start[1] = EIR_UUID128_SOME;
 535                         break;
 536                 }
 537
 538                 memcpy(ptr, uuid->uuid, 16);
 539                 ptr += 16;
 540                 uuids_start[0] += 16;
 541         }
 542
 543         return ptr;
 544 }
 545
 546 static void create_eir(struct hci_dev *hdev, u8 *data)
 547 {
 548         u8 *ptr = data;
 549         size_t name_len;
 550
 551         name_len = strlen(hdev->dev_name);
 552
 553         if (name_len > 0) {
 554                 /* EIR Data type */
 555                 if (name_len > 48) {
 556                         name_len = 48;
 557                         ptr[1] = EIR_NAME_SHORT;
 558                 } else
 559                         ptr[1] = EIR_NAME_COMPLETE;
 560
 561                 /* EIR Data length */
 562                 ptr[0] = name_len + 1;
 563
 564                 memcpy(ptr + 2, hdev->dev_name, name_len);
 565
 566                 ptr += (name_len + 2);
 567         }
 568
 569         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 570                 ptr[0] = 2;
 571                 ptr[1] = EIR_TX_POWER;
 572                 ptr[2] = (u8) hdev->inq_tx_power;
 573
 574                 ptr += 3;
 575         }
 576
 577         if (hdev->devid_source > 0) {
 578                 ptr[0] = 9;
 579                 ptr[1] = EIR_DEVICE_ID;
 580
 581                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 582                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 583                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 584                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 585
 586                 ptr += 10;
 587         }
 588
 589         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 590         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 591         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 592 }
 593
 594 static void update_eir(struct hci_request *req)
 595 {
 596         struct hci_dev *hdev = req->hdev;
 597         struct hci_cp_write_eir cp;
 598
 599         if (!hdev_is_powered(hdev))
 600                 return;
 601
 602         if (!lmp_ext_inq_capable(hdev))
 603                 return;
 604
 605         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 606                 return;
 607
 608         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 609                 return;
 610
 611         memset(&cp, 0, sizeof(cp));
 612
 613         create_eir(hdev, cp.data);
 614
 615         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 616                 return;
 617
 618         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 619
 620         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 621 }
 622
 623 static u8 get_service_classes(struct hci_dev *hdev)
 624 {
 625         struct bt_uuid *uuid;
 626         u8 val = 0;
 627
 628         list_for_each_entry(uuid, &hdev->uuids, list)
 629                 val |= uuid->svc_hint;
 630
 631         return val;
 632 }
 633
 634 static void update_class(struct hci_request *req)
 635 {
 636         struct hci_dev *hdev = req->hdev;
 637         u8 cod[3];
 638
 639         BT_DBG("%s", hdev->name);
 640
 641         if (!hdev_is_powered(hdev))
 642                 return;
 643
 644         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 645                 return;
 646
 647         cod[0] = hdev->minor_class;
 648         cod[1] = hdev->major_class;
 649         cod[2] = get_service_classes(hdev);
 650
 651         if (memcmp(cod, hdev->dev_class, 3) == 0)
 652                 return;
 653
 654         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 655 }
 656
 657 static void service_cache_off(struct work_struct *work)
 658 {
 659         struct hci_dev *hdev = container_of(work, struct hci_dev,
 660                                             service_cache.work);
 661         struct hci_request req;
 662
 663         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 664                 return;
 665
 666         hci_req_init(&req, hdev);
 667
 668         hci_dev_lock(hdev);
 669
 670         update_eir(&req);
 671         update_class(&req);
 672
 673         hci_dev_unlock(hdev);
 674
 675         hci_req_run(&req, NULL);
 676 }
 677
 678 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 679 {
 680         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 681                 return;
 682
 683         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 684
 685         /* Non-mgmt controlled devices get this bit set
 686          * implicitly so that pairing works for them, however
 687          * for mgmt we require user-space to explicitly enable
 688          * it
 689          */
 690         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 691 }
 692
 693 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 694                                 void *data, u16 data_len)
 695 {
 696         struct mgmt_rp_read_info rp;
 697
 698         BT_DBG("sock %p %s", sk, hdev->name);
 699
 700         hci_dev_lock(hdev);
 701
 702         memset(&rp, 0, sizeof(rp));
 703
 704         bacpy(&rp.bdaddr, &hdev->bdaddr);
 705
 706         rp.version = hdev->hci_ver;
 707         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 708
 709         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 710         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 711
 712         memcpy(rp.dev_class, hdev->dev_class, 3);
 713
 714         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 715         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 716
 717         hci_dev_unlock(hdev);
 718
 719         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 720                             sizeof(rp));
 721 }
 722
 723 static void mgmt_pending_free(struct pending_cmd *cmd)
 724 {
 725         sock_put(cmd->sk);
 726         kfree(cmd->param);
 727         kfree(cmd);
 728 }
 729
 730 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 731                                             struct hci_dev *hdev, void *data,
 732                                             u16 len)
 733 {
 734         struct pending_cmd *cmd;
 735
 736         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 737         if (!cmd)
 738                 return NULL;
 739
 740         cmd->opcode = opcode;
 741         cmd->index = hdev->id;
 742
 743         cmd->param = kmalloc(len, GFP_KERNEL);
 744         if (!cmd->param) {
 745                 kfree(cmd);
 746                 return NULL;
 747         }
 748
 749         if (data)
 750                 memcpy(cmd->param, data, len);
 751
 752         cmd->sk = sk;
 753         sock_hold(sk);
 754
 755         list_add(&cmd->list, &hdev->mgmt_pending);
 756
 757         return cmd;
 758 }
 759
 760 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 761                                  void (*cb)(struct pending_cmd *cmd,
 762                                             void *data),
 763                                  void *data)
 764 {
 765         struct pending_cmd *cmd, *tmp;
 766
 767         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 768                 if (opcode > 0 && cmd->opcode != opcode)
 769                         continue;
 770
 771                 cb(cmd, data);
 772         }
 773 }
 774
 775 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 776 {
 777         struct pending_cmd *cmd;
 778
 779         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 780                 if (cmd->opcode == opcode)
 781                         return cmd;
 782         }
 783
 784         return NULL;
 785 }
 786
 787 static void mgmt_pending_remove(struct pending_cmd *cmd)
 788 {
 789         list_del(&cmd->list);
 790         mgmt_pending_free(cmd);
 791 }
 792
 793 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 794 {
 795         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 796
 797         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 798                             sizeof(settings));
 799 }
 800
 801 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 802                        u16 len)
 803 {
 804         struct mgmt_mode *cp = data;
 805         struct pending_cmd *cmd;
 806         int err;
 807
 808         BT_DBG("request for %s", hdev->name);
 809
 810         if (cp->val != 0x00 && cp->val != 0x01)
 811                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 812                                   MGMT_STATUS_INVALID_PARAMS);
 813
 814         hci_dev_lock(hdev);
 815
 816         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 817                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 818                                  MGMT_STATUS_BUSY);
 819                 goto failed;
 820         }
 821
 822         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 823                 cancel_delayed_work(&hdev->power_off);
 824
 825                 if (cp->val) {
 826                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 827                                          data, len);
 828                         err = mgmt_powered(hdev, 1);
 829                         goto failed;
 830                 }
 831         }
 832
 833         if (!!cp->val == hdev_is_powered(hdev)) {
 834                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 835                 goto failed;
 836         }
 837
 838         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 839         if (!cmd) {
 840                 err = -ENOMEM;
 841                 goto failed;
 842         }
 843
 844         if (cp->val)
 845                 queue_work(hdev->req_workqueue, &hdev->power_on);
 846         else
 847                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 848
 849         err = 0;
 850
 851 failed:
 852         hci_dev_unlock(hdev);
 853         return err;
 854 }
 855
 856 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 857                       struct sock *skip_sk)
 858 {
 859         struct sk_buff *skb;
 860         struct mgmt_hdr *hdr;
 861
 862         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 863         if (!skb)
 864                 return -ENOMEM;
 865
 866         hdr = (void *) skb_put(skb, sizeof(*hdr));
 867         hdr->opcode = cpu_to_le16(event);
 868         if (hdev)
 869                 hdr->index = cpu_to_le16(hdev->id);
 870         else
 871                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 872         hdr->len = cpu_to_le16(data_len);
 873
 874         if (data)
 875                 memcpy(skb_put(skb, data_len), data, data_len);
 876
 877         /* Time stamp */
 878         __net_timestamp(skb);
 879
 880         hci_send_to_control(skb, skip_sk);
 881         kfree_skb(skb);
 882
 883         return 0;
 884 }
 885
 886 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 887 {
 888         __le32 ev;
 889
 890         ev = cpu_to_le32(get_current_settings(hdev));
 891
 892         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 893 }
 894
 895 struct cmd_lookup {
 896         struct sock *sk;
 897         struct hci_dev *hdev;
 898         u8 mgmt_status;
 899 };
 900
 901 static void settings_rsp(struct pending_cmd *cmd, void *data)
 902 {
 903         struct cmd_lookup *match = data;
 904
 905         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
 906
 907         list_del(&cmd->list);
 908
 909         if (match->sk == NULL) {
 910                 match->sk = cmd->sk;
 911                 sock_hold(match->sk);
 912         }
 913
 914         mgmt_pending_free(cmd);
 915 }
 916
 917 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
 918 {
 919         u8 *status = data;
 920
 921         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
 922         mgmt_pending_remove(cmd);
 923 }
 924
 925 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 926                             u16 len)
 927 {
 928         struct mgmt_cp_set_discoverable *cp = data;
 929         struct pending_cmd *cmd;
 930         u16 timeout;
 931         u8 scan;
 932         int err;
 933
 934         BT_DBG("request for %s", hdev->name);
 935
 936         if (!lmp_bredr_capable(hdev))
 937                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 938                                  MGMT_STATUS_NOT_SUPPORTED);
 939
 940         if (cp->val != 0x00 && cp->val != 0x01)
 941                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 942                                   MGMT_STATUS_INVALID_PARAMS);
 943
 944         timeout = __le16_to_cpu(cp->timeout);
 945         if (!cp->val && timeout > 0)
 946                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 947                                   MGMT_STATUS_INVALID_PARAMS);
 948
 949         hci_dev_lock(hdev);
 950
 951         if (!hdev_is_powered(hdev) && timeout > 0) {
 952                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 953                                  MGMT_STATUS_NOT_POWERED);
 954                 goto failed;
 955         }
 956
 957         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 958             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 959                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 960                                  MGMT_STATUS_BUSY);
 961                 goto failed;
 962         }
 963
 964         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 965                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 966                                  MGMT_STATUS_REJECTED);
 967                 goto failed;
 968         }
 969
 970         if (!hdev_is_powered(hdev)) {
 971                 bool changed = false;
 972
 973                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 974                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 975                         changed = true;
 976                 }
 977
 978                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 979                 if (err < 0)
 980                         goto failed;
 981
 982                 if (changed)
 983                         err = new_settings(hdev, sk);
 984
 985                 goto failed;
 986         }
 987
 988         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 989                 if (hdev->discov_timeout > 0) {
 990                         cancel_delayed_work(&hdev->discov_off);
 991                         hdev->discov_timeout = 0;
 992                 }
 993
 994                 if (cp->val && timeout > 0) {
 995                         hdev->discov_timeout = timeout;
 996                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 997                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 998                 }
 999
1000                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1001                 goto failed;
1002         }
1003
1004         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1005         if (!cmd) {
1006                 err = -ENOMEM;
1007                 goto failed;
1008         }
1009
1010         scan = SCAN_PAGE;
1011
1012         if (cp->val)
1013                 scan |= SCAN_INQUIRY;
1014         else
1015                 cancel_delayed_work(&hdev->discov_off);
1016
1017         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1018         if (err < 0)
1019                 mgmt_pending_remove(cmd);
1020
1021         if (cp->val)
1022                 hdev->discov_timeout = timeout;
1023
1024 failed:
1025         hci_dev_unlock(hdev);
1026         return err;
1027 }
1028
1029 static void write_fast_connectable(struct hci_request *req, bool enable)
1030 {
1031         struct hci_dev *hdev = req->hdev;
1032         struct hci_cp_write_page_scan_activity acp;
1033         u8 type;
1034
1035         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1036                 return;
1037
1038         if (enable) {
1039                 type = PAGE_SCAN_TYPE_INTERLACED;
1040
1041                 /* 160 msec page scan interval */
1042                 acp.interval = __constant_cpu_to_le16(0x0100);
1043         } else {
1044                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1045
1046                 /* default 1.28 sec page scan */
1047                 acp.interval = __constant_cpu_to_le16(0x0800);
1048         }
1049
1050         acp.window = __constant_cpu_to_le16(0x0012);
1051
1052         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1053             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1054                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1055                             sizeof(acp), &acp);
1056
1057         if (hdev->page_scan_type != type)
1058                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1059 }
1060
1061 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1062 {
1063         struct pending_cmd *cmd;
1064
1065         BT_DBG("status 0x%02x", status);
1066
1067         hci_dev_lock(hdev);
1068
1069         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1070         if (!cmd)
1071                 goto unlock;
1072
1073         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1074
1075         mgmt_pending_remove(cmd);
1076
1077 unlock:
1078         hci_dev_unlock(hdev);
1079 }
1080
1081 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1082                            u16 len)
1083 {
1084         struct mgmt_mode *cp = data;
1085         struct pending_cmd *cmd;
1086         struct hci_request req;
1087         u8 scan;
1088         int err;
1089
1090         BT_DBG("request for %s", hdev->name);
1091
1092         if (!lmp_bredr_capable(hdev))
1093                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1094                                   MGMT_STATUS_NOT_SUPPORTED);
1095
1096         if (cp->val != 0x00 && cp->val != 0x01)
1097                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1098                                   MGMT_STATUS_INVALID_PARAMS);
1099
1100         hci_dev_lock(hdev);
1101
1102         if (!hdev_is_powered(hdev)) {
1103                 bool changed = false;
1104
1105                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1106                         changed = true;
1107
1108                 if (cp->val) {
1109                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1110                 } else {
1111                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1112                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1113                 }
1114
1115                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1116                 if (err < 0)
1117                         goto failed;
1118
1119                 if (changed)
1120                         err = new_settings(hdev, sk);
1121
1122                 goto failed;
1123         }
1124
1125         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1126             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1127                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1128                                  MGMT_STATUS_BUSY);
1129                 goto failed;
1130         }
1131
1132         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1133                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1134                 goto failed;
1135         }
1136
1137         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1138         if (!cmd) {
1139                 err = -ENOMEM;
1140                 goto failed;
1141         }
1142
1143         if (cp->val) {
1144                 scan = SCAN_PAGE;
1145         } else {
1146                 scan = 0;
1147
1148                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1149                     hdev->discov_timeout > 0)
1150                         cancel_delayed_work(&hdev->discov_off);
1151         }
1152
1153         hci_req_init(&req, hdev);
1154
1155         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1156
1157         /* If we're going from non-connectable to connectable or
1158          * vice-versa when fast connectable is enabled ensure that fast
1159          * connectable gets disabled. write_fast_connectable won't do
1160          * anything if the page scan parameters are already what they
1161          * should be.
