net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   2
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 /*
 106  * These LE scan and inquiry parameters were chosen according to LE General
 107  * Discovery Procedure specification.
 108  */
 109 #define LE_SCAN_TYPE                    0x01
 110 #define LE_SCAN_WIN                     0x12
 111 #define LE_SCAN_INT                     0x12
 112 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 113 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 114
 115 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 116 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 117
 118 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 119
 120 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 121                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 122
 123 struct pending_cmd {
 124         struct list_head list;
 125         u16 opcode;
 126         int index;
 127         void *param;
 128         struct sock *sk;
 129         void *user_data;
 130 };
 131
 132 /* HCI to MGMT error code conversion table */
 133 static u8 mgmt_status_table[] = {
 134         MGMT_STATUS_SUCCESS,
 135         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 136         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 137         MGMT_STATUS_FAILED,             /* Hardware Failure */
 138         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 139         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 140         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 141         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 142         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 145         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 146         MGMT_STATUS_BUSY,               /* Command Disallowed */
 147         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 148         MGMT_STATUS_REJECTED,           /* Rejected Security */
 149         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 150         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 151         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 153         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 154         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 155         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 156         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 157         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 158         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 159         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 161         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 162         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 163         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 165         MGMT_STATUS_FAILED,             /* Unspecified Error */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 167         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 168         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 169         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 170         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 171         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 172         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 174         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 176         MGMT_STATUS_FAILED,             /* Transaction Collision */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 178         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 180         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 181         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 182         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 183         MGMT_STATUS_FAILED,             /* Slot Violation */
 184         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 185         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 187         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 188         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 189         MGMT_STATUS_BUSY,               /* Controller Busy */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 191         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 192         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 193         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 194         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 195 };
 196
 197 bool mgmt_valid_hdev(struct hci_dev *hdev)
 198 {
 199         return hdev->dev_type == HCI_BREDR;
 200 }
 201
 202 static u8 mgmt_status(u8 hci_status)
 203 {
 204         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 205                 return mgmt_status_table[hci_status];
 206
 207         return MGMT_STATUS_FAILED;
 208 }
 209
 210 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 211 {
 212         struct sk_buff *skb;
 213         struct mgmt_hdr *hdr;
 214         struct mgmt_ev_cmd_status *ev;
 215         int err;
 216
 217         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 218
 219         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 220         if (!skb)
 221                 return -ENOMEM;
 222
 223         hdr = (void *) skb_put(skb, sizeof(*hdr));
 224
 225         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 226         hdr->index = cpu_to_le16(index);
 227         hdr->len = cpu_to_le16(sizeof(*ev));
 228
 229         ev = (void *) skb_put(skb, sizeof(*ev));
 230         ev->status = status;
 231         ev->opcode = cpu_to_le16(cmd);
 232
 233         err = sock_queue_rcv_skb(sk, skb);
 234         if (err < 0)
 235                 kfree_skb(skb);
 236
 237         return err;
 238 }
 239
 240 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 241                         void *rp, size_t rp_len)
 242 {
 243         struct sk_buff *skb;
 244         struct mgmt_hdr *hdr;
 245         struct mgmt_ev_cmd_complete *ev;
 246         int err;
 247
 248         BT_DBG("sock %p", sk);
 249
 250         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 251         if (!skb)
 252                 return -ENOMEM;
 253
 254         hdr = (void *) skb_put(skb, sizeof(*hdr));
 255
 256         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 257         hdr->index = cpu_to_le16(index);
 258         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 259
 260         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 261         ev->opcode = cpu_to_le16(cmd);
 262         ev->status = status;
 263
 264         if (rp)
 265                 memcpy(ev->data, rp, rp_len);
 266
 267         err = sock_queue_rcv_skb(sk, skb);
 268         if (err < 0)
 269                 kfree_skb(skb);
 270
 271         return err;
 272 }
 273
 274 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 275                         u16 data_len)
 276 {
 277         struct mgmt_rp_read_version rp;
 278
 279         BT_DBG("sock %p", sk);
 280
 281         rp.version = MGMT_VERSION;
 282         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 283
 284         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 285                             sizeof(rp));
 286 }
 287
 288 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 289                          u16 data_len)
 290 {
 291         struct mgmt_rp_read_commands *rp;
 292         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 293         const u16 num_events = ARRAY_SIZE(mgmt_events);
 294         __le16 *opcode;
 295         size_t rp_size;
 296         int i, err;
 297
 298         BT_DBG("sock %p", sk);
 299
 300         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 301
 302         rp = kmalloc(rp_size, GFP_KERNEL);
 303         if (!rp)
 304                 return -ENOMEM;
 305
 306         rp->num_commands = __constant_cpu_to_le16(num_commands);
 307         rp->num_events = __constant_cpu_to_le16(num_events);
 308
 309         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 310                 put_unaligned_le16(mgmt_commands[i], opcode);
 311
 312         for (i = 0; i < num_events; i++, opcode++)
 313                 put_unaligned_le16(mgmt_events[i], opcode);
 314
 315         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 316                            rp_size);
 317         kfree(rp);
 318
 319         return err;
 320 }
 321
 322 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 323                            u16 data_len)
 324 {
 325         struct mgmt_rp_read_index_list *rp;
 326         struct hci_dev *d;
 327         size_t rp_len;
 328         u16 count;
 329         int err;
 330
 331         BT_DBG("sock %p", sk);
 332
 333         read_lock(&hci_dev_list_lock);
 334
 335         count = 0;
 336         list_for_each_entry(d, &hci_dev_list, list) {
 337                 if (!mgmt_valid_hdev(d))
 338                         continue;
 339
 340                 count++;
 341         }
 342
 343         rp_len = sizeof(*rp) + (2 * count);
 344         rp = kmalloc(rp_len, GFP_ATOMIC);
 345         if (!rp) {
 346                 read_unlock(&hci_dev_list_lock);
 347                 return -ENOMEM;
 348         }
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (test_bit(HCI_SETUP, &d->dev_flags))
 353                         continue;
 354
 355                 if (!mgmt_valid_hdev(d))
 356                         continue;
 357
 358                 rp->index[count++] = cpu_to_le16(d->id);
 359                 BT_DBG("Added hci%u", d->id);
 360         }
 361
 362         rp->num_controllers = cpu_to_le16(count);
 363         rp_len = sizeof(*rp) + (2 * count);
 364
 365         read_unlock(&hci_dev_list_lock);
 366
 367         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 368                            rp_len);
 369
 370         kfree(rp);
 371
 372         return err;
 373 }
 374
 375 static u32 get_supported_settings(struct hci_dev *hdev)
 376 {
 377         u32 settings = 0;
 378
 379         settings |= MGMT_SETTING_POWERED;
 380         settings |= MGMT_SETTING_PAIRABLE;
 381
 382         if (lmp_ssp_capable(hdev))
 383                 settings |= MGMT_SETTING_SSP;
 384
 385         if (lmp_bredr_capable(hdev)) {
 386                 settings |= MGMT_SETTING_CONNECTABLE;
 387                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 388                 settings |= MGMT_SETTING_DISCOVERABLE;
 389                 settings |= MGMT_SETTING_BREDR;
 390                 settings |= MGMT_SETTING_LINK_SECURITY;
 391         }
 392
 393         if (enable_hs)
 394                 settings |= MGMT_SETTING_HS;
 395
 396         if (lmp_le_capable(hdev))
 397                 settings |= MGMT_SETTING_LE;
 398
 399         return settings;
 400 }
 401
 402 static u32 get_current_settings(struct hci_dev *hdev)
 403 {
 404         u32 settings = 0;
 405
 406         if (hdev_is_powered(hdev))
 407                 settings |= MGMT_SETTING_POWERED;
 408
 409         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 410                 settings |= MGMT_SETTING_CONNECTABLE;
 411
 412         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 413                 settings |= MGMT_SETTING_DISCOVERABLE;
 414
 415         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 416                 settings |= MGMT_SETTING_PAIRABLE;
 417
 418         if (lmp_bredr_capable(hdev))
 419                 settings |= MGMT_SETTING_BREDR;
 420
 421         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 422                 settings |= MGMT_SETTING_LE;
 423
 424         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 425                 settings |= MGMT_SETTING_LINK_SECURITY;
 426
 427         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 428                 settings |= MGMT_SETTING_SSP;
 429
 430         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 431                 settings |= MGMT_SETTING_HS;
 432
 433         return settings;
 434 }
 435
 436 #define PNP_INFO_SVCLASS_ID             0x1200
 437
 438 static void create_eir(struct hci_dev *hdev, u8 *data)
 439 {
 440         u8 *ptr = data;
 441         u8 *uuids_start;
 442         struct bt_uuid *uuid;
 443         size_t name_len;
 444
 445         name_len = strlen(hdev->dev_name);
 446
 447         if (name_len > 0) {
 448                 /* EIR Data type */
 449                 if (name_len > 48) {
 450                         name_len = 48;
 451                         ptr[1] = EIR_NAME_SHORT;
 452                 } else
 453                         ptr[1] = EIR_NAME_COMPLETE;
 454
 455                 /* EIR Data length */
 456                 ptr[0] = name_len + 1;
 457
 458                 memcpy(ptr + 2, hdev->dev_name, name_len);
 459
 460                 ptr += (name_len + 2);
 461         }
 462
 463         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 464                 ptr[0] = 2;
 465                 ptr[1] = EIR_TX_POWER;
 466                 ptr[2] = (u8) hdev->inq_tx_power;
 467
 468                 ptr += 3;
 469         }
 470
 471         if (hdev->devid_source > 0) {
 472                 ptr[0] = 9;
 473                 ptr[1] = EIR_DEVICE_ID;
 474
 475                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 476                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 477                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 478                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 479
 480                 ptr += 10;
 481         }
 482
 483         uuids_start = NULL;
 484
 485         /* Group all UUID16 types */
 486         list_for_each_entry(uuid, &hdev->uuids, list) {
 487                 u16 uuid16;
 488
 489                 if (uuid->size != 16)
 490                         continue;
 491
 492                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 493                 if (uuid16 < 0x1100)
 494                         continue;
 495
 496                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 497                         continue;
 498
 499                 if (!uuids_start) {
 500                         uuids_start = ptr;
 501                         uuids_start[0] = 1;
 502                         uuids_start[1] = EIR_UUID16_ALL;
 503                         ptr += 2;
 504                 }
 505
 506                 /* Stop if not enough space to put next UUID */
 507                 if ((ptr - data) + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 508                         uuids_start[1] = EIR_UUID16_SOME;
 509                         break;
 510                 }
 511
 512                 *ptr++ = (uuid16 & 0x00ff);
 513                 *ptr++ = (uuid16 & 0xff00) >> 8;
 514                 uuids_start[0] += sizeof(uuid16);
 515         }
 516 }
 517
 518 static int update_eir(struct hci_dev *hdev)
 519 {
 520         struct hci_cp_write_eir cp;
 521
 522         if (!hdev_is_powered(hdev))
 523                 return 0;
 524
 525         if (!lmp_ext_inq_capable(hdev))
 526                 return 0;
 527
 528         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 529                 return 0;
 530
 531         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 532                 return 0;
 533
 534         memset(&cp, 0, sizeof(cp));
 535
 536         create_eir(hdev, cp.data);
 537
 538         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 539                 return 0;
 540
 541         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 542
 543         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 544 }
 545
 546 static u8 get_service_classes(struct hci_dev *hdev)
 547 {
 548         struct bt_uuid *uuid;
 549         u8 val = 0;
 550
 551         list_for_each_entry(uuid, &hdev->uuids, list)
 552                 val |= uuid->svc_hint;
 553
 554         return val;
 555 }
 556
 557 static int update_class(struct hci_dev *hdev)
 558 {
 559         u8 cod[3];
 560         int err;
 561
 562         BT_DBG("%s", hdev->name);
 563
 564         if (!hdev_is_powered(hdev))
