net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33
  34 #include "smp.h"
  35
  36 #define MGMT_VERSION    1
  37 #define MGMT_REVISION   4
  38
  39 static const u16 mgmt_commands[] = {
  40         MGMT_OP_READ_INDEX_LIST,
  41         MGMT_OP_READ_INFO,
  42         MGMT_OP_SET_POWERED,
  43         MGMT_OP_SET_DISCOVERABLE,
  44         MGMT_OP_SET_CONNECTABLE,
  45         MGMT_OP_SET_FAST_CONNECTABLE,
  46         MGMT_OP_SET_PAIRABLE,
  47         MGMT_OP_SET_LINK_SECURITY,
  48         MGMT_OP_SET_SSP,
  49         MGMT_OP_SET_HS,
  50         MGMT_OP_SET_LE,
  51         MGMT_OP_SET_DEV_CLASS,
  52         MGMT_OP_SET_LOCAL_NAME,
  53         MGMT_OP_ADD_UUID,
  54         MGMT_OP_REMOVE_UUID,
  55         MGMT_OP_LOAD_LINK_KEYS,
  56         MGMT_OP_LOAD_LONG_TERM_KEYS,
  57         MGMT_OP_DISCONNECT,
  58         MGMT_OP_GET_CONNECTIONS,
  59         MGMT_OP_PIN_CODE_REPLY,
  60         MGMT_OP_PIN_CODE_NEG_REPLY,
  61         MGMT_OP_SET_IO_CAPABILITY,
  62         MGMT_OP_PAIR_DEVICE,
  63         MGMT_OP_CANCEL_PAIR_DEVICE,
  64         MGMT_OP_UNPAIR_DEVICE,
  65         MGMT_OP_USER_CONFIRM_REPLY,
  66         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  67         MGMT_OP_USER_PASSKEY_REPLY,
  68         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  69         MGMT_OP_READ_LOCAL_OOB_DATA,
  70         MGMT_OP_ADD_REMOTE_OOB_DATA,
  71         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  72         MGMT_OP_START_DISCOVERY,
  73         MGMT_OP_STOP_DISCOVERY,
  74         MGMT_OP_CONFIRM_NAME,
  75         MGMT_OP_BLOCK_DEVICE,
  76         MGMT_OP_UNBLOCK_DEVICE,
  77         MGMT_OP_SET_DEVICE_ID,
  78         MGMT_OP_SET_ADVERTISING,
  79         MGMT_OP_SET_BREDR,
  80         MGMT_OP_SET_STATIC_ADDRESS,
  81         MGMT_OP_SET_SCAN_PARAMS,
  82 };
  83
  84 static const u16 mgmt_events[] = {
  85         MGMT_EV_CONTROLLER_ERROR,
  86         MGMT_EV_INDEX_ADDED,
  87         MGMT_EV_INDEX_REMOVED,
  88         MGMT_EV_NEW_SETTINGS,
  89         MGMT_EV_CLASS_OF_DEV_CHANGED,
  90         MGMT_EV_LOCAL_NAME_CHANGED,
  91         MGMT_EV_NEW_LINK_KEY,
  92         MGMT_EV_NEW_LONG_TERM_KEY,
  93         MGMT_EV_DEVICE_CONNECTED,
  94         MGMT_EV_DEVICE_DISCONNECTED,
  95         MGMT_EV_CONNECT_FAILED,
  96         MGMT_EV_PIN_CODE_REQUEST,
  97         MGMT_EV_USER_CONFIRM_REQUEST,
  98         MGMT_EV_USER_PASSKEY_REQUEST,
  99         MGMT_EV_AUTH_FAILED,
 100         MGMT_EV_DEVICE_FOUND,
 101         MGMT_EV_DISCOVERING,
 102         MGMT_EV_DEVICE_BLOCKED,
 103         MGMT_EV_DEVICE_UNBLOCKED,
 104         MGMT_EV_DEVICE_UNPAIRED,
 105         MGMT_EV_PASSKEY_NOTIFY,
 106 };
 107
 108 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 109
 110 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 111                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 112
 113 struct pending_cmd {
 114         struct list_head list;
 115         u16 opcode;
 116         int index;
 117         void *param;
 118         struct sock *sk;
 119         void *user_data;
 120 };
 121
 122 /* HCI to MGMT error code conversion table */
 123 static u8 mgmt_status_table[] = {
 124         MGMT_STATUS_SUCCESS,
 125         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 126         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 127         MGMT_STATUS_FAILED,             /* Hardware Failure */
 128         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 129         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 130         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 131         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 132         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 133         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 134         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 135         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 136         MGMT_STATUS_BUSY,               /* Command Disallowed */
 137         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 138         MGMT_STATUS_REJECTED,           /* Rejected Security */
 139         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 140         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 141         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 142         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 143         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 144         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 145         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 146         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 147         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 148         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 149         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 150         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 151         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 152         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 153         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 154         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 155         MGMT_STATUS_FAILED,             /* Unspecified Error */
 156         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 157         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 158         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 159         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 160         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 161         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 162         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 164         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 165         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 166         MGMT_STATUS_FAILED,             /* Transaction Collision */
 167         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 168         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 169         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 170         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 171         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 172         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 173         MGMT_STATUS_FAILED,             /* Slot Violation */
 174         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 175         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 176         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 177         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 178         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 179         MGMT_STATUS_BUSY,               /* Controller Busy */
 180         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 181         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 182         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 183         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 184         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 185 };
 186
 187 static u8 mgmt_status(u8 hci_status)
 188 {
 189         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 190                 return mgmt_status_table[hci_status];
 191
 192         return MGMT_STATUS_FAILED;
 193 }
 194
 195 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 196 {
 197         struct sk_buff *skb;
 198         struct mgmt_hdr *hdr;
 199         struct mgmt_ev_cmd_status *ev;
 200         int err;
 201
 202         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 203
 204         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 205         if (!skb)
 206                 return -ENOMEM;
 207
 208         hdr = (void *) skb_put(skb, sizeof(*hdr));
 209
 210         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 211         hdr->index = cpu_to_le16(index);
 212         hdr->len = cpu_to_le16(sizeof(*ev));
 213
 214         ev = (void *) skb_put(skb, sizeof(*ev));
 215         ev->status = status;
 216         ev->opcode = cpu_to_le16(cmd);
 217
 218         err = sock_queue_rcv_skb(sk, skb);
 219         if (err < 0)
 220                 kfree_skb(skb);
 221
 222         return err;
 223 }
 224
 225 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 226                         void *rp, size_t rp_len)
 227 {
 228         struct sk_buff *skb;
 229         struct mgmt_hdr *hdr;
 230         struct mgmt_ev_cmd_complete *ev;
 231         int err;
 232
 233         BT_DBG("sock %p", sk);
 234
 235         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 236         if (!skb)
 237                 return -ENOMEM;
 238
 239         hdr = (void *) skb_put(skb, sizeof(*hdr));
 240
 241         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 242         hdr->index = cpu_to_le16(index);
 243         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 244
 245         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 246         ev->opcode = cpu_to_le16(cmd);
 247         ev->status = status;
 248
 249         if (rp)
 250                 memcpy(ev->data, rp, rp_len);
 251
 252         err = sock_queue_rcv_skb(sk, skb);
 253         if (err < 0)
 254                 kfree_skb(skb);
 255
 256         return err;
 257 }
 258
 259 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 260                         u16 data_len)
 261 {
 262         struct mgmt_rp_read_version rp;
 263
 264         BT_DBG("sock %p", sk);
 265
 266         rp.version = MGMT_VERSION;
 267         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 268
 269         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 270                             sizeof(rp));
 271 }
 272
 273 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 274                          u16 data_len)
 275 {
 276         struct mgmt_rp_read_commands *rp;
 277         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 278         const u16 num_events = ARRAY_SIZE(mgmt_events);
 279         __le16 *opcode;
 280         size_t rp_size;
 281         int i, err;
 282
 283         BT_DBG("sock %p", sk);
 284
 285         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 286
 287         rp = kmalloc(rp_size, GFP_KERNEL);
 288         if (!rp)
 289                 return -ENOMEM;
 290
 291         rp->num_commands = __constant_cpu_to_le16(num_commands);
 292         rp->num_events = __constant_cpu_to_le16(num_events);
 293
 294         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 295                 put_unaligned_le16(mgmt_commands[i], opcode);
 296
 297         for (i = 0; i < num_events; i++, opcode++)
 298                 put_unaligned_le16(mgmt_events[i], opcode);
 299
 300         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 301                            rp_size);
 302         kfree(rp);
 303
 304         return err;
 305 }
 306
 307 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 308                            u16 data_len)
 309 {
 310         struct mgmt_rp_read_index_list *rp;
 311         struct hci_dev *d;
 312         size_t rp_len;
 313         u16 count;
 314         int err;
 315
 316         BT_DBG("sock %p", sk);
 317
 318         read_lock(&hci_dev_list_lock);
 319
 320         count = 0;
 321         list_for_each_entry(d, &hci_dev_list, list) {
 322                 if (d->dev_type == HCI_BREDR)
 323                         count++;
 324         }
 325
 326         rp_len = sizeof(*rp) + (2 * count);
 327         rp = kmalloc(rp_len, GFP_ATOMIC);
 328         if (!rp) {
 329                 read_unlock(&hci_dev_list_lock);
 330                 return -ENOMEM;
 331         }
 332
 333         count = 0;
 334         list_for_each_entry(d, &hci_dev_list, list) {
 335                 if (test_bit(HCI_SETUP, &d->dev_flags))
 336                         continue;
 337
 338                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 339                         continue;
 340
 341                 if (d->dev_type == HCI_BREDR) {
 342                         rp->index[count++] = cpu_to_le16(d->id);
 343                         BT_DBG("Added hci%u", d->id);
 344                 }
 345         }
 346
 347         rp->num_controllers = cpu_to_le16(count);
 348         rp_len = sizeof(*rp) + (2 * count);
 349
 350         read_unlock(&hci_dev_list_lock);
 351
 352         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 353                            rp_len);
 354
 355         kfree(rp);
 356
 357         return err;
 358 }
 359
 360 static u32 get_supported_settings(struct hci_dev *hdev)
 361 {
 362         u32 settings = 0;
 363
 364         settings |= MGMT_SETTING_POWERED;
 365         settings |= MGMT_SETTING_PAIRABLE;
 366
 367         if (lmp_bredr_capable(hdev)) {
 368                 settings |= MGMT_SETTING_CONNECTABLE;
 369                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 370                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 371                 settings |= MGMT_SETTING_DISCOVERABLE;
 372                 settings |= MGMT_SETTING_BREDR;
 373                 settings |= MGMT_SETTING_LINK_SECURITY;
 374
 375                 if (lmp_ssp_capable(hdev)) {
 376                         settings |= MGMT_SETTING_SSP;
 377                         settings |= MGMT_SETTING_HS;
 378                 }
 379         }
 380
 381         if (lmp_le_capable(hdev)) {
 382                 settings |= MGMT_SETTING_LE;
 383                 settings |= MGMT_SETTING_ADVERTISING;
 384         }
 385
 386         return settings;
 387 }
 388
 389 static u32 get_current_settings(struct hci_dev *hdev)
 390 {
 391         u32 settings = 0;
 392
 393         if (hdev_is_powered(hdev))
 394                 settings |= MGMT_SETTING_POWERED;
 395
 396         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 397                 settings |= MGMT_SETTING_CONNECTABLE;
 398
 399         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 400                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 401
 402         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 403                 settings |= MGMT_SETTING_DISCOVERABLE;
 404
 405         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 406                 settings |= MGMT_SETTING_PAIRABLE;
 407
 408         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 409                 settings |= MGMT_SETTING_BREDR;
 410
 411         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 412                 settings |= MGMT_SETTING_LE;
 413
 414         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 415                 settings |= MGMT_SETTING_LINK_SECURITY;
 416
