net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   2
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 /*
 106  * These LE scan and inquiry parameters were chosen according to LE General
 107  * Discovery Procedure specification.
 108  */
 109 #define LE_SCAN_TYPE                    0x01
 110 #define LE_SCAN_WIN                     0x12
 111 #define LE_SCAN_INT                     0x12
 112 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 113 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 114
 115 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 116 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 117
 118 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 119
 120 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 121                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 122
 123 struct pending_cmd {
 124         struct list_head list;
 125         u16 opcode;
 126         int index;
 127         void *param;
 128         struct sock *sk;
 129         void *user_data;
 130 };
 131
 132 /* HCI to MGMT error code conversion table */
 133 static u8 mgmt_status_table[] = {
 134         MGMT_STATUS_SUCCESS,
 135         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 136         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 137         MGMT_STATUS_FAILED,             /* Hardware Failure */
 138         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 139         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 140         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 141         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 142         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 145         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 146         MGMT_STATUS_BUSY,               /* Command Disallowed */
 147         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 148         MGMT_STATUS_REJECTED,           /* Rejected Security */
 149         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 150         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 151         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 153         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 154         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 155         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 156         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 157         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 158         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 159         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 161         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 162         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 163         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 165         MGMT_STATUS_FAILED,             /* Unspecified Error */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 167         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 168         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 169         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 170         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 171         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 172         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 174         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 176         MGMT_STATUS_FAILED,             /* Transaction Collision */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 178         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 180         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 181         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 182         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 183         MGMT_STATUS_FAILED,             /* Slot Violation */
 184         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 185         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 187         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 188         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 189         MGMT_STATUS_BUSY,               /* Controller Busy */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 191         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 192         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 193         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 194         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 195 };
 196
 197 bool mgmt_valid_hdev(struct hci_dev *hdev)
 198 {
 199         return hdev->dev_type == HCI_BREDR;
 200 }
 201
 202 static u8 mgmt_status(u8 hci_status)
 203 {
 204         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 205                 return mgmt_status_table[hci_status];
 206
 207         return MGMT_STATUS_FAILED;
 208 }
 209
 210 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 211 {
 212         struct sk_buff *skb;
 213         struct mgmt_hdr *hdr;
 214         struct mgmt_ev_cmd_status *ev;
 215         int err;
 216
 217         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 218
 219         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 220         if (!skb)
 221                 return -ENOMEM;
 222
 223         hdr = (void *) skb_put(skb, sizeof(*hdr));
 224
 225         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 226         hdr->index = cpu_to_le16(index);
 227         hdr->len = cpu_to_le16(sizeof(*ev));
 228
 229         ev = (void *) skb_put(skb, sizeof(*ev));
 230         ev->status = status;
 231         ev->opcode = cpu_to_le16(cmd);
 232
 233         err = sock_queue_rcv_skb(sk, skb);
 234         if (err < 0)
 235                 kfree_skb(skb);
 236
 237         return err;
 238 }
 239
 240 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 241                         void *rp, size_t rp_len)
 242 {
 243         struct sk_buff *skb;
 244         struct mgmt_hdr *hdr;
 245         struct mgmt_ev_cmd_complete *ev;
 246         int err;
 247
 248         BT_DBG("sock %p", sk);
 249
 250         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 251         if (!skb)
 252                 return -ENOMEM;
 253
 254         hdr = (void *) skb_put(skb, sizeof(*hdr));
 255
 256         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 257         hdr->index = cpu_to_le16(index);
 258         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 259
 260         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 261         ev->opcode = cpu_to_le16(cmd);
 262         ev->status = status;
 263
 264         if (rp)
 265                 memcpy(ev->data, rp, rp_len);
 266
 267         err = sock_queue_rcv_skb(sk, skb);
 268         if (err < 0)
 269                 kfree_skb(skb);
 270
 271         return err;
 272 }
 273
 274 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 275                         u16 data_len)
 276 {
 277         struct mgmt_rp_read_version rp;
 278
 279         BT_DBG("sock %p", sk);
 280
 281         rp.version = MGMT_VERSION;
 282         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 283
 284         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 285                             sizeof(rp));
 286 }
 287
 288 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 289                          u16 data_len)
 290 {
 291         struct mgmt_rp_read_commands *rp;
 292         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 293         const u16 num_events = ARRAY_SIZE(mgmt_events);
 294         __le16 *opcode;
 295         size_t rp_size;
 296         int i, err;
 297
 298         BT_DBG("sock %p", sk);
 299
 300         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 301
 302         rp = kmalloc(rp_size, GFP_KERNEL);
 303         if (!rp)
 304                 return -ENOMEM;
 305
 306         rp->num_commands = __constant_cpu_to_le16(num_commands);
 307         rp->num_events = __constant_cpu_to_le16(num_events);
 308
 309         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 310                 put_unaligned_le16(mgmt_commands[i], opcode);
 311
 312         for (i = 0; i < num_events; i++, opcode++)
 313                 put_unaligned_le16(mgmt_events[i], opcode);
 314
 315         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 316                            rp_size);
 317         kfree(rp);
 318
 319         return err;
 320 }
 321
 322 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 323                            u16 data_len)
 324 {
 325         struct mgmt_rp_read_index_list *rp;
 326         struct hci_dev *d;
 327         size_t rp_len;
 328         u16 count;
 329         int i, err;
 330
 331         BT_DBG("sock %p", sk);
 332
 333         read_lock(&hci_dev_list_lock);
 334
 335         count = 0;
 336         list_for_each_entry(d, &hci_dev_list, list) {
 337                 if (!mgmt_valid_hdev(d))
 338                         continue;
 339
 340                 count++;
 341         }
 342
 343         rp_len = sizeof(*rp) + (2 * count);
 344         rp = kmalloc(rp_len, GFP_ATOMIC);
 345         if (!rp) {
 346                 read_unlock(&hci_dev_list_lock);
 347                 return -ENOMEM;
 348         }
 349
 350         rp->num_controllers = cpu_to_le16(count);
 351
 352         i = 0;
 353         list_for_each_entry(d, &hci_dev_list, list) {
 354                 if (test_bit(HCI_SETUP, &d->dev_flags))
 355                         continue;
 356
 357                 if (!mgmt_valid_hdev(d))
 358                         continue;
 359
 360                 rp->index[i++] = cpu_to_le16(d->id);
 361                 BT_DBG("Added hci%u", d->id);
 362         }
 363
 364         read_unlock(&hci_dev_list_lock);
 365
 366         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 367                            rp_len);
 368
 369         kfree(rp);
 370
 371         return err;
 372 }
 373
 374 static u32 get_supported_settings(struct hci_dev *hdev)
 375 {
 376         u32 settings = 0;
 377
 378         settings |= MGMT_SETTING_POWERED;
 379         settings |= MGMT_SETTING_PAIRABLE;
 380
 381         if (lmp_ssp_capable(hdev))
 382                 settings |= MGMT_SETTING_SSP;
 383
 384         if (lmp_bredr_capable(hdev)) {
 385                 settings |= MGMT_SETTING_CONNECTABLE;
 386                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 387                 settings |= MGMT_SETTING_DISCOVERABLE;
 388                 settings |= MGMT_SETTING_BREDR;
 389                 settings |= MGMT_SETTING_LINK_SECURITY;
 390         }
 391
 392         if (enable_hs)
 393                 settings |= MGMT_SETTING_HS;
 394
 395         if (lmp_le_capable(hdev))
 396                 settings |= MGMT_SETTING_LE;
 397
 398         return settings;
 399 }
 400
 401 static u32 get_current_settings(struct hci_dev *hdev)
 402 {
 403         u32 settings = 0;
 404
 405         if (hdev_is_powered(hdev))
 406                 settings |= MGMT_SETTING_POWERED;
 407
 408         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 409                 settings |= MGMT_SETTING_CONNECTABLE;
 410
 411         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 412                 settings |= MGMT_SETTING_DISCOVERABLE;
 413
 414         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 415                 settings |= MGMT_SETTING_PAIRABLE;
 416
 417         if (lmp_bredr_capable(hdev))
 418                 settings |= MGMT_SETTING_BREDR;
 419
 420         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 421                 settings |= MGMT_SETTING_LE;
 422
 423         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 424                 settings |= MGMT_SETTING_LINK_SECURITY;
 425
 426         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 427                 settings |= MGMT_SETTING_SSP;
 428
 429         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 430                 settings |= MGMT_SETTING_HS;
 431
 432         return settings;
 433 }
 434
 435 #define PNP_INFO_SVCLASS_ID             0x1200
 436
 437 static u8 bluetooth_base_uuid[] = {
 438                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 439                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 440 };
 441
 442 static u16 get_uuid16(u8 *uuid128)
 443 {
 444         u32 val;
 445         int i;
 446
 447         for (i = 0; i < 12; i++) {
 448                 if (bluetooth_base_uuid[i] != uuid128[i])
 449                         return 0;
 450         }
 451
 452         val = get_unaligned_le32(&uuid128[12]);
 453         if (val > 0xffff)
 454                 return 0;
 455
 456         return (u16) val;
 457 }
 458
 459 static void create_eir(struct hci_dev *hdev, u8 *data)
 460 {
 461         u8 *ptr = data;
 462         u16 eir_len = 0;
 463         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 464         int i, truncated = 0;
 465         struct bt_uuid *uuid;
 466         size_t name_len;
 467
 468         name_len = strlen(hdev->dev_name);
 469
 470         if (name_len > 0) {
 471                 /* EIR Data type */
 472                 if (name_len > 48) {
 473                         name_len = 48;
 474                         ptr[1] = EIR_NAME_SHORT;
 475                 } else
 476                         ptr[1] = EIR_NAME_COMPLETE;
 477
 478                 /* EIR Data length */
 479                 ptr[0] = name_len + 1;
 480
 481                 memcpy(ptr + 2, hdev->dev_name, name_len);
 482
 483                 eir_len += (name_len + 2);
 484                 ptr += (name_len + 2);
 485         }
 486
 487         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 488                 ptr[0] = 2;
 489                 ptr[1] = EIR_TX_POWER;
 490                 ptr[2] = (u8) hdev->inq_tx_power;
 491
 492                 eir_len += 3;
 493                 ptr += 3;
 494         }
 495
 496         if (hdev->devid_source > 0) {
 497                 ptr[0] = 9;
 498                 ptr[1] = EIR_DEVICE_ID;
 499
 500                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 501                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 502                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 503                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 504
 505                 eir_len += 10;
 506                 ptr += 10;
 507         }
 508
 509         memset(uuid16_list, 0, sizeof(uuid16_list));
 510
 511         /* Group all UUID16 types */
 512         list_for_each_entry(uuid, &hdev->uuids, list) {
 513                 u16 uuid16;
 514
 515                 uuid16 = get_uuid16(uuid->uuid);
 516                 if (uuid16 == 0)
 517                         return;
 518
 519                 if (uuid16 < 0x1100)
 520                         continue;
 521
 522                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 523                         continue;
 524
 525                 /* Stop if not enough space to put next UUID */
 526                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 527                         truncated = 1;
 528                         break;
 529                 }
 530
 531                 /* Check for duplicates */
 532                 for (i = 0; uuid16_list[i] != 0; i++)
 533                         if (uuid16_list[i] == uuid16)
 534                                 break;
 535
 536                 if (uuid16_list[i] == 0) {