 565                 return 0;
 566
 567         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 568                 return 0;
 569
 570         cod[0] = hdev->minor_class;
 571         cod[1] = hdev->major_class;
 572         cod[2] = get_service_classes(hdev);
 573
 574         if (memcmp(cod, hdev->dev_class, 3) == 0)
 575                 return 0;
 576
 577         err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 578         if (err == 0)
 579                 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
 580
 581         return err;
 582 }
 583
 584 static void service_cache_off(struct work_struct *work)
 585 {
 586         struct hci_dev *hdev = container_of(work, struct hci_dev,
 587                                             service_cache.work);
 588
 589         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 590                 return;
 591
 592         hci_dev_lock(hdev);
 593
 594         update_eir(hdev);
 595         update_class(hdev);
 596
 597         hci_dev_unlock(hdev);
 598 }
 599
 600 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 601 {
 602         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 603                 return;
 604
 605         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 606
 607         /* Non-mgmt controlled devices get this bit set
 608          * implicitly so that pairing works for them, however
 609          * for mgmt we require user-space to explicitly enable
 610          * it
 611          */
 612         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 613 }
 614
 615 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 616                                 void *data, u16 data_len)
 617 {
 618         struct mgmt_rp_read_info rp;
 619
 620         BT_DBG("sock %p %s", sk, hdev->name);
 621
 622         hci_dev_lock(hdev);
 623
 624         memset(&rp, 0, sizeof(rp));
 625
 626         bacpy(&rp.bdaddr, &hdev->bdaddr);
 627
 628         rp.version = hdev->hci_ver;
 629         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 630
 631         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 632         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 633
 634         memcpy(rp.dev_class, hdev->dev_class, 3);
 635
 636         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 637         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 638
 639         hci_dev_unlock(hdev);
 640
 641         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 642                             sizeof(rp));
 643 }
 644
 645 static void mgmt_pending_free(struct pending_cmd *cmd)
 646 {
 647         sock_put(cmd->sk);
 648         kfree(cmd->param);
 649         kfree(cmd);
 650 }
 651
 652 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 653                                             struct hci_dev *hdev, void *data,
 654                                             u16 len)
 655 {
 656         struct pending_cmd *cmd;
 657
 658         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 659         if (!cmd)
 660                 return NULL;
 661
 662         cmd->opcode = opcode;
 663         cmd->index = hdev->id;
 664
 665         cmd->param = kmalloc(len, GFP_KERNEL);
 666         if (!cmd->param) {
 667                 kfree(cmd);
 668                 return NULL;
 669         }
 670
 671         if (data)
 672                 memcpy(cmd->param, data, len);
 673
 674         cmd->sk = sk;
 675         sock_hold(sk);
 676
 677         list_add(&cmd->list, &hdev->mgmt_pending);
 678
 679         return cmd;
 680 }
 681
 682 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 683                                  void (*cb)(struct pending_cmd *cmd,
 684                                             void *data),
 685                                  void *data)
 686 {
 687         struct list_head *p, *n;
 688
 689         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 690                 struct pending_cmd *cmd;
 691
 692                 cmd = list_entry(p, struct pending_cmd, list);
 693
 694                 if (opcode > 0 && cmd->opcode != opcode)
 695                         continue;
 696
 697                 cb(cmd, data);
 698         }
 699 }
 700
 701 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 702 {
 703         struct pending_cmd *cmd;
 704
 705         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 706                 if (cmd->opcode == opcode)
 707                         return cmd;
 708         }
 709
 710         return NULL;
 711 }
 712
 713 static void mgmt_pending_remove(struct pending_cmd *cmd)
 714 {
 715         list_del(&cmd->list);
 716         mgmt_pending_free(cmd);
 717 }
 718
 719 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 720 {
 721         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 722
 723         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 724                             sizeof(settings));
 725 }
 726
 727 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 728                        u16 len)
 729 {
 730         struct mgmt_mode *cp = data;
 731         struct pending_cmd *cmd;
 732         int err;
 733
 734         BT_DBG("request for %s", hdev->name);
 735
 736         if (cp->val != 0x00 && cp->val != 0x01)
 737                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 738                                   MGMT_STATUS_INVALID_PARAMS);
 739
 740         hci_dev_lock(hdev);
 741
 742         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 743                 cancel_delayed_work(&hdev->power_off);
 744
 745                 if (cp->val) {
 746                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 747                                          data, len);
 748                         err = mgmt_powered(hdev, 1);
 749                         goto failed;
 750                 }
 751         }
 752
 753         if (!!cp->val == hdev_is_powered(hdev)) {
 754                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 755                 goto failed;
 756         }
 757
 758         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 759                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 760                                  MGMT_STATUS_BUSY);
 761                 goto failed;
 762         }
 763
 764         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 765         if (!cmd) {
 766                 err = -ENOMEM;
 767                 goto failed;
 768         }
 769
 770         if (cp->val)
 771                 queue_work(hdev->req_workqueue, &hdev->power_on);
 772         else
 773                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 774
 775         err = 0;
 776
 777 failed:
 778         hci_dev_unlock(hdev);
 779         return err;
 780 }
 781
 782 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 783                       struct sock *skip_sk)
 784 {
 785         struct sk_buff *skb;
 786         struct mgmt_hdr *hdr;
 787
 788         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 789         if (!skb)
 790                 return -ENOMEM;
 791
 792         hdr = (void *) skb_put(skb, sizeof(*hdr));
 793         hdr->opcode = cpu_to_le16(event);
 794         if (hdev)
 795                 hdr->index = cpu_to_le16(hdev->id);
 796         else
 797                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 798         hdr->len = cpu_to_le16(data_len);
 799
 800         if (data)
 801                 memcpy(skb_put(skb, data_len), data, data_len);
 802
 803         /* Time stamp */
 804         __net_timestamp(skb);
 805
 806         hci_send_to_control(skb, skip_sk);
 807         kfree_skb(skb);
 808
 809         return 0;
 810 }
 811
 812 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 813 {
 814         __le32 ev;
 815
 816         ev = cpu_to_le32(get_current_settings(hdev));
 817
 818         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 819 }
 820
 821 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 822                             u16 len)
 823 {
 824         struct mgmt_cp_set_discoverable *cp = data;
 825         struct pending_cmd *cmd;
 826         u16 timeout;
 827         u8 scan;
 828         int err;
 829
 830         BT_DBG("request for %s", hdev->name);
 831
 832         if (!lmp_bredr_capable(hdev))
 833                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 834                                  MGMT_STATUS_NOT_SUPPORTED);
 835
 836         if (cp->val != 0x00 && cp->val != 0x01)
 837                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 838                                   MGMT_STATUS_INVALID_PARAMS);
 839
 840         timeout = __le16_to_cpu(cp->timeout);
 841         if (!cp->val && timeout > 0)
 842                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 843                                   MGMT_STATUS_INVALID_PARAMS);
 844
 845         hci_dev_lock(hdev);
 846
 847         if (!hdev_is_powered(hdev) && timeout > 0) {
 848                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 849                                  MGMT_STATUS_NOT_POWERED);
 850                 goto failed;
 851         }
 852
 853         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 854             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 855                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 856                                  MGMT_STATUS_BUSY);
 857                 goto failed;
 858         }
 859
 860         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 861                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 862                                  MGMT_STATUS_REJECTED);
 863                 goto failed;
 864         }
 865
 866         if (!hdev_is_powered(hdev)) {
 867                 bool changed = false;
 868
 869                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 870                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 871                         changed = true;
 872                 }
 873
 874                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 875                 if (err < 0)
 876                         goto failed;
 877
 878                 if (changed)
 879                         err = new_settings(hdev, sk);
 880
 881                 goto failed;
 882         }
 883
 884         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 885                 if (hdev->discov_timeout > 0) {
 886                         cancel_delayed_work(&hdev->discov_off);
 887                         hdev->discov_timeout = 0;
 888                 }
 889
 890                 if (cp->val && timeout > 0) {
 891                         hdev->discov_timeout = timeout;
 892                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 893                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 894                 }
 895
 896                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 897                 goto failed;
 898         }
 899
 900         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 901         if (!cmd) {
 902                 err = -ENOMEM;
 903                 goto failed;
 904         }
 905
 906         scan = SCAN_PAGE;
 907
 908         if (cp->val)
 909                 scan |= SCAN_INQUIRY;
 910         else
 911                 cancel_delayed_work(&hdev->discov_off);
 912
 913         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 914         if (err < 0)
 915                 mgmt_pending_remove(cmd);
 916
 917         if (cp->val)
 918                 hdev->discov_timeout = timeout;
 919
 920 failed:
 921         hci_dev_unlock(hdev);
 922         return err;
 923 }
 924
 925 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
 926                            u16 len)
 927 {
 928         struct mgmt_mode *cp = data;
 929         struct pending_cmd *cmd;
 930         u8 scan;
 931         int err;
 932
 933         BT_DBG("request for %s", hdev->name);
 934
 935         if (!lmp_bredr_capable(hdev))
 936                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
 937                                   MGMT_STATUS_NOT_SUPPORTED);
 938
 939         if (cp->val != 0x00 && cp->val != 0x01)
 940                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
 941                                   MGMT_STATUS_INVALID_PARAMS);
 942
 943         hci_dev_lock(hdev);
 944
 945         if (!hdev_is_powered(hdev)) {
 946                 bool changed = false;
 947
 948                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 949                         changed = true;
 950
 951                 if (cp->val) {
 952                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 953                 } else {
 954                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 955                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 956                 }
 957
 958                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 959                 if (err < 0)
 960                         goto failed;
 961
 962                 if (changed)
 963                         err = new_settings(hdev, sk);
 964
 965                 goto failed;
 966         }
 967
 968         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 969             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 970                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
 971                                  MGMT_STATUS_BUSY);
 972                 goto failed;
 973         }
 974
 975         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 976                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 977                 goto failed;
 978         }
 979
 980         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
 981         if (!cmd) {
 982                 err = -ENOMEM;
 983                 goto failed;
 984         }
 985
 986         if (cp->val) {
 987                 scan = SCAN_PAGE;
 988         } else {
 989                 scan = 0;
 990
 991                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
 992                     hdev->discov_timeout > 0)
 993                         cancel_delayed_work(&hdev->discov_off);
 994         }
 995
 996         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 997         if (err < 0)
 998                 mgmt_pending_remove(cmd);
 999
1000 failed:
1001         hci_dev_unlock(hdev);
1002         return err;
1003 }
1004
1005 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1006                         u16 len)
1007 {
1008         struct mgmt_mode *cp = data;
1009         int err;
1010
1011         BT_DBG("request for %s", hdev->name);
1012
1013         if (cp->val != 0x00 && cp->val != 0x01)
1014                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1015                                   MGMT_STATUS_INVALID_PARAMS);
1016
1017         hci_dev_lock(hdev);
1018
1019         if (cp->val)
1020                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1021         else
1022                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1023
1024         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1025         if (err < 0)
1026                 goto failed;
1027
1028         err = new_settings(hdev, sk);
1029
1030 failed:
1031         hci_dev_unlock(hdev);
1032         return err;
1033 }
1034
1035 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1036                              u16 len)
1037 {
1038         struct mgmt_mode *cp = data;
1039         struct pending_cmd *cmd;
1040         u8 val;
1041         int err;
1042
1043         BT_DBG("request for %s", hdev->name);
1044
1045         if (!lmp_bredr_capable(hdev))
1046                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1047                                   MGMT_STATUS_NOT_SUPPORTED);
1048
1049         if (cp->val != 0x00 && cp->val != 0x01)
1050                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1051                                   MGMT_STATUS_INVALID_PARAMS);