 417         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 418                 settings |= MGMT_SETTING_SSP;
 419
 420         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 421                 settings |= MGMT_SETTING_HS;
 422
 423         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 424                 settings |= MGMT_SETTING_ADVERTISING;
 425
 426         return settings;
 427 }
 428
 429 #define PNP_INFO_SVCLASS_ID             0x1200
 430
 431 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 432 {
 433         u8 *ptr = data, *uuids_start = NULL;
 434         struct bt_uuid *uuid;
 435
 436         if (len < 4)
 437                 return ptr;
 438
 439         list_for_each_entry(uuid, &hdev->uuids, list) {
 440                 u16 uuid16;
 441
 442                 if (uuid->size != 16)
 443                         continue;
 444
 445                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 446                 if (uuid16 < 0x1100)
 447                         continue;
 448
 449                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 450                         continue;
 451
 452                 if (!uuids_start) {
 453                         uuids_start = ptr;
 454                         uuids_start[0] = 1;
 455                         uuids_start[1] = EIR_UUID16_ALL;
 456                         ptr += 2;
 457                 }
 458
 459                 /* Stop if not enough space to put next UUID */
 460                 if ((ptr - data) + sizeof(u16) > len) {
 461                         uuids_start[1] = EIR_UUID16_SOME;
 462                         break;
 463                 }
 464
 465                 *ptr++ = (uuid16 & 0x00ff);
 466                 *ptr++ = (uuid16 & 0xff00) >> 8;
 467                 uuids_start[0] += sizeof(uuid16);
 468         }
 469
 470         return ptr;
 471 }
 472
 473 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 474 {
 475         u8 *ptr = data, *uuids_start = NULL;
 476         struct bt_uuid *uuid;
 477
 478         if (len < 6)
 479                 return ptr;
 480
 481         list_for_each_entry(uuid, &hdev->uuids, list) {
 482                 if (uuid->size != 32)
 483                         continue;
 484
 485                 if (!uuids_start) {
 486                         uuids_start = ptr;
 487                         uuids_start[0] = 1;
 488                         uuids_start[1] = EIR_UUID32_ALL;
 489                         ptr += 2;
 490                 }
 491
 492                 /* Stop if not enough space to put next UUID */
 493                 if ((ptr - data) + sizeof(u32) > len) {
 494                         uuids_start[1] = EIR_UUID32_SOME;
 495                         break;
 496                 }
 497
 498                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 499                 ptr += sizeof(u32);
 500                 uuids_start[0] += sizeof(u32);
 501         }
 502
 503         return ptr;
 504 }
 505
 506 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 507 {
 508         u8 *ptr = data, *uuids_start = NULL;
 509         struct bt_uuid *uuid;
 510
 511         if (len < 18)
 512                 return ptr;
 513
 514         list_for_each_entry(uuid, &hdev->uuids, list) {
 515                 if (uuid->size != 128)
 516                         continue;
 517
 518                 if (!uuids_start) {
 519                         uuids_start = ptr;
 520                         uuids_start[0] = 1;
 521                         uuids_start[1] = EIR_UUID128_ALL;
 522                         ptr += 2;
 523                 }
 524
 525                 /* Stop if not enough space to put next UUID */
 526                 if ((ptr - data) + 16 > len) {
 527                         uuids_start[1] = EIR_UUID128_SOME;
 528                         break;
 529                 }
 530
 531                 memcpy(ptr, uuid->uuid, 16);
 532                 ptr += 16;
 533                 uuids_start[0] += 16;
 534         }
 535
 536         return ptr;
 537 }
 538
 539 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 540 {
 541         u8 ad_len = 0;
 542         size_t name_len;
 543
 544         name_len = strlen(hdev->dev_name);
 545         if (name_len > 0) {
 546                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 547
 548                 if (name_len > max_len) {
 549                         name_len = max_len;
 550                         ptr[1] = EIR_NAME_SHORT;
 551                 } else
 552                         ptr[1] = EIR_NAME_COMPLETE;
 553
 554                 ptr[0] = name_len + 1;
 555
 556                 memcpy(ptr + 2, hdev->dev_name, name_len);
 557
 558                 ad_len += (name_len + 2);
 559                 ptr += (name_len + 2);
 560         }
 561
 562         return ad_len;
 563 }
 564
 565 static void update_scan_rsp_data(struct hci_request *req)
 566 {
 567         struct hci_dev *hdev = req->hdev;
 568         struct hci_cp_le_set_scan_rsp_data cp;
 569         u8 len;
 570
 571         if (!lmp_le_capable(hdev))
 572                 return;
 573
 574         memset(&cp, 0, sizeof(cp));
 575
 576         len = create_scan_rsp_data(hdev, cp.data);
 577
 578         if (hdev->adv_data_len == len &&
 579             memcmp(cp.data, hdev->adv_data, len) == 0)
 580                 return;
 581
 582         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 583         hdev->adv_data_len = len;
 584
 585         cp.length = len;
 586
 587         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 588 }
 589
 590 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 591 {
 592         u8 ad_len = 0, flags = 0;
 593
 594         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 595                 flags |= LE_AD_GENERAL;
 596
 597         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
 598                 if (lmp_le_br_capable(hdev))
 599                         flags |= LE_AD_SIM_LE_BREDR_CTRL;
 600                 if (lmp_host_le_br_capable(hdev))
 601                         flags |= LE_AD_SIM_LE_BREDR_HOST;
 602         } else {
 603                 flags |= LE_AD_NO_BREDR;
 604         }
 605
 606         if (flags) {
 607                 BT_DBG("adv flags 0x%02x", flags);
 608
 609                 ptr[0] = 2;
 610                 ptr[1] = EIR_FLAGS;
 611                 ptr[2] = flags;
 612
 613                 ad_len += 3;
 614                 ptr += 3;
 615         }
 616
 617         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 618                 ptr[0] = 2;
 619                 ptr[1] = EIR_TX_POWER;
 620                 ptr[2] = (u8) hdev->adv_tx_power;
 621
 622                 ad_len += 3;
 623                 ptr += 3;
 624         }
 625
 626         return ad_len;
 627 }
 628
 629 static void update_ad(struct hci_request *req)
 630 {
 631         struct hci_dev *hdev = req->hdev;
 632         struct hci_cp_le_set_adv_data cp;
 633         u8 len;
 634
 635         if (!lmp_le_capable(hdev))
 636                 return;
 637
 638         memset(&cp, 0, sizeof(cp));
 639
 640         len = create_adv_data(hdev, cp.data);
 641
 642         if (hdev->adv_data_len == len &&
 643             memcmp(cp.data, hdev->adv_data, len) == 0)
 644                 return;
 645
 646         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 647         hdev->adv_data_len = len;
 648
 649         cp.length = len;
 650
 651         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 652 }
 653
 654 static void create_eir(struct hci_dev *hdev, u8 *data)
 655 {
 656         u8 *ptr = data;
 657         size_t name_len;
 658
 659         name_len = strlen(hdev->dev_name);
 660
 661         if (name_len > 0) {
 662                 /* EIR Data type */
 663                 if (name_len > 48) {
 664                         name_len = 48;
 665                         ptr[1] = EIR_NAME_SHORT;
 666                 } else
 667                         ptr[1] = EIR_NAME_COMPLETE;
 668
 669                 /* EIR Data length */
 670                 ptr[0] = name_len + 1;
 671
 672                 memcpy(ptr + 2, hdev->dev_name, name_len);
 673
 674                 ptr += (name_len + 2);
 675         }
 676
 677         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 678                 ptr[0] = 2;
 679                 ptr[1] = EIR_TX_POWER;
 680                 ptr[2] = (u8) hdev->inq_tx_power;
 681
 682                 ptr += 3;
 683         }
 684
 685         if (hdev->devid_source > 0) {
 686                 ptr[0] = 9;
 687                 ptr[1] = EIR_DEVICE_ID;
 688
 689                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 690                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 691                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 692                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 693
 694                 ptr += 10;
 695         }
 696
 697         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 698         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 699         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 700 }
 701
 702 static void update_eir(struct hci_request *req)
 703 {
 704         struct hci_dev *hdev = req->hdev;
 705         struct hci_cp_write_eir cp;
 706
 707         if (!hdev_is_powered(hdev))
 708                 return;
 709
 710         if (!lmp_ext_inq_capable(hdev))
 711                 return;
 712
 713         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 714                 return;
 715
 716         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 717                 return;
 718
 719         memset(&cp, 0, sizeof(cp));
 720
 721         create_eir(hdev, cp.data);
 722
 723         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 724                 return;
 725
 726         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 727
 728         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 729 }
 730
 731 static u8 get_service_classes(struct hci_dev *hdev)
 732 {
 733         struct bt_uuid *uuid;
 734         u8 val = 0;
 735
 736         list_for_each_entry(uuid, &hdev->uuids, list)
 737                 val |= uuid->svc_hint;
 738
 739         return val;
 740 }
 741
 742 static void update_class(struct hci_request *req)
 743 {
 744         struct hci_dev *hdev = req->hdev;
 745         u8 cod[3];
 746
 747         BT_DBG("%s", hdev->name);
 748
 749         if (!hdev_is_powered(hdev))
 750                 return;
 751
 752         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 753                 return;
 754
 755         cod[0] = hdev->minor_class;
 756         cod[1] = hdev->major_class;
 757         cod[2] = get_service_classes(hdev);
 758
 759         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 760                 cod[1] |= 0x20;
 761
 762         if (memcmp(cod, hdev->dev_class, 3) == 0)
 763                 return;
 764
 765         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 766 }
 767
 768 static void service_cache_off(struct work_struct *work)
 769 {
 770         struct hci_dev *hdev = container_of(work, struct hci_dev,
 771                                             service_cache.work);
 772         struct hci_request req;
 773
 774         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 775                 return;
 776
 777         hci_req_init(&req, hdev);
 778
 779         hci_dev_lock(hdev);
 780
 781         update_eir(&req);
 782         update_class(&req);
 783
 784         hci_dev_unlock(hdev);
 785
 786         hci_req_run(&req, NULL);
 787 }
 788
 789 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 790 {
 791         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 792                 return;
 793
 794         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 795
 796         /* Non-mgmt controlled devices get this bit set
 797          * implicitly so that pairing works for them, however
 798          * for mgmt we require user-space to explicitly enable
 799          * it
 800          */
 801         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 802 }
 803
 804 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 805                                 void *data, u16 data_len)
 806 {
 807         struct mgmt_rp_read_info rp;
 808
 809         BT_DBG("sock %p %s", sk, hdev->name);
 810
 811         hci_dev_lock(hdev);
 812
 813         memset(&rp, 0, sizeof(rp));
 814
 815         bacpy(&rp.bdaddr, &hdev->bdaddr);
 816
 817         rp.version = hdev->hci_ver;
 818         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 819
 820         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 821         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 822
 823         memcpy(rp.dev_class, hdev->dev_class, 3);
 824
 825         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 826         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 827
 828         hci_dev_unlock(hdev);
 829
 830         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 831                             sizeof(rp));
 832 }
 833
 834 static void mgmt_pending_free(struct pending_cmd *cmd)
 835 {
 836         sock_put(cmd->sk);
 837         kfree(cmd->param);
 838         kfree(cmd);
 839 }
 840
 841 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 842                                             struct hci_dev *hdev, void *data,
 843                                             u16 len)
 844 {
 845         struct pending_cmd *cmd;
 846
 847         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 848         if (!cmd)
 849                 return NULL;
 850
 851         cmd->opcode = opcode;
 852         cmd->index = hdev->id;
 853
 854         cmd->param = kmalloc(len, GFP_KERNEL);
 855         if (!cmd->param) {
 856                 kfree(cmd);
 857                 return NULL;
 858         }
 859
 860         if (data)
 861                 memcpy(cmd->param, data, len);
 862
 863         cmd->sk = sk;
 864         sock_hold(sk);
 865
 866         list_add(&cmd->list, &hdev->mgmt_pending);
 867
 868         return cmd;
 869 }
 870
 871 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 872                                  void (*cb)(struct pending_cmd *cmd,
 873                                             void *data),
 874                                  void *data)
 875 {
 876         struct pending_cmd *cmd, *tmp;
 877
 878         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 879                 if (opcode > 0 && cmd->opcode != opcode)
 880                         continue;
 881
 882                 cb(cmd, data);
 883         }
 884 }
 885
 886 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 887 {
 888         struct pending_cmd *cmd;
 889
