net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   2
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 /*
 106  * These LE scan and inquiry parameters were chosen according to LE General
 107  * Discovery Procedure specification.
 108  */
 109 #define LE_SCAN_TYPE                    0x01
 110 #define LE_SCAN_WIN                     0x12
 111 #define LE_SCAN_INT                     0x12
 112 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 113 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 114
 115 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 116 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 117
 118 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 119
 120 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 121                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 122
 123 struct pending_cmd {
 124         struct list_head list;
 125         u16 opcode;
 126         int index;
 127         void *param;
 128         struct sock *sk;
 129         void *user_data;
 130 };
 131
 132 /* HCI to MGMT error code conversion table */
 133 static u8 mgmt_status_table[] = {
 134         MGMT_STATUS_SUCCESS,
 135         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 136         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 137         MGMT_STATUS_FAILED,             /* Hardware Failure */
 138         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 139         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 140         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 141         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 142         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 145         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 146         MGMT_STATUS_BUSY,               /* Command Disallowed */
 147         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 148         MGMT_STATUS_REJECTED,           /* Rejected Security */
 149         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 150         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 151         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 153         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 154         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 155         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 156         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 157         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 158         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 159         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 161         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 162         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 163         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 165         MGMT_STATUS_FAILED,             /* Unspecified Error */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 167         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 168         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 169         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 170         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 171         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 172         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 174         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 176         MGMT_STATUS_FAILED,             /* Transaction Collision */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 178         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 180         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 181         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 182         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 183         MGMT_STATUS_FAILED,             /* Slot Violation */
 184         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 185         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 187         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 188         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 189         MGMT_STATUS_BUSY,               /* Controller Busy */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 191         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 192         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 193         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 194         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 195 };
 196
 197 bool mgmt_valid_hdev(struct hci_dev *hdev)
 198 {
 199         return hdev->dev_type == HCI_BREDR;
 200 }
 201
 202 static u8 mgmt_status(u8 hci_status)
 203 {
 204         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 205                 return mgmt_status_table[hci_status];
 206
 207         return MGMT_STATUS_FAILED;
 208 }
 209
 210 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 211 {
 212         struct sk_buff *skb;
 213         struct mgmt_hdr *hdr;
 214         struct mgmt_ev_cmd_status *ev;
 215         int err;
 216
 217         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 218
 219         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 220         if (!skb)
 221                 return -ENOMEM;
 222
 223         hdr = (void *) skb_put(skb, sizeof(*hdr));
 224
 225         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 226         hdr->index = cpu_to_le16(index);
 227         hdr->len = cpu_to_le16(sizeof(*ev));
 228
 229         ev = (void *) skb_put(skb, sizeof(*ev));
 230         ev->status = status;
 231         ev->opcode = cpu_to_le16(cmd);
 232
 233         err = sock_queue_rcv_skb(sk, skb);
 234         if (err < 0)
 235                 kfree_skb(skb);
 236
 237         return err;
 238 }
 239
 240 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 241                         void *rp, size_t rp_len)
 242 {
 243         struct sk_buff *skb;
 244         struct mgmt_hdr *hdr;
 245         struct mgmt_ev_cmd_complete *ev;
 246         int err;
 247
 248         BT_DBG("sock %p", sk);
 249
 250         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 251         if (!skb)
 252                 return -ENOMEM;
 253
 254         hdr = (void *) skb_put(skb, sizeof(*hdr));
 255
 256         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 257         hdr->index = cpu_to_le16(index);
 258         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 259
 260         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 261         ev->opcode = cpu_to_le16(cmd);
 262         ev->status = status;
 263
 264         if (rp)
 265                 memcpy(ev->data, rp, rp_len);
 266
 267         err = sock_queue_rcv_skb(sk, skb);
 268         if (err < 0)
 269                 kfree_skb(skb);
 270
 271         return err;
 272 }
 273
 274 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 275                         u16 data_len)
 276 {
 277         struct mgmt_rp_read_version rp;
 278
 279         BT_DBG("sock %p", sk);
 280
 281         rp.version = MGMT_VERSION;
 282         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 283
 284         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 285                             sizeof(rp));
 286 }
 287
 288 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 289                          u16 data_len)
 290 {
 291         struct mgmt_rp_read_commands *rp;
 292         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 293         const u16 num_events = ARRAY_SIZE(mgmt_events);
 294         __le16 *opcode;
 295         size_t rp_size;
 296         int i, err;
 297
 298         BT_DBG("sock %p", sk);
 299
 300         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 301
 302         rp = kmalloc(rp_size, GFP_KERNEL);
 303         if (!rp)
 304                 return -ENOMEM;
 305
 306         rp->num_commands = __constant_cpu_to_le16(num_commands);
 307         rp->num_events = __constant_cpu_to_le16(num_events);
 308
 309         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 310                 put_unaligned_le16(mgmt_commands[i], opcode);
 311
 312         for (i = 0; i < num_events; i++, opcode++)
 313                 put_unaligned_le16(mgmt_events[i], opcode);
 314
 315         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 316                            rp_size);
 317         kfree(rp);
 318
 319         return err;
 320 }
 321
 322 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 323                            u16 data_len)
 324 {
 325         struct mgmt_rp_read_index_list *rp;
 326         struct hci_dev *d;
 327         size_t rp_len;
 328         u16 count;
 329         int err;
 330
 331         BT_DBG("sock %p", sk);
 332
 333         read_lock(&hci_dev_list_lock);
 334
 335         count = 0;
 336         list_for_each_entry(d, &hci_dev_list, list) {
 337                 if (!mgmt_valid_hdev(d))
 338                         continue;
 339
 340                 count++;
 341         }
 342
 343         rp_len = sizeof(*rp) + (2 * count);
 344         rp = kmalloc(rp_len, GFP_ATOMIC);
 345         if (!rp) {
 346                 read_unlock(&hci_dev_list_lock);
 347                 return -ENOMEM;
 348         }
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (test_bit(HCI_SETUP, &d->dev_flags))
 353                         continue;
 354
 355                 if (!mgmt_valid_hdev(d))
 356                         continue;
 357
 358                 rp->index[count++] = cpu_to_le16(d->id);
 359                 BT_DBG("Added hci%u", d->id);
 360         }
 361
 362         rp->num_controllers = cpu_to_le16(count);
 363         rp_len = sizeof(*rp) + (2 * count);
 364
 365         read_unlock(&hci_dev_list_lock);
 366
 367         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 368                            rp_len);
 369
 370         kfree(rp);
 371
 372         return err;
 373 }
 374
 375 static u32 get_supported_settings(struct hci_dev *hdev)
 376 {
 377         u32 settings = 0;
 378
 379         settings |= MGMT_SETTING_POWERED;
 380         settings |= MGMT_SETTING_PAIRABLE;
 381
 382         if (lmp_ssp_capable(hdev))
 383                 settings |= MGMT_SETTING_SSP;
 384
 385         if (lmp_bredr_capable(hdev)) {
 386                 settings |= MGMT_SETTING_CONNECTABLE;
 387                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 388                 settings |= MGMT_SETTING_DISCOVERABLE;
 389                 settings |= MGMT_SETTING_BREDR;
 390                 settings |= MGMT_SETTING_LINK_SECURITY;
 391         }
 392
 393         if (enable_hs)
 394                 settings |= MGMT_SETTING_HS;
 395
 396         if (lmp_le_capable(hdev))
 397                 settings |= MGMT_SETTING_LE;
 398
 399         return settings;
 400 }
 401
 402 static u32 get_current_settings(struct hci_dev *hdev)
 403 {
 404         u32 settings = 0;
 405
 406         if (hdev_is_powered(hdev))
 407                 settings |= MGMT_SETTING_POWERED;
 408
 409         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 410                 settings |= MGMT_SETTING_CONNECTABLE;
 411
 412         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 413                 settings |= MGMT_SETTING_DISCOVERABLE;
 414
 415         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 416                 settings |= MGMT_SETTING_PAIRABLE;
 417
 418         if (lmp_bredr_capable(hdev))
 419                 settings |= MGMT_SETTING_BREDR;
 420
 421         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 422                 settings |= MGMT_SETTING_LE;
 423
 424         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 425                 settings |= MGMT_SETTING_LINK_SECURITY;
 426
 427         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 428                 settings |= MGMT_SETTING_SSP;
 429
 430         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 431                 settings |= MGMT_SETTING_HS;
 432
 433         return settings;
 434 }
 435
 436 #define PNP_INFO_SVCLASS_ID             0x1200
 437
 438 static u8 bluetooth_base_uuid[] = {
 439                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 440                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 441 };
 442
 443 static u16 get_uuid16(u8 *uuid128)
 444 {
 445         u32 val;
 446         int i;
 447
 448         for (i = 0; i < 12; i++) {
 449                 if (bluetooth_base_uuid[i] != uuid128[i])
 450                         return 0;
 451         }
 452
 453         val = get_unaligned_le32(&uuid128[12]);
 454         if (val > 0xffff)
 455                 return 0;
 456
 457         return (u16) val;
 458 }
 459
 460 static void create_eir(struct hci_dev *hdev, u8 *data)
 461 {
 462         u8 *ptr = data;
 463         u16 eir_len = 0;
 464         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 465         int i, truncated = 0;
 466         struct bt_uuid *uuid;
 467         size_t name_len;
 468
 469         name_len = strlen(hdev->dev_name);
 470
 471         if (name_len > 0) {
 472                 /* EIR Data type */
 473                 if (name_len > 48) {
 474                         name_len = 48;
 475                         ptr[1] = EIR_NAME_SHORT;
 476                 } else
 477                         ptr[1] = EIR_NAME_COMPLETE;
 478
 479                 /* EIR Data length */
 480                 ptr[0] = name_len + 1;
 481
 482                 memcpy(ptr + 2, hdev->dev_name, name_len);
 483
 484                 eir_len += (name_len + 2);
 485                 ptr += (name_len + 2);
 486         }
 487
 488         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 489                 ptr[0] = 2;
 490                 ptr[1] = EIR_TX_POWER;
 491                 ptr[2] = (u8) hdev->inq_tx_power;
 492
 493                 eir_len += 3;
 494                 ptr += 3;
 495         }
 496
 497         if (hdev->devid_source > 0) {
 498                 ptr[0] = 9;
 499                 ptr[1] = EIR_DEVICE_ID;
 500
 501                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 502                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 503                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 504                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 505
 506                 eir_len += 10;
 507                 ptr += 10;
 508         }
 509
 510         memset(uuid16_list, 0, sizeof(uuid16_list));
 511
 512         /* Group all UUID16 types */
 513         list_for_each_entry(uuid, &hdev->uuids, list) {
 514                 u16 uuid16;
 515
 516                 uuid16 = get_uuid16(uuid->uuid);
 517                 if (uuid16 == 0)
 518                         return;
 519
 520                 if (uuid16 < 0x1100)
 521                         continue;
 522
 523                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 524                         continue;
 525
 526                 /* Stop if not enough space to put next UUID */
 527                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 528                         truncated = 1;
 529                         break;
 530                 }
 531
 532                 /* Check for duplicates */
 533                 for (i = 0; uuid16_list[i] != 0; i++)
 534                         if (uuid16_list[i] == uuid16)
 535                                 break;