1162          */
1163         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1164                 write_fast_connectable(&req, false);
1165
1166         err = hci_req_run(&req, set_connectable_complete);
1167         if (err < 0)
1168                 mgmt_pending_remove(cmd);
1169
1170 failed:
1171         hci_dev_unlock(hdev);
1172         return err;
1173 }
1174
1175 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1176                         u16 len)
1177 {
1178         struct mgmt_mode *cp = data;
1179         int err;
1180
1181         BT_DBG("request for %s", hdev->name);
1182
1183         if (cp->val != 0x00 && cp->val != 0x01)
1184                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1185                                   MGMT_STATUS_INVALID_PARAMS);
1186
1187         hci_dev_lock(hdev);
1188
1189         if (cp->val)
1190                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1191         else
1192                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1193
1194         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1195         if (err < 0)
1196                 goto failed;
1197
1198         err = new_settings(hdev, sk);
1199
1200 failed:
1201         hci_dev_unlock(hdev);
1202         return err;
1203 }
1204
1205 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1206                              u16 len)
1207 {
1208         struct mgmt_mode *cp = data;
1209         struct pending_cmd *cmd;
1210         u8 val;
1211         int err;
1212
1213         BT_DBG("request for %s", hdev->name);
1214
1215         if (!lmp_bredr_capable(hdev))
1216                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1217                                   MGMT_STATUS_NOT_SUPPORTED);
1218
1219         if (cp->val != 0x00 && cp->val != 0x01)
1220                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1221                                   MGMT_STATUS_INVALID_PARAMS);
1222
1223         hci_dev_lock(hdev);
1224
1225         if (!hdev_is_powered(hdev)) {
1226                 bool changed = false;
1227
1228                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1229                                           &hdev->dev_flags)) {
1230                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1231                         changed = true;
1232                 }
1233
1234                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1235                 if (err < 0)
1236                         goto failed;
1237
1238                 if (changed)
1239                         err = new_settings(hdev, sk);
1240
1241                 goto failed;
1242         }
1243
1244         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1245                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1246                                  MGMT_STATUS_BUSY);
1247                 goto failed;
1248         }
1249
1250         val = !!cp->val;
1251
1252         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1253                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1254                 goto failed;
1255         }
1256
1257         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1258         if (!cmd) {
1259                 err = -ENOMEM;
1260                 goto failed;
1261         }
1262
1263         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1264         if (err < 0) {
1265                 mgmt_pending_remove(cmd);
1266                 goto failed;
1267         }
1268
1269 failed:
1270         hci_dev_unlock(hdev);
1271         return err;
1272 }
1273
1274 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1275 {
1276         struct mgmt_mode *cp = data;
1277         struct pending_cmd *cmd;
1278         u8 val;
1279         int err;
1280
1281         BT_DBG("request for %s", hdev->name);
1282
1283         if (!lmp_ssp_capable(hdev))
1284                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1285                                   MGMT_STATUS_NOT_SUPPORTED);
1286
1287         if (cp->val != 0x00 && cp->val != 0x01)
1288                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1289                                   MGMT_STATUS_INVALID_PARAMS);
1290
1291         hci_dev_lock(hdev);
1292
1293         val = !!cp->val;
1294
1295         if (!hdev_is_powered(hdev)) {
1296                 bool changed = false;
1297
1298                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1299                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1300                         changed = true;
1301                 }
1302
1303                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1304                 if (err < 0)
1305                         goto failed;
1306
1307                 if (changed)
1308                         err = new_settings(hdev, sk);
1309
1310                 goto failed;
1311         }
1312
1313         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1314                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1315                                  MGMT_STATUS_BUSY);
1316                 goto failed;
1317         }
1318
1319         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1320                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1321                 goto failed;
1322         }
1323
1324         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1325         if (!cmd) {
1326                 err = -ENOMEM;
1327                 goto failed;
1328         }
1329
1330         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1331         if (err < 0) {
1332                 mgmt_pending_remove(cmd);
1333                 goto failed;
1334         }
1335
1336 failed:
1337         hci_dev_unlock(hdev);
1338         return err;
1339 }
1340
1341 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1342 {
1343         struct mgmt_mode *cp = data;
1344
1345         BT_DBG("request for %s", hdev->name);
1346
1347         if (!enable_hs)
1348                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1349                                   MGMT_STATUS_NOT_SUPPORTED);
1350
1351         if (cp->val != 0x00 && cp->val != 0x01)
1352                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1353                                   MGMT_STATUS_INVALID_PARAMS);
1354
1355         if (cp->val)
1356                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1357         else
1358                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1359
1360         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1361 }
1362
1363 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1364 {
1365         struct cmd_lookup match = { NULL, hdev };
1366
1367         if (status) {
1368                 u8 mgmt_err = mgmt_status(status);
1369
1370                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1371                                      &mgmt_err);
1372                 return;
1373         }
1374
1375         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1376
1377         new_settings(hdev, match.sk);
1378
1379         if (match.sk)
1380                 sock_put(match.sk);
1381 }
1382
1383 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1384 {
1385         struct mgmt_mode *cp = data;
1386         struct hci_cp_write_le_host_supported hci_cp;
1387         struct pending_cmd *cmd;
1388         struct hci_request req;
1389         int err;
1390         u8 val, enabled;
1391
1392         BT_DBG("request for %s", hdev->name);
1393
1394         if (!lmp_le_capable(hdev))
1395                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1396                                   MGMT_STATUS_NOT_SUPPORTED);
1397
1398         if (cp->val != 0x00 && cp->val != 0x01)
1399                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1400                                   MGMT_STATUS_INVALID_PARAMS);
1401
1402         /* LE-only devices do not allow toggling LE on/off */
1403         if (!lmp_bredr_capable(hdev))
1404                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1405                                   MGMT_STATUS_REJECTED);
1406
1407         hci_dev_lock(hdev);
1408
1409         val = !!cp->val;
1410         enabled = lmp_host_le_capable(hdev);
1411
1412         if (!hdev_is_powered(hdev) || val == enabled) {
1413                 bool changed = false;
1414
1415                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1416                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1417                         changed = true;
1418                 }
1419
1420                 if (!val && test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
1421                         clear_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags);
1422                         changed = true;
1423                 }
1424
1425                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1426                 if (err < 0)
1427                         goto unlock;
1428
1429                 if (changed)
1430                         err = new_settings(hdev, sk);
1431
1432                 goto unlock;
1433         }
1434
1435         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1436             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1437                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1438                                  MGMT_STATUS_BUSY);
1439                 goto unlock;
1440         }
1441
1442         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1443         if (!cmd) {
1444                 err = -ENOMEM;
1445                 goto unlock;
1446         }
1447
1448         memset(&hci_cp, 0, sizeof(hci_cp));
1449
1450         if (val) {
1451                 hci_cp.le = val;
1452                 hci_cp.simul = lmp_le_br_capable(hdev);
1453         }
1454
1455         hci_req_init(&req, hdev);
1456
1457         if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags) && !val)
1458                 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(val), &val);
1459
1460         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1461                     &hci_cp);
1462
1463         err = hci_req_run(&req, le_enable_complete);
1464         if (err < 0)
1465                 mgmt_pending_remove(cmd);
1466
1467 unlock:
1468         hci_dev_unlock(hdev);
1469         return err;
1470 }
1471
1472 /* This is a helper function to test for pending mgmt commands that can
1473  * cause CoD or EIR HCI commands. We can only allow one such pending
1474  * mgmt command at a time since otherwise we cannot easily track what
1475  * the current values are, will be, and based on that calculate if a new
1476  * HCI command needs to be sent and if yes with what value.