 890         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 891                 if (cmd->opcode == opcode)
 892                         return cmd;
 893         }
 894
 895         return NULL;
 896 }
 897
 898 static void mgmt_pending_remove(struct pending_cmd *cmd)
 899 {
 900         list_del(&cmd->list);
 901         mgmt_pending_free(cmd);
 902 }
 903
 904 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 905 {
 906         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 907
 908         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 909                             sizeof(settings));
 910 }
 911
 912 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 913                        u16 len)
 914 {
 915         struct mgmt_mode *cp = data;
 916         struct pending_cmd *cmd;
 917         int err;
 918
 919         BT_DBG("request for %s", hdev->name);
 920
 921         if (cp->val != 0x00 && cp->val != 0x01)
 922                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 923                                   MGMT_STATUS_INVALID_PARAMS);
 924
 925         hci_dev_lock(hdev);
 926
 927         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 928                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 929                                  MGMT_STATUS_BUSY);
 930                 goto failed;
 931         }
 932
 933         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 934                 cancel_delayed_work(&hdev->power_off);
 935
 936                 if (cp->val) {
 937                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 938                                          data, len);
 939                         err = mgmt_powered(hdev, 1);
 940                         goto failed;
 941                 }
 942         }
 943
 944         if (!!cp->val == hdev_is_powered(hdev)) {
 945                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 946                 goto failed;
 947         }
 948
 949         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 950         if (!cmd) {
 951                 err = -ENOMEM;
 952                 goto failed;
 953         }
 954
 955         if (cp->val)
 956                 queue_work(hdev->req_workqueue, &hdev->power_on);
 957         else
 958                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 959
 960         err = 0;
 961
 962 failed:
 963         hci_dev_unlock(hdev);
 964         return err;
 965 }
 966
 967 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 968                       struct sock *skip_sk)
 969 {
 970         struct sk_buff *skb;
 971         struct mgmt_hdr *hdr;
 972
 973         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 974         if (!skb)
 975                 return -ENOMEM;
 976
 977         hdr = (void *) skb_put(skb, sizeof(*hdr));
 978         hdr->opcode = cpu_to_le16(event);
 979         if (hdev)
 980                 hdr->index = cpu_to_le16(hdev->id);
 981         else
 982                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 983         hdr->len = cpu_to_le16(data_len);
 984
 985         if (data)
 986                 memcpy(skb_put(skb, data_len), data, data_len);
 987
 988         /* Time stamp */
 989         __net_timestamp(skb);
 990
 991         hci_send_to_control(skb, skip_sk);
 992         kfree_skb(skb);
 993
 994         return 0;
 995 }
 996
 997 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 998 {
 999         __le32 ev;
1000
1001         ev = cpu_to_le32(get_current_settings(hdev));
1002
1003         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1004 }
1005
1006 struct cmd_lookup {
1007         struct sock *sk;
1008         struct hci_dev *hdev;
1009         u8 mgmt_status;
1010 };
1011
1012 static void settings_rsp(struct pending_cmd *cmd, void *data)
1013 {
1014         struct cmd_lookup *match = data;
1015
1016         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1017
1018         list_del(&cmd->list);
1019
1020         if (match->sk == NULL) {
1021                 match->sk = cmd->sk;
1022                 sock_hold(match->sk);
1023         }
1024
1025         mgmt_pending_free(cmd);
1026 }
1027
1028 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1029 {
1030         u8 *status = data;
1031
1032         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1033         mgmt_pending_remove(cmd);
1034 }
1035
1036 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1037 {
1038         if (!lmp_bredr_capable(hdev))
1039                 return MGMT_STATUS_NOT_SUPPORTED;
1040         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1041                 return MGMT_STATUS_REJECTED;
1042         else
1043                 return MGMT_STATUS_SUCCESS;
1044 }
1045
1046 static u8 mgmt_le_support(struct hci_dev *hdev)
1047 {
1048         if (!lmp_le_capable(hdev))
1049                 return MGMT_STATUS_NOT_SUPPORTED;
1050         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1051                 return MGMT_STATUS_REJECTED;
1052         else
1053                 return MGMT_STATUS_SUCCESS;
1054 }
1055
1056 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1057 {
1058         struct pending_cmd *cmd;
1059         struct mgmt_mode *cp;
1060         struct hci_request req;
1061         bool changed;
1062
1063         BT_DBG("status 0x%02x", status);
1064
1065         hci_dev_lock(hdev);
1066
1067         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1068         if (!cmd)
1069                 goto unlock;
1070
1071         if (status) {
1072                 u8 mgmt_err = mgmt_status(status);
1073                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1074                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1075                 goto remove_cmd;
1076         }
1077
1078         cp = cmd->param;
1079         if (cp->val) {
1080                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1081                                             &hdev->dev_flags);
1082
1083                 if (hdev->discov_timeout > 0) {
1084                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1085                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1086                                            to);
1087                 }
1088         } else {
1089                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1090                                              &hdev->dev_flags);
1091         }
1092
1093         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1094
1095         if (changed)
1096                 new_settings(hdev, cmd->sk);
1097
1098         /* When the discoverable mode gets changed, make sure
1099          * that class of device has the limited discoverable
1100          * bit correctly set.
1101          */
1102         hci_req_init(&req, hdev);
1103         update_class(&req);
1104         hci_req_run(&req, NULL);
1105
1106 remove_cmd:
1107         mgmt_pending_remove(cmd);
1108
1109 unlock:
1110         hci_dev_unlock(hdev);
1111 }
1112
1113 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1114                             u16 len)
1115 {
1116         struct mgmt_cp_set_discoverable *cp = data;
1117         struct pending_cmd *cmd;
1118         struct hci_request req;
1119         u16 timeout;
1120         u8 scan, status;
1121         int err;
1122
1123         BT_DBG("request for %s", hdev->name);
1124
1125         status = mgmt_bredr_support(hdev);
1126         if (status)
1127                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1128                                   status);
1129
1130         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1131                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1132                                   MGMT_STATUS_INVALID_PARAMS);
1133
1134         timeout = __le16_to_cpu(cp->timeout);
1135
1136         /* Disabling discoverable requires that no timeout is set,
1137          * and enabling limited discoverable requires a timeout.
1138          */
1139         if ((cp->val == 0x00 && timeout > 0) ||
1140             (cp->val == 0x02 && timeout == 0))
1141                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1142                                   MGMT_STATUS_INVALID_PARAMS);
1143
1144         hci_dev_lock(hdev);
1145
1146         if (!hdev_is_powered(hdev) && timeout > 0) {
1147                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1148                                  MGMT_STATUS_NOT_POWERED);
1149                 goto failed;
1150         }
1151
1152         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1153             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1154                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1155                                  MGMT_STATUS_BUSY);
1156                 goto failed;
1157         }
1158
1159         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1160                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1161                                  MGMT_STATUS_REJECTED);
1162                 goto failed;
1163         }
1164
1165         if (!hdev_is_powered(hdev)) {
1166                 bool changed = false;
1167
1168                 /* Setting limited discoverable when powered off is
1169                  * not a valid operation since it requires a timeout
1170                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1171                  */
1172                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1173                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1174                         changed = true;
1175                 }
1176
1177                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1178                 if (err < 0)
1179                         goto failed;
1180
1181                 if (changed)
1182                         err = new_settings(hdev, sk);
1183
1184                 goto failed;
1185         }
1186
1187         /* If the current mode is the same, then just update the timeout
1188          * value with the new value. And if only the timeout gets updated,
1189          * then no need for any HCI transactions.
1190          */
1191         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1192             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1193                                           &hdev->dev_flags)) {
1194                 cancel_delayed_work(&hdev->discov_off);
1195                 hdev->discov_timeout = timeout;
1196
1197                 if (cp->val && hdev->discov_timeout > 0) {
1198                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1199                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1200                                            to);
1201                 }
1202
1203                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1204                 goto failed;
1205         }
1206
1207         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1208         if (!cmd) {
1209                 err = -ENOMEM;
1210                 goto failed;
1211         }
1212
1213         /* Cancel any potential discoverable timeout that might be
1214          * still active and store new timeout value. The arming of
1215          * the timeout happens in the complete handler.
1216          */
1217         cancel_delayed_work(&hdev->discov_off);
1218         hdev->discov_timeout = timeout;
1219
1220         hci_req_init(&req, hdev);
1221
1222         scan = SCAN_PAGE;
1223
1224         if (cp->val) {
1225                 struct hci_cp_write_current_iac_lap hci_cp;
1226
1227                 if (cp->val == 0x02) {
1228                         /* Limited discoverable mode */
1229                         set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1230
1231                         hci_cp.num_iac = 2;
1232                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1233                         hci_cp.iac_lap[1] = 0x8b;
1234                         hci_cp.iac_lap[2] = 0x9e;
1235                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1236                         hci_cp.iac_lap[4] = 0x8b;
1237                         hci_cp.iac_lap[5] = 0x9e;
1238                 } else {
1239                         /* General discoverable mode */
1240                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1241
1242                         hci_cp.num_iac = 1;
1243                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1244                         hci_cp.iac_lap[1] = 0x8b;
1245                         hci_cp.iac_lap[2] = 0x9e;
1246                 }
1247
1248                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1249                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1250
1251                 scan |= SCAN_INQUIRY;
1252         } else {
1253                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1254         }
1255
1256         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1257
1258         err = hci_req_run(&req, set_discoverable_complete);
1259         if (err < 0)
1260                 mgmt_pending_remove(cmd);
1261
1262 failed:
1263         hci_dev_unlock(hdev);
1264         return err;
1265 }
1266
1267 static void write_fast_connectable(struct hci_request *req, bool enable)
1268 {
1269         struct hci_dev *hdev = req->hdev;
1270         struct hci_cp_write_page_scan_activity acp;
1271         u8 type;
1272
1273         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1274                 return;
1275
1276         if (enable) {
1277                 type = PAGE_SCAN_TYPE_INTERLACED;
1278
1279                 /* 160 msec page scan interval */
1280                 acp.interval = __constant_cpu_to_le16(0x0100);
1281         } else {
1282                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1283
1284                 /* default 1.28 sec page scan */
1285                 acp.interval = __constant_cpu_to_le16(0x0800);
1286         }
1287
1288         acp.window = __constant_cpu_to_le16(0x0012);
1289
1290         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1291             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1292                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1293                             sizeof(acp), &acp);
1294
1295         if (hdev->page_scan_type != type)
1296                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1297 }
1298
1299 static u8 get_adv_type(struct hci_dev *hdev)
1300 {
1301         struct pending_cmd *cmd;
1302         bool connectable;
1303
1304         /* If there's a pending mgmt command the flag will not yet have
1305          * it's final value, so check for this first.
