net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   2
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 /*
 106  * These LE scan and inquiry parameters were chosen according to LE General
 107  * Discovery Procedure specification.
 108  */
 109 #define LE_SCAN_TYPE                    0x01
 110 #define LE_SCAN_WIN                     0x12
 111 #define LE_SCAN_INT                     0x12
 112 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 113 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 114
 115 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 116 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 117
 118 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 119
 120 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 121                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 122
 123 struct pending_cmd {
 124         struct list_head list;
 125         u16 opcode;
 126         int index;
 127         void *param;
 128         struct sock *sk;
 129         void *user_data;
 130 };
 131
 132 /* HCI to MGMT error code conversion table */
 133 static u8 mgmt_status_table[] = {
 134         MGMT_STATUS_SUCCESS,
 135         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 136         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 137         MGMT_STATUS_FAILED,             /* Hardware Failure */
 138         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 139         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 140         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 141         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 142         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 145         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 146         MGMT_STATUS_BUSY,               /* Command Disallowed */
 147         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 148         MGMT_STATUS_REJECTED,           /* Rejected Security */
 149         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 150         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 151         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 153         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 154         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 155         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 156         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 157         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 158         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 159         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 161         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 162         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 163         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 165         MGMT_STATUS_FAILED,             /* Unspecified Error */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 167         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 168         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 169         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 170         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 171         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 172         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 174         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 176         MGMT_STATUS_FAILED,             /* Transaction Collision */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 178         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 180         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 181         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 182         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 183         MGMT_STATUS_FAILED,             /* Slot Violation */
 184         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 185         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 187         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 188         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 189         MGMT_STATUS_BUSY,               /* Controller Busy */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 191         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 192         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 193         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 194         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 195 };
 196
 197 bool mgmt_valid_hdev(struct hci_dev *hdev)
 198 {
 199         return hdev->dev_type == HCI_BREDR;
 200 }
 201
 202 static u8 mgmt_status(u8 hci_status)
 203 {
 204         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 205                 return mgmt_status_table[hci_status];
 206
 207         return MGMT_STATUS_FAILED;
 208 }
 209
 210 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 211 {
 212         struct sk_buff *skb;
 213         struct mgmt_hdr *hdr;
 214         struct mgmt_ev_cmd_status *ev;
 215         int err;
 216
 217         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 218
 219         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 220         if (!skb)
 221                 return -ENOMEM;
 222
 223         hdr = (void *) skb_put(skb, sizeof(*hdr));
 224
 225         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 226         hdr->index = cpu_to_le16(index);
 227         hdr->len = cpu_to_le16(sizeof(*ev));
 228
 229         ev = (void *) skb_put(skb, sizeof(*ev));
 230         ev->status = status;
 231         ev->opcode = cpu_to_le16(cmd);
 232
 233         err = sock_queue_rcv_skb(sk, skb);
 234         if (err < 0)
 235                 kfree_skb(skb);
 236
 237         return err;
 238 }
 239
 240 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 241                         void *rp, size_t rp_len)
 242 {
 243         struct sk_buff *skb;
 244         struct mgmt_hdr *hdr;
 245         struct mgmt_ev_cmd_complete *ev;
 246         int err;
 247
 248         BT_DBG("sock %p", sk);
 249
 250         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 251         if (!skb)
 252                 return -ENOMEM;
 253
 254         hdr = (void *) skb_put(skb, sizeof(*hdr));
 255
 256         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 257         hdr->index = cpu_to_le16(index);
 258         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 259
 260         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 261         ev->opcode = cpu_to_le16(cmd);
 262         ev->status = status;
 263
 264         if (rp)
 265                 memcpy(ev->data, rp, rp_len);
 266
 267         err = sock_queue_rcv_skb(sk, skb);
 268         if (err < 0)
 269                 kfree_skb(skb);
 270
 271         return err;
 272 }
 273
 274 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 275                         u16 data_len)
 276 {
 277         struct mgmt_rp_read_version rp;
 278
 279         BT_DBG("sock %p", sk);
 280
 281         rp.version = MGMT_VERSION;
 282         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 283
 284         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 285                             sizeof(rp));
 286 }
 287
 288 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 289                          u16 data_len)
 290 {
 291         struct mgmt_rp_read_commands *rp;
 292         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 293         const u16 num_events = ARRAY_SIZE(mgmt_events);
 294         __le16 *opcode;
 295         size_t rp_size;
 296         int i, err;
 297
 298         BT_DBG("sock %p", sk);
 299
 300         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 301
 302         rp = kmalloc(rp_size, GFP_KERNEL);
 303         if (!rp)
 304                 return -ENOMEM;
 305
 306         rp->num_commands = __constant_cpu_to_le16(num_commands);
 307         rp->num_events = __constant_cpu_to_le16(num_events);
 308
 309         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 310                 put_unaligned_le16(mgmt_commands[i], opcode);
 311
 312         for (i = 0; i < num_events; i++, opcode++)
 313                 put_unaligned_le16(mgmt_events[i], opcode);
 314
 315         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 316                            rp_size);
 317         kfree(rp);
 318
 319         return err;
 320 }
 321
 322 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 323                            u16 data_len)
 324 {
 325         struct mgmt_rp_read_index_list *rp;
 326         struct hci_dev *d;
 327         size_t rp_len;
 328         u16 count;
 329         int err;
 330
 331         BT_DBG("sock %p", sk);
 332
 333         read_lock(&hci_dev_list_lock);
 334
 335         count = 0;
 336         list_for_each_entry(d, &hci_dev_list, list) {
 337                 if (!mgmt_valid_hdev(d))
 338                         continue;
 339
 340                 count++;
 341         }
 342
 343         rp_len = sizeof(*rp) + (2 * count);
 344         rp = kmalloc(rp_len, GFP_ATOMIC);
 345         if (!rp) {
 346                 read_unlock(&hci_dev_list_lock);
 347                 return -ENOMEM;
 348         }
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (test_bit(HCI_SETUP, &d->dev_flags))
 353                         continue;
 354
 355                 if (!mgmt_valid_hdev(d))
 356                         continue;
 357
 358                 rp->index[count++] = cpu_to_le16(d->id);
 359                 BT_DBG("Added hci%u", d->id);
 360         }
 361
 362         rp->num_controllers = cpu_to_le16(count);
 363         rp_len = sizeof(*rp) + (2 * count);
 364
 365         read_unlock(&hci_dev_list_lock);
 366
 367         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 368                            rp_len);
 369
 370         kfree(rp);
 371
 372         return err;
 373 }
 374
 375 static u32 get_supported_settings(struct hci_dev *hdev)
 376 {
 377         u32 settings = 0;
 378
 379         settings |= MGMT_SETTING_POWERED;
 380         settings |= MGMT_SETTING_PAIRABLE;
 381
 382         if (lmp_ssp_capable(hdev))
 383                 settings |= MGMT_SETTING_SSP;
 384
 385         if (lmp_bredr_capable(hdev)) {
 386                 settings |= MGMT_SETTING_CONNECTABLE;
 387                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 388                 settings |= MGMT_SETTING_DISCOVERABLE;
 389                 settings |= MGMT_SETTING_BREDR;
 390                 settings |= MGMT_SETTING_LINK_SECURITY;
 391         }
 392
 393         if (enable_hs)
 394                 settings |= MGMT_SETTING_HS;
 395
 396         if (lmp_le_capable(hdev))
 397                 settings |= MGMT_SETTING_LE;
 398
 399         return settings;
 400 }
 401
 402 static u32 get_current_settings(struct hci_dev *hdev)
 403 {
 404         u32 settings = 0;
 405
 406         if (hdev_is_powered(hdev))
 407                 settings |= MGMT_SETTING_POWERED;
 408
 409         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 410                 settings |= MGMT_SETTING_CONNECTABLE;
 411
 412         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 413                 settings |= MGMT_SETTING_DISCOVERABLE;
 414
 415         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 416                 settings |= MGMT_SETTING_PAIRABLE;
 417
 418         if (lmp_bredr_capable(hdev))
 419                 settings |= MGMT_SETTING_BREDR;
 420
 421         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 422                 settings |= MGMT_SETTING_LE;
 423
 424         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 425                 settings |= MGMT_SETTING_LINK_SECURITY;
 426
 427         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 428                 settings |= MGMT_SETTING_SSP;
 429
 430         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 431                 settings |= MGMT_SETTING_HS;
 432
 433         return settings;
 434 }
 435
 436 #define PNP_INFO_SVCLASS_ID             0x1200
 437
 438 static u8 bluetooth_base_uuid[] = {
 439                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 440                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 441 };
 442
 443 static u16 get_uuid16(u8 *uuid128)
 444 {
 445         u32 val;
 446         int i;
 447
 448         for (i = 0; i < 12; i++) {
 449                 if (bluetooth_base_uuid[i] != uuid128[i])
 450                         return 0;
 451         }
 452
 453         val = get_unaligned_le32(&uuid128[12]);
 454         if (val > 0xffff)
 455                 return 0;
 456
 457         return (u16) val;
 458 }
 459
 460 static void create_eir(struct hci_dev *hdev, u8 *data)
 461 {
 462         u8 *ptr = data;
 463         u16 eir_len = 0;
 464         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 465         int i, truncated = 0;
 466         struct bt_uuid *uuid;
 467         size_t name_len;
 468
 469         name_len = strlen(hdev->dev_name);
 470
 471         if (name_len > 0) {
 472                 /* EIR Data type */
 473                 if (name_len > 48) {
 474                         name_len = 48;
 475                         ptr[1] = EIR_NAME_SHORT;
 476                 } else
 477                         ptr[1] = EIR_NAME_COMPLETE;
 478
 479                 /* EIR Data length */
 480                 ptr[0] = name_len + 1;
 481
 482                 memcpy(ptr + 2, hdev->dev_name, name_len);
 483
 484                 eir_len += (name_len + 2);
 485                 ptr += (name_len + 2);
 486         }
 487
 488         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 489                 ptr[0] = 2;
 490                 ptr[1] = EIR_TX_POWER;
 491                 ptr[2] = (u8) hdev->inq_tx_power;
 492
 493                 eir_len += 3;
 494                 ptr += 3;
 495         }
 496
 497         if (hdev->devid_source > 0) {
 498                 ptr[0] = 9;
 499                 ptr[1] = EIR_DEVICE_ID;
 500
 501                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 502                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 503                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 504                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 505
 506                 eir_len += 10;
 507                 ptr += 10;
 508         }
 509
 510         memset(uuid16_list, 0, sizeof(uuid16_list));
 511
 512         /* Group all UUID16 types */
 513         list_for_each_entry(uuid, &hdev->uuids, list) {
 514                 u16 uuid16;
 515
 516                 uuid16 = get_uuid16(uuid->uuid);
 517                 if (uuid16 == 0)
 518                         return;
 519
 520                 if (uuid16 < 0x1100)
 521                         continue;
 522
 523                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 524                         continue;
 525
 526                 /* Stop if not enough space to put next UUID */
 527                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 528                         truncated = 1;
 529                         break;
 530                 }
 531
 532                 /* Check for duplicates */
 533                 for (i = 0; uuid16_list[i] != 0; i++)
 534                         if (uuid16_list[i] == uuid16)
 535                                 break;
 536
 537                 if (uuid16_list[i] == 0) {