 537                         uuid16_list[i] = uuid16;
 538                         eir_len += sizeof(u16);
 539                 }
 540         }
 541
 542         if (uuid16_list[0] != 0) {
 543                 u8 *length = ptr;
 544
 545                 /* EIR Data type */
 546                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 547
 548                 ptr += 2;
 549                 eir_len += 2;
 550
 551                 for (i = 0; uuid16_list[i] != 0; i++) {
 552                         *ptr++ = (uuid16_list[i] & 0x00ff);
 553                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 554                 }
 555
 556                 /* EIR Data length */
 557                 *length = (i * sizeof(u16)) + 1;
 558         }
 559 }
 560
 561 static int update_eir(struct hci_dev *hdev)
 562 {
 563         struct hci_cp_write_eir cp;
 564
 565         if (!hdev_is_powered(hdev))
 566                 return 0;
 567
 568         if (!lmp_ext_inq_capable(hdev))
 569                 return 0;
 570
 571         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 572                 return 0;
 573
 574         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 575                 return 0;
 576
 577         memset(&cp, 0, sizeof(cp));
 578
 579         create_eir(hdev, cp.data);
 580
 581         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 582                 return 0;
 583
 584         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 585
 586         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 587 }
 588
 589 static u8 get_service_classes(struct hci_dev *hdev)
 590 {
 591         struct bt_uuid *uuid;
 592         u8 val = 0;
 593
 594         list_for_each_entry(uuid, &hdev->uuids, list)
 595                 val |= uuid->svc_hint;
 596
 597         return val;
 598 }
 599
 600 static int update_class(struct hci_dev *hdev)
 601 {
 602         u8 cod[3];
 603         int err;
 604
 605         BT_DBG("%s", hdev->name);
 606
 607         if (!hdev_is_powered(hdev))
 608                 return 0;
 609
 610         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 611                 return 0;
 612
 613         cod[0] = hdev->minor_class;
 614         cod[1] = hdev->major_class;
 615         cod[2] = get_service_classes(hdev);
 616
 617         if (memcmp(cod, hdev->dev_class, 3) == 0)
 618                 return 0;
 619
 620         err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 621         if (err == 0)
 622                 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
 623
 624         return err;
 625 }
 626
 627 static void service_cache_off(struct work_struct *work)
 628 {
 629         struct hci_dev *hdev = container_of(work, struct hci_dev,
 630                                             service_cache.work);
 631
 632         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 633                 return;
 634
 635         hci_dev_lock(hdev);
 636
 637         update_eir(hdev);
 638         update_class(hdev);
 639
 640         hci_dev_unlock(hdev);
 641 }
 642
 643 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 644 {
 645         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 646                 return;
 647
 648         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 649
 650         /* Non-mgmt controlled devices get this bit set
 651          * implicitly so that pairing works for them, however
 652          * for mgmt we require user-space to explicitly enable
 653          * it
 654          */
 655         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 656 }
 657
 658 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 659                                 void *data, u16 data_len)
 660 {
 661         struct mgmt_rp_read_info rp;
 662
 663         BT_DBG("sock %p %s", sk, hdev->name);
 664
 665         hci_dev_lock(hdev);
 666
 667         memset(&rp, 0, sizeof(rp));
 668
 669         bacpy(&rp.bdaddr, &hdev->bdaddr);
 670
 671         rp.version = hdev->hci_ver;
 672         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 673
 674         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 675         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 676
 677         memcpy(rp.dev_class, hdev->dev_class, 3);
 678
 679         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 680         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 681
 682         hci_dev_unlock(hdev);
 683
 684         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 685                             sizeof(rp));
 686 }
 687
 688 static void mgmt_pending_free(struct pending_cmd *cmd)
 689 {
 690         sock_put(cmd->sk);
 691         kfree(cmd->param);
 692         kfree(cmd);
 693 }
 694
 695 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 696                                             struct hci_dev *hdev, void *data,
 697                                             u16 len)
 698 {
 699         struct pending_cmd *cmd;
 700
 701         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 702         if (!cmd)
 703                 return NULL;
 704
 705         cmd->opcode = opcode;
 706         cmd->index = hdev->id;
 707
 708         cmd->param = kmalloc(len, GFP_KERNEL);
 709         if (!cmd->param) {
 710                 kfree(cmd);
 711                 return NULL;
 712         }
 713
 714         if (data)
 715                 memcpy(cmd->param, data, len);
 716
 717         cmd->sk = sk;
 718         sock_hold(sk);
 719
 720         list_add(&cmd->list, &hdev->mgmt_pending);
 721
 722         return cmd;
 723 }
 724
 725 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 726                                  void (*cb)(struct pending_cmd *cmd,
 727                                             void *data),
 728                                  void *data)
 729 {
 730         struct list_head *p, *n;
 731
 732         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 733                 struct pending_cmd *cmd;
 734
 735                 cmd = list_entry(p, struct pending_cmd, list);
 736
 737                 if (opcode > 0 && cmd->opcode != opcode)
 738                         continue;
 739
 740                 cb(cmd, data);
 741         }
 742 }
 743
 744 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 745 {
 746         struct pending_cmd *cmd;
 747
 748         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 749                 if (cmd->opcode == opcode)
 750                         return cmd;
 751         }
 752
 753         return NULL;
 754 }
 755
 756 static void mgmt_pending_remove(struct pending_cmd *cmd)
 757 {
 758         list_del(&cmd->list);
 759         mgmt_pending_free(cmd);
 760 }
 761
 762 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 763 {
 764         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 765
 766         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 767                             sizeof(settings));
 768 }
 769
 770 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 771                        u16 len)
 772 {
 773         struct mgmt_mode *cp = data;
 774         struct pending_cmd *cmd;
 775         int err;
 776
 777         BT_DBG("request for %s", hdev->name);
 778
 779         hci_dev_lock(hdev);
 780
 781         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 782                 cancel_delayed_work(&hdev->power_off);
 783
 784                 if (cp->val) {
 785                         err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 786                         mgmt_powered(hdev, 1);
 787                         goto failed;
 788                 }
 789         }
 790
 791         if (!!cp->val == hdev_is_powered(hdev)) {
 792                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 793                 goto failed;
 794         }
 795
 796         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 797                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 798                                  MGMT_STATUS_BUSY);
 799                 goto failed;
 800         }
 801
 802         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 803         if (!cmd) {
 804                 err = -ENOMEM;
 805                 goto failed;
 806         }
 807
 808         if (cp->val)
 809                 schedule_work(&hdev->power_on);
 810         else
 811                 schedule_work(&hdev->power_off.work);
 812
 813         err = 0;
 814
 815 failed:
 816         hci_dev_unlock(hdev);
 817         return err;
 818 }
 819
 820 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 821                       struct sock *skip_sk)
 822 {
 823         struct sk_buff *skb;
 824         struct mgmt_hdr *hdr;
 825
 826         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 827         if (!skb)
 828                 return -ENOMEM;
 829
 830         hdr = (void *) skb_put(skb, sizeof(*hdr));
 831         hdr->opcode = cpu_to_le16(event);
 832         if (hdev)
 833                 hdr->index = cpu_to_le16(hdev->id);
 834         else
 835                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 836         hdr->len = cpu_to_le16(data_len);
 837
 838         if (data)
 839                 memcpy(skb_put(skb, data_len), data, data_len);
 840
 841         /* Time stamp */
 842         __net_timestamp(skb);
 843
 844         hci_send_to_control(skb, skip_sk);
 845         kfree_skb(skb);
 846
 847         return 0;
 848 }
 849
 850 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 851 {
 852         __le32 ev;
 853
 854         ev = cpu_to_le32(get_current_settings(hdev));
 855
 856         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 857 }
 858
 859 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 860                             u16 len)
 861 {
 862         struct mgmt_cp_set_discoverable *cp = data;
 863         struct pending_cmd *cmd;
 864         u16 timeout;
 865         u8 scan;
 866         int err;
 867
 868         BT_DBG("request for %s", hdev->name);
 869
 870         if (!lmp_bredr_capable(hdev))
 871                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 872                                  MGMT_STATUS_NOT_SUPPORTED);
 873
 874         timeout = __le16_to_cpu(cp->timeout);
 875         if (!cp->val && timeout > 0)
 876                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 877                                   MGMT_STATUS_INVALID_PARAMS);
 878
 879         hci_dev_lock(hdev);
 880
 881         if (!hdev_is_powered(hdev) && timeout > 0) {
 882                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 883                                  MGMT_STATUS_NOT_POWERED);
 884                 goto failed;
 885         }
 886
 887         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 888             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 889                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 890                                  MGMT_STATUS_BUSY);
 891                 goto failed;
 892         }
 893
 894         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 895                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 896                                  MGMT_STATUS_REJECTED);
 897                 goto failed;
 898         }
 899
 900         if (!hdev_is_powered(hdev)) {
 901                 bool changed = false;
 902
 903                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 904                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 905                         changed = true;
 906                 }
 907
 908                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 909                 if (err < 0)
 910                         goto failed;
 911
 912                 if (changed)
 913                         err = new_settings(hdev, sk);
 914
 915                 goto failed;
 916         }
 917
 918         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 919                 if (hdev->discov_timeout > 0) {
 920                         cancel_delayed_work(&hdev->discov_off);
 921                         hdev->discov_timeout = 0;
 922                 }
 923
 924                 if (cp->val && timeout > 0) {
 925                         hdev->discov_timeout = timeout;
 926                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 927                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 928                 }
 929
 930                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 931                 goto failed;
 932         }
 933
 934         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 935         if (!cmd) {
 936                 err = -ENOMEM;
 937                 goto failed;
 938         }
 939
 940         scan = SCAN_PAGE;
 941
 942         if (cp->val)
 943                 scan |= SCAN_INQUIRY;
 944         else
 945                 cancel_delayed_work(&hdev->discov_off);
 946
 947         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 948         if (err < 0)
 949                 mgmt_pending_remove(cmd);
 950
 951         if (cp->val)
 952                 hdev->discov_timeout = timeout;
 953
 954 failed:
 955         hci_dev_unlock(hdev);
 956         return err;
 957 }
 958
 959 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
 960                            u16 len)
 961 {
 962         struct mgmt_mode *cp = data;
 963         struct pending_cmd *cmd;
 964         u8 scan;
 965         int err;
 966
 967         BT_DBG("request for %s", hdev->name);
 968
 969         if (!lmp_bredr_capable(hdev))
 970                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
 971                                   MGMT_STATUS_NOT_SUPPORTED);
 972
 973         hci_dev_lock(hdev);
 974
 975         if (!hdev_is_powered(hdev)) {
 976                 bool changed = false;
 977
 978                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 979                         changed = true;
 980
 981                 if (cp->val) {
 982                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 983                 } else {
 984                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 985                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 986                 }
 987
 988                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 989                 if (err < 0)
 990                         goto failed;
 991
 992                 if (changed)
 993                         err = new_settings(hdev, sk);
 994
 995                 goto failed;
 996         }
 997
 998         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 999             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1000                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1001                                  MGMT_STATUS_BUSY);
1002                 goto failed;
1003         }
1004
1005         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1006                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1007                 goto failed;
1008         }
1009
1010         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1011         if (!cmd) {
1012                 err = -ENOMEM;
1013                 goto failed;
1014         }
1015
1016         if (cp->val) {
1017                 scan = SCAN_PAGE;
1018         } else {
1019                 scan = 0;
1020