1477  */
1478 static bool pending_eir_or_class(struct hci_dev *hdev)
1479 {
1480         struct pending_cmd *cmd;
1481
1482         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1483                 switch (cmd->opcode) {
1484                 case MGMT_OP_ADD_UUID:
1485                 case MGMT_OP_REMOVE_UUID:
1486                 case MGMT_OP_SET_DEV_CLASS:
1487                 case MGMT_OP_SET_POWERED:
1488                         return true;
1489                 }
1490         }
1491
1492         return false;
1493 }
1494
1495 static const u8 bluetooth_base_uuid[] = {
1496                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1497                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1498 };
1499
1500 static u8 get_uuid_size(const u8 *uuid)
1501 {
1502         u32 val;
1503
1504         if (memcmp(uuid, bluetooth_base_uuid, 12))
1505                 return 128;
1506
1507         val = get_unaligned_le32(&uuid[12]);
1508         if (val > 0xffff)
1509                 return 32;
1510
1511         return 16;
1512 }
1513
1514 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1515 {
1516         struct pending_cmd *cmd;
1517
1518         hci_dev_lock(hdev);
1519
1520         cmd = mgmt_pending_find(mgmt_op, hdev);
1521         if (!cmd)
1522                 goto unlock;
1523
1524         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1525                      hdev->dev_class, 3);
1526
1527         mgmt_pending_remove(cmd);
1528
1529 unlock:
1530         hci_dev_unlock(hdev);
1531 }
1532
1533 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1534 {
1535         BT_DBG("status 0x%02x", status);
1536
1537         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1538 }
1539
1540 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1541 {
1542         struct mgmt_cp_add_uuid *cp = data;
1543         struct pending_cmd *cmd;
1544         struct hci_request req;
1545         struct bt_uuid *uuid;
1546         int err;
1547
1548         BT_DBG("request for %s", hdev->name);
1549
1550         hci_dev_lock(hdev);
1551
1552         if (pending_eir_or_class(hdev)) {
1553                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1554                                  MGMT_STATUS_BUSY);
1555                 goto failed;
1556         }
1557
1558         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1559         if (!uuid) {
1560                 err = -ENOMEM;
1561                 goto failed;
1562         }
1563
1564         memcpy(uuid->uuid, cp->uuid, 16);
1565         uuid->svc_hint = cp->svc_hint;
1566         uuid->size = get_uuid_size(cp->uuid);
1567
1568         list_add_tail(&uuid->list, &hdev->uuids);
1569
1570         hci_req_init(&req, hdev);
1571
1572         update_class(&req);
1573         update_eir(&req);
1574
1575         err = hci_req_run(&req, add_uuid_complete);
1576         if (err < 0) {
1577                 if (err != -ENODATA)
1578                         goto failed;
1579
1580                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1581                                    hdev->dev_class, 3);
1582                 goto failed;
1583         }
1584
1585         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1586         if (!cmd) {
1587                 err = -ENOMEM;
1588                 goto failed;
1589         }
1590
1591         err = 0;
1592
1593 failed:
1594         hci_dev_unlock(hdev);
1595         return err;
1596 }
1597
1598 static bool enable_service_cache(struct hci_dev *hdev)
1599 {
1600         if (!hdev_is_powered(hdev))
1601                 return false;
1602
1603         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1604                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1605                                    CACHE_TIMEOUT);
1606                 return true;
1607         }
1608
1609         return false;
1610 }
1611
1612 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1613 {
1614         BT_DBG("status 0x%02x", status);
1615
1616         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1617 }
1618
1619 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1620                        u16 len)
1621 {
1622         struct mgmt_cp_remove_uuid *cp = data;
1623         struct pending_cmd *cmd;
1624         struct bt_uuid *match, *tmp;
1625         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1626         struct hci_request req;
1627         int err, found;
1628
1629         BT_DBG("request for %s", hdev->name);
1630
1631         hci_dev_lock(hdev);
1632
1633         if (pending_eir_or_class(hdev)) {
1634                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1635                                  MGMT_STATUS_BUSY);
1636                 goto unlock;
1637         }
1638
1639         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1640                 err = hci_uuids_clear(hdev);
1641
1642                 if (enable_service_cache(hdev)) {
1643                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1644                                            0, hdev->dev_class, 3);
1645                         goto unlock;
1646                 }
1647
1648                 goto update_class;
1649         }
1650
1651         found = 0;
1652
1653         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1654                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1655                         continue;
1656
1657                 list_del(&match->list);
1658                 kfree(match);
1659                 found++;
1660         }
1661
1662         if (found == 0) {
1663                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1664                                  MGMT_STATUS_INVALID_PARAMS);
1665                 goto unlock;
1666         }
1667
1668 update_class:
1669         hci_req_init(&req, hdev);
1670
1671         update_class(&req);
1672         update_eir(&req);
1673
1674         err = hci_req_run(&req, remove_uuid_complete);
1675         if (err < 0) {
1676                 if (err != -ENODATA)
1677                         goto unlock;
1678
1679                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1680                                    hdev->dev_class, 3);
1681                 goto unlock;
1682         }
1683
1684         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1685         if (!cmd) {
1686                 err = -ENOMEM;
1687                 goto unlock;
1688         }
1689
1690         err = 0;
1691
1692 unlock:
1693         hci_dev_unlock(hdev);
1694         return err;
1695 }
1696
1697 static void set_class_complete(struct hci_dev *hdev, u8 status)
1698 {
1699         BT_DBG("status 0x%02x", status);
1700
1701         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1702 }
1703
1704 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1705                          u16 len)
1706 {
1707         struct mgmt_cp_set_dev_class *cp = data;
1708         struct pending_cmd *cmd;
1709         struct hci_request req;
1710         int err;
1711
1712         BT_DBG("request for %s", hdev->name);
1713
1714         if (!lmp_bredr_capable(hdev))
1715                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1716                                   MGMT_STATUS_NOT_SUPPORTED);
1717
1718         hci_dev_lock(hdev);
1719
1720         if (pending_eir_or_class(hdev)) {
1721                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1722                                  MGMT_STATUS_BUSY);
1723                 goto unlock;
1724         }
1725
1726         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1727                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1728                                  MGMT_STATUS_INVALID_PARAMS);
1729                 goto unlock;
1730         }
1731
1732         hdev->major_class = cp->major;
1733         hdev->minor_class = cp->minor;
1734
1735         if (!hdev_is_powered(hdev)) {
1736                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1737                                    hdev->dev_class, 3);
1738                 goto unlock;
1739         }
1740
1741         hci_req_init(&req, hdev);
1742
1743         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1744                 hci_dev_unlock(hdev);
1745                 cancel_delayed_work_sync(&hdev->service_cache);
1746                 hci_dev_lock(hdev);
1747                 update_eir(&req);
1748         }
1749
1750         update_class(&req);
1751
1752         err = hci_req_run(&req, set_class_complete);
1753         if (err < 0) {
1754                 if (err != -ENODATA)
1755                         goto unlock;
1756
1757                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1758                                    hdev->dev_class, 3);
1759                 goto unlock;
1760         }
1761
1762         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1763         if (!cmd) {
1764                 err = -ENOMEM;
1765                 goto unlock;
1766         }
1767
1768         err = 0;
1769
1770 unlock:
1771         hci_dev_unlock(hdev);
1772         return err;
1773 }
1774
1775 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1776                           u16 len)
1777 {
1778         struct mgmt_cp_load_link_keys *cp = data;
1779         u16 key_count, expected_len;
1780         int i;
1781
1782         key_count = __le16_to_cpu(cp->key_count);
1783
1784         expected_len = sizeof(*cp) + key_count *
1785                                         sizeof(struct mgmt_link_key_info);
1786         if (expected_len != len) {
1787                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1788                        len, expected_len);
1789                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1790                                   MGMT_STATUS_INVALID_PARAMS);
1791         }
1792
1793         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1794                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1795                                   MGMT_STATUS_INVALID_PARAMS);
1796
1797         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1798                key_count);
1799
1800         for (i = 0; i < key_count; i++) {
1801                 struct mgmt_link_key_info *key = &cp->keys[i];
1802
1803                 if (key->addr.type != BDADDR_BREDR)
1804                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1805                                           MGMT_STATUS_INVALID_PARAMS);
1806         }
1807
1808         hci_dev_lock(hdev);
1809
1810         hci_link_keys_clear(hdev);
1811
1812         if (cp->debug_keys)
1813                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1814         else
1815                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1816
1817         for (i = 0; i < key_count; i++) {
1818                 struct mgmt_link_key_info *key = &cp->keys[i];
1819
1820                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1821                                  key->type, key->pin_len);
1822         }
1823
1824         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1825
1826         hci_dev_unlock(hdev);
1827
1828         return 0;
1829 }
1830
1831 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1832                            u8 addr_type, struct sock *skip_sk)
1833 {
1834         struct mgmt_ev_device_unpaired ev;
1835
1836         bacpy(&ev.addr.bdaddr, bdaddr);
1837         ev.addr.type = addr_type;
1838
1839         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1840                           skip_sk);
1841 }
1842
1843 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1844                          u16 len)
1845 {
1846         struct mgmt_cp_unpair_device *cp = data;
1847         struct mgmt_rp_unpair_device rp;
1848         struct hci_cp_disconnect dc;
1849         struct pending_cmd *cmd;
1850         struct hci_conn *conn;
1851         int err;
1852
1853         memset(&rp, 0, sizeof(rp));
1854         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1855         rp.addr.type = cp->addr.type;
1856
1857         if (!bdaddr_type_is_valid(cp->addr.type))
1858                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1859                                     MGMT_STATUS_INVALID_PARAMS,
1860                                     &rp, sizeof(rp));
1861
1862         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1863                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1864                                     MGMT_STATUS_INVALID_PARAMS,
1865                                     &rp, sizeof(rp));
1866
1867         hci_dev_lock(hdev);
1868
1869         if (!hdev_is_powered(hdev)) {
1870                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1871                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1872                 goto unlock;
1873         }
1874
1875         if (cp->addr.type == BDADDR_BREDR)
1876                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1877         else
1878                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1879
1880         if (err < 0) {
1881                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1882                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1883                 goto unlock;
1884         }
1885
1886         if (cp->disconnect) {
1887                 if (cp->addr.type == BDADDR_BREDR)
1888                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1889                                                        &cp->addr.bdaddr);
1890                 else
1891                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1892                                                        &cp->addr.bdaddr);
1893         } else {
1894                 conn = NULL;
1895         }
1896
1897         if (!conn) {
1898                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1899                                    &rp, sizeof(rp));
1900                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1901                 goto unlock;
1902         }
1903
1904         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1905                                sizeof(*cp));
1906         if (!cmd) {
1907                 err = -ENOMEM;
1908                 goto unlock;
1909         }
1910
1911         dc.handle = cpu_to_le16(conn->handle);
1912         dc.reason = 0x13; /* Remote User Terminated Connection */
1913         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1914         if (err < 0)
1915                 mgmt_pending_remove(cmd);
1916
1917 unlock:
1918         hci_dev_unlock(hdev);
1919         return err;
1920 }
1921
1922 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1923                       u16 len)
1924 {
1925         struct mgmt_cp_disconnect *cp = data;
1926         struct mgmt_rp_disconnect rp;
1927         struct hci_cp_disconnect dc;
1928         struct pending_cmd *cmd;
1929         struct hci_conn *conn;
1930         int err;
1931
1932         BT_DBG("");
1933
1934         memset(&rp, 0, sizeof(rp));
1935         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1936         rp.addr.type = cp->addr.type;
1937
1938         if (!bdaddr_type_is_valid(cp->addr.type))
1939                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1940                                     MGMT_STATUS_INVALID_PARAMS,
1941                                     &rp, sizeof(rp));
1942
1943         hci_dev_lock(hdev);
1944
1945         if (!test_bit(HCI_UP, &hdev->flags)) {
1946                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1947                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1948                 goto failed;
1949         }
1950
1951         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1952                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1953                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1954                 goto failed;
1955         }
1956
1957         if (cp->addr.type == BDADDR_BREDR)
1958                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1959                                                &cp->addr.bdaddr);
1960         else
1961                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1962
1963         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1964                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1965                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1966                 goto failed;
1967         }
1968
1969         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1970         if (!cmd) {
1971                 err = -ENOMEM;
1972                 goto failed;
1973         }
1974
1975         dc.handle = cpu_to_le16(conn->handle);
1976         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1977
1978         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1979         if (err < 0)
1980                 mgmt_pending_remove(cmd);
1981
1982 failed:
1983         hci_dev_unlock(hdev);
1984         return err;
1985 }
1986
1987 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1988 {
1989         switch (link_type) {
1990         case LE_LINK:
1991                 switch (addr_type) {
1992                 case ADDR_LE_DEV_PUBLIC:
1993                         return BDADDR_LE_PUBLIC;
1994
1995                 default:
1996                         /* Fallback to LE Random address type */
1997                         return BDADDR_LE_RANDOM;
1998                 }
1999
2000         default:
2001                 /* Fallback to BR/EDR type */
2002                 return BDADDR_BREDR;
2003         }
2004 }
2005
2006 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2007                            u16 data_len)
2008 {
2009         struct mgmt_rp_get_connections *rp;
2010         struct hci_conn *c;
2011         size_t rp_len;
2012         int err;
2013         u16 i;
2014
2015         BT_DBG("");
2016
2017         hci_dev_lock(hdev);
2018
2019         if (!hdev_is_powered(hdev)) {