 538                         uuid16_list[i] = uuid16;
 539                         eir_len += sizeof(u16);
 540                 }
 541         }
 542
 543         if (uuid16_list[0] != 0) {
 544                 u8 *length = ptr;
 545
 546                 /* EIR Data type */
 547                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 548
 549                 ptr += 2;
 550                 eir_len += 2;
 551
 552                 for (i = 0; uuid16_list[i] != 0; i++) {
 553                         *ptr++ = (uuid16_list[i] & 0x00ff);
 554                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 555                 }
 556
 557                 /* EIR Data length */
 558                 *length = (i * sizeof(u16)) + 1;
 559         }
 560 }
 561
 562 static int update_eir(struct hci_dev *hdev)
 563 {
 564         struct hci_cp_write_eir cp;
 565
 566         if (!hdev_is_powered(hdev))
 567                 return 0;
 568
 569         if (!lmp_ext_inq_capable(hdev))
 570                 return 0;
 571
 572         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 573                 return 0;
 574
 575         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 576                 return 0;
 577
 578         memset(&cp, 0, sizeof(cp));
 579
 580         create_eir(hdev, cp.data);
 581
 582         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 583                 return 0;
 584
 585         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 586
 587         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 588 }
 589
 590 static u8 get_service_classes(struct hci_dev *hdev)
 591 {
 592         struct bt_uuid *uuid;
 593         u8 val = 0;
 594
 595         list_for_each_entry(uuid, &hdev->uuids, list)
 596                 val |= uuid->svc_hint;
 597
 598         return val;
 599 }
 600
 601 static int update_class(struct hci_dev *hdev)
 602 {
 603         u8 cod[3];
 604         int err;
 605
 606         BT_DBG("%s", hdev->name);
 607
 608         if (!hdev_is_powered(hdev))
 609                 return 0;
 610
 611         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 612                 return 0;
 613
 614         cod[0] = hdev->minor_class;
 615         cod[1] = hdev->major_class;
 616         cod[2] = get_service_classes(hdev);
 617
 618         if (memcmp(cod, hdev->dev_class, 3) == 0)
 619                 return 0;
 620
 621         err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 622         if (err == 0)
 623                 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
 624
 625         return err;
 626 }
 627
 628 static void service_cache_off(struct work_struct *work)
 629 {
 630         struct hci_dev *hdev = container_of(work, struct hci_dev,
 631                                             service_cache.work);
 632
 633         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 634                 return;
 635
 636         hci_dev_lock(hdev);
 637
 638         update_eir(hdev);
 639         update_class(hdev);
 640
 641         hci_dev_unlock(hdev);
 642 }
 643
 644 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 645 {
 646         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 647                 return;
 648
 649         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 650
 651         /* Non-mgmt controlled devices get this bit set
 652          * implicitly so that pairing works for them, however
 653          * for mgmt we require user-space to explicitly enable
 654          * it
 655          */
 656         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 657 }
 658
 659 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 660                                 void *data, u16 data_len)
 661 {
 662         struct mgmt_rp_read_info rp;
 663
 664         BT_DBG("sock %p %s", sk, hdev->name);
 665
 666         hci_dev_lock(hdev);
 667
 668         memset(&rp, 0, sizeof(rp));
 669
 670         bacpy(&rp.bdaddr, &hdev->bdaddr);
 671
 672         rp.version = hdev->hci_ver;
 673         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 674
 675         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 676         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 677
 678         memcpy(rp.dev_class, hdev->dev_class, 3);
 679
 680         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 681         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 682
 683         hci_dev_unlock(hdev);
 684
 685         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 686                             sizeof(rp));
 687 }
 688
 689 static void mgmt_pending_free(struct pending_cmd *cmd)
 690 {
 691         sock_put(cmd->sk);
 692         kfree(cmd->param);
 693         kfree(cmd);
 694 }
 695
 696 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 697                                             struct hci_dev *hdev, void *data,
 698                                             u16 len)
 699 {
 700         struct pending_cmd *cmd;
 701
 702         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 703         if (!cmd)
 704                 return NULL;
 705
 706         cmd->opcode = opcode;
 707         cmd->index = hdev->id;
 708
 709         cmd->param = kmalloc(len, GFP_KERNEL);
 710         if (!cmd->param) {
 711                 kfree(cmd);
 712                 return NULL;
 713         }
 714
 715         if (data)
 716                 memcpy(cmd->param, data, len);
 717
 718         cmd->sk = sk;
 719         sock_hold(sk);
 720
 721         list_add(&cmd->list, &hdev->mgmt_pending);
 722
 723         return cmd;
 724 }
 725
 726 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 727                                  void (*cb)(struct pending_cmd *cmd,
 728                                             void *data),
 729                                  void *data)
 730 {
 731         struct list_head *p, *n;
 732
 733         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 734                 struct pending_cmd *cmd;
 735
 736                 cmd = list_entry(p, struct pending_cmd, list);
 737
 738                 if (opcode > 0 && cmd->opcode != opcode)
 739                         continue;
 740
 741                 cb(cmd, data);
 742         }
 743 }
 744
 745 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 746 {
 747         struct pending_cmd *cmd;
 748
 749         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 750                 if (cmd->opcode == opcode)
 751                         return cmd;
 752         }
 753
 754         return NULL;
 755 }
 756
 757 static void mgmt_pending_remove(struct pending_cmd *cmd)
 758 {
 759         list_del(&cmd->list);
 760         mgmt_pending_free(cmd);
 761 }
 762
 763 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 764 {
 765         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 766
 767         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 768                             sizeof(settings));
 769 }
 770
 771 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 772                        u16 len)
 773 {
 774         struct mgmt_mode *cp = data;
 775         struct pending_cmd *cmd;
 776         int err;
 777
 778         BT_DBG("request for %s", hdev->name);
 779
 780         hci_dev_lock(hdev);
 781
 782         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 783                 cancel_delayed_work(&hdev->power_off);
 784
 785                 if (cp->val) {
 786                         err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 787                         mgmt_powered(hdev, 1);
 788                         goto failed;
 789                 }
 790         }
 791
 792         if (!!cp->val == hdev_is_powered(hdev)) {
 793                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 794                 goto failed;
 795         }
 796
 797         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 798                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 799                                  MGMT_STATUS_BUSY);
 800                 goto failed;
 801         }
 802
 803         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 804         if (!cmd) {
 805                 err = -ENOMEM;
 806                 goto failed;
 807         }
 808
 809         if (cp->val)
 810                 schedule_work(&hdev->power_on);
 811         else
 812                 schedule_work(&hdev->power_off.work);
 813
 814         err = 0;
 815
 816 failed:
 817         hci_dev_unlock(hdev);
 818         return err;
 819 }
 820
 821 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 822                       struct sock *skip_sk)
 823 {
 824         struct sk_buff *skb;
 825         struct mgmt_hdr *hdr;
 826
 827         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 828         if (!skb)
 829                 return -ENOMEM;
 830
 831         hdr = (void *) skb_put(skb, sizeof(*hdr));
 832         hdr->opcode = cpu_to_le16(event);
 833         if (hdev)
 834                 hdr->index = cpu_to_le16(hdev->id);
 835         else
 836                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 837         hdr->len = cpu_to_le16(data_len);
 838
 839         if (data)
 840                 memcpy(skb_put(skb, data_len), data, data_len);
 841
 842         /* Time stamp */
 843         __net_timestamp(skb);
 844
 845         hci_send_to_control(skb, skip_sk);
 846         kfree_skb(skb);
 847
 848         return 0;
 849 }
 850
 851 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 852 {
 853         __le32 ev;
 854
 855         ev = cpu_to_le32(get_current_settings(hdev));
 856
 857         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 858 }
 859
 860 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 861                             u16 len)
 862 {
 863         struct mgmt_cp_set_discoverable *cp = data;
 864         struct pending_cmd *cmd;
 865         u16 timeout;
 866         u8 scan;
 867         int err;
 868
 869         BT_DBG("request for %s", hdev->name);
 870
 871         if (!lmp_bredr_capable(hdev))
 872                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 873                                  MGMT_STATUS_NOT_SUPPORTED);
 874
 875         timeout = __le16_to_cpu(cp->timeout);
 876         if (!cp->val && timeout > 0)
 877                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 878                                   MGMT_STATUS_INVALID_PARAMS);
 879
 880         hci_dev_lock(hdev);
 881
 882         if (!hdev_is_powered(hdev) && timeout > 0) {
 883                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 884                                  MGMT_STATUS_NOT_POWERED);
 885                 goto failed;
 886         }
 887
 888         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 889             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 890                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 891                                  MGMT_STATUS_BUSY);
 892                 goto failed;
 893         }
 894
 895         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 896                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 897                                  MGMT_STATUS_REJECTED);
 898                 goto failed;
 899         }
 900
 901         if (!hdev_is_powered(hdev)) {
 902                 bool changed = false;
 903
 904                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 905                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 906                         changed = true;
 907                 }
 908
 909                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 910                 if (err < 0)
 911                         goto failed;
 912
 913                 if (changed)
 914                         err = new_settings(hdev, sk);
 915
 916                 goto failed;
 917         }
 918
 919         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 920                 if (hdev->discov_timeout > 0) {
 921                         cancel_delayed_work(&hdev->discov_off);
 922                         hdev->discov_timeout = 0;
 923                 }
 924
 925                 if (cp->val && timeout > 0) {
 926                         hdev->discov_timeout = timeout;
 927                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 928                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 929                 }
 930
 931                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 932                 goto failed;
 933         }
 934
 935         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 936         if (!cmd) {
 937                 err = -ENOMEM;
 938                 goto failed;
 939         }
 940
 941         scan = SCAN_PAGE;
 942
 943         if (cp->val)
 944                 scan |= SCAN_INQUIRY;
 945         else
 946                 cancel_delayed_work(&hdev->discov_off);
 947
 948         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 949         if (err < 0)
 950                 mgmt_pending_remove(cmd);
 951
 952         if (cp->val)
 953                 hdev->discov_timeout = timeout;
 954
 955 failed:
 956         hci_dev_unlock(hdev);
 957         return err;
 958 }
 959
 960 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
 961                            u16 len)
 962 {
 963         struct mgmt_mode *cp = data;
 964         struct pending_cmd *cmd;
 965         u8 scan;
 966         int err;
 967
 968         BT_DBG("request for %s", hdev->name);
 969
 970         if (!lmp_bredr_capable(hdev))
 971                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
 972                                   MGMT_STATUS_NOT_SUPPORTED);
 973
 974         hci_dev_lock(hdev);
 975
 976         if (!hdev_is_powered(hdev)) {
 977                 bool changed = false;
 978
 979                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 980                         changed = true;
 981
 982                 if (cp->val) {
 983                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 984                 } else {
 985                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 986                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 987                 }
 988
 989                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 990                 if (err < 0)
 991                         goto failed;
 992
 993                 if (changed)
 994                         err = new_settings(hdev, sk);
 995
 996                 goto failed;
 997         }
 998
 999         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1000             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1001                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1002                                  MGMT_STATUS_BUSY);
1003                 goto failed;
1004         }
1005
1006         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1007                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1008                 goto failed;
1009         }
1010
1011         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1012         if (!cmd) {
1013                 err = -ENOMEM;
1014                 goto failed;
1015         }
1016
1017         if (cp->val) {
1018                 scan = SCAN_PAGE;
1019         } else {
1020                 scan = 0;
1021