1021                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1022                     hdev->discov_timeout > 0)
1023                         cancel_delayed_work(&hdev->discov_off);
1024         }
1025
1026         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1027         if (err < 0)
1028                 mgmt_pending_remove(cmd);
1029
1030 failed:
1031         hci_dev_unlock(hdev);
1032         return err;
1033 }
1034
1035 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1036                         u16 len)
1037 {
1038         struct mgmt_mode *cp = data;
1039         int err;
1040
1041         BT_DBG("request for %s", hdev->name);
1042
1043         hci_dev_lock(hdev);
1044
1045         if (cp->val)
1046                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1047         else
1048                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1049
1050         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1051         if (err < 0)
1052                 goto failed;
1053
1054         err = new_settings(hdev, sk);
1055
1056 failed:
1057         hci_dev_unlock(hdev);
1058         return err;
1059 }
1060
1061 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1062                              u16 len)
1063 {
1064         struct mgmt_mode *cp = data;
1065         struct pending_cmd *cmd;
1066         u8 val;
1067         int err;
1068
1069         BT_DBG("request for %s", hdev->name);
1070
1071         if (!lmp_bredr_capable(hdev))
1072                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1073                                   MGMT_STATUS_NOT_SUPPORTED);
1074
1075         hci_dev_lock(hdev);
1076
1077         if (!hdev_is_powered(hdev)) {
1078                 bool changed = false;
1079
1080                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1081                                           &hdev->dev_flags)) {
1082                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1083                         changed = true;
1084                 }
1085
1086                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1087                 if (err < 0)
1088                         goto failed;
1089
1090                 if (changed)
1091                         err = new_settings(hdev, sk);
1092
1093                 goto failed;
1094         }
1095
1096         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1097                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1098                                  MGMT_STATUS_BUSY);
1099                 goto failed;
1100         }
1101
1102         val = !!cp->val;
1103
1104         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1105                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1106                 goto failed;
1107         }
1108
1109         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1110         if (!cmd) {
1111                 err = -ENOMEM;
1112                 goto failed;
1113         }
1114
1115         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1116         if (err < 0) {
1117                 mgmt_pending_remove(cmd);
1118                 goto failed;
1119         }
1120
1121 failed:
1122         hci_dev_unlock(hdev);
1123         return err;
1124 }
1125
1126 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1127 {
1128         struct mgmt_mode *cp = data;
1129         struct pending_cmd *cmd;
1130         u8 val;
1131         int err;
1132
1133         BT_DBG("request for %s", hdev->name);
1134
1135         hci_dev_lock(hdev);
1136
1137         if (!lmp_ssp_capable(hdev)) {
1138                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1139                                  MGMT_STATUS_NOT_SUPPORTED);
1140                 goto failed;
1141         }
1142
1143         val = !!cp->val;
1144
1145         if (!hdev_is_powered(hdev)) {
1146                 bool changed = false;
1147
1148                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1149                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1150                         changed = true;
1151                 }
1152
1153                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1154                 if (err < 0)
1155                         goto failed;
1156
1157                 if (changed)
1158                         err = new_settings(hdev, sk);
1159
1160                 goto failed;
1161         }
1162
1163         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1164                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1165                                  MGMT_STATUS_BUSY);
1166                 goto failed;
1167         }
1168
1169         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1170                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1171                 goto failed;
1172         }
1173
1174         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1175         if (!cmd) {
1176                 err = -ENOMEM;
1177                 goto failed;
1178         }
1179
1180         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1181         if (err < 0) {
1182                 mgmt_pending_remove(cmd);
1183                 goto failed;
1184         }
1185
1186 failed:
1187         hci_dev_unlock(hdev);
1188         return err;
1189 }
1190
1191 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1192 {
1193         struct mgmt_mode *cp = data;
1194
1195         BT_DBG("request for %s", hdev->name);
1196
1197         if (!enable_hs)
1198                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1199                                   MGMT_STATUS_NOT_SUPPORTED);
1200
1201         if (cp->val)
1202                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1203         else
1204                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1205
1206         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1207 }
1208
1209 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1210 {
1211         struct mgmt_mode *cp = data;
1212         struct hci_cp_write_le_host_supported hci_cp;
1213         struct pending_cmd *cmd;
1214         int err;
1215         u8 val, enabled;
1216
1217         BT_DBG("request for %s", hdev->name);
1218
1219         hci_dev_lock(hdev);
1220
1221         if (!lmp_le_capable(hdev)) {
1222                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1223                                  MGMT_STATUS_NOT_SUPPORTED);
1224                 goto unlock;
1225         }
1226
1227         val = !!cp->val;
1228         enabled = !!lmp_host_le_capable(hdev);
1229
1230         if (!hdev_is_powered(hdev) || val == enabled) {
1231                 bool changed = false;
1232
1233                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1234                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1235                         changed = true;
1236                 }
1237
1238                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1239                 if (err < 0)
1240                         goto unlock;
1241
1242                 if (changed)
1243                         err = new_settings(hdev, sk);
1244
1245                 goto unlock;
1246         }
1247
1248         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1249                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1250                                  MGMT_STATUS_BUSY);
1251                 goto unlock;
1252         }
1253
1254         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1255         if (!cmd) {
1256                 err = -ENOMEM;
1257                 goto unlock;
1258         }
1259
1260         memset(&hci_cp, 0, sizeof(hci_cp));
1261
1262         if (val) {
1263                 hci_cp.le = val;
1264                 hci_cp.simul = !!lmp_le_br_capable(hdev);
1265         }
1266
1267         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1268                            &hci_cp);
1269         if (err < 0)
1270                 mgmt_pending_remove(cmd);
1271
1272 unlock:
1273         hci_dev_unlock(hdev);
1274         return err;
1275 }
1276
1277 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1278 {
1279         struct mgmt_cp_add_uuid *cp = data;
1280         struct pending_cmd *cmd;
1281         struct bt_uuid *uuid;
1282         int err;
1283
1284         BT_DBG("request for %s", hdev->name);
1285
1286         hci_dev_lock(hdev);
1287
1288         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1289                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1290                                  MGMT_STATUS_BUSY);
1291                 goto failed;
1292         }
1293
1294         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1295         if (!uuid) {
1296                 err = -ENOMEM;
1297                 goto failed;
1298         }
1299
1300         memcpy(uuid->uuid, cp->uuid, 16);
1301         uuid->svc_hint = cp->svc_hint;
1302
1303         list_add(&uuid->list, &hdev->uuids);
1304
1305         err = update_class(hdev);
1306         if (err < 0)
1307                 goto failed;
1308
1309         err = update_eir(hdev);
1310         if (err < 0)
1311                 goto failed;
1312
1313         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1314                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1315                                    hdev->dev_class, 3);
1316                 goto failed;
1317         }
1318
1319         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1320         if (!cmd)
1321                 err = -ENOMEM;
1322
1323 failed:
1324         hci_dev_unlock(hdev);
1325         return err;
1326 }
1327
1328 static bool enable_service_cache(struct hci_dev *hdev)
1329 {
1330         if (!hdev_is_powered(hdev))
1331                 return false;
1332
1333         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1334                 schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
1335                 return true;
1336         }
1337
1338         return false;
1339 }
1340
1341 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1342                        u16 len)
1343 {
1344         struct mgmt_cp_remove_uuid *cp = data;
1345         struct pending_cmd *cmd;
1346         struct list_head *p, *n;
1347         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1348         int err, found;
1349
1350         BT_DBG("request for %s", hdev->name);
1351
1352         hci_dev_lock(hdev);
1353
1354         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1355                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1356                                  MGMT_STATUS_BUSY);
1357                 goto unlock;
1358         }
1359
1360         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1361                 err = hci_uuids_clear(hdev);
1362
1363                 if (enable_service_cache(hdev)) {
1364                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1365                                            0, hdev->dev_class, 3);
1366                         goto unlock;
1367                 }
1368
1369                 goto update_class;
1370         }
1371
1372         found = 0;
1373
1374         list_for_each_safe(p, n, &hdev->uuids) {
1375                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1376
1377                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1378                         continue;
1379
1380                 list_del(&match->list);
1381                 found++;
1382         }
1383
1384         if (found == 0) {
1385                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1386                                  MGMT_STATUS_INVALID_PARAMS);
1387                 goto unlock;
1388         }
1389
1390 update_class:
1391         err = update_class(hdev);
1392         if (err < 0)
1393                 goto unlock;
1394
1395         err = update_eir(hdev);
1396         if (err < 0)
1397                 goto unlock;
1398
1399         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1400                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1401                                    hdev->dev_class, 3);
1402                 goto unlock;
1403         }
1404
1405         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1406         if (!cmd)
1407                 err = -ENOMEM;
1408
1409 unlock:
1410         hci_dev_unlock(hdev);
1411         return err;
1412 }
1413
1414 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1415                          u16 len)
1416 {
1417         struct mgmt_cp_set_dev_class *cp = data;
1418         struct pending_cmd *cmd;
1419         int err;
1420
1421         BT_DBG("request for %s", hdev->name);
1422
1423         hci_dev_lock(hdev);
1424
1425         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1426                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1427                                  MGMT_STATUS_BUSY);
1428                 goto unlock;
1429         }
1430
1431         hdev->major_class = cp->major;
1432         hdev->minor_class = cp->minor;
1433
1434         if (!hdev_is_powered(hdev)) {
1435                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1436                                    hdev->dev_class, 3);
1437                 goto unlock;
1438         }
1439
1440         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1441                 hci_dev_unlock(hdev);
1442                 cancel_delayed_work_sync(&hdev->service_cache);
1443                 hci_dev_lock(hdev);
1444                 update_eir(hdev);
1445         }
1446
1447         err = update_class(hdev);
1448         if (err < 0)
1449                 goto unlock;
1450
1451         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1452                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1453                                    hdev->dev_class, 3);
1454                 goto unlock;
1455         }
1456
1457         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1458         if (!cmd)
1459                 err = -ENOMEM;
1460
1461 unlock:
1462         hci_dev_unlock(hdev);
1463         return err;
1464 }
1465
1466 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1467                           u16 len)
1468 {
1469         struct mgmt_cp_load_link_keys *cp = data;
1470         u16 key_count, expected_len;
1471         int i;
1472
1473         key_count = __le16_to_cpu(cp->key_count);
1474
1475         expected_len = sizeof(*cp) + key_count *
1476                                         sizeof(struct mgmt_link_key_info);
1477         if (expected_len != len) {
1478                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1479                        len, expected_len);
1480                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1481                                   MGMT_STATUS_INVALID_PARAMS);
1482         }
1483
1484         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1485                key_count);
1486
1487         hci_dev_lock(hdev);
1488
1489         hci_link_keys_clear(hdev);
1490
1491         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1492
1493         if (cp->debug_keys)
1494                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1495         else
1496                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1497
1498         for (i = 0; i < key_count; i++) {