2020                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2021                                  MGMT_STATUS_NOT_POWERED);
2022                 goto unlock;
2023         }
2024
2025         i = 0;
2026         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2027                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2028                         i++;
2029         }
2030
2031         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2032         rp = kmalloc(rp_len, GFP_KERNEL);
2033         if (!rp) {
2034                 err = -ENOMEM;
2035                 goto unlock;
2036         }
2037
2038         i = 0;
2039         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2040                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2041                         continue;
2042                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2043                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2044                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2045                         continue;
2046                 i++;
2047         }
2048
2049         rp->conn_count = cpu_to_le16(i);
2050
2051         /* Recalculate length in case of filtered SCO connections, etc */
2052         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2053
2054         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2055                            rp_len);
2056
2057         kfree(rp);
2058
2059 unlock:
2060         hci_dev_unlock(hdev);
2061         return err;
2062 }
2063
2064 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2065                                    struct mgmt_cp_pin_code_neg_reply *cp)
2066 {
2067         struct pending_cmd *cmd;
2068         int err;
2069
2070         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2071                                sizeof(*cp));
2072         if (!cmd)
2073                 return -ENOMEM;
2074
2075         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2076                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2077         if (err < 0)
2078                 mgmt_pending_remove(cmd);
2079
2080         return err;
2081 }
2082
2083 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2084                           u16 len)
2085 {
2086         struct hci_conn *conn;
2087         struct mgmt_cp_pin_code_reply *cp = data;
2088         struct hci_cp_pin_code_reply reply;
2089         struct pending_cmd *cmd;
2090         int err;
2091
2092         BT_DBG("");
2093
2094         hci_dev_lock(hdev);
2095
2096         if (!hdev_is_powered(hdev)) {
2097                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2098                                  MGMT_STATUS_NOT_POWERED);
2099                 goto failed;
2100         }
2101
2102         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2103         if (!conn) {
2104                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2105                                  MGMT_STATUS_NOT_CONNECTED);
2106                 goto failed;
2107         }
2108
2109         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2110                 struct mgmt_cp_pin_code_neg_reply ncp;
2111
2112                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2113
2114                 BT_ERR("PIN code is not 16 bytes long");
2115
2116                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2117                 if (err >= 0)
2118                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2119                                          MGMT_STATUS_INVALID_PARAMS);
2120
2121                 goto failed;
2122         }
2123
2124         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2125         if (!cmd) {
2126                 err = -ENOMEM;
2127                 goto failed;
2128         }
2129
2130         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2131         reply.pin_len = cp->pin_len;
2132         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2133
2134         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2135         if (err < 0)
2136                 mgmt_pending_remove(cmd);
2137
2138 failed:
2139         hci_dev_unlock(hdev);
2140         return err;
2141 }
2142
2143 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2144                              u16 len)
2145 {
2146         struct mgmt_cp_set_io_capability *cp = data;
2147
2148         BT_DBG("");
2149
2150         hci_dev_lock(hdev);
2151
2152         hdev->io_capability = cp->io_capability;
2153
2154         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2155                hdev->io_capability);
2156
2157         hci_dev_unlock(hdev);
2158
2159         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2160                             0);
2161 }
2162
2163 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2164 {
2165         struct hci_dev *hdev = conn->hdev;
2166         struct pending_cmd *cmd;
2167
2168         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2169                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2170                         continue;
2171
2172                 if (cmd->user_data != conn)
2173                         continue;
2174
2175                 return cmd;
2176         }
2177
2178         return NULL;
2179 }
2180
2181 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2182 {
2183         struct mgmt_rp_pair_device rp;
2184         struct hci_conn *conn = cmd->user_data;
2185
2186         bacpy(&rp.addr.bdaddr, &conn->dst);
2187         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2188
2189         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2190                      &rp, sizeof(rp));
2191
2192         /* So we don't get further callbacks for this connection */
2193         conn->connect_cfm_cb = NULL;
2194         conn->security_cfm_cb = NULL;
2195         conn->disconn_cfm_cb = NULL;
2196
2197         hci_conn_drop(conn);
2198
2199         mgmt_pending_remove(cmd);
2200 }
2201
2202 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2203 {
2204         struct pending_cmd *cmd;
2205
2206         BT_DBG("status %u", status);
2207
2208         cmd = find_pairing(conn);
2209         if (!cmd)
2210                 BT_DBG("Unable to find a pending command");
2211         else
2212                 pairing_complete(cmd, mgmt_status(status));
2213 }
2214
2215 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2216 {
2217         struct pending_cmd *cmd;
2218
2219         BT_DBG("status %u", status);
2220
2221         if (!status)
2222                 return;
2223
2224         cmd = find_pairing(conn);
2225         if (!cmd)
2226                 BT_DBG("Unable to find a pending command");
2227         else
2228                 pairing_complete(cmd, mgmt_status(status));
2229 }
2230
2231 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2232                        u16 len)
2233 {
2234         struct mgmt_cp_pair_device *cp = data;
2235         struct mgmt_rp_pair_device rp;
2236         struct pending_cmd *cmd;
2237         u8 sec_level, auth_type;
2238         struct hci_conn *conn;
2239         int err;
2240
2241         BT_DBG("");
2242
2243         memset(&rp, 0, sizeof(rp));
2244         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2245         rp.addr.type = cp->addr.type;
2246
2247         if (!bdaddr_type_is_valid(cp->addr.type))
2248                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2249                                     MGMT_STATUS_INVALID_PARAMS,
2250                                     &rp, sizeof(rp));
2251
2252         hci_dev_lock(hdev);
2253
2254         if (!hdev_is_powered(hdev)) {
2255                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2256                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2257                 goto unlock;
2258         }
2259
2260         sec_level = BT_SECURITY_MEDIUM;
2261         if (cp->io_cap == 0x03)
2262                 auth_type = HCI_AT_DEDICATED_BONDING;
2263         else
2264                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2265
2266         if (cp->addr.type == BDADDR_BREDR)
2267                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2268                                    cp->addr.type, sec_level, auth_type);
2269         else
2270                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2271                                    cp->addr.type, sec_level, auth_type);
2272
2273         if (IS_ERR(conn)) {
2274                 int status;
2275
2276                 if (PTR_ERR(conn) == -EBUSY)
2277                         status = MGMT_STATUS_BUSY;
2278                 else
2279                         status = MGMT_STATUS_CONNECT_FAILED;
2280
2281                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2282                                    status, &rp,
2283                                    sizeof(rp));
2284                 goto unlock;
2285         }
2286
2287         if (conn->connect_cfm_cb) {
2288                 hci_conn_drop(conn);
2289                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2290                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2291                 goto unlock;
2292         }
2293
2294         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2295         if (!cmd) {
2296                 err = -ENOMEM;
2297                 hci_conn_drop(conn);
2298                 goto unlock;
2299         }
2300
2301         /* For LE, just connecting isn't a proof that the pairing finished */
2302         if (cp->addr.type == BDADDR_BREDR)
2303                 conn->connect_cfm_cb = pairing_complete_cb;
2304         else
2305                 conn->connect_cfm_cb = le_connect_complete_cb;
2306
2307         conn->security_cfm_cb = pairing_complete_cb;
2308         conn->disconn_cfm_cb = pairing_complete_cb;
2309         conn->io_capability = cp->io_cap;
2310         cmd->user_data = conn;
2311
2312         if (conn->state == BT_CONNECTED &&
2313             hci_conn_security(conn, sec_level, auth_type))
2314                 pairing_complete(cmd, 0);
2315
2316         err = 0;
2317
2318 unlock:
2319         hci_dev_unlock(hdev);
2320         return err;
2321 }
2322
2323 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2324                               u16 len)
2325 {
2326         struct mgmt_addr_info *addr = data;
2327         struct pending_cmd *cmd;
2328         struct hci_conn *conn;
2329         int err;
2330
2331         BT_DBG("");
2332
2333         hci_dev_lock(hdev);
2334
2335         if (!hdev_is_powered(hdev)) {
2336                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2337                                  MGMT_STATUS_NOT_POWERED);
2338                 goto unlock;
2339         }
2340
2341         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2342         if (!cmd) {
2343                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2344                                  MGMT_STATUS_INVALID_PARAMS);
2345                 goto unlock;
2346         }
2347
2348         conn = cmd->user_data;
2349
2350         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2351                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2352                                  MGMT_STATUS_INVALID_PARAMS);
2353                 goto unlock;
2354         }
2355
2356         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2357
2358         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2359                            addr, sizeof(*addr));
2360 unlock:
2361         hci_dev_unlock(hdev);
2362         return err;
2363 }
2364
2365 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2366                              struct mgmt_addr_info *addr, u16 mgmt_op,
2367                              u16 hci_op, __le32 passkey)
2368 {
2369         struct pending_cmd *cmd;
2370         struct hci_conn *conn;
2371         int err;
2372
2373         hci_dev_lock(hdev);
2374
2375         if (!hdev_is_powered(hdev)) {
2376                 err = cmd_complete(sk, hdev->id, mgmt_op,
2377                                    MGMT_STATUS_NOT_POWERED, addr,
2378                                    sizeof(*addr));
2379                 goto done;
2380         }
2381
2382         if (addr->type == BDADDR_BREDR)
2383                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2384         else
2385                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2386
2387         if (!conn) {
2388                 err = cmd_complete(sk, hdev->id, mgmt_op,
2389                                    MGMT_STATUS_NOT_CONNECTED, addr,
2390                                    sizeof(*addr));
2391                 goto done;
2392         }
2393
2394         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2395                 /* Continue with pairing via SMP */
2396                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2397
2398                 if (!err)
2399                         err = cmd_complete(sk, hdev->id, mgmt_op,
2400                                            MGMT_STATUS_SUCCESS, addr,
2401                                            sizeof(*addr));
2402                 else
2403                         err = cmd_complete(sk, hdev->id, mgmt_op,
2404                                            MGMT_STATUS_FAILED, addr,
2405                                            sizeof(*addr));
2406
2407                 goto done;
2408         }
2409
2410         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2411         if (!cmd) {
2412                 err = -ENOMEM;
2413                 goto done;
2414         }
2415
2416         /* Continue with pairing via HCI */
2417         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2418                 struct hci_cp_user_passkey_reply cp;
2419
2420                 bacpy(&cp.bdaddr, &addr->bdaddr);
2421                 cp.passkey = passkey;
2422                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2423         } else
2424                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2425                                    &addr->bdaddr);
2426
2427         if (err < 0)
2428                 mgmt_pending_remove(cmd);
2429
2430 done:
2431         hci_dev_unlock(hdev);
2432         return err;
2433 }
2434
2435 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2436                               void *data, u16 len)
2437 {
2438         struct mgmt_cp_pin_code_neg_reply *cp = data;
2439
2440         BT_DBG("");
2441
2442         return user_pairing_resp(sk, hdev, &cp->addr,
2443                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2444                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2445 }
2446
2447 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2448                               u16 len)
2449 {
2450         struct mgmt_cp_user_confirm_reply *cp = data;
2451
2452         BT_DBG("");
2453
2454         if (len != sizeof(*cp))
2455                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2456                                   MGMT_STATUS_INVALID_PARAMS);
2457
2458         return user_pairing_resp(sk, hdev, &cp->addr,
2459                                  MGMT_OP_USER_CONFIRM_REPLY,
2460                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2461 }
2462
2463 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2464                                   void *data, u16 len)
2465 {
2466         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2467
2468         BT_DBG("");
2469
2470         return user_pairing_resp(sk, hdev, &cp->addr,
2471                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2472                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2473 }
2474
2475 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2476                               u16 len)
2477 {
2478         struct mgmt_cp_user_passkey_reply *cp = data;
2479
2480         BT_DBG("");
2481
2482         return user_pairing_resp(sk, hdev, &cp->addr,
2483                                  MGMT_OP_USER_PASSKEY_REPLY,
2484                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2485 }
2486
2487 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2488                                   void *data, u16 len)
2489 {
2490         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2491
2492         BT_DBG("");
2493
2494         return user_pairing_resp(sk, hdev, &cp->addr,
2495                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2496                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2497 }
2498
2499 static void update_name(struct hci_request *req)
2500 {
2501         struct hci_dev *hdev = req->hdev;
2502         struct hci_cp_write_local_name cp;
2503
2504         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2505
2506         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2507 }
2508
2509 static void set_name_complete(struct hci_dev *hdev, u8 status)
2510 {
2511         struct mgmt_cp_set_local_name *cp;
2512         struct pending_cmd *cmd;
2513
2514         BT_DBG("status 0x%02x", status);
2515
2516         hci_dev_lock(hdev);
2517
2518         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2519         if (!cmd)
2520                 goto unlock;
2521
2522         cp = cmd->param;
2523
2524         if (status)
2525                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2526                            mgmt_status(status));
2527         else
2528                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2529                              cp, sizeof(*cp));
2530
2531         mgmt_pending_remove(cmd);
2532
2533 unlock:
2534         hci_dev_unlock(hdev);
2535 }
2536
2537 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2538                           u16 len)
2539 {
2540         struct mgmt_cp_set_local_name *cp = data;
2541         struct pending_cmd *cmd;
2542         struct hci_request req;
2543         int err;
2544
2545         BT_DBG("");
2546
2547         hci_dev_lock(hdev);
2548
2549         /* If the old values are the same as the new ones just return a
2550          * direct command complete event.