1306          */
1307         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1308         if (cmd) {
1309                 struct mgmt_mode *cp = cmd->param;
1310                 connectable = !!cp->val;
1311         } else {
1312                 connectable = test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1313         }
1314
1315         return connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1316 }
1317
1318 static void enable_advertising(struct hci_request *req)
1319 {
1320         struct hci_dev *hdev = req->hdev;
1321         struct hci_cp_le_set_adv_param cp;
1322         u8 enable = 0x01;
1323
1324         memset(&cp, 0, sizeof(cp));
1325         cp.min_interval = __constant_cpu_to_le16(0x0800);
1326         cp.max_interval = __constant_cpu_to_le16(0x0800);
1327         cp.type = get_adv_type(hdev);
1328         if (bacmp(&hdev->bdaddr, BDADDR_ANY))
1329                 cp.own_address_type = ADDR_LE_DEV_PUBLIC;
1330         else
1331                 cp.own_address_type = ADDR_LE_DEV_RANDOM;
1332         cp.channel_map = 0x07;
1333
1334         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1335
1336         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1337 }
1338
1339 static void disable_advertising(struct hci_request *req)
1340 {
1341         u8 enable = 0x00;
1342
1343         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1344 }
1345
1346 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1347 {
1348         struct pending_cmd *cmd;
1349         struct mgmt_mode *cp;
1350         bool changed;
1351
1352         BT_DBG("status 0x%02x", status);
1353
1354         hci_dev_lock(hdev);
1355
1356         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1357         if (!cmd)
1358                 goto unlock;
1359
1360         if (status) {
1361                 u8 mgmt_err = mgmt_status(status);
1362                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1363                 goto remove_cmd;
1364         }
1365
1366         cp = cmd->param;
1367         if (cp->val)
1368                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1369         else
1370                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1371
1372         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1373
1374         if (changed)
1375                 new_settings(hdev, cmd->sk);
1376
1377 remove_cmd:
1378         mgmt_pending_remove(cmd);
1379
1380 unlock:
1381         hci_dev_unlock(hdev);
1382 }
1383
1384 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1385                            u16 len)
1386 {
1387         struct mgmt_mode *cp = data;
1388         struct pending_cmd *cmd;
1389         struct hci_request req;
1390         u8 scan;
1391         int err;
1392
1393         BT_DBG("request for %s", hdev->name);
1394
1395         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1396             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1397                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1398                                   MGMT_STATUS_REJECTED);
1399
1400         if (cp->val != 0x00 && cp->val != 0x01)
1401                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1402                                   MGMT_STATUS_INVALID_PARAMS);
1403
1404         hci_dev_lock(hdev);
1405
1406         if (!hdev_is_powered(hdev)) {
1407                 bool changed = false;
1408
1409                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1410                         changed = true;
1411
1412                 if (cp->val) {
1413                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1414                 } else {
1415                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1416                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1417                 }
1418
1419                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1420                 if (err < 0)
1421                         goto failed;
1422
1423                 if (changed)
1424                         err = new_settings(hdev, sk);
1425
1426                 goto failed;
1427         }
1428
1429         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1430             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1431                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1432                                  MGMT_STATUS_BUSY);
1433                 goto failed;
1434         }
1435
1436         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1437         if (!cmd) {
1438                 err = -ENOMEM;
1439                 goto failed;
1440         }
1441
1442         hci_req_init(&req, hdev);
1443
1444         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
1445             cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1446                 if (cp->val) {
1447                         scan = SCAN_PAGE;
1448                 } else {
1449                         scan = 0;
1450
1451                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1452                             hdev->discov_timeout > 0)
1453                                 cancel_delayed_work(&hdev->discov_off);
1454                 }
1455
1456                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1457         }
1458
1459         /* If we're going from non-connectable to connectable or
1460          * vice-versa when fast connectable is enabled ensure that fast
1461          * connectable gets disabled. write_fast_connectable won't do
1462          * anything if the page scan parameters are already what they
1463          * should be.
1464          */
1465         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1466                 write_fast_connectable(&req, false);
1467
1468         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) &&
1469             hci_conn_num(hdev, LE_LINK) == 0) {
1470                 disable_advertising(&req);
1471                 enable_advertising(&req);
1472         }
1473
1474         err = hci_req_run(&req, set_connectable_complete);
1475         if (err < 0) {
1476                 mgmt_pending_remove(cmd);
1477                 if (err == -ENODATA)
1478                         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE,
1479                                                 hdev);
1480                 goto failed;
1481         }
1482
1483 failed:
1484         hci_dev_unlock(hdev);
1485         return err;
1486 }
1487
1488 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1489                         u16 len)
1490 {
1491         struct mgmt_mode *cp = data;
1492         bool changed;
1493         int err;
1494
1495         BT_DBG("request for %s", hdev->name);
1496
1497         if (cp->val != 0x00 && cp->val != 0x01)
1498                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1499                                   MGMT_STATUS_INVALID_PARAMS);
1500
1501         hci_dev_lock(hdev);
1502
1503         if (cp->val)
1504                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1505         else
1506                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1507
1508         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1509         if (err < 0)
1510                 goto unlock;
1511
1512         if (changed)
1513                 err = new_settings(hdev, sk);
1514
1515 unlock:
1516         hci_dev_unlock(hdev);
1517         return err;
1518 }
1519
1520 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1521                              u16 len)
1522 {
1523         struct mgmt_mode *cp = data;
1524         struct pending_cmd *cmd;
1525         u8 val, status;
1526         int err;
1527
1528         BT_DBG("request for %s", hdev->name);
1529
1530         status = mgmt_bredr_support(hdev);
1531         if (status)
1532                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1533                                   status);
1534
1535         if (cp->val != 0x00 && cp->val != 0x01)
1536                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1537                                   MGMT_STATUS_INVALID_PARAMS);
1538
1539         hci_dev_lock(hdev);
1540
1541         if (!hdev_is_powered(hdev)) {
1542                 bool changed = false;
1543
1544                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1545                                           &hdev->dev_flags)) {
1546                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1547                         changed = true;
1548                 }
1549
1550                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1551                 if (err < 0)
1552                         goto failed;
1553
1554                 if (changed)
1555                         err = new_settings(hdev, sk);
1556
1557                 goto failed;
1558         }
1559
1560         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1561                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1562                                  MGMT_STATUS_BUSY);
1563                 goto failed;
1564         }
1565
1566         val = !!cp->val;
1567
1568         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1569                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1570                 goto failed;
1571         }
1572
1573         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1574         if (!cmd) {
1575                 err = -ENOMEM;
1576                 goto failed;
1577         }
1578
1579         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1580         if (err < 0) {
1581                 mgmt_pending_remove(cmd);
1582                 goto failed;
1583         }
1584
1585 failed:
1586         hci_dev_unlock(hdev);
1587         return err;
1588 }
1589
1590 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1591 {
1592         struct mgmt_mode *cp = data;
1593         struct pending_cmd *cmd;
1594         u8 status;
1595         int err;
1596
1597         BT_DBG("request for %s", hdev->name);
1598
1599         status = mgmt_bredr_support(hdev);
1600         if (status)
1601                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1602
1603         if (!lmp_ssp_capable(hdev))
1604                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1605                                   MGMT_STATUS_NOT_SUPPORTED);
1606
1607         if (cp->val != 0x00 && cp->val != 0x01)
1608                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1609                                   MGMT_STATUS_INVALID_PARAMS);
1610
1611         hci_dev_lock(hdev);
1612
1613         if (!hdev_is_powered(hdev)) {
1614                 bool changed;
1615
1616                 if (cp->val) {
1617                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
1618                                                     &hdev->dev_flags);
1619                 } else {
1620                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
1621                                                      &hdev->dev_flags);
1622                         if (!changed)
1623                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
1624                                                              &hdev->dev_flags);
1625                         else
1626                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1627                 }
1628
1629                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1630                 if (err < 0)
1631                         goto failed;
1632
1633                 if (changed)
1634                         err = new_settings(hdev, sk);
1635
1636                 goto failed;
1637         }
1638
1639         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
1640             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
1641                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1642                                  MGMT_STATUS_BUSY);
1643                 goto failed;
1644         }
1645
1646         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1647                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1648                 goto failed;
1649         }
1650
1651         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1652         if (!cmd) {
1653                 err = -ENOMEM;
1654                 goto failed;
1655         }
1656
1657         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1658         if (err < 0) {
1659                 mgmt_pending_remove(cmd);
1660                 goto failed;
1661         }
1662
1663 failed:
1664         hci_dev_unlock(hdev);
1665         return err;
1666 }
1667
1668 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1669 {
1670         struct mgmt_mode *cp = data;
1671         bool changed;
1672         u8 status;
1673         int err;
1674
1675         BT_DBG("request for %s", hdev->name);
1676
1677         status = mgmt_bredr_support(hdev);
1678         if (status)
1679                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1680
1681         if (!lmp_ssp_capable(hdev))
1682                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1683                                   MGMT_STATUS_NOT_SUPPORTED);
1684
1685         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
1686                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1687                                   MGMT_STATUS_REJECTED);
1688
1689         if (cp->val != 0x00 && cp->val != 0x01)
1690                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1691                                   MGMT_STATUS_INVALID_PARAMS);
1692
1693         hci_dev_lock(hdev);
1694
1695         if (cp->val) {
1696                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1697         } else {
1698                 if (hdev_is_powered(hdev)) {
1699                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1700                                          MGMT_STATUS_REJECTED);
1701                         goto unlock;
1702                 }
1703
1704                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1705         }
1706
1707         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1708         if (err < 0)
1709                 goto unlock;
1710
1711         if (changed)
1712                 err = new_settings(hdev, sk);
1713
1714 unlock:
1715         hci_dev_unlock(hdev);
1716         return err;
1717 }
1718
1719 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1720 {
1721         struct cmd_lookup match = { NULL, hdev };
1722
1723         if (status) {
1724                 u8 mgmt_err = mgmt_status(status);
1725
1726                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1727                                      &mgmt_err);
1728                 return;
1729         }
1730
1731         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1732
1733         new_settings(hdev, match.sk);
1734
1735         if (match.sk)
1736                 sock_put(match.sk);
1737
1738         /* Make sure the controller has a good default for
1739          * advertising data. Restrict the update to when LE
1740          * has actually been enabled. During power on, the
1741          * update in powered_update_hci will take care of it.
1742          */
1743         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1744                 struct hci_request req;
1745
1746                 hci_dev_lock(hdev);
1747
1748                 hci_req_init(&req, hdev);
1749                 update_ad(&req);
1750                 update_scan_rsp_data(&req);
1751                 hci_req_run(&req, NULL);
1752
1753                 hci_dev_unlock(hdev);
1754         }
1755 }
1756
1757 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1758 {
1759         struct mgmt_mode *cp = data;
1760         struct hci_cp_write_le_host_supported hci_cp;
1761         struct pending_cmd *cmd;
1762         struct hci_request req;
1763         int err;
1764         u8 val, enabled;
1765
1766         BT_DBG("request for %s", hdev->name);
1767
1768         if (!lmp_le_capable(hdev))
1769                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1770                                   MGMT_STATUS_NOT_SUPPORTED);
1771
1772         if (cp->val != 0x00 && cp->val != 0x01)
1773                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1774                                   MGMT_STATUS_INVALID_PARAMS);
1775
1776         /* LE-only devices do not allow toggling LE on/off */
1777         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1778                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1779                                   MGMT_STATUS_REJECTED);
1780
1781         hci_dev_lock(hdev);
1782
1783         val = !!cp->val;
1784         enabled = lmp_host_le_capable(hdev);
1785
1786         if (!hdev_is_powered(hdev) || val == enabled) {
1787                 bool changed = false;
1788
1789                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1790                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1791                         changed = true;
1792                 }
1793
1794                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
1795                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1796                         changed = true;
1797                 }
1798
1799                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1800                 if (err < 0)
1801                         goto unlock;
1802
1803                 if (changed)
1804                         err = new_settings(hdev, sk);
1805
1806                 goto unlock;
1807         }
1808
1809         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1810             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1811                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1812                                  MGMT_STATUS_BUSY);
1813                 goto unlock;
1814         }
1815
1816         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1817         if (!cmd) {
1818                 err = -ENOMEM;
1819                 goto unlock;
1820         }
1821
1822         hci_req_init(&req, hdev);
1823
1824         memset(&hci_cp, 0, sizeof(hci_cp));
1825
1826         if (val) {
1827                 hci_cp.le = val;
1828                 hci_cp.simul = lmp_le_br_capable(hdev);
1829         } else {
1830                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1831                         disable_advertising(&req);
1832         }
1833
1834         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1835                     &hci_cp);
1836
1837         err = hci_req_run(&req, le_enable_complete);
1838         if (err < 0)
1839                 mgmt_pending_remove(cmd);
1840
1841 unlock:
1842         hci_dev_unlock(hdev);
1843         return err;
1844 }
1845
1846 /* This is a helper function to test for pending mgmt commands that can
1847  * cause CoD or EIR HCI commands. We can only allow one such pending
1848  * mgmt command at a time since otherwise we cannot easily track what
1849  * the current values are, will be, and based on that calculate if a new
1850  * HCI command needs to be sent and if yes with what value.