1022                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1023                     hdev->discov_timeout > 0)
1024                         cancel_delayed_work(&hdev->discov_off);
1025         }
1026
1027         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1028         if (err < 0)
1029                 mgmt_pending_remove(cmd);
1030
1031 failed:
1032         hci_dev_unlock(hdev);
1033         return err;
1034 }
1035
1036 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1037                         u16 len)
1038 {
1039         struct mgmt_mode *cp = data;
1040         int err;
1041
1042         BT_DBG("request for %s", hdev->name);
1043
1044         hci_dev_lock(hdev);
1045
1046         if (cp->val)
1047                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1048         else
1049                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1050
1051         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1052         if (err < 0)
1053                 goto failed;
1054
1055         err = new_settings(hdev, sk);
1056
1057 failed:
1058         hci_dev_unlock(hdev);
1059         return err;
1060 }
1061
1062 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1063                              u16 len)
1064 {
1065         struct mgmt_mode *cp = data;
1066         struct pending_cmd *cmd;
1067         u8 val;
1068         int err;
1069
1070         BT_DBG("request for %s", hdev->name);
1071
1072         if (!lmp_bredr_capable(hdev))
1073                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1074                                   MGMT_STATUS_NOT_SUPPORTED);
1075
1076         hci_dev_lock(hdev);
1077
1078         if (!hdev_is_powered(hdev)) {
1079                 bool changed = false;
1080
1081                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1082                                           &hdev->dev_flags)) {
1083                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1084                         changed = true;
1085                 }
1086
1087                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1088                 if (err < 0)
1089                         goto failed;
1090
1091                 if (changed)
1092                         err = new_settings(hdev, sk);
1093
1094                 goto failed;
1095         }
1096
1097         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1098                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1099                                  MGMT_STATUS_BUSY);
1100                 goto failed;
1101         }
1102
1103         val = !!cp->val;
1104
1105         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1106                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1107                 goto failed;
1108         }
1109
1110         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1111         if (!cmd) {
1112                 err = -ENOMEM;
1113                 goto failed;
1114         }
1115
1116         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1117         if (err < 0) {
1118                 mgmt_pending_remove(cmd);
1119                 goto failed;
1120         }
1121
1122 failed:
1123         hci_dev_unlock(hdev);
1124         return err;
1125 }
1126
1127 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1128 {
1129         struct mgmt_mode *cp = data;
1130         struct pending_cmd *cmd;
1131         u8 val;
1132         int err;
1133
1134         BT_DBG("request for %s", hdev->name);
1135
1136         hci_dev_lock(hdev);
1137
1138         if (!lmp_ssp_capable(hdev)) {
1139                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1140                                  MGMT_STATUS_NOT_SUPPORTED);
1141                 goto failed;
1142         }
1143
1144         val = !!cp->val;
1145
1146         if (!hdev_is_powered(hdev)) {
1147                 bool changed = false;
1148
1149                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1150                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1151                         changed = true;
1152                 }
1153
1154                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1155                 if (err < 0)
1156                         goto failed;
1157
1158                 if (changed)
1159                         err = new_settings(hdev, sk);
1160
1161                 goto failed;
1162         }
1163
1164         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1165                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1166                                  MGMT_STATUS_BUSY);
1167                 goto failed;
1168         }
1169
1170         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1171                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1172                 goto failed;
1173         }
1174
1175         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1176         if (!cmd) {
1177                 err = -ENOMEM;
1178                 goto failed;
1179         }
1180
1181         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1182         if (err < 0) {
1183                 mgmt_pending_remove(cmd);
1184                 goto failed;
1185         }
1186
1187 failed:
1188         hci_dev_unlock(hdev);
1189         return err;
1190 }
1191
1192 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1193 {
1194         struct mgmt_mode *cp = data;
1195
1196         BT_DBG("request for %s", hdev->name);
1197
1198         if (!enable_hs)
1199                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1200                                   MGMT_STATUS_NOT_SUPPORTED);
1201
1202         if (cp->val)
1203                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1204         else
1205                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1206
1207         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1208 }
1209
1210 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1211 {
1212         struct mgmt_mode *cp = data;
1213         struct hci_cp_write_le_host_supported hci_cp;
1214         struct pending_cmd *cmd;
1215         int err;
1216         u8 val, enabled;
1217
1218         BT_DBG("request for %s", hdev->name);
1219
1220         hci_dev_lock(hdev);
1221
1222         if (!lmp_le_capable(hdev)) {
1223                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1224                                  MGMT_STATUS_NOT_SUPPORTED);
1225                 goto unlock;
1226         }
1227
1228         val = !!cp->val;
1229         enabled = lmp_host_le_capable(hdev);
1230
1231         if (!hdev_is_powered(hdev) || val == enabled) {
1232                 bool changed = false;
1233
1234                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1235                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1236                         changed = true;
1237                 }
1238
1239                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1240                 if (err < 0)
1241                         goto unlock;
1242
1243                 if (changed)
1244                         err = new_settings(hdev, sk);
1245
1246                 goto unlock;
1247         }
1248
1249         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1250                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1251                                  MGMT_STATUS_BUSY);
1252                 goto unlock;
1253         }
1254
1255         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1256         if (!cmd) {
1257                 err = -ENOMEM;
1258                 goto unlock;
1259         }
1260
1261         memset(&hci_cp, 0, sizeof(hci_cp));
1262
1263         if (val) {
1264                 hci_cp.le = val;
1265                 hci_cp.simul = lmp_le_br_capable(hdev);
1266         }
1267
1268         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1269                            &hci_cp);
1270         if (err < 0)
1271                 mgmt_pending_remove(cmd);
1272
1273 unlock:
1274         hci_dev_unlock(hdev);
1275         return err;
1276 }
1277
1278 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1279 {
1280         struct mgmt_cp_add_uuid *cp = data;
1281         struct pending_cmd *cmd;
1282         struct bt_uuid *uuid;
1283         int err;
1284
1285         BT_DBG("request for %s", hdev->name);
1286
1287         hci_dev_lock(hdev);
1288
1289         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1290                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1291                                  MGMT_STATUS_BUSY);
1292                 goto failed;
1293         }
1294
1295         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1296         if (!uuid) {
1297                 err = -ENOMEM;
1298                 goto failed;
1299         }
1300
1301         memcpy(uuid->uuid, cp->uuid, 16);
1302         uuid->svc_hint = cp->svc_hint;
1303
1304         list_add(&uuid->list, &hdev->uuids);
1305
1306         err = update_class(hdev);
1307         if (err < 0)
1308                 goto failed;
1309
1310         err = update_eir(hdev);
1311         if (err < 0)
1312                 goto failed;
1313
1314         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1315                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1316                                    hdev->dev_class, 3);
1317                 goto failed;
1318         }
1319
1320         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1321         if (!cmd)
1322                 err = -ENOMEM;
1323
1324 failed:
1325         hci_dev_unlock(hdev);
1326         return err;
1327 }
1328
1329 static bool enable_service_cache(struct hci_dev *hdev)
1330 {
1331         if (!hdev_is_powered(hdev))
1332                 return false;
1333
1334         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1335                 schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
1336                 return true;
1337         }
1338
1339         return false;
1340 }
1341
1342 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1343                        u16 len)
1344 {
1345         struct mgmt_cp_remove_uuid *cp = data;
1346         struct pending_cmd *cmd;
1347         struct list_head *p, *n;
1348         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1349         int err, found;
1350
1351         BT_DBG("request for %s", hdev->name);
1352
1353         hci_dev_lock(hdev);
1354
1355         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1356                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1357                                  MGMT_STATUS_BUSY);
1358                 goto unlock;
1359         }
1360
1361         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1362                 err = hci_uuids_clear(hdev);
1363
1364                 if (enable_service_cache(hdev)) {
1365                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1366                                            0, hdev->dev_class, 3);
1367                         goto unlock;
1368                 }
1369
1370                 goto update_class;
1371         }
1372
1373         found = 0;
1374
1375         list_for_each_safe(p, n, &hdev->uuids) {
1376                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1377
1378                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1379                         continue;
1380
1381                 list_del(&match->list);
1382                 kfree(match);
1383                 found++;
1384         }
1385
1386         if (found == 0) {
1387                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1388                                  MGMT_STATUS_INVALID_PARAMS);
1389                 goto unlock;
1390         }
1391
1392 update_class:
1393         err = update_class(hdev);
1394         if (err < 0)
1395                 goto unlock;
1396
1397         err = update_eir(hdev);
1398         if (err < 0)
1399                 goto unlock;
1400
1401         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1402                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1403                                    hdev->dev_class, 3);
1404                 goto unlock;
1405         }
1406
1407         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1408         if (!cmd)
1409                 err = -ENOMEM;
1410
1411 unlock:
1412         hci_dev_unlock(hdev);
1413         return err;
1414 }
1415
1416 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1417                          u16 len)
1418 {
1419         struct mgmt_cp_set_dev_class *cp = data;
1420         struct pending_cmd *cmd;
1421         int err;
1422
1423         BT_DBG("request for %s", hdev->name);
1424
1425         hci_dev_lock(hdev);
1426
1427         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1428                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1429                                  MGMT_STATUS_BUSY);
1430                 goto unlock;
1431         }
1432
1433         hdev->major_class = cp->major;
1434         hdev->minor_class = cp->minor;
1435
1436         if (!hdev_is_powered(hdev)) {
1437                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1438                                    hdev->dev_class, 3);
1439                 goto unlock;
1440         }
1441
1442         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1443                 hci_dev_unlock(hdev);
1444                 cancel_delayed_work_sync(&hdev->service_cache);
1445                 hci_dev_lock(hdev);
1446                 update_eir(hdev);
1447         }
1448
1449         err = update_class(hdev);
1450         if (err < 0)
1451                 goto unlock;
1452
1453         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1454                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1455                                    hdev->dev_class, 3);
1456                 goto unlock;
1457         }
1458
1459         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1460         if (!cmd)
1461                 err = -ENOMEM;
1462
1463 unlock:
1464         hci_dev_unlock(hdev);
1465         return err;
1466 }
1467
1468 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1469                           u16 len)
1470 {
1471         struct mgmt_cp_load_link_keys *cp = data;
1472         u16 key_count, expected_len;
1473         int i;
1474
1475         key_count = __le16_to_cpu(cp->key_count);
1476
1477         expected_len = sizeof(*cp) + key_count *
1478                                         sizeof(struct mgmt_link_key_info);
1479         if (expected_len != len) {
1480                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1481                        len, expected_len);
1482                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1483                                   MGMT_STATUS_INVALID_PARAMS);
1484         }
1485
1486         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1487                key_count);
1488
1489         hci_dev_lock(hdev);
1490
1491         hci_link_keys_clear(hdev);
1492
1493         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1494
1495         if (cp->debug_keys)
1496                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1497         else
1498                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1499
1500         for (i = 0; i < key_count; i++) {