1052
1053         hci_dev_lock(hdev);
1054
1055         if (!hdev_is_powered(hdev)) {
1056                 bool changed = false;
1057
1058                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1059                                           &hdev->dev_flags)) {
1060                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1061                         changed = true;
1062                 }
1063
1064                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1065                 if (err < 0)
1066                         goto failed;
1067
1068                 if (changed)
1069                         err = new_settings(hdev, sk);
1070
1071                 goto failed;
1072         }
1073
1074         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1075                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1076                                  MGMT_STATUS_BUSY);
1077                 goto failed;
1078         }
1079
1080         val = !!cp->val;
1081
1082         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1083                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1084                 goto failed;
1085         }
1086
1087         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1088         if (!cmd) {
1089                 err = -ENOMEM;
1090                 goto failed;
1091         }
1092
1093         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1094         if (err < 0) {
1095                 mgmt_pending_remove(cmd);
1096                 goto failed;
1097         }
1098
1099 failed:
1100         hci_dev_unlock(hdev);
1101         return err;
1102 }
1103
1104 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1105 {
1106         struct mgmt_mode *cp = data;
1107         struct pending_cmd *cmd;
1108         u8 val;
1109         int err;
1110
1111         BT_DBG("request for %s", hdev->name);
1112
1113         if (!lmp_ssp_capable(hdev))
1114                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1115                                   MGMT_STATUS_NOT_SUPPORTED);
1116
1117         if (cp->val != 0x00 && cp->val != 0x01)
1118                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1119                                   MGMT_STATUS_INVALID_PARAMS);
1120
1121         hci_dev_lock(hdev);
1122
1123         val = !!cp->val;
1124
1125         if (!hdev_is_powered(hdev)) {
1126                 bool changed = false;
1127
1128                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1129                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1130                         changed = true;
1131                 }
1132
1133                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1134                 if (err < 0)
1135                         goto failed;
1136
1137                 if (changed)
1138                         err = new_settings(hdev, sk);
1139
1140                 goto failed;
1141         }
1142
1143         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1144                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1145                                  MGMT_STATUS_BUSY);
1146                 goto failed;
1147         }
1148
1149         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1150                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1151                 goto failed;
1152         }
1153
1154         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1155         if (!cmd) {
1156                 err = -ENOMEM;
1157                 goto failed;
1158         }
1159
1160         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1161         if (err < 0) {
1162                 mgmt_pending_remove(cmd);
1163                 goto failed;
1164         }
1165
1166 failed:
1167         hci_dev_unlock(hdev);
1168         return err;
1169 }
1170
1171 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1172 {
1173         struct mgmt_mode *cp = data;
1174
1175         BT_DBG("request for %s", hdev->name);
1176
1177         if (!enable_hs)
1178                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1179                                   MGMT_STATUS_NOT_SUPPORTED);
1180
1181         if (cp->val != 0x00 && cp->val != 0x01)
1182                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1183                                   MGMT_STATUS_INVALID_PARAMS);
1184
1185         if (cp->val)
1186                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1187         else
1188                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1189
1190         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1191 }
1192
1193 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1194 {
1195         struct mgmt_mode *cp = data;
1196         struct hci_cp_write_le_host_supported hci_cp;
1197         struct pending_cmd *cmd;
1198         int err;
1199         u8 val, enabled;
1200
1201         BT_DBG("request for %s", hdev->name);
1202
1203         if (!lmp_le_capable(hdev))
1204                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1205                                   MGMT_STATUS_NOT_SUPPORTED);
1206
1207         if (cp->val != 0x00 && cp->val != 0x01)
1208                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1209                                   MGMT_STATUS_INVALID_PARAMS);
1210
1211         hci_dev_lock(hdev);
1212
1213         val = !!cp->val;
1214         enabled = lmp_host_le_capable(hdev);
1215
1216         if (!hdev_is_powered(hdev) || val == enabled) {
1217                 bool changed = false;
1218
1219                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1220                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1221                         changed = true;
1222                 }
1223
1224                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1225                 if (err < 0)
1226                         goto unlock;
1227
1228                 if (changed)
1229                         err = new_settings(hdev, sk);
1230
1231                 goto unlock;
1232         }
1233
1234         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1235                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1236                                  MGMT_STATUS_BUSY);
1237                 goto unlock;
1238         }
1239
1240         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1241         if (!cmd) {
1242                 err = -ENOMEM;
1243                 goto unlock;
1244         }
1245
1246         memset(&hci_cp, 0, sizeof(hci_cp));
1247
1248         if (val) {
1249                 hci_cp.le = val;
1250                 hci_cp.simul = lmp_le_br_capable(hdev);
1251         }
1252
1253         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1254                            &hci_cp);
1255         if (err < 0)
1256                 mgmt_pending_remove(cmd);
1257
1258 unlock:
1259         hci_dev_unlock(hdev);
1260         return err;
1261 }
1262
1263 static const u8 bluetooth_base_uuid[] = {
1264                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1265                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1266 };
1267
1268 static u8 get_uuid_size(const u8 *uuid)
1269 {
1270         u32 val;
1271
1272         if (memcmp(uuid, bluetooth_base_uuid, 12))
1273                 return 128;
1274
1275         val = get_unaligned_le32(&uuid[12]);
1276         if (val > 0xffff)
1277                 return 32;
1278
1279         return 16;
1280 }
1281
1282 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1283 {
1284         struct mgmt_cp_add_uuid *cp = data;
1285         struct pending_cmd *cmd;
1286         struct bt_uuid *uuid;
1287         int err;
1288
1289         BT_DBG("request for %s", hdev->name);
1290
1291         hci_dev_lock(hdev);
1292
1293         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1294                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1295                                  MGMT_STATUS_BUSY);
1296                 goto failed;
1297         }
1298
1299         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1300         if (!uuid) {
1301                 err = -ENOMEM;
1302                 goto failed;
1303         }
1304
1305         memcpy(uuid->uuid, cp->uuid, 16);
1306         uuid->svc_hint = cp->svc_hint;
1307         uuid->size = get_uuid_size(cp->uuid);
1308
1309         list_add_tail(&uuid->list, &hdev->uuids);
1310
1311         err = update_class(hdev);
1312         if (err < 0)
1313                 goto failed;
1314
1315         err = update_eir(hdev);
1316         if (err < 0)
1317                 goto failed;
1318
1319         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1320                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1321                                    hdev->dev_class, 3);
1322                 goto failed;
1323         }
1324
1325         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1326         if (!cmd)
1327                 err = -ENOMEM;
1328
1329 failed:
1330         hci_dev_unlock(hdev);
1331         return err;
1332 }
1333
1334 static bool enable_service_cache(struct hci_dev *hdev)
1335 {
1336         if (!hdev_is_powered(hdev))
1337                 return false;
1338
1339         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1340                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1341                                    CACHE_TIMEOUT);
1342                 return true;
1343         }
1344
1345         return false;
1346 }
1347
1348 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1349                        u16 len)
1350 {
1351         struct mgmt_cp_remove_uuid *cp = data;
1352         struct pending_cmd *cmd;
1353         struct bt_uuid *match, *tmp;
1354         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1355         int err, found;
1356
1357         BT_DBG("request for %s", hdev->name);
1358
1359         hci_dev_lock(hdev);
1360
1361         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1362                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1363                                  MGMT_STATUS_BUSY);
1364                 goto unlock;
1365         }
1366
1367         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1368                 err = hci_uuids_clear(hdev);
1369
1370                 if (enable_service_cache(hdev)) {
1371                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1372                                            0, hdev->dev_class, 3);
1373                         goto unlock;
1374                 }
1375
1376                 goto update_class;
1377         }
1378
1379         found = 0;
1380
1381         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1382                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1383                         continue;
1384
1385                 list_del(&match->list);
1386                 kfree(match);
1387                 found++;
1388         }
1389
1390         if (found == 0) {
1391                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1392                                  MGMT_STATUS_INVALID_PARAMS);
1393                 goto unlock;
1394         }
1395
1396 update_class:
1397         err = update_class(hdev);
1398         if (err < 0)
1399                 goto unlock;
1400
1401         err = update_eir(hdev);
1402         if (err < 0)
1403                 goto unlock;
1404
1405         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1406                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1407                                    hdev->dev_class, 3);
1408                 goto unlock;
1409         }
1410
1411         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1412         if (!cmd)
1413                 err = -ENOMEM;
1414
1415 unlock:
1416         hci_dev_unlock(hdev);
1417         return err;
1418 }
1419
1420 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1421                          u16 len)
1422 {
1423         struct mgmt_cp_set_dev_class *cp = data;
1424         struct pending_cmd *cmd;
1425         int err;
1426
1427         BT_DBG("request for %s", hdev->name);
1428
1429         if (!lmp_bredr_capable(hdev))
1430                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1431                                   MGMT_STATUS_NOT_SUPPORTED);
1432
1433         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags))
1434                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1435                                   MGMT_STATUS_BUSY);
1436
1437         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0)
1438                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1439                                   MGMT_STATUS_INVALID_PARAMS);
1440
1441         hci_dev_lock(hdev);
1442
1443         hdev->major_class = cp->major;
1444         hdev->minor_class = cp->minor;
1445
1446         if (!hdev_is_powered(hdev)) {
1447                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1448                                    hdev->dev_class, 3);
1449                 goto unlock;
1450         }
1451
1452         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1453                 hci_dev_unlock(hdev);
1454                 cancel_delayed_work_sync(&hdev->service_cache);
1455                 hci_dev_lock(hdev);
1456                 update_eir(hdev);
1457         }
1458
1459         err = update_class(hdev);
1460         if (err < 0)
1461                 goto unlock;
1462
1463         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1464                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1465                                    hdev->dev_class, 3);
1466                 goto unlock;
1467         }
1468
1469         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1470         if (!cmd)
1471                 err = -ENOMEM;
1472
1473 unlock:
1474         hci_dev_unlock(hdev);
1475         return err;
1476 }
1477
1478 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1479                           u16 len)
1480 {
1481         struct mgmt_cp_load_link_keys *cp = data;
1482         u16 key_count, expected_len;
1483         int i;
1484
1485         key_count = __le16_to_cpu(cp->key_count);
1486
1487         expected_len = sizeof(*cp) + key_count *
1488                                         sizeof(struct mgmt_link_key_info);
1489         if (expected_len != len) {
1490                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1491                        len, expected_len);
1492                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1493                                   MGMT_STATUS_INVALID_PARAMS);
1494         }
1495
1496         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1497                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1498                                   MGMT_STATUS_INVALID_PARAMS);
1499
1500         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1501                key_count);
1502
1503         for (i = 0; i < key_count; i++) {
1504                 struct mgmt_link_key_info *key = &cp->keys[i];
1505
1506                 if (key->addr.type != BDADDR_BREDR)
1507                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1508                                           MGMT_STATUS_INVALID_PARAMS);
1509         }
1510
1511         hci_dev_lock(hdev);
1512
1513         hci_link_keys_clear(hdev);
1514
1515         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1516
1517         if (cp->debug_keys)
1518                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1519         else
1520                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1521
1522         for (i = 0; i < key_count; i++) {
1523                 struct mgmt_link_key_info *key = &cp->keys[i];
1524
1525                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1526                                  key->type, key->pin_len);
1527         }