1851  */
1852 static bool pending_eir_or_class(struct hci_dev *hdev)
1853 {
1854         struct pending_cmd *cmd;
1855
1856         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1857                 switch (cmd->opcode) {
1858                 case MGMT_OP_ADD_UUID:
1859                 case MGMT_OP_REMOVE_UUID:
1860                 case MGMT_OP_SET_DEV_CLASS:
1861                 case MGMT_OP_SET_POWERED:
1862                         return true;
1863                 }
1864         }
1865
1866         return false;
1867 }
1868
1869 static const u8 bluetooth_base_uuid[] = {
1870                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1871                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1872 };
1873
1874 static u8 get_uuid_size(const u8 *uuid)
1875 {
1876         u32 val;
1877
1878         if (memcmp(uuid, bluetooth_base_uuid, 12))
1879                 return 128;
1880
1881         val = get_unaligned_le32(&uuid[12]);
1882         if (val > 0xffff)
1883                 return 32;
1884
1885         return 16;
1886 }
1887
1888 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1889 {
1890         struct pending_cmd *cmd;
1891
1892         hci_dev_lock(hdev);
1893
1894         cmd = mgmt_pending_find(mgmt_op, hdev);
1895         if (!cmd)
1896                 goto unlock;
1897
1898         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1899                      hdev->dev_class, 3);
1900
1901         mgmt_pending_remove(cmd);
1902
1903 unlock:
1904         hci_dev_unlock(hdev);
1905 }
1906
1907 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1908 {
1909         BT_DBG("status 0x%02x", status);
1910
1911         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1912 }
1913
1914 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1915 {
1916         struct mgmt_cp_add_uuid *cp = data;
1917         struct pending_cmd *cmd;
1918         struct hci_request req;
1919         struct bt_uuid *uuid;
1920         int err;
1921
1922         BT_DBG("request for %s", hdev->name);
1923
1924         hci_dev_lock(hdev);
1925
1926         if (pending_eir_or_class(hdev)) {
1927                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1928                                  MGMT_STATUS_BUSY);
1929                 goto failed;
1930         }
1931
1932         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1933         if (!uuid) {
1934                 err = -ENOMEM;
1935                 goto failed;
1936         }
1937
1938         memcpy(uuid->uuid, cp->uuid, 16);
1939         uuid->svc_hint = cp->svc_hint;
1940         uuid->size = get_uuid_size(cp->uuid);
1941
1942         list_add_tail(&uuid->list, &hdev->uuids);
1943
1944         hci_req_init(&req, hdev);
1945
1946         update_class(&req);
1947         update_eir(&req);
1948
1949         err = hci_req_run(&req, add_uuid_complete);
1950         if (err < 0) {
1951                 if (err != -ENODATA)
1952                         goto failed;
1953
1954                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1955                                    hdev->dev_class, 3);
1956                 goto failed;
1957         }
1958
1959         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1960         if (!cmd) {
1961                 err = -ENOMEM;
1962                 goto failed;
1963         }
1964
1965         err = 0;
1966
1967 failed:
1968         hci_dev_unlock(hdev);
1969         return err;
1970 }
1971
1972 static bool enable_service_cache(struct hci_dev *hdev)
1973 {
1974         if (!hdev_is_powered(hdev))
1975                 return false;
1976
1977         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1978                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1979                                    CACHE_TIMEOUT);
1980                 return true;
1981         }
1982
1983         return false;
1984 }
1985
1986 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1987 {
1988         BT_DBG("status 0x%02x", status);
1989
1990         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1991 }
1992
1993 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1994                        u16 len)
1995 {
1996         struct mgmt_cp_remove_uuid *cp = data;
1997         struct pending_cmd *cmd;
1998         struct bt_uuid *match, *tmp;
1999         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2000         struct hci_request req;
2001         int err, found;
2002
2003         BT_DBG("request for %s", hdev->name);
2004
2005         hci_dev_lock(hdev);
2006
2007         if (pending_eir_or_class(hdev)) {
2008                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2009                                  MGMT_STATUS_BUSY);
2010                 goto unlock;
2011         }
2012
2013         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2014                 err = hci_uuids_clear(hdev);
2015
2016                 if (enable_service_cache(hdev)) {
2017                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2018                                            0, hdev->dev_class, 3);
2019                         goto unlock;
2020                 }
2021
2022                 goto update_class;
2023         }
2024
2025         found = 0;
2026
2027         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2028                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2029                         continue;
2030
2031                 list_del(&match->list);
2032                 kfree(match);
2033                 found++;
2034         }
2035
2036         if (found == 0) {
2037                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2038                                  MGMT_STATUS_INVALID_PARAMS);
2039                 goto unlock;
2040         }
2041
2042 update_class:
2043         hci_req_init(&req, hdev);
2044
2045         update_class(&req);
2046         update_eir(&req);
2047
2048         err = hci_req_run(&req, remove_uuid_complete);
2049         if (err < 0) {
2050                 if (err != -ENODATA)
2051                         goto unlock;
2052
2053                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2054                                    hdev->dev_class, 3);
2055                 goto unlock;
2056         }
2057
2058         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2059         if (!cmd) {
2060                 err = -ENOMEM;
2061                 goto unlock;
2062         }
2063
2064         err = 0;
2065
2066 unlock:
2067         hci_dev_unlock(hdev);
2068         return err;
2069 }
2070
2071 static void set_class_complete(struct hci_dev *hdev, u8 status)
2072 {
2073         BT_DBG("status 0x%02x", status);
2074
2075         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2076 }
2077
2078 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2079                          u16 len)
2080 {
2081         struct mgmt_cp_set_dev_class *cp = data;
2082         struct pending_cmd *cmd;
2083         struct hci_request req;
2084         int err;
2085
2086         BT_DBG("request for %s", hdev->name);
2087
2088         if (!lmp_bredr_capable(hdev))
2089                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2090                                   MGMT_STATUS_NOT_SUPPORTED);
2091
2092         hci_dev_lock(hdev);
2093
2094         if (pending_eir_or_class(hdev)) {
2095                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2096                                  MGMT_STATUS_BUSY);
2097                 goto unlock;
2098         }
2099
2100         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2101                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2102                                  MGMT_STATUS_INVALID_PARAMS);
2103                 goto unlock;
2104         }
2105
2106         hdev->major_class = cp->major;
2107         hdev->minor_class = cp->minor;
2108
2109         if (!hdev_is_powered(hdev)) {
2110                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2111                                    hdev->dev_class, 3);
2112                 goto unlock;
2113         }
2114
2115         hci_req_init(&req, hdev);
2116
2117         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2118                 hci_dev_unlock(hdev);
2119                 cancel_delayed_work_sync(&hdev->service_cache);
2120                 hci_dev_lock(hdev);
2121                 update_eir(&req);
2122         }
2123
2124         update_class(&req);
2125
2126         err = hci_req_run(&req, set_class_complete);
2127         if (err < 0) {
2128                 if (err != -ENODATA)
2129                         goto unlock;
2130
2131                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2132                                    hdev->dev_class, 3);
2133                 goto unlock;
2134         }
2135
2136         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2137         if (!cmd) {
2138                 err = -ENOMEM;
2139                 goto unlock;
2140         }
2141
2142         err = 0;
2143
2144 unlock:
2145         hci_dev_unlock(hdev);
2146         return err;
2147 }
2148
2149 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2150                           u16 len)
2151 {
2152         struct mgmt_cp_load_link_keys *cp = data;
2153         u16 key_count, expected_len;
2154         int i;
2155
2156         BT_DBG("request for %s", hdev->name);
2157
2158         if (!lmp_bredr_capable(hdev))
2159                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2160                                   MGMT_STATUS_NOT_SUPPORTED);
2161
2162         key_count = __le16_to_cpu(cp->key_count);
2163
2164         expected_len = sizeof(*cp) + key_count *
2165                                         sizeof(struct mgmt_link_key_info);
2166         if (expected_len != len) {
2167                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2168                        len, expected_len);
2169                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2170                                   MGMT_STATUS_INVALID_PARAMS);
2171         }
2172
2173         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2174                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2175                                   MGMT_STATUS_INVALID_PARAMS);
2176
2177         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2178                key_count);
2179
2180         for (i = 0; i < key_count; i++) {
2181                 struct mgmt_link_key_info *key = &cp->keys[i];
2182
2183                 if (key->addr.type != BDADDR_BREDR)
2184                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2185                                           MGMT_STATUS_INVALID_PARAMS);
2186         }
2187
2188         hci_dev_lock(hdev);
2189
2190         hci_link_keys_clear(hdev);
2191
2192         if (cp->debug_keys)
2193                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2194         else
2195                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2196
2197         for (i = 0; i < key_count; i++) {
2198                 struct mgmt_link_key_info *key = &cp->keys[i];
2199
2200                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
2201                                  key->type, key->pin_len);
2202         }
2203
2204         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2205
2206         hci_dev_unlock(hdev);
2207
2208         return 0;
2209 }
2210
2211 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2212                            u8 addr_type, struct sock *skip_sk)
2213 {
2214         struct mgmt_ev_device_unpaired ev;
2215
2216         bacpy(&ev.addr.bdaddr, bdaddr);
2217         ev.addr.type = addr_type;
2218
2219         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2220                           skip_sk);
2221 }
2222
2223 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2224                          u16 len)
2225 {
2226         struct mgmt_cp_unpair_device *cp = data;
2227         struct mgmt_rp_unpair_device rp;
2228         struct hci_cp_disconnect dc;
2229         struct pending_cmd *cmd;
2230         struct hci_conn *conn;
2231         int err;
2232
2233         memset(&rp, 0, sizeof(rp));
2234         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2235         rp.addr.type = cp->addr.type;
2236
2237         if (!bdaddr_type_is_valid(cp->addr.type))
2238                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2239                                     MGMT_STATUS_INVALID_PARAMS,
2240                                     &rp, sizeof(rp));
2241
2242         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2243                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2244                                     MGMT_STATUS_INVALID_PARAMS,
2245                                     &rp, sizeof(rp));
2246
2247         hci_dev_lock(hdev);
2248
2249         if (!hdev_is_powered(hdev)) {
2250                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2251                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2252                 goto unlock;
2253         }
2254
2255         if (cp->addr.type == BDADDR_BREDR)
2256                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2257         else
2258                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
2259
2260         if (err < 0) {
2261                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2262                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2263                 goto unlock;
2264         }
2265
2266         if (cp->disconnect) {
2267                 if (cp->addr.type == BDADDR_BREDR)
2268                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2269                                                        &cp->addr.bdaddr);
2270                 else
2271                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2272                                                        &cp->addr.bdaddr);
2273         } else {
2274                 conn = NULL;
2275         }
2276
2277         if (!conn) {
2278                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2279                                    &rp, sizeof(rp));
2280                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2281                 goto unlock;
2282         }
2283
2284         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2285                                sizeof(*cp));
2286         if (!cmd) {
2287                 err = -ENOMEM;
2288                 goto unlock;
2289         }
2290
2291         dc.handle = cpu_to_le16(conn->handle);
2292         dc.reason = 0x13; /* Remote User Terminated Connection */
2293         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2294         if (err < 0)
2295                 mgmt_pending_remove(cmd);
2296
2297 unlock:
2298         hci_dev_unlock(hdev);
2299         return err;
2300 }
2301
2302 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2303                       u16 len)
2304 {
2305         struct mgmt_cp_disconnect *cp = data;
2306         struct mgmt_rp_disconnect rp;
2307         struct hci_cp_disconnect dc;
2308         struct pending_cmd *cmd;
2309         struct hci_conn *conn;
2310         int err;
2311
2312         BT_DBG("");
2313
2314         memset(&rp, 0, sizeof(rp));
2315         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2316         rp.addr.type = cp->addr.type;
2317
2318         if (!bdaddr_type_is_valid(cp->addr.type))
2319                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2320                                     MGMT_STATUS_INVALID_PARAMS,
2321                                     &rp, sizeof(rp));
2322
2323         hci_dev_lock(hdev);
2324
2325         if (!test_bit(HCI_UP, &hdev->flags)) {
2326                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2327                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2328                 goto failed;
2329         }
2330
2331         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2332                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2333                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2334                 goto failed;
2335         }
2336
2337         if (cp->addr.type == BDADDR_BREDR)
2338                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2339                                                &cp->addr.bdaddr);
2340         else
2341                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2342
2343         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2344                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2345                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2346                 goto failed;
2347         }
2348
2349         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2350         if (!cmd) {
2351                 err = -ENOMEM;
2352                 goto failed;
2353         }
2354
2355         dc.handle = cpu_to_le16(conn->handle);
2356         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2357
2358         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2359         if (err < 0)
2360                 mgmt_pending_remove(cmd);
2361
2362 failed:
2363         hci_dev_unlock(hdev);
2364         return err;
2365 }
2366
2367 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2368 {
2369         switch (link_type) {
2370         case LE_LINK:
2371                 switch (addr_type) {
2372                 case ADDR_LE_DEV_PUBLIC:
2373                         return BDADDR_LE_PUBLIC;
2374
2375                 default:
2376                         /* Fallback to LE Random address type */
2377                         return BDADDR_LE_RANDOM;
2378                 }
2379
2380         default:
2381                 /* Fallback to BR/EDR type */
2382                 return BDADDR_BREDR;
2383         }
2384 }
2385
2386 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2387                            u16 data_len)
2388 {
2389         struct mgmt_rp_get_connections *rp;
2390         struct hci_conn *c;
2391         size_t rp_len;
2392         int err;
2393         u16 i;
2394
2395         BT_DBG("");
2396
2397         hci_dev_lock(hdev);