1499                 struct mgmt_link_key_info *key = &cp->keys[i];
1500
1501                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1502                                  key->type, key->pin_len);
1503         }
1504
1505         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1506
1507         hci_dev_unlock(hdev);
1508
1509         return 0;
1510 }
1511
1512 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1513                            u8 addr_type, struct sock *skip_sk)
1514 {
1515         struct mgmt_ev_device_unpaired ev;
1516
1517         bacpy(&ev.addr.bdaddr, bdaddr);
1518         ev.addr.type = addr_type;
1519
1520         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1521                           skip_sk);
1522 }
1523
1524 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1525                          u16 len)
1526 {
1527         struct mgmt_cp_unpair_device *cp = data;
1528         struct mgmt_rp_unpair_device rp;
1529         struct hci_cp_disconnect dc;
1530         struct pending_cmd *cmd;
1531         struct hci_conn *conn;
1532         int err;
1533
1534         hci_dev_lock(hdev);
1535
1536         memset(&rp, 0, sizeof(rp));
1537         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1538         rp.addr.type = cp->addr.type;
1539
1540         if (!hdev_is_powered(hdev)) {
1541                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1542                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1543                 goto unlock;
1544         }
1545
1546         if (cp->addr.type == BDADDR_BREDR)
1547                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1548         else
1549                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1550
1551         if (err < 0) {
1552                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1553                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1554                 goto unlock;
1555         }
1556
1557         if (cp->disconnect) {
1558                 if (cp->addr.type == BDADDR_BREDR)
1559                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1560                                                        &cp->addr.bdaddr);
1561                 else
1562                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1563                                                        &cp->addr.bdaddr);
1564         } else {
1565                 conn = NULL;
1566         }
1567
1568         if (!conn) {
1569                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1570                                    &rp, sizeof(rp));
1571                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1572                 goto unlock;
1573         }
1574
1575         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1576                                sizeof(*cp));
1577         if (!cmd) {
1578                 err = -ENOMEM;
1579                 goto unlock;
1580         }
1581
1582         dc.handle = cpu_to_le16(conn->handle);
1583         dc.reason = 0x13; /* Remote User Terminated Connection */
1584         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1585         if (err < 0)
1586                 mgmt_pending_remove(cmd);
1587
1588 unlock:
1589         hci_dev_unlock(hdev);
1590         return err;
1591 }
1592
1593 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1594                       u16 len)
1595 {
1596         struct mgmt_cp_disconnect *cp = data;
1597         struct hci_cp_disconnect dc;
1598         struct pending_cmd *cmd;
1599         struct hci_conn *conn;
1600         int err;
1601
1602         BT_DBG("");
1603
1604         hci_dev_lock(hdev);
1605
1606         if (!test_bit(HCI_UP, &hdev->flags)) {
1607                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1608                                  MGMT_STATUS_NOT_POWERED);
1609                 goto failed;
1610         }
1611
1612         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1613                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1614                                  MGMT_STATUS_BUSY);
1615                 goto failed;
1616         }
1617
1618         if (cp->addr.type == BDADDR_BREDR)
1619                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1620                                                &cp->addr.bdaddr);
1621         else
1622                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1623
1624         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1625                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1626                                  MGMT_STATUS_NOT_CONNECTED);
1627                 goto failed;
1628         }
1629
1630         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1631         if (!cmd) {
1632                 err = -ENOMEM;
1633                 goto failed;
1634         }
1635
1636         dc.handle = cpu_to_le16(conn->handle);
1637         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1638
1639         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1640         if (err < 0)
1641                 mgmt_pending_remove(cmd);
1642
1643 failed:
1644         hci_dev_unlock(hdev);
1645         return err;
1646 }
1647
1648 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1649 {
1650         switch (link_type) {
1651         case LE_LINK:
1652                 switch (addr_type) {
1653                 case ADDR_LE_DEV_PUBLIC:
1654                         return BDADDR_LE_PUBLIC;
1655
1656                 default:
1657                         /* Fallback to LE Random address type */
1658                         return BDADDR_LE_RANDOM;
1659                 }
1660
1661         default:
1662                 /* Fallback to BR/EDR type */
1663                 return BDADDR_BREDR;
1664         }
1665 }
1666
1667 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1668                            u16 data_len)
1669 {
1670         struct mgmt_rp_get_connections *rp;
1671         struct hci_conn *c;
1672         size_t rp_len;
1673         int err;
1674         u16 i;
1675
1676         BT_DBG("");
1677
1678         hci_dev_lock(hdev);
1679
1680         if (!hdev_is_powered(hdev)) {
1681                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1682                                  MGMT_STATUS_NOT_POWERED);
1683                 goto unlock;
1684         }
1685
1686         i = 0;
1687         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1688                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1689                         i++;
1690         }
1691
1692         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1693         rp = kmalloc(rp_len, GFP_KERNEL);
1694         if (!rp) {
1695                 err = -ENOMEM;
1696                 goto unlock;
1697         }
1698
1699         i = 0;
1700         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1701                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1702                         continue;
1703                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1704                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1705                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1706                         continue;
1707                 i++;
1708         }
1709
1710         rp->conn_count = cpu_to_le16(i);
1711
1712         /* Recalculate length in case of filtered SCO connections, etc */
1713         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1714
1715         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1716                            rp_len);
1717
1718         kfree(rp);
1719
1720 unlock:
1721         hci_dev_unlock(hdev);
1722         return err;
1723 }
1724
1725 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1726                                    struct mgmt_cp_pin_code_neg_reply *cp)
1727 {
1728         struct pending_cmd *cmd;
1729         int err;
1730
1731         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1732                                sizeof(*cp));
1733         if (!cmd)
1734                 return -ENOMEM;
1735
1736         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1737                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1738         if (err < 0)
1739                 mgmt_pending_remove(cmd);
1740
1741         return err;
1742 }
1743
1744 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1745                           u16 len)
1746 {
1747         struct hci_conn *conn;
1748         struct mgmt_cp_pin_code_reply *cp = data;
1749         struct hci_cp_pin_code_reply reply;
1750         struct pending_cmd *cmd;
1751         int err;
1752
1753         BT_DBG("");
1754
1755         hci_dev_lock(hdev);
1756
1757         if (!hdev_is_powered(hdev)) {
1758                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1759                                  MGMT_STATUS_NOT_POWERED);
1760                 goto failed;
1761         }
1762
1763         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1764         if (!conn) {
1765                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1766                                  MGMT_STATUS_NOT_CONNECTED);
1767                 goto failed;
1768         }
1769
1770         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1771                 struct mgmt_cp_pin_code_neg_reply ncp;
1772
1773                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1774
1775                 BT_ERR("PIN code is not 16 bytes long");
1776
1777                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1778                 if (err >= 0)
1779                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1780                                          MGMT_STATUS_INVALID_PARAMS);
1781
1782                 goto failed;
1783         }
1784
1785         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1786         if (!cmd) {
1787                 err = -ENOMEM;
1788                 goto failed;
1789         }
1790
1791         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1792         reply.pin_len = cp->pin_len;
1793         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1794
1795         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1796         if (err < 0)
1797                 mgmt_pending_remove(cmd);
1798
1799 failed:
1800         hci_dev_unlock(hdev);
1801         return err;
1802 }
1803
1804 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1805                              u16 len)
1806 {
1807         struct mgmt_cp_set_io_capability *cp = data;
1808
1809         BT_DBG("");
1810
1811         hci_dev_lock(hdev);
1812
1813         hdev->io_capability = cp->io_capability;
1814
1815         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1816                hdev->io_capability);
1817
1818         hci_dev_unlock(hdev);
1819
1820         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1821                             0);
1822 }
1823
1824 static struct pending_cmd *find_pairing(struct hci_conn *conn)
1825 {
1826         struct hci_dev *hdev = conn->hdev;
1827         struct pending_cmd *cmd;
1828
1829         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1830                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1831                         continue;
1832
1833                 if (cmd->user_data != conn)
1834                         continue;
1835
1836                 return cmd;
1837         }
1838
1839         return NULL;
1840 }
1841
1842 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1843 {
1844         struct mgmt_rp_pair_device rp;
1845         struct hci_conn *conn = cmd->user_data;
1846
1847         bacpy(&rp.addr.bdaddr, &conn->dst);
1848         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
1849
1850         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1851                      &rp, sizeof(rp));
1852
1853         /* So we don't get further callbacks for this connection */
1854         conn->connect_cfm_cb = NULL;
1855         conn->security_cfm_cb = NULL;
1856         conn->disconn_cfm_cb = NULL;
1857
1858         hci_conn_put(conn);
1859
1860         mgmt_pending_remove(cmd);
1861 }
1862
1863 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1864 {
1865         struct pending_cmd *cmd;
1866
1867         BT_DBG("status %u", status);
1868
1869         cmd = find_pairing(conn);
1870         if (!cmd)
1871                 BT_DBG("Unable to find a pending command");
1872         else
1873                 pairing_complete(cmd, mgmt_status(status));
1874 }
1875
1876 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
1877 {
1878         struct pending_cmd *cmd;
1879
1880         BT_DBG("status %u", status);
1881
1882         if (!status)
1883                 return;
1884
1885         cmd = find_pairing(conn);
1886         if (!cmd)
1887                 BT_DBG("Unable to find a pending command");
1888         else
1889                 pairing_complete(cmd, mgmt_status(status));
1890 }
1891
1892 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1893                        u16 len)
1894 {
1895         struct mgmt_cp_pair_device *cp = data;
1896         struct mgmt_rp_pair_device rp;
1897         struct pending_cmd *cmd;
1898         u8 sec_level, auth_type;
1899         struct hci_conn *conn;
1900         int err;
1901
1902         BT_DBG("");
1903
1904         hci_dev_lock(hdev);
1905
1906         if (!hdev_is_powered(hdev)) {
1907                 err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1908                                  MGMT_STATUS_NOT_POWERED);
1909                 goto unlock;
1910         }
1911
1912         sec_level = BT_SECURITY_MEDIUM;
1913         if (cp->io_cap == 0x03)
1914                 auth_type = HCI_AT_DEDICATED_BONDING;
1915         else
1916                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1917
1918         if (cp->addr.type == BDADDR_BREDR)
1919                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
1920                                    cp->addr.type, sec_level, auth_type);
1921         else
1922                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
1923                                    cp->addr.type, sec_level, auth_type);
1924
1925         memset(&rp, 0, sizeof(rp));
1926         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1927         rp.addr.type = cp->addr.type;
1928
1929         if (IS_ERR(conn)) {
1930                 int status;
1931
1932                 if (PTR_ERR(conn) == -EBUSY)
1933                         status = MGMT_STATUS_BUSY;
1934                 else
1935                         status = MGMT_STATUS_CONNECT_FAILED;
1936
1937                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1938                                    status, &rp,
1939                                    sizeof(rp));
1940                 goto unlock;
1941         }
1942
1943         if (conn->connect_cfm_cb) {
1944                 hci_conn_put(conn);
1945                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1946                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1947                 goto unlock;
1948         }
1949
1950         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1951         if (!cmd) {
1952                 err = -ENOMEM;
1953                 hci_conn_put(conn);
1954                 goto unlock;