2551          */
2552         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2553             !memcmp(hdev->short_name, cp->short_name,
2554                     sizeof(hdev->short_name))) {
2555                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2556                                    data, len);
2557                 goto failed;
2558         }
2559
2560         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2561
2562         if (!hdev_is_powered(hdev)) {
2563                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2564
2565                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2566                                    data, len);
2567                 if (err < 0)
2568                         goto failed;
2569
2570                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2571                                  sk);
2572
2573                 goto failed;
2574         }
2575
2576         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2577         if (!cmd) {
2578                 err = -ENOMEM;
2579                 goto failed;
2580         }
2581
2582         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2583
2584         hci_req_init(&req, hdev);
2585
2586         if (lmp_bredr_capable(hdev)) {
2587                 update_name(&req);
2588                 update_eir(&req);
2589         }
2590
2591         if (lmp_le_capable(hdev))
2592                 hci_update_ad(&req);
2593
2594         err = hci_req_run(&req, set_name_complete);
2595         if (err < 0)
2596                 mgmt_pending_remove(cmd);
2597
2598 failed:
2599         hci_dev_unlock(hdev);
2600         return err;
2601 }
2602
2603 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2604                                void *data, u16 data_len)
2605 {
2606         struct pending_cmd *cmd;
2607         int err;
2608
2609         BT_DBG("%s", hdev->name);
2610
2611         hci_dev_lock(hdev);
2612
2613         if (!hdev_is_powered(hdev)) {
2614                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2615                                  MGMT_STATUS_NOT_POWERED);
2616                 goto unlock;
2617         }
2618
2619         if (!lmp_ssp_capable(hdev)) {
2620                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2621                                  MGMT_STATUS_NOT_SUPPORTED);
2622                 goto unlock;
2623         }
2624
2625         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2626                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2627                                  MGMT_STATUS_BUSY);
2628                 goto unlock;
2629         }
2630
2631         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2632         if (!cmd) {
2633                 err = -ENOMEM;
2634                 goto unlock;
2635         }
2636
2637         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2638         if (err < 0)
2639                 mgmt_pending_remove(cmd);
2640
2641 unlock:
2642         hci_dev_unlock(hdev);
2643         return err;
2644 }
2645
2646 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2647                                void *data, u16 len)
2648 {
2649         struct mgmt_cp_add_remote_oob_data *cp = data;
2650         u8 status;
2651         int err;
2652
2653         BT_DBG("%s ", hdev->name);
2654
2655         hci_dev_lock(hdev);
2656
2657         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2658                                       cp->randomizer);
2659         if (err < 0)
2660                 status = MGMT_STATUS_FAILED;
2661         else
2662                 status = MGMT_STATUS_SUCCESS;
2663
2664         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2665                            &cp->addr, sizeof(cp->addr));
2666
2667         hci_dev_unlock(hdev);
2668         return err;
2669 }
2670
2671 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2672                                   void *data, u16 len)
2673 {
2674         struct mgmt_cp_remove_remote_oob_data *cp = data;
2675         u8 status;
2676         int err;
2677
2678         BT_DBG("%s", hdev->name);
2679
2680         hci_dev_lock(hdev);
2681
2682         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2683         if (err < 0)
2684                 status = MGMT_STATUS_INVALID_PARAMS;
2685         else
2686                 status = MGMT_STATUS_SUCCESS;
2687
2688         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2689                            status, &cp->addr, sizeof(cp->addr));
2690
2691         hci_dev_unlock(hdev);
2692         return err;
2693 }
2694
2695 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2696 {
2697         struct pending_cmd *cmd;
2698         u8 type;
2699         int err;
2700
2701         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2702
2703         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2704         if (!cmd)
2705                 return -ENOENT;
2706
2707         type = hdev->discovery.type;
2708
2709         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2710                            &type, sizeof(type));
2711         mgmt_pending_remove(cmd);
2712
2713         return err;
2714 }
2715
2716 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
2717 {
2718         BT_DBG("status %d", status);
2719
2720         if (status) {
2721                 hci_dev_lock(hdev);
2722                 mgmt_start_discovery_failed(hdev, status);
2723                 hci_dev_unlock(hdev);
2724                 return;
2725         }
2726
2727         hci_dev_lock(hdev);
2728         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2729         hci_dev_unlock(hdev);
2730
2731         switch (hdev->discovery.type) {
2732         case DISCOV_TYPE_LE:
2733                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2734                                    DISCOV_LE_TIMEOUT);
2735                 break;
2736
2737         case DISCOV_TYPE_INTERLEAVED:
2738                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2739                                    DISCOV_INTERLEAVED_TIMEOUT);
2740                 break;
2741
2742         case DISCOV_TYPE_BREDR:
2743                 break;
2744
2745         default:
2746                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
2747         }
2748 }
2749
2750 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2751                            void *data, u16 len)
2752 {
2753         struct mgmt_cp_start_discovery *cp = data;
2754         struct pending_cmd *cmd;
2755         struct hci_cp_le_set_scan_param param_cp;
2756         struct hci_cp_le_set_scan_enable enable_cp;
2757         struct hci_cp_inquiry inq_cp;
2758         struct hci_request req;
2759         /* General inquiry access code (GIAC) */
2760         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2761         int err;
2762
2763         BT_DBG("%s", hdev->name);
2764
2765         hci_dev_lock(hdev);
2766
2767         if (!hdev_is_powered(hdev)) {
2768                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2769                                  MGMT_STATUS_NOT_POWERED);
2770                 goto failed;
2771         }
2772
2773         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2774                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2775                                  MGMT_STATUS_BUSY);
2776                 goto failed;
2777         }
2778
2779         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2780                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2781                                  MGMT_STATUS_BUSY);
2782                 goto failed;
2783         }
2784
2785         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2786         if (!cmd) {
2787                 err = -ENOMEM;
2788                 goto failed;
2789         }
2790
2791         hdev->discovery.type = cp->type;
2792
2793         hci_req_init(&req, hdev);
2794
2795         switch (hdev->discovery.type) {
2796         case DISCOV_TYPE_BREDR:
2797                 if (!lmp_bredr_capable(hdev)) {
2798                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2799                                          MGMT_STATUS_NOT_SUPPORTED);
2800                         mgmt_pending_remove(cmd);
2801                         goto failed;
2802                 }
2803
2804                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2805                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2806                                          MGMT_STATUS_BUSY);
2807                         mgmt_pending_remove(cmd);
2808                         goto failed;
2809                 }
2810
2811                 hci_inquiry_cache_flush(hdev);
2812
2813                 memset(&inq_cp, 0, sizeof(inq_cp));
2814                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
2815                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
2816                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
2817                 break;
2818
2819         case DISCOV_TYPE_LE:
2820         case DISCOV_TYPE_INTERLEAVED:
2821                 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2822                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2823                                          MGMT_STATUS_NOT_SUPPORTED);
2824                         mgmt_pending_remove(cmd);
2825                         goto failed;
2826                 }
2827
2828                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
2829                     !lmp_bredr_capable(hdev)) {
2830                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2831                                          MGMT_STATUS_NOT_SUPPORTED);
2832                         mgmt_pending_remove(cmd);
2833                         goto failed;
2834                 }
2835
2836                 if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
2837                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2838                                          MGMT_STATUS_REJECTED);
2839                         mgmt_pending_remove(cmd);
2840                         goto failed;
2841                 }
2842
2843                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
2844                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2845                                          MGMT_STATUS_BUSY);
2846                         mgmt_pending_remove(cmd);
2847                         goto failed;
2848                 }
2849
2850                 memset(&param_cp, 0, sizeof(param_cp));
2851                 param_cp.type = LE_SCAN_ACTIVE;
2852                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
2853                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
2854                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
2855                             &param_cp);
2856
2857                 memset(&enable_cp, 0, sizeof(enable_cp));
2858                 enable_cp.enable = LE_SCAN_ENABLE;
2859                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2860                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
2861                             &enable_cp);
2862                 break;
2863
2864         default:
2865                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2866                                  MGMT_STATUS_INVALID_PARAMS);
2867                 mgmt_pending_remove(cmd);
2868                 goto failed;
2869         }
2870
2871         err = hci_req_run(&req, start_discovery_complete);
2872         if (err < 0)
2873                 mgmt_pending_remove(cmd);
2874         else
2875                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2876
2877 failed:
2878         hci_dev_unlock(hdev);
2879         return err;
2880 }
2881
2882 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2883 {
2884         struct pending_cmd *cmd;
2885         int err;
2886
2887         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2888         if (!cmd)
2889                 return -ENOENT;
2890
2891         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2892                            &hdev->discovery.type, sizeof(hdev->discovery.type));
2893         mgmt_pending_remove(cmd);
2894
2895         return err;
2896 }
2897
2898 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
2899 {
2900         BT_DBG("status %d", status);
2901
2902         hci_dev_lock(hdev);
2903
2904         if (status) {
2905                 mgmt_stop_discovery_failed(hdev, status);
2906                 goto unlock;
2907         }
2908
2909         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2910
2911 unlock:
2912         hci_dev_unlock(hdev);
2913 }
2914
2915 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2916                           u16 len)
2917 {
2918         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2919         struct pending_cmd *cmd;
2920         struct hci_cp_remote_name_req_cancel cp;
2921         struct inquiry_entry *e;
2922         struct hci_request req;
2923         struct hci_cp_le_set_scan_enable enable_cp;
2924         int err;
2925
2926         BT_DBG("%s", hdev->name);
2927
2928         hci_dev_lock(hdev);
2929
2930         if (!hci_discovery_active(hdev)) {
2931                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2932                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2933                                    sizeof(mgmt_cp->type));
2934                 goto unlock;
2935         }
2936
2937         if (hdev->discovery.type != mgmt_cp->type) {
2938                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2939                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2940                                    sizeof(mgmt_cp->type));
2941                 goto unlock;
2942         }
2943
2944         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2945         if (!cmd) {
2946                 err = -ENOMEM;
2947                 goto unlock;
2948         }
2949
2950         hci_req_init(&req, hdev);
2951
2952         switch (hdev->discovery.state) {
2953         case DISCOVERY_FINDING:
2954                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2955                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2956                 } else {
2957                         cancel_delayed_work(&hdev->le_scan_disable);
2958
2959                         memset(&enable_cp, 0, sizeof(enable_cp));
2960                         enable_cp.enable = LE_SCAN_DISABLE;
2961                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
2962                                     sizeof(enable_cp), &enable_cp);
2963                 }
2964
2965                 break;
2966
2967         case DISCOVERY_RESOLVING:
2968                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2969                                                      NAME_PENDING);
2970                 if (!e) {
2971                         mgmt_pending_remove(cmd);
2972                         err = cmd_complete(sk, hdev->id,
2973                                            MGMT_OP_STOP_DISCOVERY, 0,
2974                                            &mgmt_cp->type,
2975                                            sizeof(mgmt_cp->type));
2976                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2977                         goto unlock;
2978                 }
2979
2980                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2981                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
2982                             &cp);
2983
2984                 break;
2985
2986         default:
2987                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2988
2989                 mgmt_pending_remove(cmd);
2990                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2991                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
2992                                    sizeof(mgmt_cp->type));
2993                 goto unlock;
2994         }
2995
2996         err = hci_req_run(&req, stop_discovery_complete);