2398
2399         if (!hdev_is_powered(hdev)) {
2400                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2401                                  MGMT_STATUS_NOT_POWERED);
2402                 goto unlock;
2403         }
2404
2405         i = 0;
2406         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2407                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2408                         i++;
2409         }
2410
2411         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2412         rp = kmalloc(rp_len, GFP_KERNEL);
2413         if (!rp) {
2414                 err = -ENOMEM;
2415                 goto unlock;
2416         }
2417
2418         i = 0;
2419         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2420                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2421                         continue;
2422                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2423                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2424                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2425                         continue;
2426                 i++;
2427         }
2428
2429         rp->conn_count = cpu_to_le16(i);
2430
2431         /* Recalculate length in case of filtered SCO connections, etc */
2432         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2433
2434         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2435                            rp_len);
2436
2437         kfree(rp);
2438
2439 unlock:
2440         hci_dev_unlock(hdev);
2441         return err;
2442 }
2443
2444 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2445                                    struct mgmt_cp_pin_code_neg_reply *cp)
2446 {
2447         struct pending_cmd *cmd;
2448         int err;
2449
2450         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2451                                sizeof(*cp));
2452         if (!cmd)
2453                 return -ENOMEM;
2454
2455         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2456                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2457         if (err < 0)
2458                 mgmt_pending_remove(cmd);
2459
2460         return err;
2461 }
2462
2463 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2464                           u16 len)
2465 {
2466         struct hci_conn *conn;
2467         struct mgmt_cp_pin_code_reply *cp = data;
2468         struct hci_cp_pin_code_reply reply;
2469         struct pending_cmd *cmd;
2470         int err;
2471
2472         BT_DBG("");
2473
2474         hci_dev_lock(hdev);
2475
2476         if (!hdev_is_powered(hdev)) {
2477                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2478                                  MGMT_STATUS_NOT_POWERED);
2479                 goto failed;
2480         }
2481
2482         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2483         if (!conn) {
2484                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2485                                  MGMT_STATUS_NOT_CONNECTED);
2486                 goto failed;
2487         }
2488
2489         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2490                 struct mgmt_cp_pin_code_neg_reply ncp;
2491
2492                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2493
2494                 BT_ERR("PIN code is not 16 bytes long");
2495
2496                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2497                 if (err >= 0)
2498                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2499                                          MGMT_STATUS_INVALID_PARAMS);
2500
2501                 goto failed;
2502         }
2503
2504         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2505         if (!cmd) {
2506                 err = -ENOMEM;
2507                 goto failed;
2508         }
2509
2510         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2511         reply.pin_len = cp->pin_len;
2512         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2513
2514         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2515         if (err < 0)
2516                 mgmt_pending_remove(cmd);
2517
2518 failed:
2519         hci_dev_unlock(hdev);
2520         return err;
2521 }
2522
2523 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2524                              u16 len)
2525 {
2526         struct mgmt_cp_set_io_capability *cp = data;
2527
2528         BT_DBG("");
2529
2530         hci_dev_lock(hdev);
2531
2532         hdev->io_capability = cp->io_capability;
2533
2534         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2535                hdev->io_capability);
2536
2537         hci_dev_unlock(hdev);
2538
2539         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2540                             0);
2541 }
2542
2543 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2544 {
2545         struct hci_dev *hdev = conn->hdev;
2546         struct pending_cmd *cmd;
2547
2548         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2549                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2550                         continue;
2551
2552                 if (cmd->user_data != conn)
2553                         continue;
2554
2555                 return cmd;
2556         }
2557
2558         return NULL;
2559 }
2560
2561 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2562 {
2563         struct mgmt_rp_pair_device rp;
2564         struct hci_conn *conn = cmd->user_data;
2565
2566         bacpy(&rp.addr.bdaddr, &conn->dst);
2567         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2568
2569         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2570                      &rp, sizeof(rp));
2571
2572         /* So we don't get further callbacks for this connection */
2573         conn->connect_cfm_cb = NULL;
2574         conn->security_cfm_cb = NULL;
2575         conn->disconn_cfm_cb = NULL;
2576
2577         hci_conn_drop(conn);
2578
2579         mgmt_pending_remove(cmd);
2580 }
2581
2582 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2583 {
2584         struct pending_cmd *cmd;
2585
2586         BT_DBG("status %u", status);
2587
2588         cmd = find_pairing(conn);
2589         if (!cmd)
2590                 BT_DBG("Unable to find a pending command");
2591         else
2592                 pairing_complete(cmd, mgmt_status(status));
2593 }
2594
2595 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2596 {
2597         struct pending_cmd *cmd;
2598
2599         BT_DBG("status %u", status);
2600
2601         if (!status)
2602                 return;
2603
2604         cmd = find_pairing(conn);
2605         if (!cmd)
2606                 BT_DBG("Unable to find a pending command");
2607         else
2608                 pairing_complete(cmd, mgmt_status(status));
2609 }
2610
2611 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2612                        u16 len)
2613 {
2614         struct mgmt_cp_pair_device *cp = data;
2615         struct mgmt_rp_pair_device rp;
2616         struct pending_cmd *cmd;
2617         u8 sec_level, auth_type;
2618         struct hci_conn *conn;
2619         int err;
2620
2621         BT_DBG("");
2622
2623         memset(&rp, 0, sizeof(rp));
2624         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2625         rp.addr.type = cp->addr.type;
2626
2627         if (!bdaddr_type_is_valid(cp->addr.type))
2628                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2629                                     MGMT_STATUS_INVALID_PARAMS,
2630                                     &rp, sizeof(rp));
2631
2632         hci_dev_lock(hdev);
2633
2634         if (!hdev_is_powered(hdev)) {
2635                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2636                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2637                 goto unlock;
2638         }
2639
2640         sec_level = BT_SECURITY_MEDIUM;
2641         if (cp->io_cap == 0x03)
2642                 auth_type = HCI_AT_DEDICATED_BONDING;
2643         else
2644                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2645
2646         if (cp->addr.type == BDADDR_BREDR)
2647                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2648                                    cp->addr.type, sec_level, auth_type);
2649         else
2650                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2651                                    cp->addr.type, sec_level, auth_type);
2652
2653         if (IS_ERR(conn)) {
2654                 int status;
2655
2656                 if (PTR_ERR(conn) == -EBUSY)
2657                         status = MGMT_STATUS_BUSY;
2658                 else
2659                         status = MGMT_STATUS_CONNECT_FAILED;
2660
2661                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2662                                    status, &rp,
2663                                    sizeof(rp));
2664                 goto unlock;
2665         }
2666
2667         if (conn->connect_cfm_cb) {
2668                 hci_conn_drop(conn);
2669                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2670                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2671                 goto unlock;
2672         }
2673
2674         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2675         if (!cmd) {
2676                 err = -ENOMEM;
2677                 hci_conn_drop(conn);
2678                 goto unlock;
2679         }
2680
2681         /* For LE, just connecting isn't a proof that the pairing finished */
2682         if (cp->addr.type == BDADDR_BREDR)
2683                 conn->connect_cfm_cb = pairing_complete_cb;
2684         else
2685                 conn->connect_cfm_cb = le_connect_complete_cb;
2686
2687         conn->security_cfm_cb = pairing_complete_cb;
2688         conn->disconn_cfm_cb = pairing_complete_cb;
2689         conn->io_capability = cp->io_cap;
2690         cmd->user_data = conn;
2691
2692         if (conn->state == BT_CONNECTED &&
2693             hci_conn_security(conn, sec_level, auth_type))
2694                 pairing_complete(cmd, 0);
2695
2696         err = 0;
2697
2698 unlock:
2699         hci_dev_unlock(hdev);
2700         return err;
2701 }
2702
2703 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2704                               u16 len)
2705 {
2706         struct mgmt_addr_info *addr = data;
2707         struct pending_cmd *cmd;
2708         struct hci_conn *conn;
2709         int err;
2710
2711         BT_DBG("");
2712
2713         hci_dev_lock(hdev);
2714
2715         if (!hdev_is_powered(hdev)) {
2716                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2717                                  MGMT_STATUS_NOT_POWERED);
2718                 goto unlock;
2719         }
2720
2721         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2722         if (!cmd) {
2723                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2724                                  MGMT_STATUS_INVALID_PARAMS);
2725                 goto unlock;
2726         }
2727
2728         conn = cmd->user_data;
2729
2730         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2731                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2732                                  MGMT_STATUS_INVALID_PARAMS);
2733                 goto unlock;
2734         }
2735
2736         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2737
2738         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2739                            addr, sizeof(*addr));
2740 unlock:
2741         hci_dev_unlock(hdev);
2742         return err;
2743 }
2744
2745 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2746                              struct mgmt_addr_info *addr, u16 mgmt_op,
2747                              u16 hci_op, __le32 passkey)
2748 {
2749         struct pending_cmd *cmd;
2750         struct hci_conn *conn;
2751         int err;
2752
2753         hci_dev_lock(hdev);
2754
2755         if (!hdev_is_powered(hdev)) {
2756                 err = cmd_complete(sk, hdev->id, mgmt_op,
2757                                    MGMT_STATUS_NOT_POWERED, addr,
2758                                    sizeof(*addr));
2759                 goto done;
2760         }
2761
2762         if (addr->type == BDADDR_BREDR)
2763                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2764         else
2765                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2766
2767         if (!conn) {
2768                 err = cmd_complete(sk, hdev->id, mgmt_op,
2769                                    MGMT_STATUS_NOT_CONNECTED, addr,
2770                                    sizeof(*addr));
2771                 goto done;
2772         }
2773
2774         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2775                 /* Continue with pairing via SMP */
2776                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2777
2778                 if (!err)
2779                         err = cmd_complete(sk, hdev->id, mgmt_op,
2780                                            MGMT_STATUS_SUCCESS, addr,
2781                                            sizeof(*addr));
2782                 else
2783                         err = cmd_complete(sk, hdev->id, mgmt_op,
2784                                            MGMT_STATUS_FAILED, addr,
2785                                            sizeof(*addr));
2786
2787                 goto done;
2788         }
2789
2790         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2791         if (!cmd) {
2792                 err = -ENOMEM;
2793                 goto done;
2794         }
2795
2796         /* Continue with pairing via HCI */
2797         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2798                 struct hci_cp_user_passkey_reply cp;
2799
2800                 bacpy(&cp.bdaddr, &addr->bdaddr);
2801                 cp.passkey = passkey;
2802                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2803         } else
2804                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2805                                    &addr->bdaddr);
2806
2807         if (err < 0)
2808                 mgmt_pending_remove(cmd);
2809
2810 done:
2811         hci_dev_unlock(hdev);
2812         return err;
2813 }
2814
2815 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2816                               void *data, u16 len)
2817 {
2818         struct mgmt_cp_pin_code_neg_reply *cp = data;
2819
2820         BT_DBG("");
2821
2822         return user_pairing_resp(sk, hdev, &cp->addr,
2823                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2824                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2825 }
2826
2827 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2828                               u16 len)
2829 {
2830         struct mgmt_cp_user_confirm_reply *cp = data;
2831
2832         BT_DBG("");
2833
2834         if (len != sizeof(*cp))
2835                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2836                                   MGMT_STATUS_INVALID_PARAMS);
2837
2838         return user_pairing_resp(sk, hdev, &cp->addr,
2839                                  MGMT_OP_USER_CONFIRM_REPLY,
2840                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2841 }
2842
2843 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2844                                   void *data, u16 len)
2845 {
2846         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2847
2848         BT_DBG("");
2849
2850         return user_pairing_resp(sk, hdev, &cp->addr,
2851                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2852                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2853 }
2854
2855 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2856                               u16 len)
2857 {
2858         struct mgmt_cp_user_passkey_reply *cp = data;
2859
2860         BT_DBG("");
2861
2862         return user_pairing_resp(sk, hdev, &cp->addr,
2863                                  MGMT_OP_USER_PASSKEY_REPLY,
2864                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2865 }
2866
2867 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2868                                   void *data, u16 len)
2869 {
2870         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2871
2872         BT_DBG("");
2873
2874         return user_pairing_resp(sk, hdev, &cp->addr,
2875                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2876                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2877 }
2878
2879 static void update_name(struct hci_request *req)
2880 {
2881         struct hci_dev *hdev = req->hdev;
2882         struct hci_cp_write_local_name cp;
2883
2884         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2885
2886         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2887 }
2888
2889 static void set_name_complete(struct hci_dev *hdev, u8 status)
2890 {
2891         struct mgmt_cp_set_local_name *cp;
2892         struct pending_cmd *cmd;
2893
2894         BT_DBG("status 0x%02x", status);
2895
2896         hci_dev_lock(hdev);
2897
2898         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2899         if (!cmd)
2900                 goto unlock;
2901
2902         cp = cmd->param;
2903
2904         if (status)
2905                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2906                            mgmt_status(status));
2907         else
2908                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2909                              cp, sizeof(*cp));
2910
2911         mgmt_pending_remove(cmd);
2912
2913 unlock:
2914         hci_dev_unlock(hdev);
2915 }
2916
2917 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2918                           u16 len)
2919 {
2920         struct mgmt_cp_set_local_name *cp = data;
2921         struct pending_cmd *cmd;
2922         struct hci_request req;
2923         int err;
2924
2925         BT_DBG("");
2926
2927         hci_dev_lock(hdev);
2928
2929         /* If the old values are the same as the new ones just return a
2930          * direct command complete event.