 536
 537                 if (uuid16_list[i] == 0) {
 538                         uuid16_list[i] = uuid16;
 539                         eir_len += sizeof(u16);
 540                 }
 541         }
 542
 543         if (uuid16_list[0] != 0) {
 544                 u8 *length = ptr;
 545
 546                 /* EIR Data type */
 547                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 548
 549                 ptr += 2;
 550                 eir_len += 2;
 551
 552                 for (i = 0; uuid16_list[i] != 0; i++) {
 553                         *ptr++ = (uuid16_list[i] & 0x00ff);
 554                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 555                 }
 556
 557                 /* EIR Data length */
 558                 *length = (i * sizeof(u16)) + 1;
 559         }
 560 }
 561
 562 static int update_eir(struct hci_dev *hdev)
 563 {
 564         struct hci_cp_write_eir cp;
 565
 566         if (!hdev_is_powered(hdev))
 567                 return 0;
 568
 569         if (!lmp_ext_inq_capable(hdev))
 570                 return 0;
 571
 572         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 573                 return 0;
 574
 575         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 576                 return 0;
 577
 578         memset(&cp, 0, sizeof(cp));
 579
 580         create_eir(hdev, cp.data);
 581
 582         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 583                 return 0;
 584
 585         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 586
 587         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 588 }
 589
 590 static u8 get_service_classes(struct hci_dev *hdev)
 591 {
 592         struct bt_uuid *uuid;
 593         u8 val = 0;
 594
 595         list_for_each_entry(uuid, &hdev->uuids, list)
 596                 val |= uuid->svc_hint;
 597
 598         return val;
 599 }
 600
 601 static int update_class(struct hci_dev *hdev)
 602 {
 603         u8 cod[3];
 604         int err;
 605
 606         BT_DBG("%s", hdev->name);
 607
 608         if (!hdev_is_powered(hdev))
 609                 return 0;
 610
 611         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 612                 return 0;
 613
 614         cod[0] = hdev->minor_class;
 615         cod[1] = hdev->major_class;
 616         cod[2] = get_service_classes(hdev);
 617
 618         if (memcmp(cod, hdev->dev_class, 3) == 0)
 619                 return 0;
 620
 621         err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 622         if (err == 0)
 623                 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
 624
 625         return err;
 626 }
 627
 628 static void service_cache_off(struct work_struct *work)
 629 {
 630         struct hci_dev *hdev = container_of(work, struct hci_dev,
 631                                             service_cache.work);
 632
 633         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 634                 return;
 635
 636         hci_dev_lock(hdev);
 637
 638         update_eir(hdev);
 639         update_class(hdev);
 640
 641         hci_dev_unlock(hdev);
 642 }
 643
 644 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 645 {
 646         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 647                 return;
 648
 649         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 650
 651         /* Non-mgmt controlled devices get this bit set
 652          * implicitly so that pairing works for them, however
 653          * for mgmt we require user-space to explicitly enable
 654          * it
 655          */
 656         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 657 }
 658
 659 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 660                                 void *data, u16 data_len)
 661 {
 662         struct mgmt_rp_read_info rp;
 663
 664         BT_DBG("sock %p %s", sk, hdev->name);
 665
 666         hci_dev_lock(hdev);
 667
 668         memset(&rp, 0, sizeof(rp));
 669
 670         bacpy(&rp.bdaddr, &hdev->bdaddr);
 671
 672         rp.version = hdev->hci_ver;
 673         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 674
 675         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 676         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 677
 678         memcpy(rp.dev_class, hdev->dev_class, 3);
 679
 680         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 681         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 682
 683         hci_dev_unlock(hdev);
 684
 685         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 686                             sizeof(rp));
 687 }
 688
 689 static void mgmt_pending_free(struct pending_cmd *cmd)
 690 {
 691         sock_put(cmd->sk);
 692         kfree(cmd->param);
 693         kfree(cmd);
 694 }
 695
 696 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 697                                             struct hci_dev *hdev, void *data,
 698                                             u16 len)
 699 {
 700         struct pending_cmd *cmd;
 701
 702         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 703         if (!cmd)
 704                 return NULL;
 705
 706         cmd->opcode = opcode;
 707         cmd->index = hdev->id;
 708
 709         cmd->param = kmalloc(len, GFP_KERNEL);
 710         if (!cmd->param) {
 711                 kfree(cmd);
 712                 return NULL;
 713         }
 714
 715         if (data)
 716                 memcpy(cmd->param, data, len);
 717
 718         cmd->sk = sk;
 719         sock_hold(sk);
 720
 721         list_add(&cmd->list, &hdev->mgmt_pending);
 722
 723         return cmd;
 724 }
 725
 726 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 727                                  void (*cb)(struct pending_cmd *cmd,
 728                                             void *data),
 729                                  void *data)
 730 {
 731         struct list_head *p, *n;
 732
 733         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 734                 struct pending_cmd *cmd;
 735
 736                 cmd = list_entry(p, struct pending_cmd, list);
 737
 738                 if (opcode > 0 && cmd->opcode != opcode)
 739                         continue;
 740
 741                 cb(cmd, data);
 742         }
 743 }
 744
 745 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 746 {
 747         struct pending_cmd *cmd;
 748
 749         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 750                 if (cmd->opcode == opcode)
 751                         return cmd;
 752         }
 753
 754         return NULL;
 755 }
 756
 757 static void mgmt_pending_remove(struct pending_cmd *cmd)
 758 {
 759         list_del(&cmd->list);
 760         mgmt_pending_free(cmd);
 761 }
 762
 763 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 764 {
 765         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 766
 767         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 768                             sizeof(settings));
 769 }
 770
 771 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 772                        u16 len)
 773 {
 774         struct mgmt_mode *cp = data;
 775         struct pending_cmd *cmd;
 776         int err;
 777
 778         BT_DBG("request for %s", hdev->name);
 779
 780         hci_dev_lock(hdev);
 781
 782         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 783                 cancel_delayed_work(&hdev->power_off);
 784
 785                 if (cp->val) {
 786                         err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 787                         mgmt_powered(hdev, 1);
 788                         goto failed;
 789                 }
 790         }
 791
 792         if (!!cp->val == hdev_is_powered(hdev)) {
 793                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 794                 goto failed;
 795         }
 796
 797         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 798                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 799                                  MGMT_STATUS_BUSY);
 800                 goto failed;
 801         }
 802
 803         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 804         if (!cmd) {
 805                 err = -ENOMEM;
 806                 goto failed;
 807         }
 808
 809         if (cp->val)
 810                 schedule_work(&hdev->power_on);
 811         else
 812                 schedule_work(&hdev->power_off.work);
 813
 814         err = 0;
 815
 816 failed:
 817         hci_dev_unlock(hdev);
 818         return err;
 819 }
 820
 821 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 822                       struct sock *skip_sk)
 823 {
 824         struct sk_buff *skb;
 825         struct mgmt_hdr *hdr;
 826
 827         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 828         if (!skb)
 829                 return -ENOMEM;
 830
 831         hdr = (void *) skb_put(skb, sizeof(*hdr));
 832         hdr->opcode = cpu_to_le16(event);
 833         if (hdev)
 834                 hdr->index = cpu_to_le16(hdev->id);
 835         else
 836                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 837         hdr->len = cpu_to_le16(data_len);
 838
 839         if (data)
 840                 memcpy(skb_put(skb, data_len), data, data_len);
 841
 842         /* Time stamp */
 843         __net_timestamp(skb);
 844
 845         hci_send_to_control(skb, skip_sk);
 846         kfree_skb(skb);
 847
 848         return 0;
 849 }
 850
 851 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 852 {
 853         __le32 ev;
 854
 855         ev = cpu_to_le32(get_current_settings(hdev));
 856
 857         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 858 }
 859
 860 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 861                             u16 len)
 862 {
 863         struct mgmt_cp_set_discoverable *cp = data;
 864         struct pending_cmd *cmd;
 865         u16 timeout;
 866         u8 scan;
 867         int err;
 868
 869         BT_DBG("request for %s", hdev->name);
 870
 871         if (!lmp_bredr_capable(hdev))
 872                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 873                                  MGMT_STATUS_NOT_SUPPORTED);
 874
 875         timeout = __le16_to_cpu(cp->timeout);
 876         if (!cp->val && timeout > 0)
 877                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 878                                   MGMT_STATUS_INVALID_PARAMS);
 879
 880         hci_dev_lock(hdev);
 881
 882         if (!hdev_is_powered(hdev) && timeout > 0) {
 883                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 884                                  MGMT_STATUS_NOT_POWERED);
 885                 goto failed;
 886         }
 887
 888         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 889             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 890                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 891                                  MGMT_STATUS_BUSY);
 892                 goto failed;
 893         }
 894
 895         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 896                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 897                                  MGMT_STATUS_REJECTED);
 898                 goto failed;
 899         }
 900
 901         if (!hdev_is_powered(hdev)) {
 902                 bool changed = false;
 903
 904                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 905                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 906                         changed = true;
 907                 }
 908
 909                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 910                 if (err < 0)
 911                         goto failed;
 912
 913                 if (changed)
 914                         err = new_settings(hdev, sk);
 915
 916                 goto failed;
 917         }
 918
 919         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 920                 if (hdev->discov_timeout > 0) {
 921                         cancel_delayed_work(&hdev->discov_off);
 922                         hdev->discov_timeout = 0;
 923                 }
 924
 925                 if (cp->val && timeout > 0) {
 926                         hdev->discov_timeout = timeout;
 927                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 928                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 929                 }
 930
 931                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 932                 goto failed;
 933         }
 934
 935         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 936         if (!cmd) {
 937                 err = -ENOMEM;
 938                 goto failed;
 939         }
 940
 941         scan = SCAN_PAGE;
 942
 943         if (cp->val)
 944                 scan |= SCAN_INQUIRY;
 945         else
 946                 cancel_delayed_work(&hdev->discov_off);
 947
 948         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 949         if (err < 0)
 950                 mgmt_pending_remove(cmd);
 951
 952         if (cp->val)
 953                 hdev->discov_timeout = timeout;
 954
 955 failed:
 956         hci_dev_unlock(hdev);
 957         return err;
 958 }
 959
 960 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
 961                            u16 len)
 962 {
 963         struct mgmt_mode *cp = data;
 964         struct pending_cmd *cmd;
 965         u8 scan;
 966         int err;
 967
 968         BT_DBG("request for %s", hdev->name);
 969
 970         if (!lmp_bredr_capable(hdev))
 971                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
 972                                   MGMT_STATUS_NOT_SUPPORTED);
 973
 974         hci_dev_lock(hdev);
 975
 976         if (!hdev_is_powered(hdev)) {
 977                 bool changed = false;
 978
 979                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 980                         changed = true;
 981
 982                 if (cp->val) {
 983                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 984                 } else {
 985                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 986                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 987                 }
 988
 989                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 990                 if (err < 0)
 991                         goto failed;
 992
 993                 if (changed)
 994                         err = new_settings(hdev, sk);
 995
 996                 goto failed;
 997         }
 998
 999         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1000             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1001                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1002                                  MGMT_STATUS_BUSY);
1003                 goto failed;
1004         }
1005
1006         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1007                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1008                 goto failed;
1009         }
1010
1011         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1012         if (!cmd) {
1013                 err = -ENOMEM;
1014                 goto failed;