1528
1529         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1530
1531         hci_dev_unlock(hdev);
1532
1533         return 0;
1534 }
1535
1536 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1537                            u8 addr_type, struct sock *skip_sk)
1538 {
1539         struct mgmt_ev_device_unpaired ev;
1540
1541         bacpy(&ev.addr.bdaddr, bdaddr);
1542         ev.addr.type = addr_type;
1543
1544         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1545                           skip_sk);
1546 }
1547
1548 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1549                          u16 len)
1550 {
1551         struct mgmt_cp_unpair_device *cp = data;
1552         struct mgmt_rp_unpair_device rp;
1553         struct hci_cp_disconnect dc;
1554         struct pending_cmd *cmd;
1555         struct hci_conn *conn;
1556         int err;
1557
1558         memset(&rp, 0, sizeof(rp));
1559         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1560         rp.addr.type = cp->addr.type;
1561
1562         if (!bdaddr_type_is_valid(cp->addr.type))
1563                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1564                                     MGMT_STATUS_INVALID_PARAMS,
1565                                     &rp, sizeof(rp));
1566
1567         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1568                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1569                                     MGMT_STATUS_INVALID_PARAMS,
1570                                     &rp, sizeof(rp));
1571
1572         hci_dev_lock(hdev);
1573
1574         if (!hdev_is_powered(hdev)) {
1575                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1576                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1577                 goto unlock;
1578         }
1579
1580         if (cp->addr.type == BDADDR_BREDR)
1581                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1582         else
1583                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1584
1585         if (err < 0) {
1586                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1587                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1588                 goto unlock;
1589         }
1590
1591         if (cp->disconnect) {
1592                 if (cp->addr.type == BDADDR_BREDR)
1593                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1594                                                        &cp->addr.bdaddr);
1595                 else
1596                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1597                                                        &cp->addr.bdaddr);
1598         } else {
1599                 conn = NULL;
1600         }
1601
1602         if (!conn) {
1603                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1604                                    &rp, sizeof(rp));
1605                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1606                 goto unlock;
1607         }
1608
1609         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1610                                sizeof(*cp));
1611         if (!cmd) {
1612                 err = -ENOMEM;
1613                 goto unlock;
1614         }
1615
1616         dc.handle = cpu_to_le16(conn->handle);
1617         dc.reason = 0x13; /* Remote User Terminated Connection */
1618         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1619         if (err < 0)
1620                 mgmt_pending_remove(cmd);
1621
1622 unlock:
1623         hci_dev_unlock(hdev);
1624         return err;
1625 }
1626
1627 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1628                       u16 len)
1629 {
1630         struct mgmt_cp_disconnect *cp = data;
1631         struct mgmt_rp_disconnect rp;
1632         struct hci_cp_disconnect dc;
1633         struct pending_cmd *cmd;
1634         struct hci_conn *conn;
1635         int err;
1636
1637         BT_DBG("");
1638
1639         memset(&rp, 0, sizeof(rp));
1640         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1641         rp.addr.type = cp->addr.type;
1642
1643         if (!bdaddr_type_is_valid(cp->addr.type))
1644                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1645                                     MGMT_STATUS_INVALID_PARAMS,
1646                                     &rp, sizeof(rp));
1647
1648         hci_dev_lock(hdev);
1649
1650         if (!test_bit(HCI_UP, &hdev->flags)) {
1651                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1652                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1653                 goto failed;
1654         }
1655
1656         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1657                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1658                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1659                 goto failed;
1660         }
1661
1662         if (cp->addr.type == BDADDR_BREDR)
1663                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1664                                                &cp->addr.bdaddr);
1665         else
1666                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1667
1668         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1669                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1670                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1671                 goto failed;
1672         }
1673
1674         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1675         if (!cmd) {
1676                 err = -ENOMEM;
1677                 goto failed;
1678         }
1679
1680         dc.handle = cpu_to_le16(conn->handle);
1681         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1682
1683         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1684         if (err < 0)
1685                 mgmt_pending_remove(cmd);
1686
1687 failed:
1688         hci_dev_unlock(hdev);
1689         return err;
1690 }
1691
1692 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1693 {
1694         switch (link_type) {
1695         case LE_LINK:
1696                 switch (addr_type) {
1697                 case ADDR_LE_DEV_PUBLIC:
1698                         return BDADDR_LE_PUBLIC;
1699
1700                 default:
1701                         /* Fallback to LE Random address type */
1702                         return BDADDR_LE_RANDOM;
1703                 }
1704
1705         default:
1706                 /* Fallback to BR/EDR type */
1707                 return BDADDR_BREDR;
1708         }
1709 }
1710
1711 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1712                            u16 data_len)
1713 {
1714         struct mgmt_rp_get_connections *rp;
1715         struct hci_conn *c;
1716         size_t rp_len;
1717         int err;
1718         u16 i;
1719
1720         BT_DBG("");
1721
1722         hci_dev_lock(hdev);
1723
1724         if (!hdev_is_powered(hdev)) {
1725                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1726                                  MGMT_STATUS_NOT_POWERED);
1727                 goto unlock;
1728         }
1729
1730         i = 0;
1731         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1732                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1733                         i++;
1734         }
1735
1736         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1737         rp = kmalloc(rp_len, GFP_KERNEL);
1738         if (!rp) {
1739                 err = -ENOMEM;
1740                 goto unlock;
1741         }
1742
1743         i = 0;
1744         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1745                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1746                         continue;
1747                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1748                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1749                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1750                         continue;
1751                 i++;
1752         }
1753
1754         rp->conn_count = cpu_to_le16(i);
1755
1756         /* Recalculate length in case of filtered SCO connections, etc */
1757         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1758
1759         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1760                            rp_len);
1761
1762         kfree(rp);
1763
1764 unlock:
1765         hci_dev_unlock(hdev);
1766         return err;
1767 }
1768
1769 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1770                                    struct mgmt_cp_pin_code_neg_reply *cp)
1771 {
1772         struct pending_cmd *cmd;
1773         int err;
1774
1775         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1776                                sizeof(*cp));
1777         if (!cmd)
1778                 return -ENOMEM;
1779
1780         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1781                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1782         if (err < 0)
1783                 mgmt_pending_remove(cmd);
1784
1785         return err;
1786 }
1787
1788 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1789                           u16 len)
1790 {
1791         struct hci_conn *conn;
1792         struct mgmt_cp_pin_code_reply *cp = data;
1793         struct hci_cp_pin_code_reply reply;
1794         struct pending_cmd *cmd;
1795         int err;
1796
1797         BT_DBG("");
1798
1799         hci_dev_lock(hdev);
1800
1801         if (!hdev_is_powered(hdev)) {
1802                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1803                                  MGMT_STATUS_NOT_POWERED);
1804                 goto failed;
1805         }
1806
1807         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1808         if (!conn) {
1809                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1810                                  MGMT_STATUS_NOT_CONNECTED);
1811                 goto failed;
1812         }
1813
1814         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1815                 struct mgmt_cp_pin_code_neg_reply ncp;
1816
1817                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1818
1819                 BT_ERR("PIN code is not 16 bytes long");
1820
1821                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1822                 if (err >= 0)
1823                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1824                                          MGMT_STATUS_INVALID_PARAMS);
1825
1826                 goto failed;
1827         }
1828
1829         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1830         if (!cmd) {
1831                 err = -ENOMEM;
1832                 goto failed;
1833         }
1834
1835         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1836         reply.pin_len = cp->pin_len;
1837         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1838
1839         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1840         if (err < 0)
1841                 mgmt_pending_remove(cmd);
1842
1843 failed:
1844         hci_dev_unlock(hdev);
1845         return err;
1846 }
1847
1848 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1849                              u16 len)
1850 {
1851         struct mgmt_cp_set_io_capability *cp = data;
1852
1853         BT_DBG("");
1854
1855         hci_dev_lock(hdev);
1856
1857         hdev->io_capability = cp->io_capability;
1858
1859         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1860                hdev->io_capability);
1861
1862         hci_dev_unlock(hdev);
1863
1864         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1865                             0);
1866 }
1867
1868 static struct pending_cmd *find_pairing(struct hci_conn *conn)
1869 {
1870         struct hci_dev *hdev = conn->hdev;
1871         struct pending_cmd *cmd;
1872
1873         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1874                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1875                         continue;
1876
1877                 if (cmd->user_data != conn)
1878                         continue;
1879
1880                 return cmd;
1881         }
1882
1883         return NULL;
1884 }
1885
1886 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1887 {
1888         struct mgmt_rp_pair_device rp;
1889         struct hci_conn *conn = cmd->user_data;
1890
1891         bacpy(&rp.addr.bdaddr, &conn->dst);
1892         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
1893
1894         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1895                      &rp, sizeof(rp));
1896
1897         /* So we don't get further callbacks for this connection */
1898         conn->connect_cfm_cb = NULL;
1899         conn->security_cfm_cb = NULL;
1900         conn->disconn_cfm_cb = NULL;
1901
1902         hci_conn_put(conn);
1903
1904         mgmt_pending_remove(cmd);
1905 }
1906
1907 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1908 {
1909         struct pending_cmd *cmd;
1910
1911         BT_DBG("status %u", status);
1912
1913         cmd = find_pairing(conn);
1914         if (!cmd)
1915                 BT_DBG("Unable to find a pending command");
1916         else
1917                 pairing_complete(cmd, mgmt_status(status));
1918 }
1919
1920 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
1921 {
1922         struct pending_cmd *cmd;
1923
1924         BT_DBG("status %u", status);
1925
1926         if (!status)
1927                 return;
1928
1929         cmd = find_pairing(conn);
1930         if (!cmd)
1931                 BT_DBG("Unable to find a pending command");
1932         else
1933                 pairing_complete(cmd, mgmt_status(status));
1934 }
1935
1936 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1937                        u16 len)
1938 {
1939         struct mgmt_cp_pair_device *cp = data;
1940         struct mgmt_rp_pair_device rp;
1941         struct pending_cmd *cmd;
1942         u8 sec_level, auth_type;
1943         struct hci_conn *conn;
1944         int err;
1945
1946         BT_DBG("");
1947
1948         memset(&rp, 0, sizeof(rp));
1949         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1950         rp.addr.type = cp->addr.type;
1951
1952         if (!bdaddr_type_is_valid(cp->addr.type))
1953                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1954                                     MGMT_STATUS_INVALID_PARAMS,
1955                                     &rp, sizeof(rp));
1956
1957         hci_dev_lock(hdev);
1958
1959         if (!hdev_is_powered(hdev)) {
1960                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1961                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1962                 goto unlock;
1963         }
1964
1965         sec_level = BT_SECURITY_MEDIUM;
1966         if (cp->io_cap == 0x03)
1967                 auth_type = HCI_AT_DEDICATED_BONDING;
1968         else
1969                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1970
1971         if (cp->addr.type == BDADDR_BREDR)
1972                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
1973                                    cp->addr.type, sec_level, auth_type);
1974         else
1975                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
1976                                    cp->addr.type, sec_level, auth_type);
1977
1978         if (IS_ERR(conn)) {
1979                 int status;
1980
1981                 if (PTR_ERR(conn) == -EBUSY)
1982                         status = MGMT_STATUS_BUSY;
1983                 else
1984                         status = MGMT_STATUS_CONNECT_FAILED;
1985
1986                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1987                                    status, &rp,
1988                                    sizeof(rp));
1989                 goto unlock;
1990         }
1991
1992         if (conn->connect_cfm_cb) {