1955         }
1956
1957         /* For LE, just connecting isn't a proof that the pairing finished */
1958         if (cp->addr.type == BDADDR_BREDR)
1959                 conn->connect_cfm_cb = pairing_complete_cb;
1960         else
1961                 conn->connect_cfm_cb = le_connect_complete_cb;
1962
1963         conn->security_cfm_cb = pairing_complete_cb;
1964         conn->disconn_cfm_cb = pairing_complete_cb;
1965         conn->io_capability = cp->io_cap;
1966         cmd->user_data = conn;
1967
1968         if (conn->state == BT_CONNECTED &&
1969             hci_conn_security(conn, sec_level, auth_type))
1970                 pairing_complete(cmd, 0);
1971
1972         err = 0;
1973
1974 unlock:
1975         hci_dev_unlock(hdev);
1976         return err;
1977 }
1978
1979 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1980                               u16 len)
1981 {
1982         struct mgmt_addr_info *addr = data;
1983         struct pending_cmd *cmd;
1984         struct hci_conn *conn;
1985         int err;
1986
1987         BT_DBG("");
1988
1989         hci_dev_lock(hdev);
1990
1991         if (!hdev_is_powered(hdev)) {
1992                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1993                                  MGMT_STATUS_NOT_POWERED);
1994                 goto unlock;
1995         }
1996
1997         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
1998         if (!cmd) {
1999                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2000                                  MGMT_STATUS_INVALID_PARAMS);
2001                 goto unlock;
2002         }
2003
2004         conn = cmd->user_data;
2005
2006         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2007                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2008                                  MGMT_STATUS_INVALID_PARAMS);
2009                 goto unlock;
2010         }
2011
2012         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2013
2014         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2015                            addr, sizeof(*addr));
2016 unlock:
2017         hci_dev_unlock(hdev);
2018         return err;
2019 }
2020
2021 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2022                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2023                              u16 hci_op, __le32 passkey)
2024 {
2025         struct pending_cmd *cmd;
2026         struct hci_conn *conn;
2027         int err;
2028
2029         hci_dev_lock(hdev);
2030
2031         if (!hdev_is_powered(hdev)) {
2032                 err = cmd_status(sk, hdev->id, mgmt_op,
2033                                  MGMT_STATUS_NOT_POWERED);
2034                 goto done;
2035         }
2036
2037         if (type == BDADDR_BREDR)
2038                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2039         else
2040                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2041
2042         if (!conn) {
2043                 err = cmd_status(sk, hdev->id, mgmt_op,
2044                                  MGMT_STATUS_NOT_CONNECTED);
2045                 goto done;
2046         }
2047
2048         if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2049                 /* Continue with pairing via SMP */
2050                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2051
2052                 if (!err)
2053                         err = cmd_status(sk, hdev->id, mgmt_op,
2054                                          MGMT_STATUS_SUCCESS);
2055                 else
2056                         err = cmd_status(sk, hdev->id, mgmt_op,
2057                                          MGMT_STATUS_FAILED);
2058
2059                 goto done;
2060         }
2061
2062         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2063         if (!cmd) {
2064                 err = -ENOMEM;
2065                 goto done;
2066         }
2067
2068         /* Continue with pairing via HCI */
2069         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2070                 struct hci_cp_user_passkey_reply cp;
2071
2072                 bacpy(&cp.bdaddr, bdaddr);
2073                 cp.passkey = passkey;
2074                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2075         } else
2076                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2077
2078         if (err < 0)
2079                 mgmt_pending_remove(cmd);
2080
2081 done:
2082         hci_dev_unlock(hdev);
2083         return err;
2084 }
2085
2086 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2087                               void *data, u16 len)
2088 {
2089         struct mgmt_cp_pin_code_neg_reply *cp = data;
2090
2091         BT_DBG("");
2092
2093         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2094                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2095                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2096 }
2097
2098 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2099                               u16 len)
2100 {
2101         struct mgmt_cp_user_confirm_reply *cp = data;
2102
2103         BT_DBG("");
2104
2105         if (len != sizeof(*cp))
2106                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2107                                   MGMT_STATUS_INVALID_PARAMS);
2108
2109         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2110                                  MGMT_OP_USER_CONFIRM_REPLY,
2111                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2112 }
2113
2114 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2115                                   void *data, u16 len)
2116 {
2117         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2118
2119         BT_DBG("");
2120
2121         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2122                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2123                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2124 }
2125
2126 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2127                               u16 len)
2128 {
2129         struct mgmt_cp_user_passkey_reply *cp = data;
2130
2131         BT_DBG("");
2132
2133         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2134                                  MGMT_OP_USER_PASSKEY_REPLY,
2135                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2136 }
2137
2138 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2139                                   void *data, u16 len)
2140 {
2141         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2142
2143         BT_DBG("");
2144
2145         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2146                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2147                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2148 }
2149
2150 static int update_name(struct hci_dev *hdev, const char *name)
2151 {
2152         struct hci_cp_write_local_name cp;
2153
2154         memcpy(cp.name, name, sizeof(cp.name));
2155
2156         return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2157 }
2158
2159 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2160                           u16 len)
2161 {
2162         struct mgmt_cp_set_local_name *cp = data;
2163         struct pending_cmd *cmd;
2164         int err;
2165
2166         BT_DBG("");
2167
2168         hci_dev_lock(hdev);
2169
2170         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2171
2172         if (!hdev_is_powered(hdev)) {
2173                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2174
2175                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2176                                    data, len);
2177                 if (err < 0)
2178                         goto failed;
2179
2180                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2181                                  sk);
2182
2183                 goto failed;
2184         }
2185
2186         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2187         if (!cmd) {
2188                 err = -ENOMEM;
2189                 goto failed;
2190         }
2191
2192         err = update_name(hdev, cp->name);
2193         if (err < 0)
2194                 mgmt_pending_remove(cmd);
2195
2196 failed:
2197         hci_dev_unlock(hdev);
2198         return err;
2199 }
2200
2201 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2202                                void *data, u16 data_len)
2203 {
2204         struct pending_cmd *cmd;
2205         int err;
2206
2207         BT_DBG("%s", hdev->name);
2208
2209         hci_dev_lock(hdev);
2210
2211         if (!hdev_is_powered(hdev)) {
2212                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2213                                  MGMT_STATUS_NOT_POWERED);
2214                 goto unlock;
2215         }
2216
2217         if (!lmp_ssp_capable(hdev)) {
2218                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2219                                  MGMT_STATUS_NOT_SUPPORTED);
2220                 goto unlock;
2221         }
2222
2223         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2224                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2225                                  MGMT_STATUS_BUSY);
2226                 goto unlock;
2227         }
2228
2229         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2230         if (!cmd) {
2231                 err = -ENOMEM;
2232                 goto unlock;
2233         }
2234
2235         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2236         if (err < 0)
2237                 mgmt_pending_remove(cmd);
2238
2239 unlock:
2240         hci_dev_unlock(hdev);
2241         return err;
2242 }
2243
2244 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2245                                void *data, u16 len)
2246 {
2247         struct mgmt_cp_add_remote_oob_data *cp = data;
2248         u8 status;
2249         int err;
2250
2251         BT_DBG("%s ", hdev->name);
2252
2253         hci_dev_lock(hdev);
2254
2255         if (!hdev_is_powered(hdev)) {
2256                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
2257                                    MGMT_STATUS_NOT_POWERED, &cp->addr,
2258                                    sizeof(cp->addr));
2259                 goto unlock;
2260         }
2261
2262         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2263                                       cp->randomizer);
2264         if (err < 0)
2265                 status = MGMT_STATUS_FAILED;
2266         else
2267                 status = 0;
2268
2269         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2270                            &cp->addr, sizeof(cp->addr));
2271
2272 unlock:
2273         hci_dev_unlock(hdev);
2274         return err;
2275 }
2276
2277 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2278                                   void *data, u16 len)
2279 {
2280         struct mgmt_cp_remove_remote_oob_data *cp = data;
2281         u8 status;
2282         int err;
2283
2284         BT_DBG("%s", hdev->name);
2285
2286         hci_dev_lock(hdev);
2287
2288         if (!hdev_is_powered(hdev)) {
2289                 err = cmd_complete(sk, hdev->id,
2290                                    MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2291                                    MGMT_STATUS_NOT_POWERED, &cp->addr,
2292                                    sizeof(cp->addr));
2293                 goto unlock;
2294         }
2295
2296         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2297         if (err < 0)
2298                 status = MGMT_STATUS_INVALID_PARAMS;
2299         else
2300                 status = 0;
2301
2302         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2303                            status, &cp->addr, sizeof(cp->addr));
2304
2305 unlock:
2306         hci_dev_unlock(hdev);
2307         return err;
2308 }
2309
2310 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2311 {
2312         int err;
2313
2314         BT_DBG("%s", hdev->name);
2315
2316         hci_dev_lock(hdev);
2317
2318         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2319         if (err < 0)
2320                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2321
2322         hci_dev_unlock(hdev);
2323
2324         return err;
2325 }
2326
2327 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2328                            void *data, u16 len)
2329 {
2330         struct mgmt_cp_start_discovery *cp = data;
2331         struct pending_cmd *cmd;
2332         int err;
2333
2334         BT_DBG("%s", hdev->name);
2335
2336         hci_dev_lock(hdev);
2337
2338         if (!hdev_is_powered(hdev)) {
2339                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2340                                  MGMT_STATUS_NOT_POWERED);
2341                 goto failed;
2342         }
2343
2344         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2345                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2346                                  MGMT_STATUS_BUSY);
2347                 goto failed;
2348         }
2349
2350         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2351                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2352                                  MGMT_STATUS_BUSY);
2353                 goto failed;
2354         }
2355
2356         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2357         if (!cmd) {
2358                 err = -ENOMEM;
2359                 goto failed;
2360         }
2361
2362         hdev->discovery.type = cp->type;
2363
2364         switch (hdev->discovery.type) {
2365         case DISCOV_TYPE_BREDR:
2366                 if (lmp_bredr_capable(hdev))
2367                         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2368                 else
2369                         err = -ENOTSUPP;
2370                 break;
2371
2372         case DISCOV_TYPE_LE:
2373                 if (lmp_host_le_capable(hdev))
2374                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2375                                           LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2376                 else
2377                         err = -ENOTSUPP;
2378                 break;
2379
2380         case DISCOV_TYPE_INTERLEAVED:
2381                 if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
2382                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2383                                           LE_SCAN_WIN,
2384                                           LE_SCAN_TIMEOUT_BREDR_LE);
2385                 else
2386                         err = -ENOTSUPP;
2387                 break;
2388
2389         default:
2390                 err = -EINVAL;
2391         }
2392
2393         if (err < 0)
2394                 mgmt_pending_remove(cmd);
2395         else
2396                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2397
2398 failed:
2399         hci_dev_unlock(hdev);
2400         return err;
2401 }
2402
2403 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2404                           u16 len)
2405 {
2406         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2407         struct pending_cmd *cmd;
2408         struct hci_cp_remote_name_req_cancel cp;
2409         struct inquiry_entry *e;
2410         int err;
2411