1015         }
1016
1017         if (cp->val) {
1018                 scan = SCAN_PAGE;
1019         } else {
1020                 scan = 0;
1021
1022                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1023                     hdev->discov_timeout > 0)
1024                         cancel_delayed_work(&hdev->discov_off);
1025         }
1026
1027         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1028         if (err < 0)
1029                 mgmt_pending_remove(cmd);
1030
1031 failed:
1032         hci_dev_unlock(hdev);
1033         return err;
1034 }
1035
1036 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1037                         u16 len)
1038 {
1039         struct mgmt_mode *cp = data;
1040         int err;
1041
1042         BT_DBG("request for %s", hdev->name);
1043
1044         hci_dev_lock(hdev);
1045
1046         if (cp->val)
1047                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1048         else
1049                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1050
1051         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1052         if (err < 0)
1053                 goto failed;
1054
1055         err = new_settings(hdev, sk);
1056
1057 failed:
1058         hci_dev_unlock(hdev);
1059         return err;
1060 }
1061
1062 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1063                              u16 len)
1064 {
1065         struct mgmt_mode *cp = data;
1066         struct pending_cmd *cmd;
1067         u8 val;
1068         int err;
1069
1070         BT_DBG("request for %s", hdev->name);
1071
1072         if (!lmp_bredr_capable(hdev))
1073                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1074                                   MGMT_STATUS_NOT_SUPPORTED);
1075
1076         hci_dev_lock(hdev);
1077
1078         if (!hdev_is_powered(hdev)) {
1079                 bool changed = false;
1080
1081                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1082                                           &hdev->dev_flags)) {
1083                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1084                         changed = true;
1085                 }
1086
1087                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1088                 if (err < 0)
1089                         goto failed;
1090
1091                 if (changed)
1092                         err = new_settings(hdev, sk);
1093
1094                 goto failed;
1095         }
1096
1097         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1098                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1099                                  MGMT_STATUS_BUSY);
1100                 goto failed;
1101         }
1102
1103         val = !!cp->val;
1104
1105         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1106                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1107                 goto failed;
1108         }
1109
1110         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1111         if (!cmd) {
1112                 err = -ENOMEM;
1113                 goto failed;
1114         }
1115
1116         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1117         if (err < 0) {
1118                 mgmt_pending_remove(cmd);
1119                 goto failed;
1120         }
1121
1122 failed:
1123         hci_dev_unlock(hdev);
1124         return err;
1125 }
1126
1127 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1128 {
1129         struct mgmt_mode *cp = data;
1130         struct pending_cmd *cmd;
1131         u8 val;
1132         int err;
1133
1134         BT_DBG("request for %s", hdev->name);
1135
1136         hci_dev_lock(hdev);
1137
1138         if (!lmp_ssp_capable(hdev)) {
1139                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1140                                  MGMT_STATUS_NOT_SUPPORTED);
1141                 goto failed;
1142         }
1143
1144         val = !!cp->val;
1145
1146         if (!hdev_is_powered(hdev)) {
1147                 bool changed = false;
1148
1149                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1150                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1151                         changed = true;
1152                 }
1153
1154                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1155                 if (err < 0)
1156                         goto failed;
1157
1158                 if (changed)
1159                         err = new_settings(hdev, sk);
1160
1161                 goto failed;
1162         }
1163
1164         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1165                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1166                                  MGMT_STATUS_BUSY);
1167                 goto failed;
1168         }
1169
1170         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1171                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1172                 goto failed;
1173         }
1174
1175         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1176         if (!cmd) {
1177                 err = -ENOMEM;
1178                 goto failed;
1179         }
1180
1181         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1182         if (err < 0) {
1183                 mgmt_pending_remove(cmd);
1184                 goto failed;
1185         }
1186
1187 failed:
1188         hci_dev_unlock(hdev);
1189         return err;
1190 }
1191
1192 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1193 {
1194         struct mgmt_mode *cp = data;
1195
1196         BT_DBG("request for %s", hdev->name);
1197
1198         if (!enable_hs)
1199                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1200                                   MGMT_STATUS_NOT_SUPPORTED);
1201
1202         if (cp->val)
1203                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1204         else
1205                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1206
1207         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1208 }
1209
1210 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1211 {
1212         struct mgmt_mode *cp = data;
1213         struct hci_cp_write_le_host_supported hci_cp;
1214         struct pending_cmd *cmd;
1215         int err;
1216         u8 val, enabled;
1217
1218         BT_DBG("request for %s", hdev->name);
1219
1220         hci_dev_lock(hdev);
1221
1222         if (!lmp_le_capable(hdev)) {
1223                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1224                                  MGMT_STATUS_NOT_SUPPORTED);
1225                 goto unlock;
1226         }
1227
1228         val = !!cp->val;
1229         enabled = lmp_host_le_capable(hdev);
1230
1231         if (!hdev_is_powered(hdev) || val == enabled) {
1232                 bool changed = false;
1233
1234                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1235                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1236                         changed = true;
1237                 }
1238
1239                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1240                 if (err < 0)
1241                         goto unlock;
1242
1243                 if (changed)
1244                         err = new_settings(hdev, sk);
1245
1246                 goto unlock;
1247         }
1248
1249         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1250                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1251                                  MGMT_STATUS_BUSY);
1252                 goto unlock;
1253         }
1254
1255         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1256         if (!cmd) {
1257                 err = -ENOMEM;
1258                 goto unlock;
1259         }
1260
1261         memset(&hci_cp, 0, sizeof(hci_cp));
1262
1263         if (val) {
1264                 hci_cp.le = val;
1265                 hci_cp.simul = lmp_le_br_capable(hdev);
1266         }
1267
1268         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1269                            &hci_cp);
1270         if (err < 0)
1271                 mgmt_pending_remove(cmd);
1272
1273 unlock:
1274         hci_dev_unlock(hdev);
1275         return err;
1276 }
1277
1278 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1279 {
1280         struct mgmt_cp_add_uuid *cp = data;
1281         struct pending_cmd *cmd;
1282         struct bt_uuid *uuid;
1283         int err;
1284
1285         BT_DBG("request for %s", hdev->name);
1286
1287         hci_dev_lock(hdev);
1288
1289         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1290                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1291                                  MGMT_STATUS_BUSY);
1292                 goto failed;
1293         }
1294
1295         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1296         if (!uuid) {
1297                 err = -ENOMEM;
1298                 goto failed;
1299         }
1300
1301         memcpy(uuid->uuid, cp->uuid, 16);
1302         uuid->svc_hint = cp->svc_hint;
1303
1304         list_add(&uuid->list, &hdev->uuids);
1305
1306         err = update_class(hdev);
1307         if (err < 0)
1308                 goto failed;
1309
1310         err = update_eir(hdev);
1311         if (err < 0)
1312                 goto failed;
1313
1314         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1315                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1316                                    hdev->dev_class, 3);
1317                 goto failed;
1318         }
1319
1320         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1321         if (!cmd)
1322                 err = -ENOMEM;
1323
1324 failed:
1325         hci_dev_unlock(hdev);
1326         return err;
1327 }
1328
1329 static bool enable_service_cache(struct hci_dev *hdev)
1330 {
1331         if (!hdev_is_powered(hdev))
1332                 return false;
1333
1334         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1335                 schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
1336                 return true;
1337         }
1338
1339         return false;
1340 }
1341
1342 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1343                        u16 len)
1344 {
1345         struct mgmt_cp_remove_uuid *cp = data;
1346         struct pending_cmd *cmd;
1347         struct list_head *p, *n;
1348         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1349         int err, found;
1350
1351         BT_DBG("request for %s", hdev->name);
1352
1353         hci_dev_lock(hdev);
1354
1355         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1356                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1357                                  MGMT_STATUS_BUSY);
1358                 goto unlock;
1359         }
1360
1361         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1362                 err = hci_uuids_clear(hdev);
1363
1364                 if (enable_service_cache(hdev)) {
1365                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1366                                            0, hdev->dev_class, 3);
1367                         goto unlock;
1368                 }
1369
1370                 goto update_class;
1371         }
1372
1373         found = 0;
1374
1375         list_for_each_safe(p, n, &hdev->uuids) {
1376                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1377
1378                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1379                         continue;
1380
1381                 list_del(&match->list);
1382                 kfree(match);
1383                 found++;
1384         }
1385
1386         if (found == 0) {
1387                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1388                                  MGMT_STATUS_INVALID_PARAMS);
1389                 goto unlock;
1390         }
1391
1392 update_class:
1393         err = update_class(hdev);
1394         if (err < 0)
1395                 goto unlock;
1396
1397         err = update_eir(hdev);
1398         if (err < 0)
1399                 goto unlock;
1400
1401         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1402                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1403                                    hdev->dev_class, 3);
1404                 goto unlock;
1405         }
1406
1407         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1408         if (!cmd)
1409                 err = -ENOMEM;
1410
1411 unlock:
1412         hci_dev_unlock(hdev);
1413         return err;
1414 }
1415
1416 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1417                          u16 len)
1418 {
1419         struct mgmt_cp_set_dev_class *cp = data;
1420         struct pending_cmd *cmd;
1421         int err;
1422
1423         BT_DBG("request for %s", hdev->name);
1424
1425         hci_dev_lock(hdev);
1426
1427         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1428                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1429                                  MGMT_STATUS_BUSY);
1430                 goto unlock;
1431         }
1432
1433         hdev->major_class = cp->major;
1434         hdev->minor_class = cp->minor;
1435
1436         if (!hdev_is_powered(hdev)) {
1437                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1438                                    hdev->dev_class, 3);
1439                 goto unlock;
1440         }
1441
1442         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1443                 hci_dev_unlock(hdev);
1444                 cancel_delayed_work_sync(&hdev->service_cache);
1445                 hci_dev_lock(hdev);
1446                 update_eir(hdev);
1447         }
1448
1449         err = update_class(hdev);
1450         if (err < 0)
1451                 goto unlock;
1452
1453         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1454                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1455                                    hdev->dev_class, 3);
1456                 goto unlock;
1457         }
1458
1459         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1460         if (!cmd)
1461                 err = -ENOMEM;
1462
1463 unlock:
1464         hci_dev_unlock(hdev);
1465         return err;
1466 }
1467
1468 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1469                           u16 len)
1470 {
1471         struct mgmt_cp_load_link_keys *cp = data;
1472         u16 key_count, expected_len;
1473         int i;
1474
1475         key_count = __le16_to_cpu(cp->key_count);
1476
1477         expected_len = sizeof(*cp) + key_count *
1478                                         sizeof(struct mgmt_link_key_info);
1479         if (expected_len != len) {
1480                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1481                        len, expected_len);
1482                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1483                                   MGMT_STATUS_INVALID_PARAMS);
1484         }
1485
1486         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1487                key_count);
1488
1489         hci_dev_lock(hdev);
1490
1491         hci_link_keys_clear(hdev);
1492
1493         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1494