2997         if (err < 0)
2998                 mgmt_pending_remove(cmd);
2999         else
3000                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3001
3002 unlock:
3003         hci_dev_unlock(hdev);
3004         return err;
3005 }
3006
3007 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3008                         u16 len)
3009 {
3010         struct mgmt_cp_confirm_name *cp = data;
3011         struct inquiry_entry *e;
3012         int err;
3013
3014         BT_DBG("%s", hdev->name);
3015
3016         hci_dev_lock(hdev);
3017
3018         if (!hci_discovery_active(hdev)) {
3019                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3020                                  MGMT_STATUS_FAILED);
3021                 goto failed;
3022         }
3023
3024         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3025         if (!e) {
3026                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3027                                  MGMT_STATUS_INVALID_PARAMS);
3028                 goto failed;
3029         }
3030
3031         if (cp->name_known) {
3032                 e->name_state = NAME_KNOWN;
3033                 list_del(&e->list);
3034         } else {
3035                 e->name_state = NAME_NEEDED;
3036                 hci_inquiry_cache_update_resolve(hdev, e);
3037         }
3038
3039         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3040                            sizeof(cp->addr));
3041
3042 failed:
3043         hci_dev_unlock(hdev);
3044         return err;
3045 }
3046
3047 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3048                         u16 len)
3049 {
3050         struct mgmt_cp_block_device *cp = data;
3051         u8 status;
3052         int err;
3053
3054         BT_DBG("%s", hdev->name);
3055
3056         if (!bdaddr_type_is_valid(cp->addr.type))
3057                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3058                                     MGMT_STATUS_INVALID_PARAMS,
3059                                     &cp->addr, sizeof(cp->addr));
3060
3061         hci_dev_lock(hdev);
3062
3063         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3064         if (err < 0)
3065                 status = MGMT_STATUS_FAILED;
3066         else
3067                 status = MGMT_STATUS_SUCCESS;
3068
3069         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3070                            &cp->addr, sizeof(cp->addr));
3071
3072         hci_dev_unlock(hdev);
3073
3074         return err;
3075 }
3076
3077 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3078                           u16 len)
3079 {
3080         struct mgmt_cp_unblock_device *cp = data;
3081         u8 status;
3082         int err;
3083
3084         BT_DBG("%s", hdev->name);
3085
3086         if (!bdaddr_type_is_valid(cp->addr.type))
3087                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3088                                     MGMT_STATUS_INVALID_PARAMS,
3089                                     &cp->addr, sizeof(cp->addr));
3090
3091         hci_dev_lock(hdev);
3092
3093         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3094         if (err < 0)
3095                 status = MGMT_STATUS_INVALID_PARAMS;
3096         else
3097                 status = MGMT_STATUS_SUCCESS;
3098
3099         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3100                            &cp->addr, sizeof(cp->addr));
3101
3102         hci_dev_unlock(hdev);
3103
3104         return err;
3105 }
3106
3107 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3108                          u16 len)
3109 {
3110         struct mgmt_cp_set_device_id *cp = data;
3111         struct hci_request req;
3112         int err;
3113         __u16 source;
3114
3115         BT_DBG("%s", hdev->name);
3116
3117         source = __le16_to_cpu(cp->source);
3118
3119         if (source > 0x0002)
3120                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3121                                   MGMT_STATUS_INVALID_PARAMS);
3122
3123         hci_dev_lock(hdev);
3124
3125         hdev->devid_source = source;
3126         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3127         hdev->devid_product = __le16_to_cpu(cp->product);
3128         hdev->devid_version = __le16_to_cpu(cp->version);
3129
3130         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3131
3132         hci_req_init(&req, hdev);
3133         update_eir(&req);
3134         hci_req_run(&req, NULL);
3135
3136         hci_dev_unlock(hdev);
3137
3138         return err;
3139 }
3140
3141 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3142 {
3143         struct cmd_lookup match = { NULL, hdev };
3144
3145         if (status) {
3146                 u8 mgmt_err = mgmt_status(status);
3147
3148                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3149                                      cmd_status_rsp, &mgmt_err);
3150                 return;
3151         }
3152
3153         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3154                              &match);
3155
3156         new_settings(hdev, match.sk);
3157
3158         if (match.sk)
3159                 sock_put(match.sk);
3160 }
3161
3162 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3163 {
3164         struct mgmt_mode *cp = data;
3165         struct pending_cmd *cmd;
3166         struct hci_request req;
3167         u8 val, enabled;
3168         int err;
3169
3170         BT_DBG("request for %s", hdev->name);
3171
3172         if (!lmp_le_capable(hdev))
3173                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3174                                   MGMT_STATUS_NOT_SUPPORTED);
3175
3176         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3177                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3178                                   MGMT_STATUS_REJECTED);
3179
3180         if (cp->val != 0x00 && cp->val != 0x01)
3181                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3182                                   MGMT_STATUS_INVALID_PARAMS);
3183
3184         hci_dev_lock(hdev);
3185
3186         val = !!cp->val;
3187         enabled = test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags);
3188
3189         if (!hdev_is_powered(hdev) || val == enabled) {
3190                 bool changed = false;
3191
3192                 if (val != test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
3193                         change_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags);
3194                         changed = true;
3195                 }
3196
3197                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3198                 if (err < 0)
3199                         goto unlock;
3200
3201                 if (changed)
3202                         err = new_settings(hdev, sk);
3203
3204                 goto unlock;
3205         }
3206
3207         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3208             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3209                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3210                                  MGMT_STATUS_BUSY);
3211                 goto unlock;
3212         }
3213
3214         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3215         if (!cmd) {
3216                 err = -ENOMEM;
3217                 goto unlock;
3218         }
3219
3220         hci_req_init(&req, hdev);
3221
3222         hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(val), &val);
3223
3224         err = hci_req_run(&req, set_advertising_complete);
3225         if (err < 0)
3226                 mgmt_pending_remove(cmd);
3227
3228 unlock:
3229         hci_dev_unlock(hdev);
3230         return err;
3231 }
3232
3233 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3234 {
3235         struct pending_cmd *cmd;
3236
3237         BT_DBG("status 0x%02x", status);
3238
3239         hci_dev_lock(hdev);
3240
3241         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3242         if (!cmd)
3243                 goto unlock;
3244
3245         if (status) {
3246                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3247                            mgmt_status(status));
3248         } else {
3249                 struct mgmt_mode *cp = cmd->param;
3250
3251                 if (cp->val)
3252                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3253                 else
3254                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3255
3256                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3257                 new_settings(hdev, cmd->sk);
3258         }
3259
3260         mgmt_pending_remove(cmd);
3261
3262 unlock:
3263         hci_dev_unlock(hdev);
3264 }
3265
3266 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3267                                 void *data, u16 len)
3268 {
3269         struct mgmt_mode *cp = data;
3270         struct pending_cmd *cmd;
3271         struct hci_request req;
3272         int err;
3273
3274         BT_DBG("%s", hdev->name);
3275
3276         if (!lmp_bredr_capable(hdev) || hdev->hci_ver < BLUETOOTH_VER_1_2)
3277                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3278                                   MGMT_STATUS_NOT_SUPPORTED);
3279
3280         if (cp->val != 0x00 && cp->val != 0x01)
3281                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3282                                   MGMT_STATUS_INVALID_PARAMS);
3283
3284         if (!hdev_is_powered(hdev))
3285                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3286                                   MGMT_STATUS_NOT_POWERED);
3287
3288         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3289                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3290                                   MGMT_STATUS_REJECTED);
3291
3292         hci_dev_lock(hdev);
3293
3294         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3295                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3296                                  MGMT_STATUS_BUSY);
3297                 goto unlock;
3298         }
3299
3300         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3301                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3302                                         hdev);
3303                 goto unlock;
3304         }
3305
3306         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3307                                data, len);
3308         if (!cmd) {
3309                 err = -ENOMEM;
3310                 goto unlock;
3311         }
3312
3313         hci_req_init(&req, hdev);
3314
3315         write_fast_connectable(&req, cp->val);
3316
3317         err = hci_req_run(&req, fast_connectable_complete);
3318         if (err < 0) {
3319                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3320                                  MGMT_STATUS_FAILED);
3321                 mgmt_pending_remove(cmd);
3322         }
3323
3324 unlock:
3325         hci_dev_unlock(hdev);
3326
3327         return err;
3328 }
3329
3330 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3331 {
3332         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3333                 return false;
3334         if (key->master != 0x00 && key->master != 0x01)
3335                 return false;
3336         if (!bdaddr_type_is_le(key->addr.type))
3337                 return false;
3338         return true;
3339 }
3340
3341 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3342                                void *cp_data, u16 len)
3343 {
3344         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3345         u16 key_count, expected_len;
3346         int i, err;
3347
3348         key_count = __le16_to_cpu(cp->key_count);
3349
3350         expected_len = sizeof(*cp) + key_count *
3351                                         sizeof(struct mgmt_ltk_info);
3352         if (expected_len != len) {
3353                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3354                        len, expected_len);
3355                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3356                                   MGMT_STATUS_INVALID_PARAMS);
3357         }
3358
3359         BT_DBG("%s key_count %u", hdev->name, key_count);
3360
3361         for (i = 0; i < key_count; i++) {
3362                 struct mgmt_ltk_info *key = &cp->keys[i];
3363
3364                 if (!ltk_is_valid(key))
3365                         return cmd_status(sk, hdev->id,
3366                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3367                                           MGMT_STATUS_INVALID_PARAMS);
3368         }
3369
3370         hci_dev_lock(hdev);
3371
3372         hci_smp_ltks_clear(hdev);
3373
3374         for (i = 0; i < key_count; i++) {
3375                 struct mgmt_ltk_info *key = &cp->keys[i];
3376                 u8 type;
3377
3378                 if (key->master)
3379                         type = HCI_SMP_LTK;
3380                 else
3381                         type = HCI_SMP_LTK_SLAVE;
3382
3383                 hci_add_ltk(hdev, &key->addr.bdaddr,
3384                             bdaddr_to_le(key->addr.type),
3385                             type, 0, key->authenticated, key->val,
3386                             key->enc_size, key->ediv, key->rand);
3387         }
3388
3389         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3390                            NULL, 0);
3391
3392         hci_dev_unlock(hdev);
3393
3394         return err;
3395 }
3396
3397 static const struct mgmt_handler {
3398         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3399                      u16 data_len);
3400         bool var_len;
3401         size_t data_len;
3402 } mgmt_handlers[] = {
3403         { NULL }, /* 0x0000 (no command) */
3404         { read_version,           false, MGMT_READ_VERSION_SIZE },
3405         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3406         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3407         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3408         { set_powered,            false, MGMT_SETTING_SIZE },
3409         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3410         { set_connectable,        false, MGMT_SETTING_SIZE },
3411         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3412         { set_pairable,           false, MGMT_SETTING_SIZE },
3413         { set_link_security,      false, MGMT_SETTING_SIZE },
3414         { set_ssp,                false, MGMT_SETTING_SIZE },
3415         { set_hs,                 false, MGMT_SETTING_SIZE },
3416         { set_le,                 false, MGMT_SETTING_SIZE },
3417         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3418         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3419         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3420         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3421         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3422         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3423         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3424         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3425         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3426         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3427         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3428         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3429         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3430         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3431         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3432         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3433         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3434         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3435         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3436         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3437         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3438         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3439         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3440         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3441         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3442         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3443         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3444         { set_advertising,        false, MGMT_SETTING_SIZE },