2412         BT_DBG("%s", hdev->name);
2413
2414         hci_dev_lock(hdev);
2415
2416         if (!hci_discovery_active(hdev)) {
2417                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2418                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2419                                    sizeof(mgmt_cp->type));
2420                 goto unlock;
2421         }
2422
2423         if (hdev->discovery.type != mgmt_cp->type) {
2424                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2425                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2426                                    sizeof(mgmt_cp->type));
2427                 goto unlock;
2428         }
2429
2430         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2431         if (!cmd) {
2432                 err = -ENOMEM;
2433                 goto unlock;
2434         }
2435
2436         switch (hdev->discovery.state) {
2437         case DISCOVERY_FINDING:
2438                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2439                         err = hci_cancel_inquiry(hdev);
2440                 else
2441                         err = hci_cancel_le_scan(hdev);
2442
2443                 break;
2444
2445         case DISCOVERY_RESOLVING:
2446                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2447                                                      NAME_PENDING);
2448                 if (!e) {
2449                         mgmt_pending_remove(cmd);
2450                         err = cmd_complete(sk, hdev->id,
2451                                            MGMT_OP_STOP_DISCOVERY, 0,
2452                                            &mgmt_cp->type,
2453                                            sizeof(mgmt_cp->type));
2454                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2455                         goto unlock;
2456                 }
2457
2458                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2459                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2460                                    sizeof(cp), &cp);
2461
2462                 break;
2463
2464         default:
2465                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2466                 err = -EFAULT;
2467         }
2468
2469         if (err < 0)
2470                 mgmt_pending_remove(cmd);
2471         else
2472                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2473
2474 unlock:
2475         hci_dev_unlock(hdev);
2476         return err;
2477 }
2478
2479 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2480                         u16 len)
2481 {
2482         struct mgmt_cp_confirm_name *cp = data;
2483         struct inquiry_entry *e;
2484         int err;
2485
2486         BT_DBG("%s", hdev->name);
2487
2488         hci_dev_lock(hdev);
2489
2490         if (!hci_discovery_active(hdev)) {
2491                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2492                                  MGMT_STATUS_FAILED);
2493                 goto failed;
2494         }
2495
2496         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2497         if (!e) {
2498                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2499                                  MGMT_STATUS_INVALID_PARAMS);
2500                 goto failed;
2501         }
2502
2503         if (cp->name_known) {
2504                 e->name_state = NAME_KNOWN;
2505                 list_del(&e->list);
2506         } else {
2507                 e->name_state = NAME_NEEDED;
2508                 hci_inquiry_cache_update_resolve(hdev, e);
2509         }
2510
2511         err = 0;
2512
2513 failed:
2514         hci_dev_unlock(hdev);
2515         return err;
2516 }
2517
2518 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2519                         u16 len)
2520 {
2521         struct mgmt_cp_block_device *cp = data;
2522         u8 status;
2523         int err;
2524
2525         BT_DBG("%s", hdev->name);
2526
2527         hci_dev_lock(hdev);
2528
2529         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2530         if (err < 0)
2531                 status = MGMT_STATUS_FAILED;
2532         else
2533                 status = 0;
2534
2535         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2536                            &cp->addr, sizeof(cp->addr));
2537
2538         hci_dev_unlock(hdev);
2539
2540         return err;
2541 }
2542
2543 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2544                           u16 len)
2545 {
2546         struct mgmt_cp_unblock_device *cp = data;
2547         u8 status;
2548         int err;
2549
2550         BT_DBG("%s", hdev->name);
2551
2552         hci_dev_lock(hdev);
2553
2554         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2555         if (err < 0)
2556                 status = MGMT_STATUS_INVALID_PARAMS;
2557         else
2558                 status = 0;
2559
2560         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2561                            &cp->addr, sizeof(cp->addr));
2562
2563         hci_dev_unlock(hdev);
2564
2565         return err;
2566 }
2567
2568 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2569                          u16 len)
2570 {
2571         struct mgmt_cp_set_device_id *cp = data;
2572         int err;
2573         __u16 source;
2574
2575         BT_DBG("%s", hdev->name);
2576
2577         source = __le16_to_cpu(cp->source);
2578
2579         if (source > 0x0002)
2580                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2581                                   MGMT_STATUS_INVALID_PARAMS);
2582
2583         hci_dev_lock(hdev);
2584
2585         hdev->devid_source = source;
2586         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2587         hdev->devid_product = __le16_to_cpu(cp->product);
2588         hdev->devid_version = __le16_to_cpu(cp->version);
2589
2590         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2591
2592         update_eir(hdev);
2593
2594         hci_dev_unlock(hdev);
2595
2596         return err;
2597 }
2598
2599 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2600                                 void *data, u16 len)
2601 {
2602         struct mgmt_mode *cp = data;
2603         struct hci_cp_write_page_scan_activity acp;
2604         u8 type;
2605         int err;
2606
2607         BT_DBG("%s", hdev->name);
2608
2609         if (!lmp_bredr_capable(hdev))
2610                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2611                                   MGMT_STATUS_NOT_SUPPORTED);
2612
2613         if (!hdev_is_powered(hdev))
2614                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2615                                   MGMT_STATUS_NOT_POWERED);
2616
2617         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2618                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2619                                   MGMT_STATUS_REJECTED);
2620
2621         hci_dev_lock(hdev);
2622
2623         if (cp->val) {
2624                 type = PAGE_SCAN_TYPE_INTERLACED;
2625
2626                 /* 160 msec page scan interval */
2627                 acp.interval = __constant_cpu_to_le16(0x0100);
2628         } else {
2629                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2630
2631                 /* default 1.28 sec page scan */
2632                 acp.interval = __constant_cpu_to_le16(0x0800);
2633         }
2634
2635         /* default 11.25 msec page scan window */
2636         acp.window = __constant_cpu_to_le16(0x0012);
2637
2638         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2639                            &acp);
2640         if (err < 0) {
2641                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2642                                  MGMT_STATUS_FAILED);
2643                 goto done;
2644         }
2645
2646         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2647         if (err < 0) {
2648                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2649                                  MGMT_STATUS_FAILED);
2650                 goto done;
2651         }
2652
2653         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2654                            NULL, 0);
2655 done:
2656         hci_dev_unlock(hdev);
2657         return err;
2658 }
2659
2660 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2661                                void *cp_data, u16 len)
2662 {
2663         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2664         u16 key_count, expected_len;
2665         int i;
2666
2667         key_count = __le16_to_cpu(cp->key_count);
2668
2669         expected_len = sizeof(*cp) + key_count *
2670                                         sizeof(struct mgmt_ltk_info);
2671         if (expected_len != len) {
2672                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2673                        len, expected_len);
2674                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2675                                   EINVAL);
2676         }
2677
2678         BT_DBG("%s key_count %u", hdev->name, key_count);
2679
2680         hci_dev_lock(hdev);
2681
2682         hci_smp_ltks_clear(hdev);
2683
2684         for (i = 0; i < key_count; i++) {
2685                 struct mgmt_ltk_info *key = &cp->keys[i];
2686                 u8 type;
2687
2688                 if (key->master)
2689                         type = HCI_SMP_LTK;
2690                 else
2691                         type = HCI_SMP_LTK_SLAVE;
2692
2693                 hci_add_ltk(hdev, &key->addr.bdaddr,
2694                             bdaddr_to_le(key->addr.type),
2695                             type, 0, key->authenticated, key->val,
2696                             key->enc_size, key->ediv, key->rand);
2697         }
2698
2699         hci_dev_unlock(hdev);
2700
2701         return 0;
2702 }
2703
2704 static const struct mgmt_handler {
2705         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2706                      u16 data_len);
2707         bool var_len;
2708         size_t data_len;
2709 } mgmt_handlers[] = {
2710         { NULL }, /* 0x0000 (no command) */
2711         { read_version,           false, MGMT_READ_VERSION_SIZE },
2712         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
2713         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
2714         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
2715         { set_powered,            false, MGMT_SETTING_SIZE },
2716         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
2717         { set_connectable,        false, MGMT_SETTING_SIZE },
2718         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
2719         { set_pairable,           false, MGMT_SETTING_SIZE },
2720         { set_link_security,      false, MGMT_SETTING_SIZE },
2721         { set_ssp,                false, MGMT_SETTING_SIZE },
2722         { set_hs,                 false, MGMT_SETTING_SIZE },
2723         { set_le,                 false, MGMT_SETTING_SIZE },
2724         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
2725         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
2726         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
2727         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
2728         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
2729         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2730         { disconnect,             false, MGMT_DISCONNECT_SIZE },
2731         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
2732         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
2733         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2734         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
2735         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
2736         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2737         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
2738         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
2739         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2740         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
2741         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2742         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2743         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2744         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2745         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
2746         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
2747         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
2748         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
2749         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
2750         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
2751 };
2752
2753
2754 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2755 {
2756         void *buf;
2757         u8 *cp;
2758         struct mgmt_hdr *hdr;
2759         u16 opcode, index, len;
2760         struct hci_dev *hdev = NULL;
2761         const struct mgmt_handler *handler;
2762         int err;
2763
2764         BT_DBG("got %zu bytes", msglen);
2765
2766         if (msglen < sizeof(*hdr))
2767                 return -EINVAL;
2768
2769         buf = kmalloc(msglen, GFP_KERNEL);
2770         if (!buf)
2771                 return -ENOMEM;
2772
2773         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2774                 err = -EFAULT;
2775                 goto done;
2776         }
2777
2778         hdr = buf;
2779         opcode = __le16_to_cpu(hdr->opcode);
2780         index = __le16_to_cpu(hdr->index);
2781         len = __le16_to_cpu(hdr->len);
2782
2783         if (len != msglen - sizeof(*hdr)) {
2784                 err = -EINVAL;
2785                 goto done;
2786         }
2787
2788         if (index != MGMT_INDEX_NONE) {
2789                 hdev = hci_dev_get(index);
2790                 if (!hdev) {
2791                         err = cmd_status(sk, index, opcode,
2792                                          MGMT_STATUS_INVALID_INDEX);
2793                         goto done;
2794                 }
2795         }
2796
2797         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2798             mgmt_handlers[opcode].func == NULL) {
2799                 BT_DBG("Unknown op %u", opcode);
2800                 err = cmd_status(sk, index, opcode,
2801                                  MGMT_STATUS_UNKNOWN_COMMAND);
2802                 goto done;
2803         }
2804
2805         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2806             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2807                 err = cmd_status(sk, index, opcode,
2808                                  MGMT_STATUS_INVALID_INDEX);
2809                 goto done;
2810         }
2811
2812         handler = &mgmt_handlers[opcode];
2813
2814         if ((handler->var_len && len < handler->data_len) ||
2815             (!handler->var_len && len != handler->data_len)) {
2816                 err = cmd_status(sk, index, opcode,
2817                                  MGMT_STATUS_INVALID_PARAMS);
2818                 goto done;
2819         }
2820
2821         if (hdev)
2822                 mgmt_init_hdev(sk, hdev);
2823
2824         cp = buf + sizeof(*hdr);
2825
2826         err = handler->func(sk, hdev, cp, len);
2827         if (err < 0)