1501                 struct mgmt_link_key_info *key = &cp->keys[i];
1502
1503                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1504                                  key->type, key->pin_len);
1505         }
1506
1507         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1508
1509         hci_dev_unlock(hdev);
1510
1511         return 0;
1512 }
1513
1514 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1515                            u8 addr_type, struct sock *skip_sk)
1516 {
1517         struct mgmt_ev_device_unpaired ev;
1518
1519         bacpy(&ev.addr.bdaddr, bdaddr);
1520         ev.addr.type = addr_type;
1521
1522         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1523                           skip_sk);
1524 }
1525
1526 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1527                          u16 len)
1528 {
1529         struct mgmt_cp_unpair_device *cp = data;
1530         struct mgmt_rp_unpair_device rp;
1531         struct hci_cp_disconnect dc;
1532         struct pending_cmd *cmd;
1533         struct hci_conn *conn;
1534         int err;
1535
1536         hci_dev_lock(hdev);
1537
1538         memset(&rp, 0, sizeof(rp));
1539         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1540         rp.addr.type = cp->addr.type;
1541
1542         if (!hdev_is_powered(hdev)) {
1543                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1544                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1545                 goto unlock;
1546         }
1547
1548         if (cp->addr.type == BDADDR_BREDR)
1549                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1550         else
1551                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1552
1553         if (err < 0) {
1554                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1555                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1556                 goto unlock;
1557         }
1558
1559         if (cp->disconnect) {
1560                 if (cp->addr.type == BDADDR_BREDR)
1561                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1562                                                        &cp->addr.bdaddr);
1563                 else
1564                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1565                                                        &cp->addr.bdaddr);
1566         } else {
1567                 conn = NULL;
1568         }
1569
1570         if (!conn) {
1571                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1572                                    &rp, sizeof(rp));
1573                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1574                 goto unlock;
1575         }
1576
1577         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1578                                sizeof(*cp));
1579         if (!cmd) {
1580                 err = -ENOMEM;
1581                 goto unlock;
1582         }
1583
1584         dc.handle = cpu_to_le16(conn->handle);
1585         dc.reason = 0x13; /* Remote User Terminated Connection */
1586         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1587         if (err < 0)
1588                 mgmt_pending_remove(cmd);
1589
1590 unlock:
1591         hci_dev_unlock(hdev);
1592         return err;
1593 }
1594
1595 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1596                       u16 len)
1597 {
1598         struct mgmt_cp_disconnect *cp = data;
1599         struct hci_cp_disconnect dc;
1600         struct pending_cmd *cmd;
1601         struct hci_conn *conn;
1602         int err;
1603
1604         BT_DBG("");
1605
1606         hci_dev_lock(hdev);
1607
1608         if (!test_bit(HCI_UP, &hdev->flags)) {
1609                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1610                                  MGMT_STATUS_NOT_POWERED);
1611                 goto failed;
1612         }
1613
1614         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1615                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1616                                  MGMT_STATUS_BUSY);
1617                 goto failed;
1618         }
1619
1620         if (cp->addr.type == BDADDR_BREDR)
1621                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1622                                                &cp->addr.bdaddr);
1623         else
1624                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1625
1626         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1627                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1628                                  MGMT_STATUS_NOT_CONNECTED);
1629                 goto failed;
1630         }
1631
1632         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1633         if (!cmd) {
1634                 err = -ENOMEM;
1635                 goto failed;
1636         }
1637
1638         dc.handle = cpu_to_le16(conn->handle);
1639         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1640
1641         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1642         if (err < 0)
1643                 mgmt_pending_remove(cmd);
1644
1645 failed:
1646         hci_dev_unlock(hdev);
1647         return err;
1648 }
1649
1650 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1651 {
1652         switch (link_type) {
1653         case LE_LINK:
1654                 switch (addr_type) {
1655                 case ADDR_LE_DEV_PUBLIC:
1656                         return BDADDR_LE_PUBLIC;
1657
1658                 default:
1659                         /* Fallback to LE Random address type */
1660                         return BDADDR_LE_RANDOM;
1661                 }
1662
1663         default:
1664                 /* Fallback to BR/EDR type */
1665                 return BDADDR_BREDR;
1666         }
1667 }
1668
1669 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1670                            u16 data_len)
1671 {
1672         struct mgmt_rp_get_connections *rp;
1673         struct hci_conn *c;
1674         size_t rp_len;
1675         int err;
1676         u16 i;
1677
1678         BT_DBG("");
1679
1680         hci_dev_lock(hdev);
1681
1682         if (!hdev_is_powered(hdev)) {
1683                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1684                                  MGMT_STATUS_NOT_POWERED);
1685                 goto unlock;
1686         }
1687
1688         i = 0;
1689         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1690                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1691                         i++;
1692         }
1693
1694         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1695         rp = kmalloc(rp_len, GFP_KERNEL);
1696         if (!rp) {
1697                 err = -ENOMEM;
1698                 goto unlock;
1699         }
1700
1701         i = 0;
1702         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1703                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1704                         continue;
1705                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1706                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1707                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1708                         continue;
1709                 i++;
1710         }
1711
1712         rp->conn_count = cpu_to_le16(i);
1713
1714         /* Recalculate length in case of filtered SCO connections, etc */
1715         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1716
1717         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1718                            rp_len);
1719
1720         kfree(rp);
1721
1722 unlock:
1723         hci_dev_unlock(hdev);
1724         return err;
1725 }
1726
1727 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1728                                    struct mgmt_cp_pin_code_neg_reply *cp)
1729 {
1730         struct pending_cmd *cmd;
1731         int err;
1732
1733         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1734                                sizeof(*cp));
1735         if (!cmd)
1736                 return -ENOMEM;
1737
1738         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1739                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1740         if (err < 0)
1741                 mgmt_pending_remove(cmd);
1742
1743         return err;
1744 }
1745
1746 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1747                           u16 len)
1748 {
1749         struct hci_conn *conn;
1750         struct mgmt_cp_pin_code_reply *cp = data;
1751         struct hci_cp_pin_code_reply reply;
1752         struct pending_cmd *cmd;
1753         int err;
1754
1755         BT_DBG("");
1756
1757         hci_dev_lock(hdev);
1758
1759         if (!hdev_is_powered(hdev)) {
1760                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1761                                  MGMT_STATUS_NOT_POWERED);
1762                 goto failed;
1763         }
1764
1765         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1766         if (!conn) {
1767                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1768                                  MGMT_STATUS_NOT_CONNECTED);
1769                 goto failed;
1770         }
1771
1772         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1773                 struct mgmt_cp_pin_code_neg_reply ncp;
1774
1775                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1776
1777                 BT_ERR("PIN code is not 16 bytes long");
1778
1779                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1780                 if (err >= 0)
1781                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1782                                          MGMT_STATUS_INVALID_PARAMS);
1783
1784                 goto failed;
1785         }
1786
1787         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1788         if (!cmd) {
1789                 err = -ENOMEM;
1790                 goto failed;
1791         }
1792
1793         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1794         reply.pin_len = cp->pin_len;
1795         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1796
1797         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1798         if (err < 0)
1799                 mgmt_pending_remove(cmd);
1800
1801 failed:
1802         hci_dev_unlock(hdev);
1803         return err;
1804 }
1805
1806 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1807                              u16 len)
1808 {
1809         struct mgmt_cp_set_io_capability *cp = data;
1810
1811         BT_DBG("");
1812
1813         hci_dev_lock(hdev);
1814
1815         hdev->io_capability = cp->io_capability;
1816
1817         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1818                hdev->io_capability);
1819
1820         hci_dev_unlock(hdev);
1821
1822         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1823                             0);
1824 }
1825
1826 static struct pending_cmd *find_pairing(struct hci_conn *conn)
1827 {
1828         struct hci_dev *hdev = conn->hdev;
1829         struct pending_cmd *cmd;
1830
1831         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1832                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1833                         continue;
1834
1835                 if (cmd->user_data != conn)
1836                         continue;
1837
1838                 return cmd;
1839         }
1840
1841         return NULL;
1842 }
1843
1844 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1845 {
1846         struct mgmt_rp_pair_device rp;
1847         struct hci_conn *conn = cmd->user_data;
1848
1849         bacpy(&rp.addr.bdaddr, &conn->dst);
1850         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
1851
1852         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1853                      &rp, sizeof(rp));
1854
1855         /* So we don't get further callbacks for this connection */
1856         conn->connect_cfm_cb = NULL;
1857         conn->security_cfm_cb = NULL;
1858         conn->disconn_cfm_cb = NULL;
1859
1860         hci_conn_put(conn);
1861
1862         mgmt_pending_remove(cmd);
1863 }
1864
1865 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1866 {
1867         struct pending_cmd *cmd;
1868
1869         BT_DBG("status %u", status);
1870
1871         cmd = find_pairing(conn);
1872         if (!cmd)
1873                 BT_DBG("Unable to find a pending command");
1874         else
1875                 pairing_complete(cmd, mgmt_status(status));
1876 }
1877
1878 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
1879 {
1880         struct pending_cmd *cmd;
1881
1882         BT_DBG("status %u", status);
1883
1884         if (!status)
1885                 return;
1886
1887         cmd = find_pairing(conn);
1888         if (!cmd)
1889                 BT_DBG("Unable to find a pending command");
1890         else
1891                 pairing_complete(cmd, mgmt_status(status));
1892 }
1893
1894 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1895                        u16 len)
1896 {
1897         struct mgmt_cp_pair_device *cp = data;
1898         struct mgmt_rp_pair_device rp;
1899         struct pending_cmd *cmd;
1900         u8 sec_level, auth_type;
1901         struct hci_conn *conn;
1902         int err;
1903
1904         BT_DBG("");
1905
1906         hci_dev_lock(hdev);
1907
1908         if (!hdev_is_powered(hdev)) {
1909                 err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1910                                  MGMT_STATUS_NOT_POWERED);
1911                 goto unlock;
1912         }
1913
1914         sec_level = BT_SECURITY_MEDIUM;
1915         if (cp->io_cap == 0x03)
1916                 auth_type = HCI_AT_DEDICATED_BONDING;
1917         else
1918                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1919
1920         if (cp->addr.type == BDADDR_BREDR)
1921                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
1922                                    cp->addr.type, sec_level, auth_type);
1923         else
1924                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
1925                                    cp->addr.type, sec_level, auth_type);
1926
1927         memset(&rp, 0, sizeof(rp));
1928         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1929         rp.addr.type = cp->addr.type;
1930
1931         if (IS_ERR(conn)) {
1932                 int status;
1933
1934                 if (PTR_ERR(conn) == -EBUSY)
1935                         status = MGMT_STATUS_BUSY;
1936                 else
1937                         status = MGMT_STATUS_CONNECT_FAILED;
1938
1939                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1940                                    status, &rp,
1941                                    sizeof(rp));
1942                 goto unlock;
1943         }
1944
1945         if (conn->connect_cfm_cb) {
1946                 hci_conn_put(conn);
1947                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1948                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1949                 goto unlock;
1950         }
1951
1952         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1953         if (!cmd) {
1954                 err = -ENOMEM;
1955                 hci_conn_put(conn);
1956                 goto unlock;