1495         if (cp->debug_keys)
1496                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1497         else
1498                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1499
1500         for (i = 0; i < key_count; i++) {
1501                 struct mgmt_link_key_info *key = &cp->keys[i];
1502
1503                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1504                                  key->type, key->pin_len);
1505         }
1506
1507         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1508
1509         hci_dev_unlock(hdev);
1510
1511         return 0;
1512 }
1513
1514 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1515                            u8 addr_type, struct sock *skip_sk)
1516 {
1517         struct mgmt_ev_device_unpaired ev;
1518
1519         bacpy(&ev.addr.bdaddr, bdaddr);
1520         ev.addr.type = addr_type;
1521
1522         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1523                           skip_sk);
1524 }
1525
1526 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1527                          u16 len)
1528 {
1529         struct mgmt_cp_unpair_device *cp = data;
1530         struct mgmt_rp_unpair_device rp;
1531         struct hci_cp_disconnect dc;
1532         struct pending_cmd *cmd;
1533         struct hci_conn *conn;
1534         int err;
1535
1536         hci_dev_lock(hdev);
1537
1538         memset(&rp, 0, sizeof(rp));
1539         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1540         rp.addr.type = cp->addr.type;
1541
1542         if (!hdev_is_powered(hdev)) {
1543                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1544                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1545                 goto unlock;
1546         }
1547
1548         if (cp->addr.type == BDADDR_BREDR)
1549                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1550         else
1551                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1552
1553         if (err < 0) {
1554                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1555                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1556                 goto unlock;
1557         }
1558
1559         if (cp->disconnect) {
1560                 if (cp->addr.type == BDADDR_BREDR)
1561                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1562                                                        &cp->addr.bdaddr);
1563                 else
1564                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1565                                                        &cp->addr.bdaddr);
1566         } else {
1567                 conn = NULL;
1568         }
1569
1570         if (!conn) {
1571                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1572                                    &rp, sizeof(rp));
1573                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1574                 goto unlock;
1575         }
1576
1577         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1578                                sizeof(*cp));
1579         if (!cmd) {
1580                 err = -ENOMEM;
1581                 goto unlock;
1582         }
1583
1584         dc.handle = cpu_to_le16(conn->handle);
1585         dc.reason = 0x13; /* Remote User Terminated Connection */
1586         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1587         if (err < 0)
1588                 mgmt_pending_remove(cmd);
1589
1590 unlock:
1591         hci_dev_unlock(hdev);
1592         return err;
1593 }
1594
1595 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1596                       u16 len)
1597 {
1598         struct mgmt_cp_disconnect *cp = data;
1599         struct hci_cp_disconnect dc;
1600         struct pending_cmd *cmd;
1601         struct hci_conn *conn;
1602         int err;
1603
1604         BT_DBG("");
1605
1606         hci_dev_lock(hdev);
1607
1608         if (!test_bit(HCI_UP, &hdev->flags)) {
1609                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1610                                  MGMT_STATUS_NOT_POWERED);
1611                 goto failed;
1612         }
1613
1614         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1615                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1616                                  MGMT_STATUS_BUSY);
1617                 goto failed;
1618         }
1619
1620         if (cp->addr.type == BDADDR_BREDR)
1621                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1622                                                &cp->addr.bdaddr);
1623         else
1624                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1625
1626         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1627                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1628                                  MGMT_STATUS_NOT_CONNECTED);
1629                 goto failed;
1630         }
1631
1632         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1633         if (!cmd) {
1634                 err = -ENOMEM;
1635                 goto failed;
1636         }
1637
1638         dc.handle = cpu_to_le16(conn->handle);
1639         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1640
1641         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1642         if (err < 0)
1643                 mgmt_pending_remove(cmd);
1644
1645 failed:
1646         hci_dev_unlock(hdev);
1647         return err;
1648 }
1649
1650 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1651 {
1652         switch (link_type) {
1653         case LE_LINK:
1654                 switch (addr_type) {
1655                 case ADDR_LE_DEV_PUBLIC:
1656                         return BDADDR_LE_PUBLIC;
1657
1658                 default:
1659                         /* Fallback to LE Random address type */
1660                         return BDADDR_LE_RANDOM;
1661                 }
1662
1663         default:
1664                 /* Fallback to BR/EDR type */
1665                 return BDADDR_BREDR;
1666         }
1667 }
1668
1669 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1670                            u16 data_len)
1671 {
1672         struct mgmt_rp_get_connections *rp;
1673         struct hci_conn *c;
1674         size_t rp_len;
1675         int err;
1676         u16 i;
1677
1678         BT_DBG("");
1679
1680         hci_dev_lock(hdev);
1681
1682         if (!hdev_is_powered(hdev)) {
1683                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1684                                  MGMT_STATUS_NOT_POWERED);
1685                 goto unlock;
1686         }
1687
1688         i = 0;
1689         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1690                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1691                         i++;
1692         }
1693
1694         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1695         rp = kmalloc(rp_len, GFP_KERNEL);
1696         if (!rp) {
1697                 err = -ENOMEM;
1698                 goto unlock;
1699         }
1700
1701         i = 0;
1702         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1703                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1704                         continue;
1705                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1706                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1707                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1708                         continue;
1709                 i++;
1710         }
1711
1712         rp->conn_count = cpu_to_le16(i);
1713
1714         /* Recalculate length in case of filtered SCO connections, etc */
1715         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1716
1717         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1718                            rp_len);
1719
1720         kfree(rp);
1721
1722 unlock:
1723         hci_dev_unlock(hdev);
1724         return err;
1725 }
1726
1727 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1728                                    struct mgmt_cp_pin_code_neg_reply *cp)
1729 {
1730         struct pending_cmd *cmd;
1731         int err;
1732
1733         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1734                                sizeof(*cp));
1735         if (!cmd)
1736                 return -ENOMEM;
1737
1738         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1739                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1740         if (err < 0)
1741                 mgmt_pending_remove(cmd);
1742
1743         return err;
1744 }
1745
1746 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1747                           u16 len)
1748 {
1749         struct hci_conn *conn;
1750         struct mgmt_cp_pin_code_reply *cp = data;
1751         struct hci_cp_pin_code_reply reply;
1752         struct pending_cmd *cmd;
1753         int err;
1754
1755         BT_DBG("");
1756
1757         hci_dev_lock(hdev);
1758
1759         if (!hdev_is_powered(hdev)) {
1760                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1761                                  MGMT_STATUS_NOT_POWERED);
1762                 goto failed;
1763         }
1764
1765         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1766         if (!conn) {
1767                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1768                                  MGMT_STATUS_NOT_CONNECTED);
1769                 goto failed;
1770         }
1771
1772         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1773                 struct mgmt_cp_pin_code_neg_reply ncp;
1774
1775                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1776
1777                 BT_ERR("PIN code is not 16 bytes long");
1778
1779                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1780                 if (err >= 0)
1781                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1782                                          MGMT_STATUS_INVALID_PARAMS);
1783
1784                 goto failed;
1785         }
1786
1787         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1788         if (!cmd) {
1789                 err = -ENOMEM;
1790                 goto failed;
1791         }
1792
1793         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1794         reply.pin_len = cp->pin_len;
1795         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1796
1797         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1798         if (err < 0)
1799                 mgmt_pending_remove(cmd);
1800
1801 failed:
1802         hci_dev_unlock(hdev);
1803         return err;
1804 }
1805
1806 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1807                              u16 len)
1808 {
1809         struct mgmt_cp_set_io_capability *cp = data;
1810
1811         BT_DBG("");
1812
1813         hci_dev_lock(hdev);
1814
1815         hdev->io_capability = cp->io_capability;
1816
1817         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1818                hdev->io_capability);
1819
1820         hci_dev_unlock(hdev);
1821
1822         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1823                             0);
1824 }
1825
1826 static struct pending_cmd *find_pairing(struct hci_conn *conn)
1827 {
1828         struct hci_dev *hdev = conn->hdev;
1829         struct pending_cmd *cmd;
1830
1831         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1832                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1833                         continue;
1834
1835                 if (cmd->user_data != conn)
1836                         continue;
1837
1838                 return cmd;
1839         }
1840
1841         return NULL;
1842 }
1843
1844 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1845 {
1846         struct mgmt_rp_pair_device rp;
1847         struct hci_conn *conn = cmd->user_data;
1848
1849         bacpy(&rp.addr.bdaddr, &conn->dst);
1850         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
1851
1852         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1853                      &rp, sizeof(rp));
1854
1855         /* So we don't get further callbacks for this connection */
1856         conn->connect_cfm_cb = NULL;
1857         conn->security_cfm_cb = NULL;
1858         conn->disconn_cfm_cb = NULL;
1859
1860         hci_conn_put(conn);
1861
1862         mgmt_pending_remove(cmd);
1863 }
1864
1865 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1866 {
1867         struct pending_cmd *cmd;
1868
1869         BT_DBG("status %u", status);
1870
1871         cmd = find_pairing(conn);
1872         if (!cmd)
1873                 BT_DBG("Unable to find a pending command");
1874         else
1875                 pairing_complete(cmd, mgmt_status(status));
1876 }
1877
1878 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
1879 {
1880         struct pending_cmd *cmd;
1881
1882         BT_DBG("status %u", status);
1883
1884         if (!status)
1885                 return;
1886
1887         cmd = find_pairing(conn);
1888         if (!cmd)
1889                 BT_DBG("Unable to find a pending command");
1890         else
1891                 pairing_complete(cmd, mgmt_status(status));
1892 }
1893
1894 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1895                        u16 len)
1896 {
1897         struct mgmt_cp_pair_device *cp = data;
1898         struct mgmt_rp_pair_device rp;
1899         struct pending_cmd *cmd;
1900         u8 sec_level, auth_type;
1901         struct hci_conn *conn;
1902         int err;
1903
1904         BT_DBG("");
1905
1906         hci_dev_lock(hdev);
1907
1908         if (!hdev_is_powered(hdev)) {
1909                 err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1910                                  MGMT_STATUS_NOT_POWERED);
1911                 goto unlock;
1912         }
1913
1914         sec_level = BT_SECURITY_MEDIUM;
1915         if (cp->io_cap == 0x03)
1916                 auth_type = HCI_AT_DEDICATED_BONDING;
1917         else
1918                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1919
1920         if (cp->addr.type == BDADDR_BREDR)
1921                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
1922                                    cp->addr.type, sec_level, auth_type);
1923         else
1924                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
1925                                    cp->addr.type, sec_level, auth_type);
1926
1927         memset(&rp, 0, sizeof(rp));
1928         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1929         rp.addr.type = cp->addr.type;
1930
1931         if (IS_ERR(conn)) {
1932                 int status;
1933
1934                 if (PTR_ERR(conn) == -EBUSY)
1935                         status = MGMT_STATUS_BUSY;
1936                 else
1937                         status = MGMT_STATUS_CONNECT_FAILED;
1938
1939                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1940                                    status, &rp,
1941                                    sizeof(rp));
1942                 goto unlock;
1943         }
1944
1945         if (conn->connect_cfm_cb) {
1946                 hci_conn_put(conn);