1993                 hci_conn_put(conn);
1994                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1995                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1996                 goto unlock;
1997         }
1998
1999         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2000         if (!cmd) {
2001                 err = -ENOMEM;
2002                 hci_conn_put(conn);
2003                 goto unlock;
2004         }
2005
2006         /* For LE, just connecting isn't a proof that the pairing finished */
2007         if (cp->addr.type == BDADDR_BREDR)
2008                 conn->connect_cfm_cb = pairing_complete_cb;
2009         else
2010                 conn->connect_cfm_cb = le_connect_complete_cb;
2011
2012         conn->security_cfm_cb = pairing_complete_cb;
2013         conn->disconn_cfm_cb = pairing_complete_cb;
2014         conn->io_capability = cp->io_cap;
2015         cmd->user_data = conn;
2016
2017         if (conn->state == BT_CONNECTED &&
2018             hci_conn_security(conn, sec_level, auth_type))
2019                 pairing_complete(cmd, 0);
2020
2021         err = 0;
2022
2023 unlock:
2024         hci_dev_unlock(hdev);
2025         return err;
2026 }
2027
2028 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2029                               u16 len)
2030 {
2031         struct mgmt_addr_info *addr = data;
2032         struct pending_cmd *cmd;
2033         struct hci_conn *conn;
2034         int err;
2035
2036         BT_DBG("");
2037
2038         hci_dev_lock(hdev);
2039
2040         if (!hdev_is_powered(hdev)) {
2041                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2042                                  MGMT_STATUS_NOT_POWERED);
2043                 goto unlock;
2044         }
2045
2046         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2047         if (!cmd) {
2048                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2049                                  MGMT_STATUS_INVALID_PARAMS);
2050                 goto unlock;
2051         }
2052
2053         conn = cmd->user_data;
2054
2055         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2056                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2057                                  MGMT_STATUS_INVALID_PARAMS);
2058                 goto unlock;
2059         }
2060
2061         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2062
2063         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2064                            addr, sizeof(*addr));
2065 unlock:
2066         hci_dev_unlock(hdev);
2067         return err;
2068 }
2069
2070 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2071                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2072                              u16 hci_op, __le32 passkey)
2073 {
2074         struct pending_cmd *cmd;
2075         struct hci_conn *conn;
2076         int err;
2077
2078         hci_dev_lock(hdev);
2079
2080         if (!hdev_is_powered(hdev)) {
2081                 err = cmd_status(sk, hdev->id, mgmt_op,
2082                                  MGMT_STATUS_NOT_POWERED);
2083                 goto done;
2084         }
2085
2086         if (type == BDADDR_BREDR)
2087                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2088         else
2089                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2090
2091         if (!conn) {
2092                 err = cmd_status(sk, hdev->id, mgmt_op,
2093                                  MGMT_STATUS_NOT_CONNECTED);
2094                 goto done;
2095         }
2096
2097         if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2098                 /* Continue with pairing via SMP */
2099                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2100
2101                 if (!err)
2102                         err = cmd_status(sk, hdev->id, mgmt_op,
2103                                          MGMT_STATUS_SUCCESS);
2104                 else
2105                         err = cmd_status(sk, hdev->id, mgmt_op,
2106                                          MGMT_STATUS_FAILED);
2107
2108                 goto done;
2109         }
2110
2111         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2112         if (!cmd) {
2113                 err = -ENOMEM;
2114                 goto done;
2115         }
2116
2117         /* Continue with pairing via HCI */
2118         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2119                 struct hci_cp_user_passkey_reply cp;
2120
2121                 bacpy(&cp.bdaddr, bdaddr);
2122                 cp.passkey = passkey;
2123                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2124         } else
2125                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2126
2127         if (err < 0)
2128                 mgmt_pending_remove(cmd);
2129
2130 done:
2131         hci_dev_unlock(hdev);
2132         return err;
2133 }
2134
2135 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2136                               void *data, u16 len)
2137 {
2138         struct mgmt_cp_pin_code_neg_reply *cp = data;
2139
2140         BT_DBG("");
2141
2142         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2143                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2144                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2145 }
2146
2147 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2148                               u16 len)
2149 {
2150         struct mgmt_cp_user_confirm_reply *cp = data;
2151
2152         BT_DBG("");
2153
2154         if (len != sizeof(*cp))
2155                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2156                                   MGMT_STATUS_INVALID_PARAMS);
2157
2158         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2159                                  MGMT_OP_USER_CONFIRM_REPLY,
2160                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2161 }
2162
2163 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2164                                   void *data, u16 len)
2165 {
2166         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2167
2168         BT_DBG("");
2169
2170         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2171                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2172                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2173 }
2174
2175 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2176                               u16 len)
2177 {
2178         struct mgmt_cp_user_passkey_reply *cp = data;
2179
2180         BT_DBG("");
2181
2182         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2183                                  MGMT_OP_USER_PASSKEY_REPLY,
2184                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2185 }
2186
2187 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2188                                   void *data, u16 len)
2189 {
2190         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2191
2192         BT_DBG("");
2193
2194         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2195                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2196                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2197 }
2198
2199 static int update_name(struct hci_dev *hdev, const char *name)
2200 {
2201         struct hci_cp_write_local_name cp;
2202
2203         memcpy(cp.name, name, sizeof(cp.name));
2204
2205         return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2206 }
2207
2208 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2209                           u16 len)
2210 {
2211         struct mgmt_cp_set_local_name *cp = data;
2212         struct pending_cmd *cmd;
2213         int err;
2214
2215         BT_DBG("");
2216
2217         hci_dev_lock(hdev);
2218
2219         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2220
2221         if (!hdev_is_powered(hdev)) {
2222                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2223
2224                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2225                                    data, len);
2226                 if (err < 0)
2227                         goto failed;
2228
2229                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2230                                  sk);
2231
2232                 goto failed;
2233         }
2234
2235         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2236         if (!cmd) {
2237                 err = -ENOMEM;
2238                 goto failed;
2239         }
2240
2241         err = update_name(hdev, cp->name);
2242         if (err < 0)
2243                 mgmt_pending_remove(cmd);
2244
2245 failed:
2246         hci_dev_unlock(hdev);
2247         return err;
2248 }
2249
2250 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2251                                void *data, u16 data_len)
2252 {
2253         struct pending_cmd *cmd;
2254         int err;
2255
2256         BT_DBG("%s", hdev->name);
2257
2258         hci_dev_lock(hdev);
2259
2260         if (!hdev_is_powered(hdev)) {
2261                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2262                                  MGMT_STATUS_NOT_POWERED);
2263                 goto unlock;
2264         }
2265
2266         if (!lmp_ssp_capable(hdev)) {
2267                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2268                                  MGMT_STATUS_NOT_SUPPORTED);
2269                 goto unlock;
2270         }
2271
2272         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2273                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2274                                  MGMT_STATUS_BUSY);
2275                 goto unlock;
2276         }
2277
2278         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2279         if (!cmd) {
2280                 err = -ENOMEM;
2281                 goto unlock;
2282         }
2283
2284         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2285         if (err < 0)
2286                 mgmt_pending_remove(cmd);
2287
2288 unlock:
2289         hci_dev_unlock(hdev);
2290         return err;
2291 }
2292
2293 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2294                                void *data, u16 len)
2295 {
2296         struct mgmt_cp_add_remote_oob_data *cp = data;
2297         u8 status;
2298         int err;
2299
2300         BT_DBG("%s ", hdev->name);
2301
2302         hci_dev_lock(hdev);
2303
2304         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2305                                       cp->randomizer);
2306         if (err < 0)
2307                 status = MGMT_STATUS_FAILED;
2308         else
2309                 status = MGMT_STATUS_SUCCESS;
2310
2311         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2312                            &cp->addr, sizeof(cp->addr));
2313
2314         hci_dev_unlock(hdev);
2315         return err;
2316 }
2317
2318 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2319                                   void *data, u16 len)
2320 {
2321         struct mgmt_cp_remove_remote_oob_data *cp = data;
2322         u8 status;
2323         int err;
2324
2325         BT_DBG("%s", hdev->name);
2326
2327         hci_dev_lock(hdev);
2328
2329         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2330         if (err < 0)
2331                 status = MGMT_STATUS_INVALID_PARAMS;
2332         else
2333                 status = MGMT_STATUS_SUCCESS;
2334
2335         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2336                            status, &cp->addr, sizeof(cp->addr));
2337
2338         hci_dev_unlock(hdev);
2339         return err;
2340 }
2341
2342 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2343 {
2344         int err;
2345
2346         BT_DBG("%s", hdev->name);
2347
2348         hci_dev_lock(hdev);
2349
2350         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2351         if (err < 0)
2352                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2353
2354         hci_dev_unlock(hdev);
2355
2356         return err;
2357 }
2358
2359 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2360                            void *data, u16 len)
2361 {
2362         struct mgmt_cp_start_discovery *cp = data;
2363         struct pending_cmd *cmd;
2364         int err;
2365
2366         BT_DBG("%s", hdev->name);
2367
2368         hci_dev_lock(hdev);
2369
2370         if (!hdev_is_powered(hdev)) {
2371                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2372                                  MGMT_STATUS_NOT_POWERED);
2373                 goto failed;
2374         }
2375
2376         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2377                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2378                                  MGMT_STATUS_BUSY);
2379                 goto failed;
2380         }
2381
2382         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2383                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2384                                  MGMT_STATUS_BUSY);
2385                 goto failed;
2386         }
2387
2388         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2389         if (!cmd) {
2390                 err = -ENOMEM;
2391                 goto failed;
2392         }
2393
2394         hdev->discovery.type = cp->type;
2395
2396         switch (hdev->discovery.type) {
2397         case DISCOV_TYPE_BREDR:
2398                 if (!lmp_bredr_capable(hdev)) {
2399                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2400                                          MGMT_STATUS_NOT_SUPPORTED);
2401                         mgmt_pending_remove(cmd);
2402                         goto failed;
2403                 }
2404
2405                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2406                 break;
2407
2408         case DISCOV_TYPE_LE:
2409                 if (!lmp_host_le_capable(hdev)) {
2410                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2411                                          MGMT_STATUS_NOT_SUPPORTED);
2412                         mgmt_pending_remove(cmd);
2413                         goto failed;
2414                 }
2415
2416                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2417                                   LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2418                 break;
2419
2420         case DISCOV_TYPE_INTERLEAVED:
2421                 if (!lmp_host_le_capable(hdev) || !lmp_bredr_capable(hdev)) {
2422                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2423                                          MGMT_STATUS_NOT_SUPPORTED);
2424                         mgmt_pending_remove(cmd);
2425                         goto failed;
2426                 }
2427
2428                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT, LE_SCAN_WIN,
2429                                   LE_SCAN_TIMEOUT_BREDR_LE);
2430                 break;
2431
2432         default:
2433                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2434                                  MGMT_STATUS_INVALID_PARAMS);
2435                 mgmt_pending_remove(cmd);
2436                 goto failed;
2437         }
2438
2439         if (err < 0)
2440                 mgmt_pending_remove(cmd);
2441         else
2442                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2443
2444 failed:
2445         hci_dev_unlock(hdev);
2446         return err;
2447 }
2448
2449 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2450                           u16 len)
2451 {
2452         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2453         struct pending_cmd *cmd;
2454         struct hci_cp_remote_name_req_cancel cp;
2455         struct inquiry_entry *e;
2456         int err;
2457
2458         BT_DBG("%s", hdev->name);
2459
2460         hci_dev_lock(hdev);
2461
2462         if (!hci_discovery_active(hdev)) {