1957         }
1958
1959         /* For LE, just connecting isn't a proof that the pairing finished */
1960         if (cp->addr.type == BDADDR_BREDR)
1961                 conn->connect_cfm_cb = pairing_complete_cb;
1962         else
1963                 conn->connect_cfm_cb = le_connect_complete_cb;
1964
1965         conn->security_cfm_cb = pairing_complete_cb;
1966         conn->disconn_cfm_cb = pairing_complete_cb;
1967         conn->io_capability = cp->io_cap;
1968         cmd->user_data = conn;
1969
1970         if (conn->state == BT_CONNECTED &&
1971             hci_conn_security(conn, sec_level, auth_type))
1972                 pairing_complete(cmd, 0);
1973
1974         err = 0;
1975
1976 unlock:
1977         hci_dev_unlock(hdev);
1978         return err;
1979 }
1980
1981 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1982                               u16 len)
1983 {
1984         struct mgmt_addr_info *addr = data;
1985         struct pending_cmd *cmd;
1986         struct hci_conn *conn;
1987         int err;
1988
1989         BT_DBG("");
1990
1991         hci_dev_lock(hdev);
1992
1993         if (!hdev_is_powered(hdev)) {
1994                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1995                                  MGMT_STATUS_NOT_POWERED);
1996                 goto unlock;
1997         }
1998
1999         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2000         if (!cmd) {
2001                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2002                                  MGMT_STATUS_INVALID_PARAMS);
2003                 goto unlock;
2004         }
2005
2006         conn = cmd->user_data;
2007
2008         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2009                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2010                                  MGMT_STATUS_INVALID_PARAMS);
2011                 goto unlock;
2012         }
2013
2014         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2015
2016         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2017                            addr, sizeof(*addr));
2018 unlock:
2019         hci_dev_unlock(hdev);
2020         return err;
2021 }
2022
2023 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2024                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2025                              u16 hci_op, __le32 passkey)
2026 {
2027         struct pending_cmd *cmd;
2028         struct hci_conn *conn;
2029         int err;
2030
2031         hci_dev_lock(hdev);
2032
2033         if (!hdev_is_powered(hdev)) {
2034                 err = cmd_status(sk, hdev->id, mgmt_op,
2035                                  MGMT_STATUS_NOT_POWERED);
2036                 goto done;
2037         }
2038
2039         if (type == BDADDR_BREDR)
2040                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2041         else
2042                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2043
2044         if (!conn) {
2045                 err = cmd_status(sk, hdev->id, mgmt_op,
2046                                  MGMT_STATUS_NOT_CONNECTED);
2047                 goto done;
2048         }
2049
2050         if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2051                 /* Continue with pairing via SMP */
2052                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2053
2054                 if (!err)
2055                         err = cmd_status(sk, hdev->id, mgmt_op,
2056                                          MGMT_STATUS_SUCCESS);
2057                 else
2058                         err = cmd_status(sk, hdev->id, mgmt_op,
2059                                          MGMT_STATUS_FAILED);
2060
2061                 goto done;
2062         }
2063
2064         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2065         if (!cmd) {
2066                 err = -ENOMEM;
2067                 goto done;
2068         }
2069
2070         /* Continue with pairing via HCI */
2071         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2072                 struct hci_cp_user_passkey_reply cp;
2073
2074                 bacpy(&cp.bdaddr, bdaddr);
2075                 cp.passkey = passkey;
2076                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2077         } else
2078                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2079
2080         if (err < 0)
2081                 mgmt_pending_remove(cmd);
2082
2083 done:
2084         hci_dev_unlock(hdev);
2085         return err;
2086 }
2087
2088 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2089                               void *data, u16 len)
2090 {
2091         struct mgmt_cp_pin_code_neg_reply *cp = data;
2092
2093         BT_DBG("");
2094
2095         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2096                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2097                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2098 }
2099
2100 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2101                               u16 len)
2102 {
2103         struct mgmt_cp_user_confirm_reply *cp = data;
2104
2105         BT_DBG("");
2106
2107         if (len != sizeof(*cp))
2108                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2109                                   MGMT_STATUS_INVALID_PARAMS);
2110
2111         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2112                                  MGMT_OP_USER_CONFIRM_REPLY,
2113                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2114 }
2115
2116 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2117                                   void *data, u16 len)
2118 {
2119         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2120
2121         BT_DBG("");
2122
2123         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2124                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2125                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2126 }
2127
2128 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2129                               u16 len)
2130 {
2131         struct mgmt_cp_user_passkey_reply *cp = data;
2132
2133         BT_DBG("");
2134
2135         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2136                                  MGMT_OP_USER_PASSKEY_REPLY,
2137                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2138 }
2139
2140 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2141                                   void *data, u16 len)
2142 {
2143         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2144
2145         BT_DBG("");
2146
2147         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2148                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2149                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2150 }
2151
2152 static int update_name(struct hci_dev *hdev, const char *name)
2153 {
2154         struct hci_cp_write_local_name cp;
2155
2156         memcpy(cp.name, name, sizeof(cp.name));
2157
2158         return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2159 }
2160
2161 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2162                           u16 len)
2163 {
2164         struct mgmt_cp_set_local_name *cp = data;
2165         struct pending_cmd *cmd;
2166         int err;
2167
2168         BT_DBG("");
2169
2170         hci_dev_lock(hdev);
2171
2172         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2173
2174         if (!hdev_is_powered(hdev)) {
2175                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2176
2177                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2178                                    data, len);
2179                 if (err < 0)
2180                         goto failed;
2181
2182                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2183                                  sk);
2184
2185                 goto failed;
2186         }
2187
2188         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2189         if (!cmd) {
2190                 err = -ENOMEM;
2191                 goto failed;
2192         }
2193
2194         err = update_name(hdev, cp->name);
2195         if (err < 0)
2196                 mgmt_pending_remove(cmd);
2197
2198 failed:
2199         hci_dev_unlock(hdev);
2200         return err;
2201 }
2202
2203 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2204                                void *data, u16 data_len)
2205 {
2206         struct pending_cmd *cmd;
2207         int err;
2208
2209         BT_DBG("%s", hdev->name);
2210
2211         hci_dev_lock(hdev);
2212
2213         if (!hdev_is_powered(hdev)) {
2214                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2215                                  MGMT_STATUS_NOT_POWERED);
2216                 goto unlock;
2217         }
2218
2219         if (!lmp_ssp_capable(hdev)) {
2220                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2221                                  MGMT_STATUS_NOT_SUPPORTED);
2222                 goto unlock;
2223         }
2224
2225         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2226                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2227                                  MGMT_STATUS_BUSY);
2228                 goto unlock;
2229         }
2230
2231         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2232         if (!cmd) {
2233                 err = -ENOMEM;
2234                 goto unlock;
2235         }
2236
2237         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2238         if (err < 0)
2239                 mgmt_pending_remove(cmd);
2240
2241 unlock:
2242         hci_dev_unlock(hdev);
2243         return err;
2244 }
2245
2246 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2247                                void *data, u16 len)
2248 {
2249         struct mgmt_cp_add_remote_oob_data *cp = data;
2250         u8 status;
2251         int err;
2252
2253         BT_DBG("%s ", hdev->name);
2254
2255         hci_dev_lock(hdev);
2256
2257         if (!hdev_is_powered(hdev)) {
2258                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
2259                                    MGMT_STATUS_NOT_POWERED, &cp->addr,
2260                                    sizeof(cp->addr));
2261                 goto unlock;
2262         }
2263
2264         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2265                                       cp->randomizer);
2266         if (err < 0)
2267                 status = MGMT_STATUS_FAILED;
2268         else
2269                 status = 0;
2270
2271         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2272                            &cp->addr, sizeof(cp->addr));
2273
2274 unlock:
2275         hci_dev_unlock(hdev);
2276         return err;
2277 }
2278
2279 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2280                                   void *data, u16 len)
2281 {
2282         struct mgmt_cp_remove_remote_oob_data *cp = data;
2283         u8 status;
2284         int err;
2285
2286         BT_DBG("%s", hdev->name);
2287
2288         hci_dev_lock(hdev);
2289
2290         if (!hdev_is_powered(hdev)) {
2291                 err = cmd_complete(sk, hdev->id,
2292                                    MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2293                                    MGMT_STATUS_NOT_POWERED, &cp->addr,
2294                                    sizeof(cp->addr));
2295                 goto unlock;
2296         }
2297
2298         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2299         if (err < 0)
2300                 status = MGMT_STATUS_INVALID_PARAMS;
2301         else
2302                 status = 0;
2303
2304         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2305                            status, &cp->addr, sizeof(cp->addr));
2306
2307 unlock:
2308         hci_dev_unlock(hdev);
2309         return err;
2310 }
2311
2312 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2313 {
2314         int err;
2315
2316         BT_DBG("%s", hdev->name);
2317
2318         hci_dev_lock(hdev);
2319
2320         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2321         if (err < 0)
2322                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2323
2324         hci_dev_unlock(hdev);
2325
2326         return err;
2327 }
2328
2329 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2330                            void *data, u16 len)
2331 {
2332         struct mgmt_cp_start_discovery *cp = data;
2333         struct pending_cmd *cmd;
2334         int err;
2335
2336         BT_DBG("%s", hdev->name);
2337
2338         hci_dev_lock(hdev);
2339
2340         if (!hdev_is_powered(hdev)) {
2341                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2342                                  MGMT_STATUS_NOT_POWERED);
2343                 goto failed;
2344         }
2345
2346         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2347                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2348                                  MGMT_STATUS_BUSY);
2349                 goto failed;
2350         }
2351
2352         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2353                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2354                                  MGMT_STATUS_BUSY);
2355                 goto failed;
2356         }
2357
2358         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2359         if (!cmd) {
2360                 err = -ENOMEM;
2361                 goto failed;
2362         }
2363
2364         hdev->discovery.type = cp->type;
2365
2366         switch (hdev->discovery.type) {
2367         case DISCOV_TYPE_BREDR:
2368                 if (lmp_bredr_capable(hdev))
2369                         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2370                 else
2371                         err = -ENOTSUPP;
2372                 break;
2373
2374         case DISCOV_TYPE_LE:
2375                 if (lmp_host_le_capable(hdev))
2376                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2377                                           LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2378                 else
2379                         err = -ENOTSUPP;
2380                 break;
2381
2382         case DISCOV_TYPE_INTERLEAVED:
2383                 if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
2384                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2385                                           LE_SCAN_WIN,
2386                                           LE_SCAN_TIMEOUT_BREDR_LE);
2387                 else
2388                         err = -ENOTSUPP;
2389                 break;
2390
2391         default:
2392                 err = -EINVAL;
2393         }
2394
2395         if (err < 0)
2396                 mgmt_pending_remove(cmd);
2397         else
2398                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2399
2400 failed:
2401         hci_dev_unlock(hdev);
2402         return err;
2403 }
2404
2405 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2406                           u16 len)
2407 {
2408         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2409         struct pending_cmd *cmd;
2410         struct hci_cp_remote_name_req_cancel cp;
2411         struct inquiry_entry *e;
2412         int err;