1947                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1948                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1949                 goto unlock;
1950         }
1951
1952         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1953         if (!cmd) {
1954                 err = -ENOMEM;
1955                 hci_conn_put(conn);
1956                 goto unlock;
1957         }
1958
1959         /* For LE, just connecting isn't a proof that the pairing finished */
1960         if (cp->addr.type == BDADDR_BREDR)
1961                 conn->connect_cfm_cb = pairing_complete_cb;
1962         else
1963                 conn->connect_cfm_cb = le_connect_complete_cb;
1964
1965         conn->security_cfm_cb = pairing_complete_cb;
1966         conn->disconn_cfm_cb = pairing_complete_cb;
1967         conn->io_capability = cp->io_cap;
1968         cmd->user_data = conn;
1969
1970         if (conn->state == BT_CONNECTED &&
1971             hci_conn_security(conn, sec_level, auth_type))
1972                 pairing_complete(cmd, 0);
1973
1974         err = 0;
1975
1976 unlock:
1977         hci_dev_unlock(hdev);
1978         return err;
1979 }
1980
1981 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1982                               u16 len)
1983 {
1984         struct mgmt_addr_info *addr = data;
1985         struct pending_cmd *cmd;
1986         struct hci_conn *conn;
1987         int err;
1988
1989         BT_DBG("");
1990
1991         hci_dev_lock(hdev);
1992
1993         if (!hdev_is_powered(hdev)) {
1994                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1995                                  MGMT_STATUS_NOT_POWERED);
1996                 goto unlock;
1997         }
1998
1999         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2000         if (!cmd) {
2001                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2002                                  MGMT_STATUS_INVALID_PARAMS);
2003                 goto unlock;
2004         }
2005
2006         conn = cmd->user_data;
2007
2008         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2009                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2010                                  MGMT_STATUS_INVALID_PARAMS);
2011                 goto unlock;
2012         }
2013
2014         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2015
2016         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2017                            addr, sizeof(*addr));
2018 unlock:
2019         hci_dev_unlock(hdev);
2020         return err;
2021 }
2022
2023 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2024                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2025                              u16 hci_op, __le32 passkey)
2026 {
2027         struct pending_cmd *cmd;
2028         struct hci_conn *conn;
2029         int err;
2030
2031         hci_dev_lock(hdev);
2032
2033         if (!hdev_is_powered(hdev)) {
2034                 err = cmd_status(sk, hdev->id, mgmt_op,
2035                                  MGMT_STATUS_NOT_POWERED);
2036                 goto done;
2037         }
2038
2039         if (type == BDADDR_BREDR)
2040                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2041         else
2042                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2043
2044         if (!conn) {
2045                 err = cmd_status(sk, hdev->id, mgmt_op,
2046                                  MGMT_STATUS_NOT_CONNECTED);
2047                 goto done;
2048         }
2049
2050         if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2051                 /* Continue with pairing via SMP */
2052                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2053
2054                 if (!err)
2055                         err = cmd_status(sk, hdev->id, mgmt_op,
2056                                          MGMT_STATUS_SUCCESS);
2057                 else
2058                         err = cmd_status(sk, hdev->id, mgmt_op,
2059                                          MGMT_STATUS_FAILED);
2060
2061                 goto done;
2062         }
2063
2064         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2065         if (!cmd) {
2066                 err = -ENOMEM;
2067                 goto done;
2068         }
2069
2070         /* Continue with pairing via HCI */
2071         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2072                 struct hci_cp_user_passkey_reply cp;
2073
2074                 bacpy(&cp.bdaddr, bdaddr);
2075                 cp.passkey = passkey;
2076                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2077         } else
2078                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2079
2080         if (err < 0)
2081                 mgmt_pending_remove(cmd);
2082
2083 done:
2084         hci_dev_unlock(hdev);
2085         return err;
2086 }
2087
2088 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2089                               void *data, u16 len)
2090 {
2091         struct mgmt_cp_pin_code_neg_reply *cp = data;
2092
2093         BT_DBG("");
2094
2095         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2096                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2097                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2098 }
2099
2100 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2101                               u16 len)
2102 {
2103         struct mgmt_cp_user_confirm_reply *cp = data;
2104
2105         BT_DBG("");
2106
2107         if (len != sizeof(*cp))
2108                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2109                                   MGMT_STATUS_INVALID_PARAMS);
2110
2111         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2112                                  MGMT_OP_USER_CONFIRM_REPLY,
2113                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2114 }
2115
2116 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2117                                   void *data, u16 len)
2118 {
2119         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2120
2121         BT_DBG("");
2122
2123         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2124                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2125                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2126 }
2127
2128 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2129                               u16 len)
2130 {
2131         struct mgmt_cp_user_passkey_reply *cp = data;
2132
2133         BT_DBG("");
2134
2135         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2136                                  MGMT_OP_USER_PASSKEY_REPLY,
2137                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2138 }
2139
2140 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2141                                   void *data, u16 len)
2142 {
2143         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2144
2145         BT_DBG("");
2146
2147         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2148                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2149                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2150 }
2151
2152 static int update_name(struct hci_dev *hdev, const char *name)
2153 {
2154         struct hci_cp_write_local_name cp;
2155
2156         memcpy(cp.name, name, sizeof(cp.name));
2157
2158         return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2159 }
2160
2161 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2162                           u16 len)
2163 {
2164         struct mgmt_cp_set_local_name *cp = data;
2165         struct pending_cmd *cmd;
2166         int err;
2167
2168         BT_DBG("");
2169
2170         hci_dev_lock(hdev);
2171
2172         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2173
2174         if (!hdev_is_powered(hdev)) {
2175                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2176
2177                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2178                                    data, len);
2179                 if (err < 0)
2180                         goto failed;
2181
2182                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2183                                  sk);
2184
2185                 goto failed;
2186         }
2187
2188         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2189         if (!cmd) {
2190                 err = -ENOMEM;
2191                 goto failed;
2192         }
2193
2194         err = update_name(hdev, cp->name);
2195         if (err < 0)
2196                 mgmt_pending_remove(cmd);
2197
2198 failed:
2199         hci_dev_unlock(hdev);
2200         return err;
2201 }
2202
2203 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2204                                void *data, u16 data_len)
2205 {
2206         struct pending_cmd *cmd;
2207         int err;
2208
2209         BT_DBG("%s", hdev->name);
2210
2211         hci_dev_lock(hdev);
2212
2213         if (!hdev_is_powered(hdev)) {
2214                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2215                                  MGMT_STATUS_NOT_POWERED);
2216                 goto unlock;
2217         }
2218
2219         if (!lmp_ssp_capable(hdev)) {
2220                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2221                                  MGMT_STATUS_NOT_SUPPORTED);
2222                 goto unlock;
2223         }
2224
2225         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2226                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2227                                  MGMT_STATUS_BUSY);
2228                 goto unlock;
2229         }
2230
2231         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2232         if (!cmd) {
2233                 err = -ENOMEM;
2234                 goto unlock;
2235         }
2236
2237         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2238         if (err < 0)
2239                 mgmt_pending_remove(cmd);
2240
2241 unlock:
2242         hci_dev_unlock(hdev);
2243         return err;
2244 }
2245
2246 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2247                                void *data, u16 len)
2248 {
2249         struct mgmt_cp_add_remote_oob_data *cp = data;
2250         u8 status;
2251         int err;
2252
2253         BT_DBG("%s ", hdev->name);
2254
2255         hci_dev_lock(hdev);
2256
2257         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2258                                       cp->randomizer);
2259         if (err < 0)
2260                 status = MGMT_STATUS_FAILED;
2261         else
2262                 status = 0;
2263
2264         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2265                            &cp->addr, sizeof(cp->addr));
2266
2267         hci_dev_unlock(hdev);
2268         return err;
2269 }
2270
2271 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2272                                   void *data, u16 len)
2273 {
2274         struct mgmt_cp_remove_remote_oob_data *cp = data;
2275         u8 status;
2276         int err;
2277
2278         BT_DBG("%s", hdev->name);
2279
2280         hci_dev_lock(hdev);
2281
2282         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2283         if (err < 0)
2284                 status = MGMT_STATUS_INVALID_PARAMS;
2285         else
2286                 status = 0;
2287
2288         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2289                            status, &cp->addr, sizeof(cp->addr));
2290
2291         hci_dev_unlock(hdev);
2292         return err;
2293 }
2294
2295 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2296 {
2297         int err;
2298
2299         BT_DBG("%s", hdev->name);
2300
2301         hci_dev_lock(hdev);
2302
2303         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2304         if (err < 0)
2305                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2306
2307         hci_dev_unlock(hdev);
2308
2309         return err;
2310 }
2311
2312 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2313                            void *data, u16 len)
2314 {
2315         struct mgmt_cp_start_discovery *cp = data;
2316         struct pending_cmd *cmd;
2317         int err;
2318
2319         BT_DBG("%s", hdev->name);
2320
2321         hci_dev_lock(hdev);
2322
2323         if (!hdev_is_powered(hdev)) {
2324                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2325                                  MGMT_STATUS_NOT_POWERED);
2326                 goto failed;
2327         }
2328
2329         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2330                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2331                                  MGMT_STATUS_BUSY);
2332                 goto failed;
2333         }
2334
2335         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2336                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2337                                  MGMT_STATUS_BUSY);
2338                 goto failed;
2339         }
2340
2341         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2342         if (!cmd) {
2343                 err = -ENOMEM;
2344                 goto failed;
2345         }
2346
2347         hdev->discovery.type = cp->type;
2348
2349         switch (hdev->discovery.type) {
2350         case DISCOV_TYPE_BREDR:
2351                 if (lmp_bredr_capable(hdev))
2352                         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2353                 else
2354                         err = -ENOTSUPP;
2355                 break;
2356
2357         case DISCOV_TYPE_LE:
2358                 if (lmp_host_le_capable(hdev))
2359                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2360                                           LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2361                 else
2362                         err = -ENOTSUPP;
2363                 break;
2364
2365         case DISCOV_TYPE_INTERLEAVED:
2366                 if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
2367                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2368                                           LE_SCAN_WIN,
2369                                           LE_SCAN_TIMEOUT_BREDR_LE);
2370                 else
2371                         err = -ENOTSUPP;
2372                 break;
2373
2374         default:
2375                 err = -EINVAL;
2376         }
2377
2378         if (err < 0)
2379                 mgmt_pending_remove(cmd);
2380         else
2381                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2382
2383 failed:
2384         hci_dev_unlock(hdev);
2385         return err;
2386 }
2387
2388 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2389                           u16 len)
2390 {
2391         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2392         struct pending_cmd *cmd;
2393         struct hci_cp_remote_name_req_cancel cp;
2394         struct inquiry_entry *e;
2395         int err;
2396
2397         BT_DBG("%s", hdev->name);
2398
2399         hci_dev_lock(hdev);
2400
2401         if (!hci_discovery_active(hdev)) {
2402                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2403                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2404                                    sizeof(mgmt_cp->type));