2463                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2464                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2465                                    sizeof(mgmt_cp->type));
2466                 goto unlock;
2467         }
2468
2469         if (hdev->discovery.type != mgmt_cp->type) {
2470                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2471                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2472                                    sizeof(mgmt_cp->type));
2473                 goto unlock;
2474         }
2475
2476         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2477         if (!cmd) {
2478                 err = -ENOMEM;
2479                 goto unlock;
2480         }
2481
2482         switch (hdev->discovery.state) {
2483         case DISCOVERY_FINDING:
2484                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2485                         err = hci_cancel_inquiry(hdev);
2486                 else
2487                         err = hci_cancel_le_scan(hdev);
2488
2489                 break;
2490
2491         case DISCOVERY_RESOLVING:
2492                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2493                                                      NAME_PENDING);
2494                 if (!e) {
2495                         mgmt_pending_remove(cmd);
2496                         err = cmd_complete(sk, hdev->id,
2497                                            MGMT_OP_STOP_DISCOVERY, 0,
2498                                            &mgmt_cp->type,
2499                                            sizeof(mgmt_cp->type));
2500                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2501                         goto unlock;
2502                 }
2503
2504                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2505                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2506                                    sizeof(cp), &cp);
2507
2508                 break;
2509
2510         default:
2511                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2512                 err = -EFAULT;
2513         }
2514
2515         if (err < 0)
2516                 mgmt_pending_remove(cmd);
2517         else
2518                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2519
2520 unlock:
2521         hci_dev_unlock(hdev);
2522         return err;
2523 }
2524
2525 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2526                         u16 len)
2527 {
2528         struct mgmt_cp_confirm_name *cp = data;
2529         struct inquiry_entry *e;
2530         int err;
2531
2532         BT_DBG("%s", hdev->name);
2533
2534         hci_dev_lock(hdev);
2535
2536         if (!hci_discovery_active(hdev)) {
2537                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2538                                  MGMT_STATUS_FAILED);
2539                 goto failed;
2540         }
2541
2542         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2543         if (!e) {
2544                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2545                                  MGMT_STATUS_INVALID_PARAMS);
2546                 goto failed;
2547         }
2548
2549         if (cp->name_known) {
2550                 e->name_state = NAME_KNOWN;
2551                 list_del(&e->list);
2552         } else {
2553                 e->name_state = NAME_NEEDED;
2554                 hci_inquiry_cache_update_resolve(hdev, e);
2555         }
2556
2557         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
2558                            sizeof(cp->addr));
2559
2560 failed:
2561         hci_dev_unlock(hdev);
2562         return err;
2563 }
2564
2565 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2566                         u16 len)
2567 {
2568         struct mgmt_cp_block_device *cp = data;
2569         u8 status;
2570         int err;
2571
2572         BT_DBG("%s", hdev->name);
2573
2574         if (!bdaddr_type_is_valid(cp->addr.type))
2575                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
2576                                     MGMT_STATUS_INVALID_PARAMS,
2577                                     &cp->addr, sizeof(cp->addr));
2578
2579         hci_dev_lock(hdev);
2580
2581         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2582         if (err < 0)
2583                 status = MGMT_STATUS_FAILED;
2584         else
2585                 status = MGMT_STATUS_SUCCESS;
2586
2587         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2588                            &cp->addr, sizeof(cp->addr));
2589
2590         hci_dev_unlock(hdev);
2591
2592         return err;
2593 }
2594
2595 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2596                           u16 len)
2597 {
2598         struct mgmt_cp_unblock_device *cp = data;
2599         u8 status;
2600         int err;
2601
2602         BT_DBG("%s", hdev->name);
2603
2604         if (!bdaddr_type_is_valid(cp->addr.type))
2605                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
2606                                     MGMT_STATUS_INVALID_PARAMS,
2607                                     &cp->addr, sizeof(cp->addr));
2608
2609         hci_dev_lock(hdev);
2610
2611         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2612         if (err < 0)
2613                 status = MGMT_STATUS_INVALID_PARAMS;
2614         else
2615                 status = MGMT_STATUS_SUCCESS;
2616
2617         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2618                            &cp->addr, sizeof(cp->addr));
2619
2620         hci_dev_unlock(hdev);
2621
2622         return err;
2623 }
2624
2625 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2626                          u16 len)
2627 {
2628         struct mgmt_cp_set_device_id *cp = data;
2629         int err;
2630         __u16 source;
2631
2632         BT_DBG("%s", hdev->name);
2633
2634         source = __le16_to_cpu(cp->source);
2635
2636         if (source > 0x0002)
2637                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2638                                   MGMT_STATUS_INVALID_PARAMS);
2639
2640         hci_dev_lock(hdev);
2641
2642         hdev->devid_source = source;
2643         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2644         hdev->devid_product = __le16_to_cpu(cp->product);
2645         hdev->devid_version = __le16_to_cpu(cp->version);
2646
2647         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2648
2649         update_eir(hdev);
2650
2651         hci_dev_unlock(hdev);
2652
2653         return err;
2654 }
2655
2656 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2657                                 void *data, u16 len)
2658 {
2659         struct mgmt_mode *cp = data;
2660         struct hci_cp_write_page_scan_activity acp;
2661         u8 type;
2662         int err;
2663
2664         BT_DBG("%s", hdev->name);
2665
2666         if (!lmp_bredr_capable(hdev))
2667                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2668                                   MGMT_STATUS_NOT_SUPPORTED);
2669
2670         if (cp->val != 0x00 && cp->val != 0x01)
2671                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2672                                   MGMT_STATUS_INVALID_PARAMS);
2673
2674         if (!hdev_is_powered(hdev))
2675                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2676                                   MGMT_STATUS_NOT_POWERED);
2677
2678         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2679                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2680                                   MGMT_STATUS_REJECTED);
2681
2682         hci_dev_lock(hdev);
2683
2684         if (cp->val) {
2685                 type = PAGE_SCAN_TYPE_INTERLACED;
2686
2687                 /* 160 msec page scan interval */
2688                 acp.interval = __constant_cpu_to_le16(0x0100);
2689         } else {
2690                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2691
2692                 /* default 1.28 sec page scan */
2693                 acp.interval = __constant_cpu_to_le16(0x0800);
2694         }
2695
2696         /* default 11.25 msec page scan window */
2697         acp.window = __constant_cpu_to_le16(0x0012);
2698
2699         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2700                            &acp);
2701         if (err < 0) {
2702                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2703                                  MGMT_STATUS_FAILED);
2704                 goto done;
2705         }
2706
2707         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2708         if (err < 0) {
2709                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2710                                  MGMT_STATUS_FAILED);
2711                 goto done;
2712         }
2713
2714         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2715                            NULL, 0);
2716 done:
2717         hci_dev_unlock(hdev);
2718         return err;
2719 }
2720
2721 static bool ltk_is_valid(struct mgmt_ltk_info *key)
2722 {
2723         if (key->authenticated != 0x00 && key->authenticated != 0x01)
2724                 return false;
2725         if (key->master != 0x00 && key->master != 0x01)
2726                 return false;
2727         if (!bdaddr_type_is_le(key->addr.type))
2728                 return false;
2729         return true;
2730 }
2731
2732 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2733                                void *cp_data, u16 len)
2734 {
2735         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2736         u16 key_count, expected_len;
2737         int i, err;
2738
2739         key_count = __le16_to_cpu(cp->key_count);
2740
2741         expected_len = sizeof(*cp) + key_count *
2742                                         sizeof(struct mgmt_ltk_info);
2743         if (expected_len != len) {
2744                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2745                        len, expected_len);
2746                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2747                                   MGMT_STATUS_INVALID_PARAMS);
2748         }
2749
2750         BT_DBG("%s key_count %u", hdev->name, key_count);
2751
2752         for (i = 0; i < key_count; i++) {
2753                 struct mgmt_ltk_info *key = &cp->keys[i];
2754
2755                 if (!ltk_is_valid(key))
2756                         return cmd_status(sk, hdev->id,
2757                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
2758                                           MGMT_STATUS_INVALID_PARAMS);
2759         }
2760
2761         hci_dev_lock(hdev);
2762
2763         hci_smp_ltks_clear(hdev);
2764
2765         for (i = 0; i < key_count; i++) {
2766                 struct mgmt_ltk_info *key = &cp->keys[i];
2767                 u8 type;
2768
2769                 if (key->master)
2770                         type = HCI_SMP_LTK;
2771                 else
2772                         type = HCI_SMP_LTK_SLAVE;
2773
2774                 hci_add_ltk(hdev, &key->addr.bdaddr,
2775                             bdaddr_to_le(key->addr.type),
2776                             type, 0, key->authenticated, key->val,
2777                             key->enc_size, key->ediv, key->rand);
2778         }
2779
2780         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
2781                            NULL, 0);
2782
2783         hci_dev_unlock(hdev);
2784
2785         return err;
2786 }
2787
2788 static const struct mgmt_handler {
2789         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2790                      u16 data_len);
2791         bool var_len;
2792         size_t data_len;
2793 } mgmt_handlers[] = {
2794         { NULL }, /* 0x0000 (no command) */
2795         { read_version,           false, MGMT_READ_VERSION_SIZE },
2796         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
2797         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
2798         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
2799         { set_powered,            false, MGMT_SETTING_SIZE },
2800         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
2801         { set_connectable,        false, MGMT_SETTING_SIZE },
2802         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
2803         { set_pairable,           false, MGMT_SETTING_SIZE },
2804         { set_link_security,      false, MGMT_SETTING_SIZE },
2805         { set_ssp,                false, MGMT_SETTING_SIZE },
2806         { set_hs,                 false, MGMT_SETTING_SIZE },
2807         { set_le,                 false, MGMT_SETTING_SIZE },
2808         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
2809         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
2810         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
2811         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
2812         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
2813         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2814         { disconnect,             false, MGMT_DISCONNECT_SIZE },
2815         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
2816         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
2817         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2818         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
2819         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
2820         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2821         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
2822         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
2823         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2824         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
2825         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2826         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2827         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2828         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2829         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
2830         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
2831         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
2832         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
2833         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
2834         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
2835 };
2836
2837
2838 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2839 {
2840         void *buf;
2841         u8 *cp;
2842         struct mgmt_hdr *hdr;
2843         u16 opcode, index, len;
2844         struct hci_dev *hdev = NULL;
2845         const struct mgmt_handler *handler;
2846         int err;
2847
2848         BT_DBG("got %zu bytes", msglen);
2849
2850         if (msglen < sizeof(*hdr))
2851                 return -EINVAL;
2852
2853         buf = kmalloc(msglen, GFP_KERNEL);
2854         if (!buf)
2855                 return -ENOMEM;
2856
2857         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2858                 err = -EFAULT;
2859                 goto done;
2860         }
2861
2862         hdr = buf;
2863         opcode = __le16_to_cpu(hdr->opcode);
2864         index = __le16_to_cpu(hdr->index);
2865         len = __le16_to_cpu(hdr->len);
2866
2867         if (len != msglen - sizeof(*hdr)) {
2868                 err = -EINVAL;
2869                 goto done;
2870         }
2871
2872         if (index != MGMT_INDEX_NONE) {
2873                 hdev = hci_dev_get(index);
2874                 if (!hdev) {
2875                         err = cmd_status(sk, index, opcode,
2876                                          MGMT_STATUS_INVALID_INDEX);
2877                         goto done;
2878                 }
2879         }
2880
2881         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2882             mgmt_handlers[opcode].func == NULL) {
2883                 BT_DBG("Unknown op %u", opcode);
2884                 err = cmd_status(sk, index, opcode,