2931          */
2932         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2933             !memcmp(hdev->short_name, cp->short_name,
2934                     sizeof(hdev->short_name))) {
2935                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2936                                    data, len);
2937                 goto failed;
2938         }
2939
2940         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2941
2942         if (!hdev_is_powered(hdev)) {
2943                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2944
2945                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2946                                    data, len);
2947                 if (err < 0)
2948                         goto failed;
2949
2950                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2951                                  sk);
2952
2953                 goto failed;
2954         }
2955
2956         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2957         if (!cmd) {
2958                 err = -ENOMEM;
2959                 goto failed;
2960         }
2961
2962         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2963
2964         hci_req_init(&req, hdev);
2965
2966         if (lmp_bredr_capable(hdev)) {
2967                 update_name(&req);
2968                 update_eir(&req);
2969         }
2970
2971         /* The name is stored in the scan response data and so
2972          * no need to udpate the advertising data here.
2973          */
2974         if (lmp_le_capable(hdev))
2975                 update_scan_rsp_data(&req);
2976
2977         err = hci_req_run(&req, set_name_complete);
2978         if (err < 0)
2979                 mgmt_pending_remove(cmd);
2980
2981 failed:
2982         hci_dev_unlock(hdev);
2983         return err;
2984 }
2985
2986 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2987                                void *data, u16 data_len)
2988 {
2989         struct pending_cmd *cmd;
2990         int err;
2991
2992         BT_DBG("%s", hdev->name);
2993
2994         hci_dev_lock(hdev);
2995
2996         if (!hdev_is_powered(hdev)) {
2997                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2998                                  MGMT_STATUS_NOT_POWERED);
2999                 goto unlock;
3000         }
3001
3002         if (!lmp_ssp_capable(hdev)) {
3003                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3004                                  MGMT_STATUS_NOT_SUPPORTED);
3005                 goto unlock;
3006         }
3007
3008         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3009                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3010                                  MGMT_STATUS_BUSY);
3011                 goto unlock;
3012         }
3013
3014         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3015         if (!cmd) {
3016                 err = -ENOMEM;
3017                 goto unlock;
3018         }
3019
3020         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3021         if (err < 0)
3022                 mgmt_pending_remove(cmd);
3023
3024 unlock:
3025         hci_dev_unlock(hdev);
3026         return err;
3027 }
3028
3029 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3030                                void *data, u16 len)
3031 {
3032         struct mgmt_cp_add_remote_oob_data *cp = data;
3033         u8 status;
3034         int err;
3035
3036         BT_DBG("%s ", hdev->name);
3037
3038         hci_dev_lock(hdev);
3039
3040         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
3041                                       cp->randomizer);
3042         if (err < 0)
3043                 status = MGMT_STATUS_FAILED;
3044         else
3045                 status = MGMT_STATUS_SUCCESS;
3046
3047         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3048                            &cp->addr, sizeof(cp->addr));
3049
3050         hci_dev_unlock(hdev);
3051         return err;
3052 }
3053
3054 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3055                                   void *data, u16 len)
3056 {
3057         struct mgmt_cp_remove_remote_oob_data *cp = data;
3058         u8 status;
3059         int err;
3060
3061         BT_DBG("%s", hdev->name);
3062
3063         hci_dev_lock(hdev);
3064
3065         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
3066         if (err < 0)
3067                 status = MGMT_STATUS_INVALID_PARAMS;
3068         else
3069                 status = MGMT_STATUS_SUCCESS;
3070
3071         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3072                            status, &cp->addr, sizeof(cp->addr));
3073
3074         hci_dev_unlock(hdev);
3075         return err;
3076 }
3077
3078 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3079 {
3080         struct pending_cmd *cmd;
3081         u8 type;
3082         int err;
3083
3084         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3085
3086         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3087         if (!cmd)
3088                 return -ENOENT;
3089
3090         type = hdev->discovery.type;
3091
3092         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3093                            &type, sizeof(type));
3094         mgmt_pending_remove(cmd);
3095
3096         return err;
3097 }
3098
3099 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3100 {
3101         BT_DBG("status %d", status);
3102
3103         if (status) {
3104                 hci_dev_lock(hdev);
3105                 mgmt_start_discovery_failed(hdev, status);
3106                 hci_dev_unlock(hdev);
3107                 return;
3108         }
3109
3110         hci_dev_lock(hdev);
3111         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3112         hci_dev_unlock(hdev);
3113
3114         switch (hdev->discovery.type) {
3115         case DISCOV_TYPE_LE:
3116                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
3117                                    DISCOV_LE_TIMEOUT);
3118                 break;
3119
3120         case DISCOV_TYPE_INTERLEAVED:
3121                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
3122                                    DISCOV_INTERLEAVED_TIMEOUT);
3123                 break;
3124
3125         case DISCOV_TYPE_BREDR:
3126                 break;
3127
3128         default:
3129                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3130         }
3131 }
3132
3133 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3134                            void *data, u16 len)
3135 {
3136         struct mgmt_cp_start_discovery *cp = data;
3137         struct pending_cmd *cmd;
3138         struct hci_cp_le_set_scan_param param_cp;
3139         struct hci_cp_le_set_scan_enable enable_cp;
3140         struct hci_cp_inquiry inq_cp;
3141         struct hci_request req;
3142         /* General inquiry access code (GIAC) */
3143         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3144         u8 status;
3145         int err;
3146
3147         BT_DBG("%s", hdev->name);
3148
3149         hci_dev_lock(hdev);
3150
3151         if (!hdev_is_powered(hdev)) {
3152                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3153                                  MGMT_STATUS_NOT_POWERED);
3154                 goto failed;
3155         }
3156
3157         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3158                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3159                                  MGMT_STATUS_BUSY);
3160                 goto failed;
3161         }
3162
3163         if (hdev->discovery.state != DISCOVERY_STOPPED) {
3164                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3165                                  MGMT_STATUS_BUSY);
3166                 goto failed;
3167         }
3168
3169         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3170         if (!cmd) {
3171                 err = -ENOMEM;
3172                 goto failed;
3173         }
3174
3175         hdev->discovery.type = cp->type;
3176
3177         hci_req_init(&req, hdev);
3178
3179         switch (hdev->discovery.type) {
3180         case DISCOV_TYPE_BREDR:
3181                 status = mgmt_bredr_support(hdev);
3182                 if (status) {
3183                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3184                                          status);
3185                         mgmt_pending_remove(cmd);
3186                         goto failed;
3187                 }
3188
3189                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3190                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3191                                          MGMT_STATUS_BUSY);
3192                         mgmt_pending_remove(cmd);
3193                         goto failed;
3194                 }
3195
3196                 hci_inquiry_cache_flush(hdev);
3197
3198                 memset(&inq_cp, 0, sizeof(inq_cp));
3199                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3200                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3201                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3202                 break;
3203
3204         case DISCOV_TYPE_LE:
3205         case DISCOV_TYPE_INTERLEAVED:
3206                 status = mgmt_le_support(hdev);
3207                 if (status) {
3208                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3209                                          status);
3210                         mgmt_pending_remove(cmd);
3211                         goto failed;
3212                 }
3213
3214                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3215                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3216                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3217                                          MGMT_STATUS_NOT_SUPPORTED);
3218                         mgmt_pending_remove(cmd);
3219                         goto failed;
3220                 }
3221
3222                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3223                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3224                                          MGMT_STATUS_REJECTED);
3225                         mgmt_pending_remove(cmd);
3226                         goto failed;
3227                 }
3228
3229                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
3230                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3231                                          MGMT_STATUS_BUSY);
3232                         mgmt_pending_remove(cmd);
3233                         goto failed;
3234                 }
3235
3236                 memset(&param_cp, 0, sizeof(param_cp));
3237                 param_cp.type = LE_SCAN_ACTIVE;
3238                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3239                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3240                 if (bacmp(&hdev->bdaddr, BDADDR_ANY))
3241                         param_cp.own_address_type = ADDR_LE_DEV_PUBLIC;
3242                 else
3243                         param_cp.own_address_type = ADDR_LE_DEV_RANDOM;
3244                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3245                             &param_cp);
3246
3247                 memset(&enable_cp, 0, sizeof(enable_cp));
3248                 enable_cp.enable = LE_SCAN_ENABLE;
3249                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3250                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3251                             &enable_cp);
3252                 break;
3253
3254         default:
3255                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3256                                  MGMT_STATUS_INVALID_PARAMS);
3257                 mgmt_pending_remove(cmd);
3258                 goto failed;
3259         }
3260
3261         err = hci_req_run(&req, start_discovery_complete);
3262         if (err < 0)
3263                 mgmt_pending_remove(cmd);
3264         else
3265                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3266
3267 failed:
3268         hci_dev_unlock(hdev);
3269         return err;
3270 }
3271
3272 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3273 {
3274         struct pending_cmd *cmd;
3275         int err;
3276
3277         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3278         if (!cmd)
3279                 return -ENOENT;
3280
3281         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3282                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3283         mgmt_pending_remove(cmd);
3284
3285         return err;
3286 }
3287
3288 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3289 {
3290         BT_DBG("status %d", status);
3291
3292         hci_dev_lock(hdev);
3293
3294         if (status) {
3295                 mgmt_stop_discovery_failed(hdev, status);
3296                 goto unlock;
3297         }
3298
3299         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3300
3301 unlock:
3302         hci_dev_unlock(hdev);
3303 }
3304
3305 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3306                           u16 len)
3307 {
3308         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3309         struct pending_cmd *cmd;
3310         struct hci_cp_remote_name_req_cancel cp;
3311         struct inquiry_entry *e;
3312         struct hci_request req;
3313         struct hci_cp_le_set_scan_enable enable_cp;
3314         int err;
3315
3316         BT_DBG("%s", hdev->name);
3317
3318         hci_dev_lock(hdev);
3319
3320         if (!hci_discovery_active(hdev)) {
3321                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3322                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3323                                    sizeof(mgmt_cp->type));
3324                 goto unlock;
3325         }
3326
3327         if (hdev->discovery.type != mgmt_cp->type) {
3328                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3329                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3330                                    sizeof(mgmt_cp->type));
3331                 goto unlock;
3332         }
3333
3334         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3335         if (!cmd) {
3336                 err = -ENOMEM;
3337                 goto unlock;
3338         }
3339
3340         hci_req_init(&req, hdev);
3341
3342         switch (hdev->discovery.state) {
3343         case DISCOVERY_FINDING:
3344                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3345                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3346                 } else {
3347                         cancel_delayed_work(&hdev->le_scan_disable);
3348
3349                         memset(&enable_cp, 0, sizeof(enable_cp));
3350                         enable_cp.enable = LE_SCAN_DISABLE;
3351                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
3352                                     sizeof(enable_cp), &enable_cp);
3353                 }
3354
3355                 break;
3356
3357         case DISCOVERY_RESOLVING:
3358                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3359                                                      NAME_PENDING);
3360                 if (!e) {
3361                         mgmt_pending_remove(cmd);
3362                         err = cmd_complete(sk, hdev->id,
3363                                            MGMT_OP_STOP_DISCOVERY, 0,
3364                                            &mgmt_cp->type,