2828                 goto done;
2829
2830         err = msglen;
2831
2832 done:
2833         if (hdev)
2834                 hci_dev_put(hdev);
2835
2836         kfree(buf);
2837         return err;
2838 }
2839
2840 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2841 {
2842         u8 *status = data;
2843
2844         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2845         mgmt_pending_remove(cmd);
2846 }
2847
2848 int mgmt_index_added(struct hci_dev *hdev)
2849 {
2850         if (!mgmt_valid_hdev(hdev))
2851                 return -ENOTSUPP;
2852
2853         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2854 }
2855
2856 int mgmt_index_removed(struct hci_dev *hdev)
2857 {
2858         u8 status = MGMT_STATUS_INVALID_INDEX;
2859
2860         if (!mgmt_valid_hdev(hdev))
2861                 return -ENOTSUPP;
2862
2863         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2864
2865         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2866 }
2867
2868 struct cmd_lookup {
2869         struct sock *sk;
2870         struct hci_dev *hdev;
2871         u8 mgmt_status;
2872 };
2873
2874 static void settings_rsp(struct pending_cmd *cmd, void *data)
2875 {
2876         struct cmd_lookup *match = data;
2877
2878         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2879
2880         list_del(&cmd->list);
2881
2882         if (match->sk == NULL) {
2883                 match->sk = cmd->sk;
2884                 sock_hold(match->sk);
2885         }
2886
2887         mgmt_pending_free(cmd);
2888 }
2889
2890 static int set_bredr_scan(struct hci_dev *hdev)
2891 {
2892         u8 scan = 0;
2893
2894         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2895                 scan |= SCAN_PAGE;
2896         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2897                 scan |= SCAN_INQUIRY;
2898
2899         if (!scan)
2900                 return 0;
2901
2902         return hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2903 }
2904
2905 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2906 {
2907         struct cmd_lookup match = { NULL, hdev };
2908         int err;
2909
2910         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2911                 return 0;
2912
2913         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2914
2915         if (powered) {
2916                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
2917                     !lmp_host_ssp_capable(hdev)) {
2918                         u8 ssp = 1;
2919
2920                         hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
2921                 }
2922
2923                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2924                         struct hci_cp_write_le_host_supported cp;
2925
2926                         cp.le = 1;
2927                         cp.simul = !!lmp_le_br_capable(hdev);
2928
2929                         /* Check first if we already have the right
2930                          * host state (host features set)
2931                          */
2932                         if (cp.le != !!lmp_host_le_capable(hdev) ||
2933                             cp.simul != !!lmp_host_le_br_capable(hdev))
2934                                 hci_send_cmd(hdev,
2935                                              HCI_OP_WRITE_LE_HOST_SUPPORTED,
2936                                              sizeof(cp), &cp);
2937                 }
2938
2939                 if (lmp_bredr_capable(hdev)) {
2940                         set_bredr_scan(hdev);
2941                         update_class(hdev);
2942                         update_name(hdev, hdev->dev_name);
2943                         update_eir(hdev);
2944                 }
2945         } else {
2946                 u8 status = MGMT_STATUS_NOT_POWERED;
2947                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2948         }
2949
2950         err = new_settings(hdev, match.sk);
2951
2952         if (match.sk)
2953                 sock_put(match.sk);
2954
2955         return err;
2956 }
2957
2958 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2959 {
2960         struct cmd_lookup match = { NULL, hdev };
2961         bool changed = false;
2962         int err = 0;
2963
2964         if (discoverable) {
2965                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2966                         changed = true;
2967         } else {
2968                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2969                         changed = true;
2970         }
2971
2972         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
2973                              &match);
2974
2975         if (changed)
2976                 err = new_settings(hdev, match.sk);
2977
2978         if (match.sk)
2979                 sock_put(match.sk);
2980
2981         return err;
2982 }
2983
2984 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2985 {
2986         struct cmd_lookup match = { NULL, hdev };
2987         bool changed = false;
2988         int err = 0;
2989
2990         if (connectable) {
2991                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2992                         changed = true;
2993         } else {
2994                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2995                         changed = true;
2996         }
2997
2998         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
2999                              &match);
3000
3001         if (changed)
3002                 err = new_settings(hdev, match.sk);
3003
3004         if (match.sk)
3005                 sock_put(match.sk);
3006
3007         return err;
3008 }
3009
3010 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3011 {
3012         u8 mgmt_err = mgmt_status(status);
3013
3014         if (scan & SCAN_PAGE)
3015                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3016                                      cmd_status_rsp, &mgmt_err);
3017
3018         if (scan & SCAN_INQUIRY)
3019                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3020                                      cmd_status_rsp, &mgmt_err);
3021
3022         return 0;
3023 }
3024
3025 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3026                       bool persistent)
3027 {
3028         struct mgmt_ev_new_link_key ev;
3029
3030         memset(&ev, 0, sizeof(ev));
3031
3032         ev.store_hint = persistent;
3033         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3034         ev.key.addr.type = BDADDR_BREDR;
3035         ev.key.type = key->type;
3036         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3037         ev.key.pin_len = key->pin_len;
3038
3039         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3040 }
3041
3042 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3043 {
3044         struct mgmt_ev_new_long_term_key ev;
3045
3046         memset(&ev, 0, sizeof(ev));
3047
3048         ev.store_hint = persistent;
3049         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3050         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3051         ev.key.authenticated = key->authenticated;
3052         ev.key.enc_size = key->enc_size;
3053         ev.key.ediv = key->ediv;
3054
3055         if (key->type == HCI_SMP_LTK)
3056                 ev.key.master = 1;
3057
3058         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3059         memcpy(ev.key.val, key->val, sizeof(key->val));
3060
3061         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3062                           NULL);
3063 }
3064
3065 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3066                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3067                           u8 *dev_class)
3068 {
3069         char buf[512];
3070         struct mgmt_ev_device_connected *ev = (void *) buf;
3071         u16 eir_len = 0;
3072
3073         bacpy(&ev->addr.bdaddr, bdaddr);
3074         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3075
3076         ev->flags = __cpu_to_le32(flags);
3077
3078         if (name_len > 0)
3079                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3080                                           name, name_len);
3081
3082         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3083                 eir_len = eir_append_data(ev->eir, eir_len,
3084                                           EIR_CLASS_OF_DEV, dev_class, 3);
3085
3086         ev->eir_len = cpu_to_le16(eir_len);
3087
3088         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3089                           sizeof(*ev) + eir_len, NULL);
3090 }
3091
3092 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3093 {
3094         struct mgmt_cp_disconnect *cp = cmd->param;
3095         struct sock **sk = data;
3096         struct mgmt_rp_disconnect rp;
3097
3098         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3099         rp.addr.type = cp->addr.type;
3100
3101         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3102                      sizeof(rp));
3103
3104         *sk = cmd->sk;
3105         sock_hold(*sk);
3106
3107         mgmt_pending_remove(cmd);
3108 }
3109
3110 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3111 {
3112         struct hci_dev *hdev = data;
3113         struct mgmt_cp_unpair_device *cp = cmd->param;
3114         struct mgmt_rp_unpair_device rp;
3115
3116         memset(&rp, 0, sizeof(rp));
3117         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3118         rp.addr.type = cp->addr.type;
3119
3120         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3121
3122         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3123
3124         mgmt_pending_remove(cmd);
3125 }
3126
3127 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3128                              u8 link_type, u8 addr_type, u8 reason)
3129 {
3130         struct mgmt_ev_device_disconnected ev;
3131         struct sock *sk = NULL;
3132         int err;
3133
3134         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3135
3136         bacpy(&ev.addr.bdaddr, bdaddr);
3137         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3138         ev.reason = reason;
3139
3140         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3141                          sk);
3142
3143         if (sk)
3144                 sock_put(sk);
3145
3146         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3147                              hdev);
3148
3149         return err;
3150 }
3151
3152 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3153                            u8 link_type, u8 addr_type, u8 status)
3154 {
3155         struct mgmt_rp_disconnect rp;
3156         struct pending_cmd *cmd;
3157         int err;
3158
3159         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3160                              hdev);
3161
3162         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3163         if (!cmd)
3164                 return -ENOENT;
3165
3166         bacpy(&rp.addr.bdaddr, bdaddr);
3167         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3168
3169         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3170                            mgmt_status(status), &rp, sizeof(rp));
3171
3172         mgmt_pending_remove(cmd);
3173
3174         return err;
3175 }
3176
3177 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3178                         u8 addr_type, u8 status)
3179 {
3180         struct mgmt_ev_connect_failed ev;
3181
3182         bacpy(&ev.addr.bdaddr, bdaddr);
3183         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3184         ev.status = mgmt_status(status);
3185
3186         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3187 }
3188
3189 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3190 {
3191         struct mgmt_ev_pin_code_request ev;
3192
3193         bacpy(&ev.addr.bdaddr, bdaddr);
3194         ev.addr.type = BDADDR_BREDR;
3195         ev.secure = secure;
3196
3197         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3198                           NULL);
3199 }
3200
3201 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3202                                  u8 status)
3203 {
3204         struct pending_cmd *cmd;
3205         struct mgmt_rp_pin_code_reply rp;
3206         int err;
3207
3208         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3209         if (!cmd)
3210                 return -ENOENT;
3211
3212         bacpy(&rp.addr.bdaddr, bdaddr);
3213         rp.addr.type = BDADDR_BREDR;
3214
3215         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3216                            mgmt_status(status), &rp, sizeof(rp));
3217
3218         mgmt_pending_remove(cmd);
3219
3220         return err;
3221 }
3222
3223 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3224                                      u8 status)
3225 {
3226         struct pending_cmd *cmd;
3227         struct mgmt_rp_pin_code_reply rp;
3228         int err;
3229
3230         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3231         if (!cmd)
3232                 return -ENOENT;
3233
3234         bacpy(&rp.addr.bdaddr, bdaddr);
3235         rp.addr.type = BDADDR_BREDR;
3236
3237         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3238                            mgmt_status(status), &rp, sizeof(rp));
3239
3240         mgmt_pending_remove(cmd);
3241
3242         return err;
3243 }
3244
3245 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3246                               u8 link_type, u8 addr_type, __le32 value,
3247                               u8 confirm_hint)
3248 {
3249         struct mgmt_ev_user_confirm_request ev;
3250
3251         BT_DBG("%s", hdev->name);
3252
3253         bacpy(&ev.addr.bdaddr, bdaddr);
3254         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3255         ev.confirm_hint = confirm_hint;
3256         ev.value = value;
3257
3258         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3259                           NULL);
3260 }
3261
3262 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3263                               u8 link_type, u8 addr_type)
3264 {
3265         struct mgmt_ev_user_passkey_request ev;
3266
3267         BT_DBG("%s", hdev->name);
3268
3269         bacpy(&ev.addr.bdaddr, bdaddr);
3270         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3271
3272         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3273                           NULL);
3274 }
3275
3276 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3277                                       u8 link_type, u8 addr_type, u8 status,
3278                                       u8 opcode)
3279 {
3280         struct pending_cmd *cmd;
3281         struct mgmt_rp_user_confirm_reply rp;
3282         int err;
3283
3284         cmd = mgmt_pending_find(opcode, hdev);
3285         if (!cmd)
3286                 return -ENOENT;
3287
3288         bacpy(&rp.addr.bdaddr, bdaddr);
3289         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3290         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3291                            &rp, sizeof(rp));
3292
3293         mgmt_pending_remove(cmd);
3294
3295         return err;
3296 }
3297
3298 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3299                                      u8 link_type, u8 addr_type, u8 status)
3300 {