3445 };
3446
3447
3448 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3449 {
3450         void *buf;
3451         u8 *cp;
3452         struct mgmt_hdr *hdr;
3453         u16 opcode, index, len;
3454         struct hci_dev *hdev = NULL;
3455         const struct mgmt_handler *handler;
3456         int err;
3457
3458         BT_DBG("got %zu bytes", msglen);
3459
3460         if (msglen < sizeof(*hdr))
3461                 return -EINVAL;
3462
3463         buf = kmalloc(msglen, GFP_KERNEL);
3464         if (!buf)
3465                 return -ENOMEM;
3466
3467         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3468                 err = -EFAULT;
3469                 goto done;
3470         }
3471
3472         hdr = buf;
3473         opcode = __le16_to_cpu(hdr->opcode);
3474         index = __le16_to_cpu(hdr->index);
3475         len = __le16_to_cpu(hdr->len);
3476
3477         if (len != msglen - sizeof(*hdr)) {
3478                 err = -EINVAL;
3479                 goto done;
3480         }
3481
3482         if (index != MGMT_INDEX_NONE) {
3483                 hdev = hci_dev_get(index);
3484                 if (!hdev) {
3485                         err = cmd_status(sk, index, opcode,
3486                                          MGMT_STATUS_INVALID_INDEX);
3487                         goto done;
3488                 }
3489
3490                 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
3491                         err = cmd_status(sk, index, opcode,
3492                                          MGMT_STATUS_INVALID_INDEX);
3493                         goto done;
3494                 }
3495         }
3496
3497         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3498             mgmt_handlers[opcode].func == NULL) {
3499                 BT_DBG("Unknown op %u", opcode);
3500                 err = cmd_status(sk, index, opcode,
3501                                  MGMT_STATUS_UNKNOWN_COMMAND);
3502                 goto done;
3503         }
3504
3505         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3506             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3507                 err = cmd_status(sk, index, opcode,
3508                                  MGMT_STATUS_INVALID_INDEX);
3509                 goto done;
3510         }
3511
3512         handler = &mgmt_handlers[opcode];
3513
3514         if ((handler->var_len && len < handler->data_len) ||
3515             (!handler->var_len && len != handler->data_len)) {
3516                 err = cmd_status(sk, index, opcode,
3517                                  MGMT_STATUS_INVALID_PARAMS);
3518                 goto done;
3519         }
3520
3521         if (hdev)
3522                 mgmt_init_hdev(sk, hdev);
3523
3524         cp = buf + sizeof(*hdr);
3525
3526         err = handler->func(sk, hdev, cp, len);
3527         if (err < 0)
3528                 goto done;
3529
3530         err = msglen;
3531
3532 done:
3533         if (hdev)
3534                 hci_dev_put(hdev);
3535
3536         kfree(buf);
3537         return err;
3538 }
3539
3540 int mgmt_index_added(struct hci_dev *hdev)
3541 {
3542         if (!mgmt_valid_hdev(hdev))
3543                 return -ENOTSUPP;
3544
3545         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3546 }
3547
3548 int mgmt_index_removed(struct hci_dev *hdev)
3549 {
3550         u8 status = MGMT_STATUS_INVALID_INDEX;
3551
3552         if (!mgmt_valid_hdev(hdev))
3553                 return -ENOTSUPP;
3554
3555         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3556
3557         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3558 }
3559
3560 static void set_bredr_scan(struct hci_request *req)
3561 {
3562         struct hci_dev *hdev = req->hdev;
3563         u8 scan = 0;
3564
3565         /* Ensure that fast connectable is disabled. This function will
3566          * not do anything if the page scan parameters are already what
3567          * they should be.
3568          */
3569         write_fast_connectable(req, false);
3570
3571         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3572                 scan |= SCAN_PAGE;
3573         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3574                 scan |= SCAN_INQUIRY;
3575
3576         if (scan)
3577                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3578 }
3579
3580 static void powered_complete(struct hci_dev *hdev, u8 status)
3581 {
3582         struct cmd_lookup match = { NULL, hdev };
3583
3584         BT_DBG("status 0x%02x", status);
3585
3586         hci_dev_lock(hdev);
3587
3588         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3589
3590         new_settings(hdev, match.sk);
3591
3592         hci_dev_unlock(hdev);
3593
3594         if (match.sk)
3595                 sock_put(match.sk);
3596 }
3597
3598 static int powered_update_hci(struct hci_dev *hdev)
3599 {
3600         struct hci_request req;
3601         u8 link_sec;
3602
3603         hci_req_init(&req, hdev);
3604
3605         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3606             !lmp_host_ssp_capable(hdev)) {
3607                 u8 ssp = 1;
3608
3609                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3610         }
3611
3612         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
3613             lmp_bredr_capable(hdev)) {
3614                 struct hci_cp_write_le_host_supported cp;
3615
3616                 cp.le = 1;
3617                 cp.simul = lmp_le_br_capable(hdev);
3618
3619                 /* Check first if we already have the right
3620                  * host state (host features set)
3621                  */
3622                 if (cp.le != lmp_host_le_capable(hdev) ||
3623                     cp.simul != lmp_host_le_br_capable(hdev))
3624                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3625                                     sizeof(cp), &cp);
3626         }
3627
3628         if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
3629                 u8 adv = 0x01;
3630
3631                 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(adv), &adv);
3632         }
3633
3634         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3635         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3636                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3637                             sizeof(link_sec), &link_sec);
3638
3639         if (lmp_bredr_capable(hdev)) {
3640                 set_bredr_scan(&req);
3641                 update_class(&req);
3642                 update_name(&req);
3643                 update_eir(&req);
3644         }
3645
3646         return hci_req_run(&req, powered_complete);
3647 }
3648
3649 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3650 {
3651         struct cmd_lookup match = { NULL, hdev };
3652         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3653         u8 zero_cod[] = { 0, 0, 0 };
3654         int err;
3655
3656         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3657                 return 0;
3658
3659         if (powered) {
3660                 if (powered_update_hci(hdev) == 0)
3661                         return 0;
3662
3663                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3664                                      &match);
3665                 goto new_settings;
3666         }
3667
3668         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3669         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3670
3671         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3672                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3673                            zero_cod, sizeof(zero_cod), NULL);
3674
3675 new_settings:
3676         err = new_settings(hdev, match.sk);
3677
3678         if (match.sk)
3679                 sock_put(match.sk);
3680
3681         return err;
3682 }
3683
3684 int mgmt_set_powered_failed(struct hci_dev *hdev, int err)
3685 {
3686         struct pending_cmd *cmd;
3687         u8 status;
3688
3689         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
3690         if (!cmd)
3691                 return -ENOENT;
3692
3693         if (err == -ERFKILL)
3694                 status = MGMT_STATUS_RFKILLED;
3695         else
3696                 status = MGMT_STATUS_FAILED;
3697
3698         err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
3699
3700         mgmt_pending_remove(cmd);
3701
3702         return err;
3703 }
3704
3705 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3706 {
3707         struct cmd_lookup match = { NULL, hdev };
3708         bool changed = false;
3709         int err = 0;
3710
3711         if (discoverable) {
3712                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3713                         changed = true;
3714         } else {
3715                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3716                         changed = true;
3717         }
3718
3719         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3720                              &match);
3721
3722         if (changed)
3723                 err = new_settings(hdev, match.sk);
3724
3725         if (match.sk)
3726                 sock_put(match.sk);
3727
3728         return err;
3729 }
3730
3731 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3732 {
3733         struct pending_cmd *cmd;
3734         bool changed = false;
3735         int err = 0;
3736
3737         if (connectable) {
3738                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3739                         changed = true;
3740         } else {
3741                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3742                         changed = true;
3743         }
3744
3745         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
3746
3747         if (changed)
3748                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
3749
3750         return err;
3751 }
3752
3753 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3754 {
3755         u8 mgmt_err = mgmt_status(status);
3756
3757         if (scan & SCAN_PAGE)
3758                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3759                                      cmd_status_rsp, &mgmt_err);
3760
3761         if (scan & SCAN_INQUIRY)
3762                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3763                                      cmd_status_rsp, &mgmt_err);
3764
3765         return 0;
3766 }
3767
3768 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3769                       bool persistent)
3770 {
3771         struct mgmt_ev_new_link_key ev;
3772
3773         memset(&ev, 0, sizeof(ev));
3774
3775         ev.store_hint = persistent;
3776         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3777         ev.key.addr.type = BDADDR_BREDR;
3778         ev.key.type = key->type;
3779         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3780         ev.key.pin_len = key->pin_len;
3781
3782         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3783 }
3784
3785 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3786 {
3787         struct mgmt_ev_new_long_term_key ev;
3788
3789         memset(&ev, 0, sizeof(ev));
3790
3791         ev.store_hint = persistent;
3792         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3793         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3794         ev.key.authenticated = key->authenticated;
3795         ev.key.enc_size = key->enc_size;
3796         ev.key.ediv = key->ediv;
3797
3798         if (key->type == HCI_SMP_LTK)
3799                 ev.key.master = 1;
3800
3801         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3802         memcpy(ev.key.val, key->val, sizeof(key->val));
3803
3804         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3805                           NULL);
3806 }
3807
3808 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3809                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3810                           u8 *dev_class)
3811 {
3812         char buf[512];
3813         struct mgmt_ev_device_connected *ev = (void *) buf;
3814         u16 eir_len = 0;
3815
3816         bacpy(&ev->addr.bdaddr, bdaddr);
3817         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3818
3819         ev->flags = __cpu_to_le32(flags);
3820
3821         if (name_len > 0)
3822                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3823                                           name, name_len);
3824
3825         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3826                 eir_len = eir_append_data(ev->eir, eir_len,
3827                                           EIR_CLASS_OF_DEV, dev_class, 3);
3828
3829         ev->eir_len = cpu_to_le16(eir_len);
3830
3831         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3832                           sizeof(*ev) + eir_len, NULL);
3833 }
3834
3835 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3836 {
3837         struct mgmt_cp_disconnect *cp = cmd->param;
3838         struct sock **sk = data;
3839         struct mgmt_rp_disconnect rp;
3840
3841         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3842         rp.addr.type = cp->addr.type;
3843
3844         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3845                      sizeof(rp));
3846
3847         *sk = cmd->sk;
3848         sock_hold(*sk);
3849
3850         mgmt_pending_remove(cmd);
3851 }
3852
3853 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3854 {
3855         struct hci_dev *hdev = data;
3856         struct mgmt_cp_unpair_device *cp = cmd->param;
3857         struct mgmt_rp_unpair_device rp;
3858
3859         memset(&rp, 0, sizeof(rp));
3860         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3861         rp.addr.type = cp->addr.type;
3862
3863         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3864
3865         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3866
3867         mgmt_pending_remove(cmd);
3868 }
3869
3870 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3871                              u8 link_type, u8 addr_type, u8 reason)
3872 {
3873         struct mgmt_ev_device_disconnected ev;
3874         struct sock *sk = NULL;
3875         int err;
3876
3877         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3878
3879         bacpy(&ev.addr.bdaddr, bdaddr);
3880         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3881         ev.reason = reason;
3882
3883         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3884                          sk);
3885
3886         if (sk)
3887                 sock_put(sk);
3888
3889         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3890                              hdev);
3891
3892         return err;
3893 }
3894
3895 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3896                            u8 link_type, u8 addr_type, u8 status)
3897 {
3898         struct mgmt_rp_disconnect rp;
3899         struct pending_cmd *cmd;
3900         int err;
3901
3902         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3903                              hdev);
3904
3905         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3906         if (!cmd)
3907                 return -ENOENT;
3908
3909         bacpy(&rp.addr.bdaddr, bdaddr);
3910         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3911
3912         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3913                            mgmt_status(status), &rp, sizeof(rp));
3914
3915         mgmt_pending_remove(cmd);
3916
3917         return err;
3918 }
3919
3920 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3921                         u8 addr_type, u8 status)
3922 {
3923         struct mgmt_ev_connect_failed ev;