2405                 goto unlock;
2406         }
2407
2408         if (hdev->discovery.type != mgmt_cp->type) {
2409                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2410                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2411                                    sizeof(mgmt_cp->type));
2412                 goto unlock;
2413         }
2414
2415         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2416         if (!cmd) {
2417                 err = -ENOMEM;
2418                 goto unlock;
2419         }
2420
2421         switch (hdev->discovery.state) {
2422         case DISCOVERY_FINDING:
2423                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2424                         err = hci_cancel_inquiry(hdev);
2425                 else
2426                         err = hci_cancel_le_scan(hdev);
2427
2428                 break;
2429
2430         case DISCOVERY_RESOLVING:
2431                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2432                                                      NAME_PENDING);
2433                 if (!e) {
2434                         mgmt_pending_remove(cmd);
2435                         err = cmd_complete(sk, hdev->id,
2436                                            MGMT_OP_STOP_DISCOVERY, 0,
2437                                            &mgmt_cp->type,
2438                                            sizeof(mgmt_cp->type));
2439                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2440                         goto unlock;
2441                 }
2442
2443                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2444                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2445                                    sizeof(cp), &cp);
2446
2447                 break;
2448
2449         default:
2450                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2451                 err = -EFAULT;
2452         }
2453
2454         if (err < 0)
2455                 mgmt_pending_remove(cmd);
2456         else
2457                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2458
2459 unlock:
2460         hci_dev_unlock(hdev);
2461         return err;
2462 }
2463
2464 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2465                         u16 len)
2466 {
2467         struct mgmt_cp_confirm_name *cp = data;
2468         struct inquiry_entry *e;
2469         int err;
2470
2471         BT_DBG("%s", hdev->name);
2472
2473         hci_dev_lock(hdev);
2474
2475         if (!hci_discovery_active(hdev)) {
2476                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2477                                  MGMT_STATUS_FAILED);
2478                 goto failed;
2479         }
2480
2481         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2482         if (!e) {
2483                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2484                                  MGMT_STATUS_INVALID_PARAMS);
2485                 goto failed;
2486         }
2487
2488         if (cp->name_known) {
2489                 e->name_state = NAME_KNOWN;
2490                 list_del(&e->list);
2491         } else {
2492                 e->name_state = NAME_NEEDED;
2493                 hci_inquiry_cache_update_resolve(hdev, e);
2494         }
2495
2496         err = 0;
2497
2498 failed:
2499         hci_dev_unlock(hdev);
2500         return err;
2501 }
2502
2503 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2504                         u16 len)
2505 {
2506         struct mgmt_cp_block_device *cp = data;
2507         u8 status;
2508         int err;
2509
2510         BT_DBG("%s", hdev->name);
2511
2512         hci_dev_lock(hdev);
2513
2514         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2515         if (err < 0)
2516                 status = MGMT_STATUS_FAILED;
2517         else
2518                 status = 0;
2519
2520         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2521                            &cp->addr, sizeof(cp->addr));
2522
2523         hci_dev_unlock(hdev);
2524
2525         return err;
2526 }
2527
2528 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2529                           u16 len)
2530 {
2531         struct mgmt_cp_unblock_device *cp = data;
2532         u8 status;
2533         int err;
2534
2535         BT_DBG("%s", hdev->name);
2536
2537         hci_dev_lock(hdev);
2538
2539         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2540         if (err < 0)
2541                 status = MGMT_STATUS_INVALID_PARAMS;
2542         else
2543                 status = 0;
2544
2545         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2546                            &cp->addr, sizeof(cp->addr));
2547
2548         hci_dev_unlock(hdev);
2549
2550         return err;
2551 }
2552
2553 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2554                          u16 len)
2555 {
2556         struct mgmt_cp_set_device_id *cp = data;
2557         int err;
2558         __u16 source;
2559
2560         BT_DBG("%s", hdev->name);
2561
2562         source = __le16_to_cpu(cp->source);
2563
2564         if (source > 0x0002)
2565                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2566                                   MGMT_STATUS_INVALID_PARAMS);
2567
2568         hci_dev_lock(hdev);
2569
2570         hdev->devid_source = source;
2571         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2572         hdev->devid_product = __le16_to_cpu(cp->product);
2573         hdev->devid_version = __le16_to_cpu(cp->version);
2574
2575         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2576
2577         update_eir(hdev);
2578
2579         hci_dev_unlock(hdev);
2580
2581         return err;
2582 }
2583
2584 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2585                                 void *data, u16 len)
2586 {
2587         struct mgmt_mode *cp = data;
2588         struct hci_cp_write_page_scan_activity acp;
2589         u8 type;
2590         int err;
2591
2592         BT_DBG("%s", hdev->name);
2593
2594         if (!lmp_bredr_capable(hdev))
2595                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2596                                   MGMT_STATUS_NOT_SUPPORTED);
2597
2598         if (!hdev_is_powered(hdev))
2599                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2600                                   MGMT_STATUS_NOT_POWERED);
2601
2602         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2603                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2604                                   MGMT_STATUS_REJECTED);
2605
2606         hci_dev_lock(hdev);
2607
2608         if (cp->val) {
2609                 type = PAGE_SCAN_TYPE_INTERLACED;
2610
2611                 /* 160 msec page scan interval */
2612                 acp.interval = __constant_cpu_to_le16(0x0100);
2613         } else {
2614                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2615
2616                 /* default 1.28 sec page scan */
2617                 acp.interval = __constant_cpu_to_le16(0x0800);
2618         }
2619
2620         /* default 11.25 msec page scan window */
2621         acp.window = __constant_cpu_to_le16(0x0012);
2622
2623         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2624                            &acp);
2625         if (err < 0) {
2626                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2627                                  MGMT_STATUS_FAILED);
2628                 goto done;
2629         }
2630
2631         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2632         if (err < 0) {
2633                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2634                                  MGMT_STATUS_FAILED);
2635                 goto done;
2636         }
2637
2638         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2639                            NULL, 0);
2640 done:
2641         hci_dev_unlock(hdev);
2642         return err;
2643 }
2644
2645 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2646                                void *cp_data, u16 len)
2647 {
2648         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2649         u16 key_count, expected_len;
2650         int i;
2651
2652         key_count = __le16_to_cpu(cp->key_count);
2653
2654         expected_len = sizeof(*cp) + key_count *
2655                                         sizeof(struct mgmt_ltk_info);
2656         if (expected_len != len) {
2657                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2658                        len, expected_len);
2659                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2660                                   EINVAL);
2661         }
2662
2663         BT_DBG("%s key_count %u", hdev->name, key_count);
2664
2665         hci_dev_lock(hdev);
2666
2667         hci_smp_ltks_clear(hdev);
2668
2669         for (i = 0; i < key_count; i++) {
2670                 struct mgmt_ltk_info *key = &cp->keys[i];
2671                 u8 type;
2672
2673                 if (key->master)
2674                         type = HCI_SMP_LTK;
2675                 else
2676                         type = HCI_SMP_LTK_SLAVE;
2677
2678                 hci_add_ltk(hdev, &key->addr.bdaddr,
2679                             bdaddr_to_le(key->addr.type),
2680                             type, 0, key->authenticated, key->val,
2681                             key->enc_size, key->ediv, key->rand);
2682         }
2683
2684         hci_dev_unlock(hdev);
2685
2686         return 0;
2687 }
2688
2689 static const struct mgmt_handler {
2690         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2691                      u16 data_len);
2692         bool var_len;
2693         size_t data_len;
2694 } mgmt_handlers[] = {
2695         { NULL }, /* 0x0000 (no command) */
2696         { read_version,           false, MGMT_READ_VERSION_SIZE },
2697         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
2698         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
2699         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
2700         { set_powered,            false, MGMT_SETTING_SIZE },
2701         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
2702         { set_connectable,        false, MGMT_SETTING_SIZE },
2703         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
2704         { set_pairable,           false, MGMT_SETTING_SIZE },
2705         { set_link_security,      false, MGMT_SETTING_SIZE },
2706         { set_ssp,                false, MGMT_SETTING_SIZE },
2707         { set_hs,                 false, MGMT_SETTING_SIZE },
2708         { set_le,                 false, MGMT_SETTING_SIZE },
2709         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
2710         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
2711         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
2712         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
2713         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
2714         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2715         { disconnect,             false, MGMT_DISCONNECT_SIZE },
2716         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
2717         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
2718         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2719         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
2720         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
2721         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2722         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
2723         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
2724         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2725         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
2726         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2727         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2728         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2729         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2730         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
2731         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
2732         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
2733         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
2734         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
2735         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
2736 };
2737
2738
2739 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2740 {
2741         void *buf;
2742         u8 *cp;
2743         struct mgmt_hdr *hdr;
2744         u16 opcode, index, len;
2745         struct hci_dev *hdev = NULL;
2746         const struct mgmt_handler *handler;
2747         int err;
2748
2749         BT_DBG("got %zu bytes", msglen);
2750
2751         if (msglen < sizeof(*hdr))
2752                 return -EINVAL;
2753
2754         buf = kmalloc(msglen, GFP_KERNEL);
2755         if (!buf)
2756                 return -ENOMEM;
2757
2758         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2759                 err = -EFAULT;
2760                 goto done;
2761         }
2762
2763         hdr = buf;
2764         opcode = __le16_to_cpu(hdr->opcode);
2765         index = __le16_to_cpu(hdr->index);
2766         len = __le16_to_cpu(hdr->len);
2767
2768         if (len != msglen - sizeof(*hdr)) {
2769                 err = -EINVAL;
2770                 goto done;
2771         }
2772
2773         if (index != MGMT_INDEX_NONE) {
2774                 hdev = hci_dev_get(index);
2775                 if (!hdev) {
2776                         err = cmd_status(sk, index, opcode,
2777                                          MGMT_STATUS_INVALID_INDEX);
2778                         goto done;
2779                 }
2780         }
2781
2782         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2783             mgmt_handlers[opcode].func == NULL) {
2784                 BT_DBG("Unknown op %u", opcode);
2785                 err = cmd_status(sk, index, opcode,
2786                                  MGMT_STATUS_UNKNOWN_COMMAND);
2787                 goto done;
2788         }
2789
2790         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2791             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2792                 err = cmd_status(sk, index, opcode,
2793                                  MGMT_STATUS_INVALID_INDEX);
2794                 goto done;
2795         }
2796
2797         handler = &mgmt_handlers[opcode];
2798
2799         if ((handler->var_len && len < handler->data_len) ||
2800             (!handler->var_len && len != handler->data_len)) {
2801                 err = cmd_status(sk, index, opcode,
2802                                  MGMT_STATUS_INVALID_PARAMS);
2803                 goto done;
2804         }
2805
2806         if (hdev)
2807                 mgmt_init_hdev(sk, hdev);
2808
2809         cp = buf + sizeof(*hdr);
2810
2811         err = handler->func(sk, hdev, cp, len);
2812         if (err < 0)
2813                 goto done;
2814
2815         err = msglen;
2816
2817 done:
2818         if (hdev)
2819                 hci_dev_put(hdev);
2820
2821         kfree(buf);