3301         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3302                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3303 }
3304
3305 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3306                                          u8 link_type, u8 addr_type, u8 status)
3307 {
3308         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3309                                           status,
3310                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3311 }
3312
3313 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3314                                      u8 link_type, u8 addr_type, u8 status)
3315 {
3316         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3317                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3318 }
3319
3320 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3321                                          u8 link_type, u8 addr_type, u8 status)
3322 {
3323         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3324                                           status,
3325                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3326 }
3327
3328 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3329                              u8 link_type, u8 addr_type, u32 passkey,
3330                              u8 entered)
3331 {
3332         struct mgmt_ev_passkey_notify ev;
3333
3334         BT_DBG("%s", hdev->name);
3335
3336         bacpy(&ev.addr.bdaddr, bdaddr);
3337         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3338         ev.passkey = __cpu_to_le32(passkey);
3339         ev.entered = entered;
3340
3341         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3342 }
3343
3344 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3345                      u8 addr_type, u8 status)
3346 {
3347         struct mgmt_ev_auth_failed ev;
3348
3349         bacpy(&ev.addr.bdaddr, bdaddr);
3350         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3351         ev.status = mgmt_status(status);
3352
3353         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3354 }
3355
3356 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3357 {
3358         struct cmd_lookup match = { NULL, hdev };
3359         bool changed = false;
3360         int err = 0;
3361
3362         if (status) {
3363                 u8 mgmt_err = mgmt_status(status);
3364                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3365                                      cmd_status_rsp, &mgmt_err);
3366                 return 0;
3367         }
3368
3369         if (test_bit(HCI_AUTH, &hdev->flags)) {
3370                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3371                         changed = true;
3372         } else {
3373                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3374                         changed = true;
3375         }
3376
3377         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3378                              &match);
3379
3380         if (changed)
3381                 err = new_settings(hdev, match.sk);
3382
3383         if (match.sk)
3384                 sock_put(match.sk);
3385
3386         return err;
3387 }
3388
3389 static int clear_eir(struct hci_dev *hdev)
3390 {
3391         struct hci_cp_write_eir cp;
3392
3393         if (!lmp_ext_inq_capable(hdev))
3394                 return 0;
3395
3396         memset(hdev->eir, 0, sizeof(hdev->eir));
3397
3398         memset(&cp, 0, sizeof(cp));
3399
3400         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3401 }
3402
3403 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3404 {
3405         struct cmd_lookup match = { NULL, hdev };
3406         bool changed = false;
3407         int err = 0;
3408
3409         if (status) {
3410                 u8 mgmt_err = mgmt_status(status);
3411
3412                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3413                                                  &hdev->dev_flags))
3414                         err = new_settings(hdev, NULL);
3415
3416                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3417                                      &mgmt_err);
3418
3419                 return err;
3420         }
3421
3422         if (enable) {
3423                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3424                         changed = true;
3425         } else {
3426                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3427                         changed = true;
3428         }
3429
3430         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3431
3432         if (changed)
3433                 err = new_settings(hdev, match.sk);
3434
3435         if (match.sk)
3436                 sock_put(match.sk);
3437
3438         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3439                 update_eir(hdev);
3440         else
3441                 clear_eir(hdev);
3442
3443         return err;
3444 }
3445
3446 static void class_rsp(struct pending_cmd *cmd, void *data)
3447 {
3448         struct cmd_lookup *match = data;
3449
3450         cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3451                      match->hdev->dev_class, 3);
3452
3453         list_del(&cmd->list);
3454
3455         if (match->sk == NULL) {
3456                 match->sk = cmd->sk;
3457                 sock_hold(match->sk);
3458         }
3459
3460         mgmt_pending_free(cmd);
3461 }
3462
3463 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3464                                    u8 status)
3465 {
3466         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3467         int err = 0;
3468
3469         clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3470
3471         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3472         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3473         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3474
3475         if (!status)
3476                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3477                                  3, NULL);
3478
3479         if (match.sk)
3480                 sock_put(match.sk);
3481
3482         return err;
3483 }
3484
3485 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3486 {
3487         struct pending_cmd *cmd;
3488         struct mgmt_cp_set_local_name ev;
3489         bool changed = false;
3490         int err = 0;
3491
3492         if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3493                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3494                 changed = true;
3495         }
3496
3497         memset(&ev, 0, sizeof(ev));
3498         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3499         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3500
3501         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3502         if (!cmd)
3503                 goto send_event;
3504
3505         /* Always assume that either the short or the complete name has
3506          * changed if there was a pending mgmt command */
3507         changed = true;
3508
3509         if (status) {
3510                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3511                                  mgmt_status(status));
3512                 goto failed;
3513         }
3514
3515         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3516                            sizeof(ev));
3517         if (err < 0)
3518                 goto failed;
3519
3520 send_event:
3521         if (changed)
3522                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3523                                  sizeof(ev), cmd ? cmd->sk : NULL);
3524
3525         /* EIR is taken care of separately when powering on the
3526          * adapter so only update them here if this is a name change
3527          * unrelated to power on.
3528          */
3529         if (!test_bit(HCI_INIT, &hdev->flags))
3530                 update_eir(hdev);
3531
3532 failed:
3533         if (cmd)
3534                 mgmt_pending_remove(cmd);
3535         return err;
3536 }
3537
3538 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3539                                             u8 *randomizer, u8 status)
3540 {
3541         struct pending_cmd *cmd;
3542         int err;
3543
3544         BT_DBG("%s status %u", hdev->name, status);
3545
3546         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3547         if (!cmd)
3548                 return -ENOENT;
3549
3550         if (status) {
3551                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3552                                  mgmt_status(status));
3553         } else {
3554                 struct mgmt_rp_read_local_oob_data rp;
3555
3556                 memcpy(rp.hash, hash, sizeof(rp.hash));
3557                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3558
3559                 err = cmd_complete(cmd->sk, hdev->id,
3560                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3561                                    sizeof(rp));
3562         }
3563
3564         mgmt_pending_remove(cmd);
3565
3566         return err;
3567 }
3568
3569 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3570 {
3571         struct cmd_lookup match = { NULL, hdev };
3572         bool changed = false;
3573         int err = 0;
3574
3575         if (status) {
3576                 u8 mgmt_err = mgmt_status(status);
3577
3578                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3579                                                  &hdev->dev_flags))
3580                         err = new_settings(hdev, NULL);
3581
3582                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3583                                      &mgmt_err);
3584
3585                 return err;
3586         }
3587
3588         if (enable) {
3589                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3590                         changed = true;
3591         } else {
3592                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3593                         changed = true;
3594         }
3595
3596         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3597
3598         if (changed)
3599                 err = new_settings(hdev, match.sk);
3600
3601         if (match.sk)
3602                 sock_put(match.sk);
3603
3604         return err;
3605 }
3606
3607 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3608                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3609                       ssp, u8 *eir, u16 eir_len)
3610 {
3611         char buf[512];
3612         struct mgmt_ev_device_found *ev = (void *) buf;
3613         size_t ev_size;
3614
3615         /* Leave 5 bytes for a potential CoD field */
3616         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3617                 return -EINVAL;
3618
3619         memset(buf, 0, sizeof(buf));
3620
3621         bacpy(&ev->addr.bdaddr, bdaddr);
3622         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3623         ev->rssi = rssi;
3624         if (cfm_name)
3625                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
3626         if (!ssp)
3627                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
3628
3629         if (eir_len > 0)
3630                 memcpy(ev->eir, eir, eir_len);
3631
3632         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3633                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3634                                           dev_class, 3);
3635
3636         ev->eir_len = cpu_to_le16(eir_len);
3637         ev_size = sizeof(*ev) + eir_len;
3638
3639         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3640 }
3641
3642 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3643                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3644 {
3645         struct mgmt_ev_device_found *ev;
3646         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3647         u16 eir_len;
3648
3649         ev = (struct mgmt_ev_device_found *) buf;
3650
3651         memset(buf, 0, sizeof(buf));
3652
3653         bacpy(&ev->addr.bdaddr, bdaddr);
3654         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3655         ev->rssi = rssi;
3656
3657         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3658                                   name_len);
3659
3660         ev->eir_len = cpu_to_le16(eir_len);
3661
3662         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3663                           sizeof(*ev) + eir_len, NULL);
3664 }
3665
3666 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3667 {
3668         struct pending_cmd *cmd;
3669         u8 type;
3670         int err;
3671
3672         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3673
3674         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3675         if (!cmd)
3676                 return -ENOENT;
3677
3678         type = hdev->discovery.type;
3679
3680         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3681                            &type, sizeof(type));
3682         mgmt_pending_remove(cmd);
3683
3684         return err;
3685 }
3686
3687 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3688 {
3689         struct pending_cmd *cmd;
3690         int err;
3691
3692         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3693         if (!cmd)
3694                 return -ENOENT;
3695
3696         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3697                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3698         mgmt_pending_remove(cmd);
3699
3700         return err;
3701 }
3702
3703 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3704 {
3705         struct mgmt_ev_discovering ev;
3706         struct pending_cmd *cmd;
3707
3708         BT_DBG("%s discovering %u", hdev->name, discovering);
3709
3710         if (discovering)
3711                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3712         else
3713                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3714
3715         if (cmd != NULL) {
3716                 u8 type = hdev->discovery.type;
3717
3718                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3719                              sizeof(type));
3720                 mgmt_pending_remove(cmd);
3721         }
3722
3723         memset(&ev, 0, sizeof(ev));
3724         ev.type = hdev->discovery.type;
3725         ev.discovering = discovering;
3726
3727         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3728 }
3729
3730 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3731 {
3732         struct pending_cmd *cmd;
3733         struct mgmt_ev_device_blocked ev;
3734
3735         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3736
3737         bacpy(&ev.addr.bdaddr, bdaddr);
3738         ev.addr.type = type;
3739
3740         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3741                           cmd ? cmd->sk : NULL);
3742 }
3743
3744 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3745 {
3746         struct pending_cmd *cmd;
3747         struct mgmt_ev_device_unblocked ev;
3748
3749         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3750
3751         bacpy(&ev.addr.bdaddr, bdaddr);
3752         ev.addr.type = type;
3753
3754         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3755                           cmd ? cmd->sk : NULL);
3756 }
3757
3758 module_param(enable_hs, bool, 0644);
3759 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");