3924
3925         bacpy(&ev.addr.bdaddr, bdaddr);
3926         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3927         ev.status = mgmt_status(status);
3928
3929         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3930 }
3931
3932 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3933 {
3934         struct mgmt_ev_pin_code_request ev;
3935
3936         bacpy(&ev.addr.bdaddr, bdaddr);
3937         ev.addr.type = BDADDR_BREDR;
3938         ev.secure = secure;
3939
3940         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3941                           NULL);
3942 }
3943
3944 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3945                                  u8 status)
3946 {
3947         struct pending_cmd *cmd;
3948         struct mgmt_rp_pin_code_reply rp;
3949         int err;
3950
3951         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3952         if (!cmd)
3953                 return -ENOENT;
3954
3955         bacpy(&rp.addr.bdaddr, bdaddr);
3956         rp.addr.type = BDADDR_BREDR;
3957
3958         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3959                            mgmt_status(status), &rp, sizeof(rp));
3960
3961         mgmt_pending_remove(cmd);
3962
3963         return err;
3964 }
3965
3966 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3967                                      u8 status)
3968 {
3969         struct pending_cmd *cmd;
3970         struct mgmt_rp_pin_code_reply rp;
3971         int err;
3972
3973         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3974         if (!cmd)
3975                 return -ENOENT;
3976
3977         bacpy(&rp.addr.bdaddr, bdaddr);
3978         rp.addr.type = BDADDR_BREDR;
3979
3980         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3981                            mgmt_status(status), &rp, sizeof(rp));
3982
3983         mgmt_pending_remove(cmd);
3984
3985         return err;
3986 }
3987
3988 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3989                               u8 link_type, u8 addr_type, __le32 value,
3990                               u8 confirm_hint)
3991 {
3992         struct mgmt_ev_user_confirm_request ev;
3993
3994         BT_DBG("%s", hdev->name);
3995
3996         bacpy(&ev.addr.bdaddr, bdaddr);
3997         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3998         ev.confirm_hint = confirm_hint;
3999         ev.value = value;
4000
4001         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
4002                           NULL);
4003 }
4004
4005 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4006                               u8 link_type, u8 addr_type)
4007 {
4008         struct mgmt_ev_user_passkey_request ev;
4009
4010         BT_DBG("%s", hdev->name);
4011
4012         bacpy(&ev.addr.bdaddr, bdaddr);
4013         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4014
4015         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
4016                           NULL);
4017 }
4018
4019 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4020                                       u8 link_type, u8 addr_type, u8 status,
4021                                       u8 opcode)
4022 {
4023         struct pending_cmd *cmd;
4024         struct mgmt_rp_user_confirm_reply rp;
4025         int err;
4026
4027         cmd = mgmt_pending_find(opcode, hdev);
4028         if (!cmd)
4029                 return -ENOENT;
4030
4031         bacpy(&rp.addr.bdaddr, bdaddr);
4032         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4033         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
4034                            &rp, sizeof(rp));
4035
4036         mgmt_pending_remove(cmd);
4037
4038         return err;
4039 }
4040
4041 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4042                                      u8 link_type, u8 addr_type, u8 status)
4043 {
4044         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4045                                           status, MGMT_OP_USER_CONFIRM_REPLY);
4046 }
4047
4048 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4049                                          u8 link_type, u8 addr_type, u8 status)
4050 {
4051         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4052                                           status,
4053                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
4054 }
4055
4056 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4057                                      u8 link_type, u8 addr_type, u8 status)
4058 {
4059         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4060                                           status, MGMT_OP_USER_PASSKEY_REPLY);
4061 }
4062
4063 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4064                                          u8 link_type, u8 addr_type, u8 status)
4065 {
4066         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4067                                           status,
4068                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
4069 }
4070
4071 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
4072                              u8 link_type, u8 addr_type, u32 passkey,
4073                              u8 entered)
4074 {
4075         struct mgmt_ev_passkey_notify ev;
4076
4077         BT_DBG("%s", hdev->name);
4078
4079         bacpy(&ev.addr.bdaddr, bdaddr);
4080         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4081         ev.passkey = __cpu_to_le32(passkey);
4082         ev.entered = entered;
4083
4084         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
4085 }
4086
4087 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4088                      u8 addr_type, u8 status)
4089 {
4090         struct mgmt_ev_auth_failed ev;
4091
4092         bacpy(&ev.addr.bdaddr, bdaddr);
4093         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4094         ev.status = mgmt_status(status);
4095
4096         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
4097 }
4098
4099 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
4100 {
4101         struct cmd_lookup match = { NULL, hdev };
4102         bool changed = false;
4103         int err = 0;
4104
4105         if (status) {
4106                 u8 mgmt_err = mgmt_status(status);
4107                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
4108                                      cmd_status_rsp, &mgmt_err);
4109                 return 0;
4110         }
4111
4112         if (test_bit(HCI_AUTH, &hdev->flags)) {
4113                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4114                         changed = true;
4115         } else {
4116                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4117                         changed = true;
4118         }
4119
4120         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
4121                              &match);
4122
4123         if (changed)
4124                 err = new_settings(hdev, match.sk);
4125
4126         if (match.sk)
4127                 sock_put(match.sk);
4128
4129         return err;
4130 }
4131
4132 static void clear_eir(struct hci_request *req)
4133 {
4134         struct hci_dev *hdev = req->hdev;
4135         struct hci_cp_write_eir cp;
4136
4137         if (!lmp_ext_inq_capable(hdev))
4138                 return;
4139
4140         memset(hdev->eir, 0, sizeof(hdev->eir));
4141
4142         memset(&cp, 0, sizeof(cp));
4143
4144         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4145 }
4146
4147 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4148 {
4149         struct cmd_lookup match = { NULL, hdev };
4150         struct hci_request req;
4151         bool changed = false;
4152         int err = 0;
4153
4154         if (status) {
4155                 u8 mgmt_err = mgmt_status(status);
4156
4157                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4158                                                  &hdev->dev_flags))
4159                         err = new_settings(hdev, NULL);
4160
4161                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4162                                      &mgmt_err);
4163
4164                 return err;
4165         }
4166
4167         if (enable) {
4168                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4169                         changed = true;
4170         } else {
4171                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4172                         changed = true;
4173         }
4174
4175         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4176
4177         if (changed)
4178                 err = new_settings(hdev, match.sk);
4179
4180         if (match.sk)
4181                 sock_put(match.sk);
4182
4183         hci_req_init(&req, hdev);
4184
4185         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4186                 update_eir(&req);
4187         else
4188                 clear_eir(&req);
4189
4190         hci_req_run(&req, NULL);
4191
4192         return err;
4193 }
4194
4195 static void sk_lookup(struct pending_cmd *cmd, void *data)
4196 {
4197         struct cmd_lookup *match = data;
4198
4199         if (match->sk == NULL) {
4200                 match->sk = cmd->sk;
4201                 sock_hold(match->sk);
4202         }
4203 }
4204
4205 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4206                                    u8 status)
4207 {
4208         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4209         int err = 0;
4210
4211         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4212         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4213         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4214
4215         if (!status)
4216                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4217                                  3, NULL);
4218
4219         if (match.sk)
4220                 sock_put(match.sk);
4221
4222         return err;
4223 }
4224
4225 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4226 {
4227         struct mgmt_cp_set_local_name ev;
4228         struct pending_cmd *cmd;
4229
4230         if (status)
4231                 return 0;
4232
4233         memset(&ev, 0, sizeof(ev));
4234         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4235         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4236
4237         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4238         if (!cmd) {
4239                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4240
4241                 /* If this is a HCI command related to powering on the
4242                  * HCI dev don't send any mgmt signals.
4243                  */
4244                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4245                         return 0;
4246         }
4247
4248         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4249                           cmd ? cmd->sk : NULL);
4250 }
4251
4252 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4253                                             u8 *randomizer, u8 status)
4254 {
4255         struct pending_cmd *cmd;
4256         int err;
4257
4258         BT_DBG("%s status %u", hdev->name, status);
4259
4260         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4261         if (!cmd)
4262                 return -ENOENT;
4263
4264         if (status) {
4265                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4266                                  mgmt_status(status));
4267         } else {
4268                 struct mgmt_rp_read_local_oob_data rp;
4269
4270                 memcpy(rp.hash, hash, sizeof(rp.hash));
4271                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4272
4273                 err = cmd_complete(cmd->sk, hdev->id,
4274                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4275                                    sizeof(rp));
4276         }
4277
4278         mgmt_pending_remove(cmd);
4279
4280         return err;
4281 }
4282
4283 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4284                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4285                       ssp, u8 *eir, u16 eir_len)
4286 {
4287         char buf[512];
4288         struct mgmt_ev_device_found *ev = (void *) buf;
4289         size_t ev_size;
4290
4291         if (!hci_discovery_active(hdev))
4292                 return -EPERM;
4293
4294         /* Leave 5 bytes for a potential CoD field */
4295         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4296                 return -EINVAL;
4297
4298         memset(buf, 0, sizeof(buf));
4299
4300         bacpy(&ev->addr.bdaddr, bdaddr);
4301         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4302         ev->rssi = rssi;
4303         if (cfm_name)
4304                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4305         if (!ssp)
4306                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4307
4308         if (eir_len > 0)
4309                 memcpy(ev->eir, eir, eir_len);
4310
4311         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4312                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4313                                           dev_class, 3);
4314
4315         ev->eir_len = cpu_to_le16(eir_len);
4316         ev_size = sizeof(*ev) + eir_len;
4317
4318         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4319 }
4320
4321 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4322                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4323 {
4324         struct mgmt_ev_device_found *ev;
4325         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4326         u16 eir_len;
4327
4328         ev = (struct mgmt_ev_device_found *) buf;
4329
4330         memset(buf, 0, sizeof(buf));
4331
4332         bacpy(&ev->addr.bdaddr, bdaddr);
4333         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4334         ev->rssi = rssi;
4335
4336         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4337                                   name_len);
4338
4339         ev->eir_len = cpu_to_le16(eir_len);
4340
4341         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4342                           sizeof(*ev) + eir_len, NULL);
4343 }
4344
4345 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4346 {
4347         struct mgmt_ev_discovering ev;
4348         struct pending_cmd *cmd;
4349
4350         BT_DBG("%s discovering %u", hdev->name, discovering);
4351
4352         if (discovering)
4353                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4354         else
4355                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4356
4357         if (cmd != NULL) {
4358                 u8 type = hdev->discovery.type;
4359
4360                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4361                              sizeof(type));
4362                 mgmt_pending_remove(cmd);
4363         }
4364
4365         memset(&ev, 0, sizeof(ev));
4366         ev.type = hdev->discovery.type;
4367         ev.discovering = discovering;
4368
4369         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4370 }
4371
4372 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4373 {
4374         struct pending_cmd *cmd;
4375         struct mgmt_ev_device_blocked ev;
4376
4377         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4378
4379         bacpy(&ev.addr.bdaddr, bdaddr);
4380         ev.addr.type = type;
4381
4382         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4383                           cmd ? cmd->sk : NULL);
4384 }
4385
4386 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4387 {
4388         struct pending_cmd *cmd;
4389         struct mgmt_ev_device_unblocked ev;
4390
4391         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4392
4393         bacpy(&ev.addr.bdaddr, bdaddr);
4394         ev.addr.type = type;
4395
4396         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4397                           cmd ? cmd->sk : NULL);
4398 }
4399
4400 module_param(enable_hs, bool, 0644);
4401 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");