2822         return err;
2823 }
2824
2825 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2826 {
2827         u8 *status = data;
2828
2829         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2830         mgmt_pending_remove(cmd);
2831 }
2832
2833 int mgmt_index_added(struct hci_dev *hdev)
2834 {
2835         if (!mgmt_valid_hdev(hdev))
2836                 return -ENOTSUPP;
2837
2838         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2839 }
2840
2841 int mgmt_index_removed(struct hci_dev *hdev)
2842 {
2843         u8 status = MGMT_STATUS_INVALID_INDEX;
2844
2845         if (!mgmt_valid_hdev(hdev))
2846                 return -ENOTSUPP;
2847
2848         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2849
2850         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2851 }
2852
2853 struct cmd_lookup {
2854         struct sock *sk;
2855         struct hci_dev *hdev;
2856         u8 mgmt_status;
2857 };
2858
2859 static void settings_rsp(struct pending_cmd *cmd, void *data)
2860 {
2861         struct cmd_lookup *match = data;
2862
2863         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2864
2865         list_del(&cmd->list);
2866
2867         if (match->sk == NULL) {
2868                 match->sk = cmd->sk;
2869                 sock_hold(match->sk);
2870         }
2871
2872         mgmt_pending_free(cmd);
2873 }
2874
2875 static int set_bredr_scan(struct hci_dev *hdev)
2876 {
2877         u8 scan = 0;
2878
2879         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2880                 scan |= SCAN_PAGE;
2881         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2882                 scan |= SCAN_INQUIRY;
2883
2884         if (!scan)
2885                 return 0;
2886
2887         return hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2888 }
2889
2890 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2891 {
2892         struct cmd_lookup match = { NULL, hdev };
2893         int err;
2894
2895         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2896                 return 0;
2897
2898         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2899
2900         if (powered) {
2901                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
2902                     !lmp_host_ssp_capable(hdev)) {
2903                         u8 ssp = 1;
2904
2905                         hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
2906                 }
2907
2908                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2909                         struct hci_cp_write_le_host_supported cp;
2910
2911                         cp.le = 1;
2912                         cp.simul = lmp_le_br_capable(hdev);
2913
2914                         /* Check first if we already have the right
2915                          * host state (host features set)
2916                          */
2917                         if (cp.le != lmp_host_le_capable(hdev) ||
2918                             cp.simul != lmp_host_le_br_capable(hdev))
2919                                 hci_send_cmd(hdev,
2920                                              HCI_OP_WRITE_LE_HOST_SUPPORTED,
2921                                              sizeof(cp), &cp);
2922                 }
2923
2924                 if (lmp_bredr_capable(hdev)) {
2925                         set_bredr_scan(hdev);
2926                         update_class(hdev);
2927                         update_name(hdev, hdev->dev_name);
2928                         update_eir(hdev);
2929                 }
2930         } else {
2931                 u8 status = MGMT_STATUS_NOT_POWERED;
2932                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2933         }
2934
2935         err = new_settings(hdev, match.sk);
2936
2937         if (match.sk)
2938                 sock_put(match.sk);
2939
2940         return err;
2941 }
2942
2943 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2944 {
2945         struct cmd_lookup match = { NULL, hdev };
2946         bool changed = false;
2947         int err = 0;
2948
2949         if (discoverable) {
2950                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2951                         changed = true;
2952         } else {
2953                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2954                         changed = true;
2955         }
2956
2957         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
2958                              &match);
2959
2960         if (changed)
2961                 err = new_settings(hdev, match.sk);
2962
2963         if (match.sk)
2964                 sock_put(match.sk);
2965
2966         return err;
2967 }
2968
2969 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2970 {
2971         struct cmd_lookup match = { NULL, hdev };
2972         bool changed = false;
2973         int err = 0;
2974
2975         if (connectable) {
2976                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2977                         changed = true;
2978         } else {
2979                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2980                         changed = true;
2981         }
2982
2983         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
2984                              &match);
2985
2986         if (changed)
2987                 err = new_settings(hdev, match.sk);
2988
2989         if (match.sk)
2990                 sock_put(match.sk);
2991
2992         return err;
2993 }
2994
2995 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2996 {
2997         u8 mgmt_err = mgmt_status(status);
2998
2999         if (scan & SCAN_PAGE)
3000                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3001                                      cmd_status_rsp, &mgmt_err);
3002
3003         if (scan & SCAN_INQUIRY)
3004                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3005                                      cmd_status_rsp, &mgmt_err);
3006
3007         return 0;
3008 }
3009
3010 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3011                       bool persistent)
3012 {
3013         struct mgmt_ev_new_link_key ev;
3014
3015         memset(&ev, 0, sizeof(ev));
3016
3017         ev.store_hint = persistent;
3018         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3019         ev.key.addr.type = BDADDR_BREDR;
3020         ev.key.type = key->type;
3021         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3022         ev.key.pin_len = key->pin_len;
3023
3024         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3025 }
3026
3027 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3028 {
3029         struct mgmt_ev_new_long_term_key ev;
3030
3031         memset(&ev, 0, sizeof(ev));
3032
3033         ev.store_hint = persistent;
3034         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3035         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3036         ev.key.authenticated = key->authenticated;
3037         ev.key.enc_size = key->enc_size;
3038         ev.key.ediv = key->ediv;
3039
3040         if (key->type == HCI_SMP_LTK)
3041                 ev.key.master = 1;
3042
3043         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3044         memcpy(ev.key.val, key->val, sizeof(key->val));
3045
3046         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3047                           NULL);
3048 }
3049
3050 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3051                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3052                           u8 *dev_class)
3053 {
3054         char buf[512];
3055         struct mgmt_ev_device_connected *ev = (void *) buf;
3056         u16 eir_len = 0;
3057
3058         bacpy(&ev->addr.bdaddr, bdaddr);
3059         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3060
3061         ev->flags = __cpu_to_le32(flags);
3062
3063         if (name_len > 0)
3064                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3065                                           name, name_len);
3066
3067         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3068                 eir_len = eir_append_data(ev->eir, eir_len,
3069                                           EIR_CLASS_OF_DEV, dev_class, 3);
3070
3071         ev->eir_len = cpu_to_le16(eir_len);
3072
3073         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3074                           sizeof(*ev) + eir_len, NULL);
3075 }
3076
3077 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3078 {
3079         struct mgmt_cp_disconnect *cp = cmd->param;
3080         struct sock **sk = data;
3081         struct mgmt_rp_disconnect rp;
3082
3083         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3084         rp.addr.type = cp->addr.type;
3085
3086         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3087                      sizeof(rp));
3088
3089         *sk = cmd->sk;
3090         sock_hold(*sk);
3091
3092         mgmt_pending_remove(cmd);
3093 }
3094
3095 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3096 {
3097         struct hci_dev *hdev = data;
3098         struct mgmt_cp_unpair_device *cp = cmd->param;
3099         struct mgmt_rp_unpair_device rp;
3100
3101         memset(&rp, 0, sizeof(rp));
3102         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3103         rp.addr.type = cp->addr.type;
3104
3105         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3106
3107         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3108
3109         mgmt_pending_remove(cmd);
3110 }
3111
3112 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3113                              u8 link_type, u8 addr_type, u8 reason)
3114 {
3115         struct mgmt_ev_device_disconnected ev;
3116         struct sock *sk = NULL;
3117         int err;
3118
3119         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3120
3121         bacpy(&ev.addr.bdaddr, bdaddr);
3122         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3123         ev.reason = reason;
3124
3125         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3126                          sk);
3127
3128         if (sk)
3129                 sock_put(sk);
3130
3131         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3132                              hdev);
3133
3134         return err;
3135 }
3136
3137 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3138                            u8 link_type, u8 addr_type, u8 status)
3139 {
3140         struct mgmt_rp_disconnect rp;
3141         struct pending_cmd *cmd;
3142         int err;
3143
3144         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3145                              hdev);
3146
3147         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3148         if (!cmd)
3149                 return -ENOENT;
3150
3151         bacpy(&rp.addr.bdaddr, bdaddr);
3152         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3153
3154         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3155                            mgmt_status(status), &rp, sizeof(rp));
3156
3157         mgmt_pending_remove(cmd);
3158
3159         return err;
3160 }
3161
3162 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3163                         u8 addr_type, u8 status)
3164 {
3165         struct mgmt_ev_connect_failed ev;
3166
3167         bacpy(&ev.addr.bdaddr, bdaddr);
3168         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3169         ev.status = mgmt_status(status);
3170
3171         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3172 }
3173
3174 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3175 {
3176         struct mgmt_ev_pin_code_request ev;
3177
3178         bacpy(&ev.addr.bdaddr, bdaddr);
3179         ev.addr.type = BDADDR_BREDR;
3180         ev.secure = secure;
3181
3182         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3183                           NULL);
3184 }
3185
3186 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3187                                  u8 status)
3188 {
3189         struct pending_cmd *cmd;
3190         struct mgmt_rp_pin_code_reply rp;
3191         int err;
3192
3193         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3194         if (!cmd)
3195                 return -ENOENT;
3196
3197         bacpy(&rp.addr.bdaddr, bdaddr);
3198         rp.addr.type = BDADDR_BREDR;
3199
3200         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3201                            mgmt_status(status), &rp, sizeof(rp));
3202
3203         mgmt_pending_remove(cmd);
3204
3205         return err;
3206 }
3207
3208 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3209                                      u8 status)
3210 {
3211         struct pending_cmd *cmd;
3212         struct mgmt_rp_pin_code_reply rp;
3213         int err;
3214
3215         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3216         if (!cmd)
3217                 return -ENOENT;
3218
3219         bacpy(&rp.addr.bdaddr, bdaddr);
3220         rp.addr.type = BDADDR_BREDR;
3221
3222         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3223                            mgmt_status(status), &rp, sizeof(rp));
3224
3225         mgmt_pending_remove(cmd);
3226
3227         return err;
3228 }
3229
3230 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3231                               u8 link_type, u8 addr_type, __le32 value,
3232                               u8 confirm_hint)
3233 {
3234         struct mgmt_ev_user_confirm_request ev;
3235
3236         BT_DBG("%s", hdev->name);
3237
3238         bacpy(&ev.addr.bdaddr, bdaddr);
3239         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3240         ev.confirm_hint = confirm_hint;
3241         ev.value = value;
3242
3243         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3244                           NULL);
3245 }
3246
3247 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3248                               u8 link_type, u8 addr_type)
3249 {
3250         struct mgmt_ev_user_passkey_request ev;
3251
3252         BT_DBG("%s", hdev->name);
3253
3254         bacpy(&ev.addr.bdaddr, bdaddr);
3255         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3256
3257         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3258                           NULL);
3259 }
3260
3261 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3262                                       u8 link_type, u8 addr_type, u8 status,
3263                                       u8 opcode)
3264 {
3265         struct pending_cmd *cmd;
3266         struct mgmt_rp_user_confirm_reply rp;
3267         int err;
3268
3269         cmd = mgmt_pending_find(opcode, hdev);
3270         if (!cmd)
3271                 return -ENOENT;
3272
3273         bacpy(&rp.addr.bdaddr, bdaddr);
3274         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3275         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3276                            &rp, sizeof(rp));
3277
3278         mgmt_pending_remove(cmd);
3279
3280         return err;
3281 }
3282
3283 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3284                                      u8 link_type, u8 addr_type, u8 status)
3285 {
3286         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3287                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3288 }
3289