2885                                  MGMT_STATUS_UNKNOWN_COMMAND);
2886                 goto done;
2887         }
2888
2889         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2890             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2891                 err = cmd_status(sk, index, opcode,
2892                                  MGMT_STATUS_INVALID_INDEX);
2893                 goto done;
2894         }
2895
2896         handler = &mgmt_handlers[opcode];
2897
2898         if ((handler->var_len && len < handler->data_len) ||
2899             (!handler->var_len && len != handler->data_len)) {
2900                 err = cmd_status(sk, index, opcode,
2901                                  MGMT_STATUS_INVALID_PARAMS);
2902                 goto done;
2903         }
2904
2905         if (hdev)
2906                 mgmt_init_hdev(sk, hdev);
2907
2908         cp = buf + sizeof(*hdr);
2909
2910         err = handler->func(sk, hdev, cp, len);
2911         if (err < 0)
2912                 goto done;
2913
2914         err = msglen;
2915
2916 done:
2917         if (hdev)
2918                 hci_dev_put(hdev);
2919
2920         kfree(buf);
2921         return err;
2922 }
2923
2924 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2925 {
2926         u8 *status = data;
2927
2928         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2929         mgmt_pending_remove(cmd);
2930 }
2931
2932 int mgmt_index_added(struct hci_dev *hdev)
2933 {
2934         if (!mgmt_valid_hdev(hdev))
2935                 return -ENOTSUPP;
2936
2937         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2938 }
2939
2940 int mgmt_index_removed(struct hci_dev *hdev)
2941 {
2942         u8 status = MGMT_STATUS_INVALID_INDEX;
2943
2944         if (!mgmt_valid_hdev(hdev))
2945                 return -ENOTSUPP;
2946
2947         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2948
2949         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2950 }
2951
2952 struct cmd_lookup {
2953         struct sock *sk;
2954         struct hci_dev *hdev;
2955         u8 mgmt_status;
2956 };
2957
2958 static void settings_rsp(struct pending_cmd *cmd, void *data)
2959 {
2960         struct cmd_lookup *match = data;
2961
2962         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2963
2964         list_del(&cmd->list);
2965
2966         if (match->sk == NULL) {
2967                 match->sk = cmd->sk;
2968                 sock_hold(match->sk);
2969         }
2970
2971         mgmt_pending_free(cmd);
2972 }
2973
2974 static int set_bredr_scan(struct hci_dev *hdev)
2975 {
2976         u8 scan = 0;
2977
2978         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2979                 scan |= SCAN_PAGE;
2980         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2981                 scan |= SCAN_INQUIRY;
2982
2983         if (!scan)
2984                 return 0;
2985
2986         return hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2987 }
2988
2989 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2990 {
2991         struct cmd_lookup match = { NULL, hdev };
2992         int err;
2993
2994         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2995                 return 0;
2996
2997         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2998
2999         if (powered) {
3000                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3001                     !lmp_host_ssp_capable(hdev)) {
3002                         u8 ssp = 1;
3003
3004                         hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3005                 }
3006
3007                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
3008                         struct hci_cp_write_le_host_supported cp;
3009
3010                         cp.le = 1;
3011                         cp.simul = lmp_le_br_capable(hdev);
3012
3013                         /* Check first if we already have the right
3014                          * host state (host features set)
3015                          */
3016                         if (cp.le != lmp_host_le_capable(hdev) ||
3017                             cp.simul != lmp_host_le_br_capable(hdev))
3018                                 hci_send_cmd(hdev,
3019                                              HCI_OP_WRITE_LE_HOST_SUPPORTED,
3020                                              sizeof(cp), &cp);
3021                 }
3022
3023                 if (lmp_bredr_capable(hdev)) {
3024                         set_bredr_scan(hdev);
3025                         update_class(hdev);
3026                         update_name(hdev, hdev->dev_name);
3027                         update_eir(hdev);
3028                 }
3029         } else {
3030                 u8 status = MGMT_STATUS_NOT_POWERED;
3031                 u8 zero_cod[] = { 0, 0, 0 };
3032
3033                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3034
3035                 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3036                         mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3037                                    zero_cod, sizeof(zero_cod), NULL);
3038         }
3039
3040         err = new_settings(hdev, match.sk);
3041
3042         if (match.sk)
3043                 sock_put(match.sk);
3044
3045         return err;
3046 }
3047
3048 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3049 {
3050         struct cmd_lookup match = { NULL, hdev };
3051         bool changed = false;
3052         int err = 0;
3053
3054         if (discoverable) {
3055                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3056                         changed = true;
3057         } else {
3058                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3059                         changed = true;
3060         }
3061
3062         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3063                              &match);
3064
3065         if (changed)
3066                 err = new_settings(hdev, match.sk);
3067
3068         if (match.sk)
3069                 sock_put(match.sk);
3070
3071         return err;
3072 }
3073
3074 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3075 {
3076         struct cmd_lookup match = { NULL, hdev };
3077         bool changed = false;
3078         int err = 0;
3079
3080         if (connectable) {
3081                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3082                         changed = true;
3083         } else {
3084                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3085                         changed = true;
3086         }
3087
3088         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
3089                              &match);
3090
3091         if (changed)
3092                 err = new_settings(hdev, match.sk);
3093
3094         if (match.sk)
3095                 sock_put(match.sk);
3096
3097         return err;
3098 }
3099
3100 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3101 {
3102         u8 mgmt_err = mgmt_status(status);
3103
3104         if (scan & SCAN_PAGE)
3105                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3106                                      cmd_status_rsp, &mgmt_err);
3107
3108         if (scan & SCAN_INQUIRY)
3109                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3110                                      cmd_status_rsp, &mgmt_err);
3111
3112         return 0;
3113 }
3114
3115 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3116                       bool persistent)
3117 {
3118         struct mgmt_ev_new_link_key ev;
3119
3120         memset(&ev, 0, sizeof(ev));
3121
3122         ev.store_hint = persistent;
3123         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3124         ev.key.addr.type = BDADDR_BREDR;
3125         ev.key.type = key->type;
3126         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3127         ev.key.pin_len = key->pin_len;
3128
3129         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3130 }
3131
3132 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3133 {
3134         struct mgmt_ev_new_long_term_key ev;
3135
3136         memset(&ev, 0, sizeof(ev));
3137
3138         ev.store_hint = persistent;
3139         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3140         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3141         ev.key.authenticated = key->authenticated;
3142         ev.key.enc_size = key->enc_size;
3143         ev.key.ediv = key->ediv;
3144
3145         if (key->type == HCI_SMP_LTK)
3146                 ev.key.master = 1;
3147
3148         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3149         memcpy(ev.key.val, key->val, sizeof(key->val));
3150
3151         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3152                           NULL);
3153 }
3154
3155 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3156                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3157                           u8 *dev_class)
3158 {
3159         char buf[512];
3160         struct mgmt_ev_device_connected *ev = (void *) buf;
3161         u16 eir_len = 0;
3162
3163         bacpy(&ev->addr.bdaddr, bdaddr);
3164         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3165
3166         ev->flags = __cpu_to_le32(flags);
3167
3168         if (name_len > 0)
3169                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3170                                           name, name_len);
3171
3172         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3173                 eir_len = eir_append_data(ev->eir, eir_len,
3174                                           EIR_CLASS_OF_DEV, dev_class, 3);
3175
3176         ev->eir_len = cpu_to_le16(eir_len);
3177
3178         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3179                           sizeof(*ev) + eir_len, NULL);
3180 }
3181
3182 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3183 {
3184         struct mgmt_cp_disconnect *cp = cmd->param;
3185         struct sock **sk = data;
3186         struct mgmt_rp_disconnect rp;
3187
3188         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3189         rp.addr.type = cp->addr.type;
3190
3191         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3192                      sizeof(rp));
3193
3194         *sk = cmd->sk;
3195         sock_hold(*sk);
3196
3197         mgmt_pending_remove(cmd);
3198 }
3199
3200 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3201 {
3202         struct hci_dev *hdev = data;
3203         struct mgmt_cp_unpair_device *cp = cmd->param;
3204         struct mgmt_rp_unpair_device rp;
3205
3206         memset(&rp, 0, sizeof(rp));
3207         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3208         rp.addr.type = cp->addr.type;
3209
3210         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3211
3212         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3213
3214         mgmt_pending_remove(cmd);
3215 }
3216
3217 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3218                              u8 link_type, u8 addr_type, u8 reason)
3219 {
3220         struct mgmt_ev_device_disconnected ev;
3221         struct sock *sk = NULL;
3222         int err;
3223
3224         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3225
3226         bacpy(&ev.addr.bdaddr, bdaddr);
3227         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3228         ev.reason = reason;
3229
3230         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3231                          sk);
3232
3233         if (sk)
3234                 sock_put(sk);
3235
3236         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3237                              hdev);
3238
3239         return err;
3240 }
3241
3242 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3243                            u8 link_type, u8 addr_type, u8 status)
3244 {
3245         struct mgmt_rp_disconnect rp;
3246         struct pending_cmd *cmd;
3247         int err;
3248
3249         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3250                              hdev);
3251
3252         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3253         if (!cmd)
3254                 return -ENOENT;
3255
3256         bacpy(&rp.addr.bdaddr, bdaddr);
3257         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3258
3259         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3260                            mgmt_status(status), &rp, sizeof(rp));
3261
3262         mgmt_pending_remove(cmd);
3263
3264         return err;
3265 }
3266
3267 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3268                         u8 addr_type, u8 status)
3269 {
3270         struct mgmt_ev_connect_failed ev;
3271
3272         bacpy(&ev.addr.bdaddr, bdaddr);
3273         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3274         ev.status = mgmt_status(status);
3275
3276         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3277 }
3278
3279 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3280 {
3281         struct mgmt_ev_pin_code_request ev;
3282
3283         bacpy(&ev.addr.bdaddr, bdaddr);
3284         ev.addr.type = BDADDR_BREDR;
3285         ev.secure = secure;
3286
3287         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3288                           NULL);
3289 }
3290
3291 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3292                                  u8 status)
3293 {
3294         struct pending_cmd *cmd;
3295         struct mgmt_rp_pin_code_reply rp;
3296         int err;
3297
3298         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3299         if (!cmd)
3300                 return -ENOENT;
3301
3302         bacpy(&rp.addr.bdaddr, bdaddr);
3303         rp.addr.type = BDADDR_BREDR;
3304
3305         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3306                            mgmt_status(status), &rp, sizeof(rp));
3307
3308         mgmt_pending_remove(cmd);
3309
3310         return err;
3311 }
3312
3313 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3314                                      u8 status)
3315 {
3316         struct pending_cmd *cmd;
3317         struct mgmt_rp_pin_code_reply rp;
3318         int err;
3319
3320         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3321         if (!cmd)
3322                 return -ENOENT;
3323
3324         bacpy(&rp.addr.bdaddr, bdaddr);
3325         rp.addr.type = BDADDR_BREDR;
3326
3327         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3328                            mgmt_status(status), &rp, sizeof(rp));
3329
3330         mgmt_pending_remove(cmd);
3331
3332         return err;
3333 }
3334
3335 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3336                               u8 link_type, u8 addr_type, __le32 value,
3337                               u8 confirm_hint)
3338 {
3339         struct mgmt_ev_user_confirm_request ev;
3340
3341         BT_DBG("%s", hdev->name);
3342
3343         bacpy(&ev.addr.bdaddr, bdaddr);
3344         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3345         ev.confirm_hint = confirm_hint;
3346         ev.value = value;
3347
3348         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3349                           NULL);
3350 }
3351
3352 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3353                               u8 link_type, u8 addr_type)
3354 {
3355         struct mgmt_ev_user_passkey_request ev;
3356
3357         BT_DBG("%s", hdev->name);
3358
3359         bacpy(&ev.addr.bdaddr, bdaddr);
3360         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3361
3362         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3363                           NULL);
3364 }
3365
3366 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3367                                       u8 link_type, u8 addr_type, u8 status,
3368                                       u8 opcode)
3369 {
3370         struct pending_cmd *cmd;
3371         struct mgmt_rp_user_confirm_reply rp;
3372         int err;
3373