2413
2414         BT_DBG("%s", hdev->name);
2415
2416         hci_dev_lock(hdev);
2417
2418         if (!hci_discovery_active(hdev)) {
2419                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2420                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2421                                    sizeof(mgmt_cp->type));
2422                 goto unlock;
2423         }
2424
2425         if (hdev->discovery.type != mgmt_cp->type) {
2426                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2427                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2428                                    sizeof(mgmt_cp->type));
2429                 goto unlock;
2430         }
2431
2432         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2433         if (!cmd) {
2434                 err = -ENOMEM;
2435                 goto unlock;
2436         }
2437
2438         switch (hdev->discovery.state) {
2439         case DISCOVERY_FINDING:
2440                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2441                         err = hci_cancel_inquiry(hdev);
2442                 else
2443                         err = hci_cancel_le_scan(hdev);
2444
2445                 break;
2446
2447         case DISCOVERY_RESOLVING:
2448                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2449                                                      NAME_PENDING);
2450                 if (!e) {
2451                         mgmt_pending_remove(cmd);
2452                         err = cmd_complete(sk, hdev->id,
2453                                            MGMT_OP_STOP_DISCOVERY, 0,
2454                                            &mgmt_cp->type,
2455                                            sizeof(mgmt_cp->type));
2456                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2457                         goto unlock;
2458                 }
2459
2460                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2461                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2462                                    sizeof(cp), &cp);
2463
2464                 break;
2465
2466         default:
2467                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2468                 err = -EFAULT;
2469         }
2470
2471         if (err < 0)
2472                 mgmt_pending_remove(cmd);
2473         else
2474                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2475
2476 unlock:
2477         hci_dev_unlock(hdev);
2478         return err;
2479 }
2480
2481 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2482                         u16 len)
2483 {
2484         struct mgmt_cp_confirm_name *cp = data;
2485         struct inquiry_entry *e;
2486         int err;
2487
2488         BT_DBG("%s", hdev->name);
2489
2490         hci_dev_lock(hdev);
2491
2492         if (!hci_discovery_active(hdev)) {
2493                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2494                                  MGMT_STATUS_FAILED);
2495                 goto failed;
2496         }
2497
2498         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2499         if (!e) {
2500                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2501                                  MGMT_STATUS_INVALID_PARAMS);
2502                 goto failed;
2503         }
2504
2505         if (cp->name_known) {
2506                 e->name_state = NAME_KNOWN;
2507                 list_del(&e->list);
2508         } else {
2509                 e->name_state = NAME_NEEDED;
2510                 hci_inquiry_cache_update_resolve(hdev, e);
2511         }
2512
2513         err = 0;
2514
2515 failed:
2516         hci_dev_unlock(hdev);
2517         return err;
2518 }
2519
2520 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2521                         u16 len)
2522 {
2523         struct mgmt_cp_block_device *cp = data;
2524         u8 status;
2525         int err;
2526
2527         BT_DBG("%s", hdev->name);
2528
2529         hci_dev_lock(hdev);
2530
2531         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2532         if (err < 0)
2533                 status = MGMT_STATUS_FAILED;
2534         else
2535                 status = 0;
2536
2537         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2538                            &cp->addr, sizeof(cp->addr));
2539
2540         hci_dev_unlock(hdev);
2541
2542         return err;
2543 }
2544
2545 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2546                           u16 len)
2547 {
2548         struct mgmt_cp_unblock_device *cp = data;
2549         u8 status;
2550         int err;
2551
2552         BT_DBG("%s", hdev->name);
2553
2554         hci_dev_lock(hdev);
2555
2556         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2557         if (err < 0)
2558                 status = MGMT_STATUS_INVALID_PARAMS;
2559         else
2560                 status = 0;
2561
2562         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2563                            &cp->addr, sizeof(cp->addr));
2564
2565         hci_dev_unlock(hdev);
2566
2567         return err;
2568 }
2569
2570 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2571                          u16 len)
2572 {
2573         struct mgmt_cp_set_device_id *cp = data;
2574         int err;
2575         __u16 source;
2576
2577         BT_DBG("%s", hdev->name);
2578
2579         source = __le16_to_cpu(cp->source);
2580
2581         if (source > 0x0002)
2582                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2583                                   MGMT_STATUS_INVALID_PARAMS);
2584
2585         hci_dev_lock(hdev);
2586
2587         hdev->devid_source = source;
2588         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2589         hdev->devid_product = __le16_to_cpu(cp->product);
2590         hdev->devid_version = __le16_to_cpu(cp->version);
2591
2592         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2593
2594         update_eir(hdev);
2595
2596         hci_dev_unlock(hdev);
2597
2598         return err;
2599 }
2600
2601 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2602                                 void *data, u16 len)
2603 {
2604         struct mgmt_mode *cp = data;
2605         struct hci_cp_write_page_scan_activity acp;
2606         u8 type;
2607         int err;
2608
2609         BT_DBG("%s", hdev->name);
2610
2611         if (!lmp_bredr_capable(hdev))
2612                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2613                                   MGMT_STATUS_NOT_SUPPORTED);
2614
2615         if (!hdev_is_powered(hdev))
2616                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2617                                   MGMT_STATUS_NOT_POWERED);
2618
2619         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2620                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2621                                   MGMT_STATUS_REJECTED);
2622
2623         hci_dev_lock(hdev);
2624
2625         if (cp->val) {
2626                 type = PAGE_SCAN_TYPE_INTERLACED;
2627
2628                 /* 160 msec page scan interval */
2629                 acp.interval = __constant_cpu_to_le16(0x0100);
2630         } else {
2631                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2632
2633                 /* default 1.28 sec page scan */
2634                 acp.interval = __constant_cpu_to_le16(0x0800);
2635         }
2636
2637         /* default 11.25 msec page scan window */
2638         acp.window = __constant_cpu_to_le16(0x0012);
2639
2640         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2641                            &acp);
2642         if (err < 0) {
2643                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2644                                  MGMT_STATUS_FAILED);
2645                 goto done;
2646         }
2647
2648         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2649         if (err < 0) {
2650                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2651                                  MGMT_STATUS_FAILED);
2652                 goto done;
2653         }
2654
2655         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2656                            NULL, 0);
2657 done:
2658         hci_dev_unlock(hdev);
2659         return err;
2660 }
2661
2662 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2663                                void *cp_data, u16 len)
2664 {
2665         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2666         u16 key_count, expected_len;
2667         int i;
2668
2669         key_count = __le16_to_cpu(cp->key_count);
2670
2671         expected_len = sizeof(*cp) + key_count *
2672                                         sizeof(struct mgmt_ltk_info);
2673         if (expected_len != len) {
2674                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2675                        len, expected_len);
2676                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2677                                   EINVAL);
2678         }
2679
2680         BT_DBG("%s key_count %u", hdev->name, key_count);
2681
2682         hci_dev_lock(hdev);
2683
2684         hci_smp_ltks_clear(hdev);
2685
2686         for (i = 0; i < key_count; i++) {
2687                 struct mgmt_ltk_info *key = &cp->keys[i];
2688                 u8 type;
2689
2690                 if (key->master)
2691                         type = HCI_SMP_LTK;
2692                 else
2693                         type = HCI_SMP_LTK_SLAVE;
2694
2695                 hci_add_ltk(hdev, &key->addr.bdaddr,
2696                             bdaddr_to_le(key->addr.type),
2697                             type, 0, key->authenticated, key->val,
2698                             key->enc_size, key->ediv, key->rand);
2699         }
2700
2701         hci_dev_unlock(hdev);
2702
2703         return 0;
2704 }
2705
2706 static const struct mgmt_handler {
2707         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2708                      u16 data_len);
2709         bool var_len;
2710         size_t data_len;
2711 } mgmt_handlers[] = {
2712         { NULL }, /* 0x0000 (no command) */
2713         { read_version,           false, MGMT_READ_VERSION_SIZE },
2714         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
2715         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
2716         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
2717         { set_powered,            false, MGMT_SETTING_SIZE },
2718         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
2719         { set_connectable,        false, MGMT_SETTING_SIZE },
2720         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
2721         { set_pairable,           false, MGMT_SETTING_SIZE },
2722         { set_link_security,      false, MGMT_SETTING_SIZE },
2723         { set_ssp,                false, MGMT_SETTING_SIZE },
2724         { set_hs,                 false, MGMT_SETTING_SIZE },
2725         { set_le,                 false, MGMT_SETTING_SIZE },
2726         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
2727         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
2728         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
2729         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
2730         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
2731         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2732         { disconnect,             false, MGMT_DISCONNECT_SIZE },
2733         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
2734         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
2735         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2736         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
2737         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
2738         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2739         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
2740         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
2741         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2742         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
2743         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2744         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2745         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2746         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2747         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
2748         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
2749         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
2750         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
2751         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
2752         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
2753 };
2754
2755
2756 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2757 {
2758         void *buf;
2759         u8 *cp;
2760         struct mgmt_hdr *hdr;
2761         u16 opcode, index, len;
2762         struct hci_dev *hdev = NULL;
2763         const struct mgmt_handler *handler;
2764         int err;
2765
2766         BT_DBG("got %zu bytes", msglen);
2767
2768         if (msglen < sizeof(*hdr))
2769                 return -EINVAL;
2770
2771         buf = kmalloc(msglen, GFP_KERNEL);
2772         if (!buf)
2773                 return -ENOMEM;
2774
2775         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2776                 err = -EFAULT;
2777                 goto done;
2778         }
2779
2780         hdr = buf;
2781         opcode = __le16_to_cpu(hdr->opcode);
2782         index = __le16_to_cpu(hdr->index);
2783         len = __le16_to_cpu(hdr->len);
2784
2785         if (len != msglen - sizeof(*hdr)) {
2786                 err = -EINVAL;
2787                 goto done;
2788         }
2789
2790         if (index != MGMT_INDEX_NONE) {
2791                 hdev = hci_dev_get(index);
2792                 if (!hdev) {
2793                         err = cmd_status(sk, index, opcode,
2794                                          MGMT_STATUS_INVALID_INDEX);
2795                         goto done;
2796                 }
2797         }
2798
2799         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2800             mgmt_handlers[opcode].func == NULL) {
2801                 BT_DBG("Unknown op %u", opcode);
2802                 err = cmd_status(sk, index, opcode,
2803                                  MGMT_STATUS_UNKNOWN_COMMAND);
2804                 goto done;
2805         }
2806
2807         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2808             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2809                 err = cmd_status(sk, index, opcode,
2810                                  MGMT_STATUS_INVALID_INDEX);
2811                 goto done;
2812         }
2813
2814         handler = &mgmt_handlers[opcode];
2815
2816         if ((handler->var_len && len < handler->data_len) ||
2817             (!handler->var_len && len != handler->data_len)) {
2818                 err = cmd_status(sk, index, opcode,
2819                                  MGMT_STATUS_INVALID_PARAMS);
2820                 goto done;
2821         }
2822
2823         if (hdev)
2824                 mgmt_init_hdev(sk, hdev);
2825
2826         cp = buf + sizeof(*hdr);
2827
2828         err = handler->func(sk, hdev, cp, len);
2829         if (err < 0)