3290 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3291                                          u8 link_type, u8 addr_type, u8 status)
3292 {
3293         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3294                                           status,
3295                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3296 }
3297
3298 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3299                                      u8 link_type, u8 addr_type, u8 status)
3300 {
3301         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3302                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3303 }
3304
3305 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3306                                          u8 link_type, u8 addr_type, u8 status)
3307 {
3308         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3309                                           status,
3310                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3311 }
3312
3313 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3314                              u8 link_type, u8 addr_type, u32 passkey,
3315                              u8 entered)
3316 {
3317         struct mgmt_ev_passkey_notify ev;
3318
3319         BT_DBG("%s", hdev->name);
3320
3321         bacpy(&ev.addr.bdaddr, bdaddr);
3322         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3323         ev.passkey = __cpu_to_le32(passkey);
3324         ev.entered = entered;
3325
3326         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3327 }
3328
3329 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3330                      u8 addr_type, u8 status)
3331 {
3332         struct mgmt_ev_auth_failed ev;
3333
3334         bacpy(&ev.addr.bdaddr, bdaddr);
3335         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3336         ev.status = mgmt_status(status);
3337
3338         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3339 }
3340
3341 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3342 {
3343         struct cmd_lookup match = { NULL, hdev };
3344         bool changed = false;
3345         int err = 0;
3346
3347         if (status) {
3348                 u8 mgmt_err = mgmt_status(status);
3349                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3350                                      cmd_status_rsp, &mgmt_err);
3351                 return 0;
3352         }
3353
3354         if (test_bit(HCI_AUTH, &hdev->flags)) {
3355                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3356                         changed = true;
3357         } else {
3358                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3359                         changed = true;
3360         }
3361
3362         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3363                              &match);
3364
3365         if (changed)
3366                 err = new_settings(hdev, match.sk);
3367
3368         if (match.sk)
3369                 sock_put(match.sk);
3370
3371         return err;
3372 }
3373
3374 static int clear_eir(struct hci_dev *hdev)
3375 {
3376         struct hci_cp_write_eir cp;
3377
3378         if (!lmp_ext_inq_capable(hdev))
3379                 return 0;
3380
3381         memset(hdev->eir, 0, sizeof(hdev->eir));
3382
3383         memset(&cp, 0, sizeof(cp));
3384
3385         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3386 }
3387
3388 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3389 {
3390         struct cmd_lookup match = { NULL, hdev };
3391         bool changed = false;
3392         int err = 0;
3393
3394         if (status) {
3395                 u8 mgmt_err = mgmt_status(status);
3396
3397                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3398                                                  &hdev->dev_flags))
3399                         err = new_settings(hdev, NULL);
3400
3401                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3402                                      &mgmt_err);
3403
3404                 return err;
3405         }
3406
3407         if (enable) {
3408                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3409                         changed = true;
3410         } else {
3411                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3412                         changed = true;
3413         }
3414
3415         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3416
3417         if (changed)
3418                 err = new_settings(hdev, match.sk);
3419
3420         if (match.sk)
3421                 sock_put(match.sk);
3422
3423         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3424                 update_eir(hdev);
3425         else
3426                 clear_eir(hdev);
3427
3428         return err;
3429 }
3430
3431 static void class_rsp(struct pending_cmd *cmd, void *data)
3432 {
3433         struct cmd_lookup *match = data;
3434
3435         cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3436                      match->hdev->dev_class, 3);
3437
3438         list_del(&cmd->list);
3439
3440         if (match->sk == NULL) {
3441                 match->sk = cmd->sk;
3442                 sock_hold(match->sk);
3443         }
3444
3445         mgmt_pending_free(cmd);
3446 }
3447
3448 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3449                                    u8 status)
3450 {
3451         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3452         int err = 0;
3453
3454         clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3455
3456         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3457         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3458         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3459
3460         if (!status)
3461                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3462                                  3, NULL);
3463
3464         if (match.sk)
3465                 sock_put(match.sk);
3466
3467         return err;
3468 }
3469
3470 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3471 {
3472         struct pending_cmd *cmd;
3473         struct mgmt_cp_set_local_name ev;
3474         bool changed = false;
3475         int err = 0;
3476
3477         if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3478                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3479                 changed = true;
3480         }
3481
3482         memset(&ev, 0, sizeof(ev));
3483         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3484         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3485
3486         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3487         if (!cmd)
3488                 goto send_event;
3489
3490         /* Always assume that either the short or the complete name has
3491          * changed if there was a pending mgmt command */
3492         changed = true;
3493
3494         if (status) {
3495                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3496                                  mgmt_status(status));
3497                 goto failed;
3498         }
3499
3500         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3501                            sizeof(ev));
3502         if (err < 0)
3503                 goto failed;
3504
3505 send_event:
3506         if (changed)
3507                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3508                                  sizeof(ev), cmd ? cmd->sk : NULL);
3509
3510         /* EIR is taken care of separately when powering on the
3511          * adapter so only update them here if this is a name change
3512          * unrelated to power on.
3513          */
3514         if (!test_bit(HCI_INIT, &hdev->flags))
3515                 update_eir(hdev);
3516
3517 failed:
3518         if (cmd)
3519                 mgmt_pending_remove(cmd);
3520         return err;
3521 }
3522
3523 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3524                                             u8 *randomizer, u8 status)
3525 {
3526         struct pending_cmd *cmd;
3527         int err;
3528
3529         BT_DBG("%s status %u", hdev->name, status);
3530
3531         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3532         if (!cmd)
3533                 return -ENOENT;
3534
3535         if (status) {
3536                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3537                                  mgmt_status(status));
3538         } else {
3539                 struct mgmt_rp_read_local_oob_data rp;
3540
3541                 memcpy(rp.hash, hash, sizeof(rp.hash));
3542                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3543
3544                 err = cmd_complete(cmd->sk, hdev->id,
3545                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3546                                    sizeof(rp));
3547         }
3548
3549         mgmt_pending_remove(cmd);
3550
3551         return err;
3552 }
3553
3554 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3555 {
3556         struct cmd_lookup match = { NULL, hdev };
3557         bool changed = false;
3558         int err = 0;
3559
3560         if (status) {
3561                 u8 mgmt_err = mgmt_status(status);
3562
3563                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3564                                                  &hdev->dev_flags))
3565                         err = new_settings(hdev, NULL);
3566
3567                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3568                                      &mgmt_err);
3569
3570                 return err;
3571         }
3572
3573         if (enable) {
3574                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3575                         changed = true;
3576         } else {
3577                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3578                         changed = true;
3579         }
3580
3581         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3582
3583         if (changed)
3584                 err = new_settings(hdev, match.sk);
3585
3586         if (match.sk)
3587                 sock_put(match.sk);
3588
3589         return err;
3590 }
3591
3592 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3593                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3594                       ssp, u8 *eir, u16 eir_len)
3595 {
3596         char buf[512];
3597         struct mgmt_ev_device_found *ev = (void *) buf;
3598         size_t ev_size;
3599
3600         /* Leave 5 bytes for a potential CoD field */
3601         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3602                 return -EINVAL;
3603
3604         memset(buf, 0, sizeof(buf));
3605
3606         bacpy(&ev->addr.bdaddr, bdaddr);
3607         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3608         ev->rssi = rssi;
3609         if (cfm_name)
3610                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
3611         if (!ssp)
3612                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
3613
3614         if (eir_len > 0)
3615                 memcpy(ev->eir, eir, eir_len);
3616
3617         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3618                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3619                                           dev_class, 3);
3620
3621         ev->eir_len = cpu_to_le16(eir_len);
3622         ev_size = sizeof(*ev) + eir_len;
3623
3624         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3625 }
3626
3627 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3628                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3629 {
3630         struct mgmt_ev_device_found *ev;
3631         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3632         u16 eir_len;
3633
3634         ev = (struct mgmt_ev_device_found *) buf;
3635
3636         memset(buf, 0, sizeof(buf));
3637
3638         bacpy(&ev->addr.bdaddr, bdaddr);
3639         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3640         ev->rssi = rssi;
3641
3642         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3643                                   name_len);
3644
3645         ev->eir_len = cpu_to_le16(eir_len);
3646
3647         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3648                           sizeof(*ev) + eir_len, NULL);
3649 }
3650
3651 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3652 {
3653         struct pending_cmd *cmd;
3654         u8 type;
3655         int err;
3656
3657         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3658
3659         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3660         if (!cmd)
3661                 return -ENOENT;
3662
3663         type = hdev->discovery.type;
3664
3665         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3666                            &type, sizeof(type));
3667         mgmt_pending_remove(cmd);
3668
3669         return err;
3670 }
3671
3672 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3673 {
3674         struct pending_cmd *cmd;
3675         int err;
3676
3677         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3678         if (!cmd)
3679                 return -ENOENT;
3680
3681         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3682                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3683         mgmt_pending_remove(cmd);
3684
3685         return err;
3686 }
3687
3688 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3689 {
3690         struct mgmt_ev_discovering ev;
3691         struct pending_cmd *cmd;
3692
3693         BT_DBG("%s discovering %u", hdev->name, discovering);
3694
3695         if (discovering)
3696                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3697         else
3698                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3699
3700         if (cmd != NULL) {
3701                 u8 type = hdev->discovery.type;
3702
3703                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3704                              sizeof(type));
3705                 mgmt_pending_remove(cmd);
3706         }
3707
3708         memset(&ev, 0, sizeof(ev));
3709         ev.type = hdev->discovery.type;
3710         ev.discovering = discovering;
3711
3712         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3713 }
3714
3715 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3716 {
3717         struct pending_cmd *cmd;
3718         struct mgmt_ev_device_blocked ev;
3719
3720         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3721
3722         bacpy(&ev.addr.bdaddr, bdaddr);
3723         ev.addr.type = type;
3724
3725         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3726                           cmd ? cmd->sk : NULL);
3727 }
3728
3729 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3730 {
3731         struct pending_cmd *cmd;
3732         struct mgmt_ev_device_unblocked ev;
3733
3734         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3735
3736         bacpy(&ev.addr.bdaddr, bdaddr);
3737         ev.addr.type = type;
3738
3739         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3740                           cmd ? cmd->sk : NULL);
3741 }
3742
3743 module_param(enable_hs, bool, 0644);
3744 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");