3374         cmd = mgmt_pending_find(opcode, hdev);
3375         if (!cmd)
3376                 return -ENOENT;
3377
3378         bacpy(&rp.addr.bdaddr, bdaddr);
3379         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3380         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3381                            &rp, sizeof(rp));
3382
3383         mgmt_pending_remove(cmd);
3384
3385         return err;
3386 }
3387
3388 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3389                                      u8 link_type, u8 addr_type, u8 status)
3390 {
3391         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3392                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3393 }
3394
3395 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3396                                          u8 link_type, u8 addr_type, u8 status)
3397 {
3398         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3399                                           status,
3400                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3401 }
3402
3403 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3404                                      u8 link_type, u8 addr_type, u8 status)
3405 {
3406         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3407                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3408 }
3409
3410 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3411                                          u8 link_type, u8 addr_type, u8 status)
3412 {
3413         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3414                                           status,
3415                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3416 }
3417
3418 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3419                              u8 link_type, u8 addr_type, u32 passkey,
3420                              u8 entered)
3421 {
3422         struct mgmt_ev_passkey_notify ev;
3423
3424         BT_DBG("%s", hdev->name);
3425
3426         bacpy(&ev.addr.bdaddr, bdaddr);
3427         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3428         ev.passkey = __cpu_to_le32(passkey);
3429         ev.entered = entered;
3430
3431         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3432 }
3433
3434 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3435                      u8 addr_type, u8 status)
3436 {
3437         struct mgmt_ev_auth_failed ev;
3438
3439         bacpy(&ev.addr.bdaddr, bdaddr);
3440         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3441         ev.status = mgmt_status(status);
3442
3443         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3444 }
3445
3446 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3447 {
3448         struct cmd_lookup match = { NULL, hdev };
3449         bool changed = false;
3450         int err = 0;
3451
3452         if (status) {
3453                 u8 mgmt_err = mgmt_status(status);
3454                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3455                                      cmd_status_rsp, &mgmt_err);
3456                 return 0;
3457         }
3458
3459         if (test_bit(HCI_AUTH, &hdev->flags)) {
3460                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3461                         changed = true;
3462         } else {
3463                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3464                         changed = true;
3465         }
3466
3467         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3468                              &match);
3469
3470         if (changed)
3471                 err = new_settings(hdev, match.sk);
3472
3473         if (match.sk)
3474                 sock_put(match.sk);
3475
3476         return err;
3477 }
3478
3479 static int clear_eir(struct hci_dev *hdev)
3480 {
3481         struct hci_cp_write_eir cp;
3482
3483         if (!lmp_ext_inq_capable(hdev))
3484                 return 0;
3485
3486         memset(hdev->eir, 0, sizeof(hdev->eir));
3487
3488         memset(&cp, 0, sizeof(cp));
3489
3490         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3491 }
3492
3493 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3494 {
3495         struct cmd_lookup match = { NULL, hdev };
3496         bool changed = false;
3497         int err = 0;
3498
3499         if (status) {
3500                 u8 mgmt_err = mgmt_status(status);
3501
3502                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3503                                                  &hdev->dev_flags))
3504                         err = new_settings(hdev, NULL);
3505
3506                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3507                                      &mgmt_err);
3508
3509                 return err;
3510         }
3511
3512         if (enable) {
3513                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3514                         changed = true;
3515         } else {
3516                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3517                         changed = true;
3518         }
3519
3520         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3521
3522         if (changed)
3523                 err = new_settings(hdev, match.sk);
3524
3525         if (match.sk)
3526                 sock_put(match.sk);
3527
3528         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3529                 update_eir(hdev);
3530         else
3531                 clear_eir(hdev);
3532
3533         return err;
3534 }
3535
3536 static void class_rsp(struct pending_cmd *cmd, void *data)
3537 {
3538         struct cmd_lookup *match = data;
3539
3540         cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3541                      match->hdev->dev_class, 3);
3542
3543         list_del(&cmd->list);
3544
3545         if (match->sk == NULL) {
3546                 match->sk = cmd->sk;
3547                 sock_hold(match->sk);
3548         }
3549
3550         mgmt_pending_free(cmd);
3551 }
3552
3553 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3554                                    u8 status)
3555 {
3556         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3557         int err = 0;
3558
3559         clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3560
3561         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3562         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3563         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3564
3565         if (!status)
3566                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3567                                  3, NULL);
3568
3569         if (match.sk)
3570                 sock_put(match.sk);
3571
3572         return err;
3573 }
3574
3575 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3576 {
3577         struct pending_cmd *cmd;
3578         struct mgmt_cp_set_local_name ev;
3579         bool changed = false;
3580         int err = 0;
3581
3582         if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3583                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3584                 changed = true;
3585         }
3586
3587         memset(&ev, 0, sizeof(ev));
3588         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3589         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3590
3591         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3592         if (!cmd)
3593                 goto send_event;
3594
3595         /* Always assume that either the short or the complete name has
3596          * changed if there was a pending mgmt command */
3597         changed = true;
3598
3599         if (status) {
3600                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3601                                  mgmt_status(status));
3602                 goto failed;
3603         }
3604
3605         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3606                            sizeof(ev));
3607         if (err < 0)
3608                 goto failed;
3609
3610 send_event:
3611         if (changed)
3612                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3613                                  sizeof(ev), cmd ? cmd->sk : NULL);
3614
3615         /* EIR is taken care of separately when powering on the
3616          * adapter so only update them here if this is a name change
3617          * unrelated to power on.
3618          */
3619         if (!test_bit(HCI_INIT, &hdev->flags))
3620                 update_eir(hdev);
3621
3622 failed:
3623         if (cmd)
3624                 mgmt_pending_remove(cmd);
3625         return err;
3626 }
3627
3628 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3629                                             u8 *randomizer, u8 status)
3630 {
3631         struct pending_cmd *cmd;
3632         int err;
3633
3634         BT_DBG("%s status %u", hdev->name, status);
3635
3636         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3637         if (!cmd)
3638                 return -ENOENT;
3639
3640         if (status) {
3641                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3642                                  mgmt_status(status));
3643         } else {
3644                 struct mgmt_rp_read_local_oob_data rp;
3645
3646                 memcpy(rp.hash, hash, sizeof(rp.hash));
3647                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3648
3649                 err = cmd_complete(cmd->sk, hdev->id,
3650                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3651                                    sizeof(rp));
3652         }
3653
3654         mgmt_pending_remove(cmd);
3655
3656         return err;
3657 }
3658
3659 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3660 {
3661         struct cmd_lookup match = { NULL, hdev };
3662         bool changed = false;
3663         int err = 0;
3664
3665         if (status) {
3666                 u8 mgmt_err = mgmt_status(status);
3667
3668                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3669                                                  &hdev->dev_flags))
3670                         err = new_settings(hdev, NULL);
3671
3672                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3673                                      &mgmt_err);
3674
3675                 return err;
3676         }
3677
3678         if (enable) {
3679                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3680                         changed = true;
3681         } else {
3682                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3683                         changed = true;
3684         }
3685
3686         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3687
3688         if (changed)
3689                 err = new_settings(hdev, match.sk);
3690
3691         if (match.sk)
3692                 sock_put(match.sk);
3693
3694         return err;
3695 }
3696
3697 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3698                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3699                       ssp, u8 *eir, u16 eir_len)
3700 {
3701         char buf[512];
3702         struct mgmt_ev_device_found *ev = (void *) buf;
3703         size_t ev_size;
3704
3705         /* Leave 5 bytes for a potential CoD field */
3706         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3707                 return -EINVAL;
3708
3709         memset(buf, 0, sizeof(buf));
3710
3711         bacpy(&ev->addr.bdaddr, bdaddr);
3712         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3713         ev->rssi = rssi;
3714         if (cfm_name)
3715                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
3716         if (!ssp)
3717                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
3718
3719         if (eir_len > 0)
3720                 memcpy(ev->eir, eir, eir_len);
3721
3722         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3723                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3724                                           dev_class, 3);
3725
3726         ev->eir_len = cpu_to_le16(eir_len);
3727         ev_size = sizeof(*ev) + eir_len;
3728
3729         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3730 }
3731
3732 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3733                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3734 {
3735         struct mgmt_ev_device_found *ev;
3736         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3737         u16 eir_len;
3738
3739         ev = (struct mgmt_ev_device_found *) buf;
3740
3741         memset(buf, 0, sizeof(buf));
3742
3743         bacpy(&ev->addr.bdaddr, bdaddr);
3744         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3745         ev->rssi = rssi;
3746
3747         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3748                                   name_len);
3749
3750         ev->eir_len = cpu_to_le16(eir_len);
3751
3752         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3753                           sizeof(*ev) + eir_len, NULL);
3754 }
3755
3756 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3757 {
3758         struct pending_cmd *cmd;
3759         u8 type;
3760         int err;
3761
3762         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3763
3764         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3765         if (!cmd)
3766                 return -ENOENT;
3767
3768         type = hdev->discovery.type;
3769
3770         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3771                            &type, sizeof(type));
3772         mgmt_pending_remove(cmd);
3773
3774         return err;
3775 }
3776
3777 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3778 {
3779         struct pending_cmd *cmd;
3780         int err;
3781
3782         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3783         if (!cmd)
3784                 return -ENOENT;
3785
3786         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3787                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3788         mgmt_pending_remove(cmd);
3789
3790         return err;
3791 }
3792
3793 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3794 {
3795         struct mgmt_ev_discovering ev;
3796         struct pending_cmd *cmd;
3797
3798         BT_DBG("%s discovering %u", hdev->name, discovering);
3799
3800         if (discovering)
3801                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3802         else
3803                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3804
3805         if (cmd != NULL) {
3806                 u8 type = hdev->discovery.type;
3807
3808                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3809                              sizeof(type));
3810                 mgmt_pending_remove(cmd);
3811         }
3812
3813         memset(&ev, 0, sizeof(ev));
3814         ev.type = hdev->discovery.type;
3815         ev.discovering = discovering;
3816
3817         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3818 }
3819
3820 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3821 {
3822         struct pending_cmd *cmd;
3823         struct mgmt_ev_device_blocked ev;
3824
3825         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3826
3827         bacpy(&ev.addr.bdaddr, bdaddr);
3828         ev.addr.type = type;
3829
3830         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3831                           cmd ? cmd->sk : NULL);
3832 }
3833
3834 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3835 {
3836         struct pending_cmd *cmd;
3837         struct mgmt_ev_device_unblocked ev;
3838
3839         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3840
3841         bacpy(&ev.addr.bdaddr, bdaddr);
3842         ev.addr.type = type;
3843
3844         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3845                           cmd ? cmd->sk : NULL);
3846 }
3847
3848 module_param(enable_hs, bool, 0644);
3849 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");