2830                 goto done;
2831
2832         err = msglen;
2833
2834 done:
2835         if (hdev)
2836                 hci_dev_put(hdev);
2837
2838         kfree(buf);
2839         return err;
2840 }
2841
2842 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2843 {
2844         u8 *status = data;
2845
2846         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2847         mgmt_pending_remove(cmd);
2848 }
2849
2850 int mgmt_index_added(struct hci_dev *hdev)
2851 {
2852         if (!mgmt_valid_hdev(hdev))
2853                 return -ENOTSUPP;
2854
2855         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2856 }
2857
2858 int mgmt_index_removed(struct hci_dev *hdev)
2859 {
2860         u8 status = MGMT_STATUS_INVALID_INDEX;
2861
2862         if (!mgmt_valid_hdev(hdev))
2863                 return -ENOTSUPP;
2864
2865         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2866
2867         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2868 }
2869
2870 struct cmd_lookup {
2871         struct sock *sk;
2872         struct hci_dev *hdev;
2873         u8 mgmt_status;
2874 };
2875
2876 static void settings_rsp(struct pending_cmd *cmd, void *data)
2877 {
2878         struct cmd_lookup *match = data;
2879
2880         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2881
2882         list_del(&cmd->list);
2883
2884         if (match->sk == NULL) {
2885                 match->sk = cmd->sk;
2886                 sock_hold(match->sk);
2887         }
2888
2889         mgmt_pending_free(cmd);
2890 }
2891
2892 static int set_bredr_scan(struct hci_dev *hdev)
2893 {
2894         u8 scan = 0;
2895
2896         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2897                 scan |= SCAN_PAGE;
2898         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2899                 scan |= SCAN_INQUIRY;
2900
2901         if (!scan)
2902                 return 0;
2903
2904         return hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2905 }
2906
2907 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2908 {
2909         struct cmd_lookup match = { NULL, hdev };
2910         int err;
2911
2912         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2913                 return 0;
2914
2915         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2916
2917         if (powered) {
2918                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
2919                     !lmp_host_ssp_capable(hdev)) {
2920                         u8 ssp = 1;
2921
2922                         hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
2923                 }
2924
2925                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2926                         struct hci_cp_write_le_host_supported cp;
2927
2928                         cp.le = 1;
2929                         cp.simul = lmp_le_br_capable(hdev);
2930
2931                         /* Check first if we already have the right
2932                          * host state (host features set)
2933                          */
2934                         if (cp.le != lmp_host_le_capable(hdev) ||
2935                             cp.simul != lmp_host_le_br_capable(hdev))
2936                                 hci_send_cmd(hdev,
2937                                              HCI_OP_WRITE_LE_HOST_SUPPORTED,
2938                                              sizeof(cp), &cp);
2939                 }
2940
2941                 if (lmp_bredr_capable(hdev)) {
2942                         set_bredr_scan(hdev);
2943                         update_class(hdev);
2944                         update_name(hdev, hdev->dev_name);
2945                         update_eir(hdev);
2946                 }
2947         } else {
2948                 u8 status = MGMT_STATUS_NOT_POWERED;
2949                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2950         }
2951
2952         err = new_settings(hdev, match.sk);
2953
2954         if (match.sk)
2955                 sock_put(match.sk);
2956
2957         return err;
2958 }
2959
2960 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2961 {
2962         struct cmd_lookup match = { NULL, hdev };
2963         bool changed = false;
2964         int err = 0;
2965
2966         if (discoverable) {
2967                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2968                         changed = true;
2969         } else {
2970                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2971                         changed = true;
2972         }
2973
2974         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
2975                              &match);
2976
2977         if (changed)
2978                 err = new_settings(hdev, match.sk);
2979
2980         if (match.sk)
2981                 sock_put(match.sk);
2982
2983         return err;
2984 }
2985
2986 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2987 {
2988         struct cmd_lookup match = { NULL, hdev };
2989         bool changed = false;
2990         int err = 0;
2991
2992         if (connectable) {
2993                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2994                         changed = true;
2995         } else {
2996                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2997                         changed = true;
2998         }
2999
3000         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
3001                              &match);
3002
3003         if (changed)
3004                 err = new_settings(hdev, match.sk);
3005
3006         if (match.sk)
3007                 sock_put(match.sk);
3008
3009         return err;
3010 }
3011
3012 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3013 {
3014         u8 mgmt_err = mgmt_status(status);
3015
3016         if (scan & SCAN_PAGE)
3017                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3018                                      cmd_status_rsp, &mgmt_err);
3019
3020         if (scan & SCAN_INQUIRY)
3021                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3022                                      cmd_status_rsp, &mgmt_err);
3023
3024         return 0;
3025 }
3026
3027 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3028                       bool persistent)
3029 {
3030         struct mgmt_ev_new_link_key ev;
3031
3032         memset(&ev, 0, sizeof(ev));
3033
3034         ev.store_hint = persistent;
3035         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3036         ev.key.addr.type = BDADDR_BREDR;
3037         ev.key.type = key->type;
3038         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3039         ev.key.pin_len = key->pin_len;
3040
3041         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3042 }
3043
3044 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3045 {
3046         struct mgmt_ev_new_long_term_key ev;
3047
3048         memset(&ev, 0, sizeof(ev));
3049
3050         ev.store_hint = persistent;
3051         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3052         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3053         ev.key.authenticated = key->authenticated;
3054         ev.key.enc_size = key->enc_size;
3055         ev.key.ediv = key->ediv;
3056
3057         if (key->type == HCI_SMP_LTK)
3058                 ev.key.master = 1;
3059
3060         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3061         memcpy(ev.key.val, key->val, sizeof(key->val));
3062
3063         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3064                           NULL);
3065 }
3066
3067 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3068                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3069                           u8 *dev_class)
3070 {
3071         char buf[512];
3072         struct mgmt_ev_device_connected *ev = (void *) buf;
3073         u16 eir_len = 0;
3074
3075         bacpy(&ev->addr.bdaddr, bdaddr);
3076         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3077
3078         ev->flags = __cpu_to_le32(flags);
3079
3080         if (name_len > 0)
3081                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3082                                           name, name_len);
3083
3084         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3085                 eir_len = eir_append_data(ev->eir, eir_len,
3086                                           EIR_CLASS_OF_DEV, dev_class, 3);
3087
3088         ev->eir_len = cpu_to_le16(eir_len);
3089
3090         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3091                           sizeof(*ev) + eir_len, NULL);
3092 }
3093
3094 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3095 {
3096         struct mgmt_cp_disconnect *cp = cmd->param;
3097         struct sock **sk = data;
3098         struct mgmt_rp_disconnect rp;
3099
3100         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3101         rp.addr.type = cp->addr.type;
3102
3103         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3104                      sizeof(rp));
3105
3106         *sk = cmd->sk;
3107         sock_hold(*sk);
3108
3109         mgmt_pending_remove(cmd);
3110 }
3111
3112 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3113 {
3114         struct hci_dev *hdev = data;
3115         struct mgmt_cp_unpair_device *cp = cmd->param;
3116         struct mgmt_rp_unpair_device rp;
3117
3118         memset(&rp, 0, sizeof(rp));
3119         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3120         rp.addr.type = cp->addr.type;
3121
3122         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3123
3124         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3125
3126         mgmt_pending_remove(cmd);
3127 }
3128
3129 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3130                              u8 link_type, u8 addr_type, u8 reason)
3131 {
3132         struct mgmt_ev_device_disconnected ev;
3133         struct sock *sk = NULL;
3134         int err;
3135
3136         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3137
3138         bacpy(&ev.addr.bdaddr, bdaddr);
3139         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3140         ev.reason = reason;
3141
3142         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3143                          sk);
3144
3145         if (sk)
3146                 sock_put(sk);
3147
3148         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3149                              hdev);
3150
3151         return err;
3152 }
3153
3154 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3155                            u8 link_type, u8 addr_type, u8 status)
3156 {
3157         struct mgmt_rp_disconnect rp;
3158         struct pending_cmd *cmd;
3159         int err;
3160
3161         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3162                              hdev);
3163
3164         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3165         if (!cmd)
3166                 return -ENOENT;
3167
3168         bacpy(&rp.addr.bdaddr, bdaddr);
3169         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3170
3171         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3172                            mgmt_status(status), &rp, sizeof(rp));
3173
3174         mgmt_pending_remove(cmd);
3175
3176         return err;
3177 }
3178
3179 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3180                         u8 addr_type, u8 status)
3181 {
3182         struct mgmt_ev_connect_failed ev;
3183
3184         bacpy(&ev.addr.bdaddr, bdaddr);
3185         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3186         ev.status = mgmt_status(status);
3187
3188         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3189 }
3190
3191 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3192 {
3193         struct mgmt_ev_pin_code_request ev;
3194
3195         bacpy(&ev.addr.bdaddr, bdaddr);
3196         ev.addr.type = BDADDR_BREDR;
3197         ev.secure = secure;
3198
3199         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3200                           NULL);
3201 }
3202
3203 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3204                                  u8 status)
3205 {
3206         struct pending_cmd *cmd;
3207         struct mgmt_rp_pin_code_reply rp;
3208         int err;
3209
3210         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3211         if (!cmd)
3212                 return -ENOENT;
3213
3214         bacpy(&rp.addr.bdaddr, bdaddr);
3215         rp.addr.type = BDADDR_BREDR;
3216
3217         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3218                            mgmt_status(status), &rp, sizeof(rp));
3219
3220         mgmt_pending_remove(cmd);
3221
3222         return err;
3223 }
3224
3225 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3226                                      u8 status)
3227 {
3228         struct pending_cmd *cmd;
3229         struct mgmt_rp_pin_code_reply rp;
3230         int err;
3231
3232         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3233         if (!cmd)
3234                 return -ENOENT;
3235
3236         bacpy(&rp.addr.bdaddr, bdaddr);
3237         rp.addr.type = BDADDR_BREDR;
3238
3239         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3240                            mgmt_status(status), &rp, sizeof(rp));
3241
3242         mgmt_pending_remove(cmd);
3243
3244         return err;
3245 }
3246
3247 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3248                               u8 link_type, u8 addr_type, __le32 value,
3249                               u8 confirm_hint)
3250 {
3251         struct mgmt_ev_user_confirm_request ev;
3252
3253         BT_DBG("%s", hdev->name);
3254
3255         bacpy(&ev.addr.bdaddr, bdaddr);
3256         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3257         ev.confirm_hint = confirm_hint;
3258         ev.value = value;
3259
3260         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3261                           NULL);
3262 }
3263
3264 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3265                               u8 link_type, u8 addr_type)
3266 {
3267         struct mgmt_ev_user_passkey_request ev;
3268
3269         BT_DBG("%s", hdev->name);
3270
3271         bacpy(&ev.addr.bdaddr, bdaddr);
3272         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3273
3274         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3275                           NULL);
3276 }
3277
3278 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3279                                       u8 link_type, u8 addr_type, u8 status,
3280                                       u8 opcode)
3281 {
3282         struct pending_cmd *cmd;
3283         struct mgmt_rp_user_confirm_reply rp;
3284         int err;
3285
3286         cmd = mgmt_pending_find(opcode, hdev);
3287         if (!cmd)
3288                 return -ENOENT;
3289
3290         bacpy(&rp.addr.bdaddr, bdaddr);
3291         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3292         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3293                            &rp, sizeof(rp));
3294
3295         mgmt_pending_remove(cmd);
3296
3297         return err;
3298 }
3299
3300 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3301                                      u8 link_type, u8 addr_type, u8 status)
3302 {
3303         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3304                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3305 }
3306
3307 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3308                                          u8 link_type, u8 addr_type, u8 status)
3309 {
3310         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3311                                           status,
3312                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3313 }
3314
3315 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3316                                      u8 link_type, u8 addr_type, u8 status)
3317 {
3318         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3319                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3320 }
3321
3322 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3323                                          u8 link_type, u8 addr_type, u8 status)
3324 {
3325         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3326                                           status,
3327                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3328 }
3329
3330 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3331                              u8 link_type, u8 addr_type, u32 passkey,
3332                              u8 entered)
3333 {
3334         struct mgmt_ev_passkey_notify ev;
3335
3336         BT_DBG("%s", hdev->name);
3337
3338         bacpy(&ev.addr.bdaddr, bdaddr);
3339         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3340         ev.passkey = __cpu_to_le32(passkey);
3341         ev.entered = entered;
3342
3343         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3344 }
3345
3346 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3347                      u8 addr_type, u8 status)
3348 {
3349         struct mgmt_ev_auth_failed ev;
3350
3351         bacpy(&ev.addr.bdaddr, bdaddr);
3352         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3353         ev.status = mgmt_status(status);
3354
3355         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3356 }
3357
3358 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3359 {
3360         struct cmd_lookup match = { NULL, hdev };
3361         bool changed = false;
3362         int err = 0;
3363
3364         if (status) {
3365                 u8 mgmt_err = mgmt_status(status);
3366                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3367                                      cmd_status_rsp, &mgmt_err);
3368                 return 0;
3369         }
3370
3371         if (test_bit(HCI_AUTH, &hdev->flags)) {
3372                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3373                         changed = true;
3374         } else {
3375                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3376                         changed = true;
3377         }
3378
3379         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3380                              &match);
3381
3382         if (changed)
3383                 err = new_settings(hdev, match.sk);
3384
3385         if (match.sk)
3386                 sock_put(match.sk);
3387
3388         return err;
3389 }
3390
3391 static int clear_eir(struct hci_dev *hdev)
3392 {
3393         struct hci_cp_write_eir cp;
3394
3395         if (!lmp_ext_inq_capable(hdev))
3396                 return 0;
3397
3398         memset(hdev->eir, 0, sizeof(hdev->eir));
3399
3400         memset(&cp, 0, sizeof(cp));
3401
3402         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3403 }
3404
3405 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3406 {
3407         struct cmd_lookup match = { NULL, hdev };
3408         bool changed = false;
3409         int err = 0;
3410
3411         if (status) {
3412                 u8 mgmt_err = mgmt_status(status);
3413
3414                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3415                                                  &hdev->dev_flags))
3416                         err = new_settings(hdev, NULL);
3417
3418                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3419                                      &mgmt_err);
3420
3421                 return err;
3422         }
3423
3424         if (enable) {
3425                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3426                         changed = true;
3427         } else {
3428                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3429                         changed = true;
3430         }
3431
3432         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3433
3434         if (changed)
3435                 err = new_settings(hdev, match.sk);
3436
3437         if (match.sk)
3438                 sock_put(match.sk);
3439
3440         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3441                 update_eir(hdev);
3442         else
3443                 clear_eir(hdev);
3444
3445         return err;
3446 }
3447
3448 static void class_rsp(struct pending_cmd *cmd, void *data)
3449 {
3450         struct cmd_lookup *match = data;
3451
3452         cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3453                      match->hdev->dev_class, 3);
3454
3455         list_del(&cmd->list);
3456
3457         if (match->sk == NULL) {
3458                 match->sk = cmd->sk;
3459                 sock_hold(match->sk);
3460         }
3461
3462         mgmt_pending_free(cmd);
3463 }
3464
3465 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3466                                    u8 status)
3467 {
3468         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3469         int err = 0;
3470
3471         clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3472
3473         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3474         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3475         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3476
3477         if (!status)
3478                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3479                                  3, NULL);
3480
3481         if (match.sk)
3482                 sock_put(match.sk);
3483
3484         return err;
3485 }
3486
3487 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3488 {
3489         struct pending_cmd *cmd;
3490         struct mgmt_cp_set_local_name ev;
3491         bool changed = false;
3492         int err = 0;
3493
3494         if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3495                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3496                 changed = true;
3497         }
3498
3499         memset(&ev, 0, sizeof(ev));
3500         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3501         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3502
3503         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3504         if (!cmd)
3505                 goto send_event;
3506
3507         /* Always assume that either the short or the complete name has
3508          * changed if there was a pending mgmt command */
3509         changed = true;
3510
3511         if (status) {
3512                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3513                                  mgmt_status(status));
3514                 goto failed;
3515         }
3516
3517         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3518                            sizeof(ev));
3519         if (err < 0)
3520                 goto failed;
3521
3522 send_event:
3523         if (changed)
3524                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3525                                  sizeof(ev), cmd ? cmd->sk : NULL);
3526
3527         /* EIR is taken care of separately when powering on the
3528          * adapter so only update them here if this is a name change
3529          * unrelated to power on.
3530          */
3531         if (!test_bit(HCI_INIT, &hdev->flags))
3532                 update_eir(hdev);
3533
3534 failed:
3535         if (cmd)
3536                 mgmt_pending_remove(cmd);
3537         return err;
3538 }
3539
3540 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3541                                             u8 *randomizer, u8 status)
3542 {
3543         struct pending_cmd *cmd;
3544         int err;
3545
3546         BT_DBG("%s status %u", hdev->name, status);
3547
3548         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3549         if (!cmd)
3550                 return -ENOENT;
3551
3552         if (status) {
3553                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3554                                  mgmt_status(status));
3555         } else {
3556                 struct mgmt_rp_read_local_oob_data rp;
3557
3558                 memcpy(rp.hash, hash, sizeof(rp.hash));
3559                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3560
3561                 err = cmd_complete(cmd->sk, hdev->id,
3562                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3563                                    sizeof(rp));
3564         }
3565
3566         mgmt_pending_remove(cmd);
3567
3568         return err;
3569 }
3570
3571 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3572 {
3573         struct cmd_lookup match = { NULL, hdev };
3574         bool changed = false;
3575         int err = 0;
3576
3577         if (status) {
3578                 u8 mgmt_err = mgmt_status(status);
3579
3580                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3581                                                  &hdev->dev_flags))
3582                         err = new_settings(hdev, NULL);
3583
3584                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3585                                      &mgmt_err);
3586
3587                 return err;
3588         }
3589
3590         if (enable) {
3591                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3592                         changed = true;
3593         } else {
3594                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3595                         changed = true;
3596         }
3597
3598         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3599
3600         if (changed)
3601                 err = new_settings(hdev, match.sk);
3602
3603         if (match.sk)
3604                 sock_put(match.sk);
3605
3606         return err;
3607 }
3608
3609 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3610                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3611                       ssp, u8 *eir, u16 eir_len)
3612 {
3613         char buf[512];
3614         struct mgmt_ev_device_found *ev = (void *) buf;
3615         size_t ev_size;
3616
3617         /* Leave 5 bytes for a potential CoD field */
3618         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3619                 return -EINVAL;
3620
3621         memset(buf, 0, sizeof(buf));
3622
3623         bacpy(&ev->addr.bdaddr, bdaddr);
3624         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3625         ev->rssi = rssi;
3626         if (cfm_name)
3627                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
3628         if (!ssp)
3629                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
3630
3631         if (eir_len > 0)
3632                 memcpy(ev->eir, eir, eir_len);
3633
3634         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3635                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3636                                           dev_class, 3);
3637
3638         ev->eir_len = cpu_to_le16(eir_len);
3639         ev_size = sizeof(*ev) + eir_len;
3640
3641         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3642 }
3643
3644 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3645                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3646 {
3647         struct mgmt_ev_device_found *ev;
3648         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3649         u16 eir_len;
3650
3651         ev = (struct mgmt_ev_device_found *) buf;
3652
3653         memset(buf, 0, sizeof(buf));
3654
3655         bacpy(&ev->addr.bdaddr, bdaddr);
3656         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3657         ev->rssi = rssi;
3658
3659         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3660                                   name_len);
3661
3662         ev->eir_len = cpu_to_le16(eir_len);
3663
3664         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3665                           sizeof(*ev) + eir_len, NULL);
3666 }
3667
3668 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3669 {
3670         struct pending_cmd *cmd;
3671         u8 type;
3672         int err;
3673
3674         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3675
3676         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3677         if (!cmd)
3678                 return -ENOENT;
3679
3680         type = hdev->discovery.type;
3681
3682         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3683                            &type, sizeof(type));
3684         mgmt_pending_remove(cmd);
3685
3686         return err;
3687 }
3688
3689 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3690 {
3691         struct pending_cmd *cmd;
3692         int err;
3693
3694         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3695         if (!cmd)
3696                 return -ENOENT;
3697
3698         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3699                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3700         mgmt_pending_remove(cmd);
3701
3702         return err;
3703 }
3704
3705 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3706 {
3707         struct mgmt_ev_discovering ev;
3708         struct pending_cmd *cmd;
3709
3710         BT_DBG("%s discovering %u", hdev->name, discovering);
3711
3712         if (discovering)
3713                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3714         else
3715                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3716
3717         if (cmd != NULL) {
3718                 u8 type = hdev->discovery.type;
3719
3720                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3721                              sizeof(type));
3722                 mgmt_pending_remove(cmd);
3723         }
3724
3725         memset(&ev, 0, sizeof(ev));
3726         ev.type = hdev->discovery.type;
3727         ev.discovering = discovering;
3728
3729         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3730 }
3731
3732 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3733 {
3734         struct pending_cmd *cmd;
3735         struct mgmt_ev_device_blocked ev;
3736
3737         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3738
3739         bacpy(&ev.addr.bdaddr, bdaddr);
3740         ev.addr.type = type;
3741
3742         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3743                           cmd ? cmd->sk : NULL);
3744 }
3745
3746 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3747 {
3748         struct pending_cmd *cmd;
3749         struct mgmt_ev_device_unblocked ev;
3750
3751         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3752
3753         bacpy(&ev.addr.bdaddr, bdaddr);
3754         ev.addr.type = type;
3755
3756         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3757                           cmd ? cmd->sk : NULL);
3758 }
3759
3760 module_param(enable_hs, bool, 0644);
3761 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");