3365                                            sizeof(mgmt_cp->type));
3366                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3367                         goto unlock;
3368                 }
3369
3370                 bacpy(&cp.bdaddr, &e->data.bdaddr);
3371                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3372                             &cp);
3373
3374                 break;
3375
3376         default:
3377                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
3378
3379                 mgmt_pending_remove(cmd);
3380                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3381                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
3382                                    sizeof(mgmt_cp->type));
3383                 goto unlock;
3384         }
3385
3386         err = hci_req_run(&req, stop_discovery_complete);
3387         if (err < 0)
3388                 mgmt_pending_remove(cmd);
3389         else
3390                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3391
3392 unlock:
3393         hci_dev_unlock(hdev);
3394         return err;
3395 }
3396
3397 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3398                         u16 len)
3399 {
3400         struct mgmt_cp_confirm_name *cp = data;
3401         struct inquiry_entry *e;
3402         int err;
3403
3404         BT_DBG("%s", hdev->name);
3405
3406         hci_dev_lock(hdev);
3407
3408         if (!hci_discovery_active(hdev)) {
3409                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3410                                  MGMT_STATUS_FAILED);
3411                 goto failed;
3412         }
3413
3414         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3415         if (!e) {
3416                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3417                                  MGMT_STATUS_INVALID_PARAMS);
3418                 goto failed;
3419         }
3420
3421         if (cp->name_known) {
3422                 e->name_state = NAME_KNOWN;
3423                 list_del(&e->list);
3424         } else {
3425                 e->name_state = NAME_NEEDED;
3426                 hci_inquiry_cache_update_resolve(hdev, e);
3427         }
3428
3429         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3430                            sizeof(cp->addr));
3431
3432 failed:
3433         hci_dev_unlock(hdev);
3434         return err;
3435 }
3436
3437 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3438                         u16 len)
3439 {
3440         struct mgmt_cp_block_device *cp = data;
3441         u8 status;
3442         int err;
3443
3444         BT_DBG("%s", hdev->name);
3445
3446         if (!bdaddr_type_is_valid(cp->addr.type))
3447                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3448                                     MGMT_STATUS_INVALID_PARAMS,
3449                                     &cp->addr, sizeof(cp->addr));
3450
3451         hci_dev_lock(hdev);
3452
3453         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3454         if (err < 0)
3455                 status = MGMT_STATUS_FAILED;
3456         else
3457                 status = MGMT_STATUS_SUCCESS;
3458
3459         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3460                            &cp->addr, sizeof(cp->addr));
3461
3462         hci_dev_unlock(hdev);
3463
3464         return err;
3465 }
3466
3467 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3468                           u16 len)
3469 {
3470         struct mgmt_cp_unblock_device *cp = data;
3471         u8 status;
3472         int err;
3473
3474         BT_DBG("%s", hdev->name);
3475
3476         if (!bdaddr_type_is_valid(cp->addr.type))
3477                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3478                                     MGMT_STATUS_INVALID_PARAMS,
3479                                     &cp->addr, sizeof(cp->addr));
3480
3481         hci_dev_lock(hdev);
3482
3483         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3484         if (err < 0)
3485                 status = MGMT_STATUS_INVALID_PARAMS;
3486         else
3487                 status = MGMT_STATUS_SUCCESS;
3488
3489         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3490                            &cp->addr, sizeof(cp->addr));
3491
3492         hci_dev_unlock(hdev);
3493
3494         return err;
3495 }
3496
3497 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3498                          u16 len)
3499 {
3500         struct mgmt_cp_set_device_id *cp = data;
3501         struct hci_request req;
3502         int err;
3503         __u16 source;
3504
3505         BT_DBG("%s", hdev->name);
3506
3507         source = __le16_to_cpu(cp->source);
3508
3509         if (source > 0x0002)
3510                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3511                                   MGMT_STATUS_INVALID_PARAMS);
3512
3513         hci_dev_lock(hdev);
3514
3515         hdev->devid_source = source;
3516         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3517         hdev->devid_product = __le16_to_cpu(cp->product);
3518         hdev->devid_version = __le16_to_cpu(cp->version);
3519
3520         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3521
3522         hci_req_init(&req, hdev);
3523         update_eir(&req);
3524         hci_req_run(&req, NULL);
3525
3526         hci_dev_unlock(hdev);
3527
3528         return err;
3529 }
3530
3531 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3532 {
3533         struct cmd_lookup match = { NULL, hdev };
3534
3535         if (status) {
3536                 u8 mgmt_err = mgmt_status(status);
3537
3538                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3539                                      cmd_status_rsp, &mgmt_err);
3540                 return;
3541         }
3542
3543         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3544                              &match);
3545
3546         new_settings(hdev, match.sk);
3547
3548         if (match.sk)
3549                 sock_put(match.sk);
3550 }
3551
3552 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3553                            u16 len)
3554 {
3555         struct mgmt_mode *cp = data;
3556         struct pending_cmd *cmd;
3557         struct hci_request req;
3558         u8 val, enabled, status;
3559         int err;
3560
3561         BT_DBG("request for %s", hdev->name);
3562
3563         status = mgmt_le_support(hdev);
3564         if (status)
3565                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3566                                   status);
3567
3568         if (cp->val != 0x00 && cp->val != 0x01)
3569                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3570                                   MGMT_STATUS_INVALID_PARAMS);
3571
3572         hci_dev_lock(hdev);
3573
3574         val = !!cp->val;
3575         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3576
3577         /* The following conditions are ones which mean that we should
3578          * not do any HCI communication but directly send a mgmt
3579          * response to user space (after toggling the flag if
3580          * necessary).
3581          */
3582         if (!hdev_is_powered(hdev) || val == enabled ||
3583             hci_conn_num(hdev, LE_LINK) > 0) {
3584                 bool changed = false;
3585
3586                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3587                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3588                         changed = true;
3589                 }
3590
3591                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3592                 if (err < 0)
3593                         goto unlock;
3594
3595                 if (changed)
3596                         err = new_settings(hdev, sk);
3597
3598                 goto unlock;
3599         }
3600
3601         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3602             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3603                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3604                                  MGMT_STATUS_BUSY);
3605                 goto unlock;
3606         }
3607
3608         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3609         if (!cmd) {
3610                 err = -ENOMEM;
3611                 goto unlock;
3612         }
3613
3614         hci_req_init(&req, hdev);
3615
3616         if (val)
3617                 enable_advertising(&req);
3618         else
3619                 disable_advertising(&req);
3620
3621         err = hci_req_run(&req, set_advertising_complete);
3622         if (err < 0)
3623                 mgmt_pending_remove(cmd);
3624
3625 unlock:
3626         hci_dev_unlock(hdev);
3627         return err;
3628 }
3629
3630 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3631                               void *data, u16 len)
3632 {
3633         struct mgmt_cp_set_static_address *cp = data;
3634         int err;
3635
3636         BT_DBG("%s", hdev->name);
3637
3638         if (!lmp_le_capable(hdev))
3639                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3640                                   MGMT_STATUS_NOT_SUPPORTED);
3641
3642         if (hdev_is_powered(hdev))
3643                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3644                                   MGMT_STATUS_REJECTED);
3645
3646         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3647                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3648                         return cmd_status(sk, hdev->id,
3649                                           MGMT_OP_SET_STATIC_ADDRESS,
3650                                           MGMT_STATUS_INVALID_PARAMS);
3651
3652                 /* Two most significant bits shall be set */
3653                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3654                         return cmd_status(sk, hdev->id,
3655                                           MGMT_OP_SET_STATIC_ADDRESS,
3656                                           MGMT_STATUS_INVALID_PARAMS);
3657         }
3658
3659         hci_dev_lock(hdev);
3660
3661         bacpy(&hdev->static_addr, &cp->bdaddr);
3662
3663         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3664
3665         hci_dev_unlock(hdev);
3666
3667         return err;
3668 }
3669
3670 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
3671                            void *data, u16 len)
3672 {
3673         struct mgmt_cp_set_scan_params *cp = data;
3674         __u16 interval, window;
3675         int err;
3676
3677         BT_DBG("%s", hdev->name);
3678
3679         if (!lmp_le_capable(hdev))
3680                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3681                                   MGMT_STATUS_NOT_SUPPORTED);
3682
3683         interval = __le16_to_cpu(cp->interval);
3684
3685         if (interval < 0x0004 || interval > 0x4000)
3686                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3687                                   MGMT_STATUS_INVALID_PARAMS);
3688
3689         window = __le16_to_cpu(cp->window);
3690
3691         if (window < 0x0004 || window > 0x4000)
3692                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3693                                   MGMT_STATUS_INVALID_PARAMS);
3694
3695         if (window > interval)
3696                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3697                                   MGMT_STATUS_INVALID_PARAMS);
3698
3699         hci_dev_lock(hdev);
3700
3701         hdev->le_scan_interval = interval;
3702         hdev->le_scan_window = window;
3703
3704         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
3705
3706         hci_dev_unlock(hdev);
3707
3708         return err;
3709 }
3710
3711 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3712 {
3713         struct pending_cmd *cmd;
3714
3715         BT_DBG("status 0x%02x", status);
3716
3717         hci_dev_lock(hdev);
3718
3719         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3720         if (!cmd)
3721                 goto unlock;
3722
3723         if (status) {
3724                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3725                            mgmt_status(status));
3726         } else {
3727                 struct mgmt_mode *cp = cmd->param;
3728
3729                 if (cp->val)
3730                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3731                 else
3732                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3733
3734                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3735                 new_settings(hdev, cmd->sk);
3736         }
3737
3738         mgmt_pending_remove(cmd);
3739
3740 unlock:
3741         hci_dev_unlock(hdev);
3742 }
3743
3744 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3745                                 void *data, u16 len)
3746 {
3747         struct mgmt_mode *cp = data;
3748         struct pending_cmd *cmd;
3749         struct hci_request req;
3750         int err;
3751
3752         BT_DBG("%s", hdev->name);
3753
3754         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
3755             hdev->hci_ver < BLUETOOTH_VER_1_2)
3756                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3757                                   MGMT_STATUS_NOT_SUPPORTED);
3758
3759         if (cp->val != 0x00 && cp->val != 0x01)
3760                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3761                                   MGMT_STATUS_INVALID_PARAMS);
3762
3763         if (!hdev_is_powered(hdev))
3764                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3765                                   MGMT_STATUS_NOT_POWERED);
3766
3767         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3768                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3769                                   MGMT_STATUS_REJECTED);
3770
3771         hci_dev_lock(hdev);
3772
3773         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3774                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3775                                  MGMT_STATUS_BUSY);
3776                 goto unlock;
3777         }
3778
3779         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3780                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3781                                         hdev);
3782                 goto unlock;
3783         }
3784
3785         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3786                                data, len);
3787         if (!cmd) {
3788                 err = -ENOMEM;
3789                 goto unlock;
3790         }
3791
3792         hci_req_init(&req, hdev);
3793
3794         write_fast_connectable(&req, cp->val);
3795
3796         err = hci_req_run(&req, fast_connectable_complete);
3797         if (err < 0) {
3798                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3799                                  MGMT_STATUS_FAILED);
3800                 mgmt_pending_remove(cmd);
3801         }
3802
3803 unlock:
3804         hci_dev_unlock(hdev);
3805
3806         return err;
3807 }
3808
3809 static void set_bredr_scan(struct hci_request *req)
3810 {
3811         struct hci_dev *hdev = req->hdev;
3812         u8 scan = 0;
3813
3814         /* Ensure that fast connectable is disabled. This function will
3815          * not do anything if the page scan parameters are already what
3816          * they should be.
3817          */
3818         write_fast_connectable(req, false);
3819
3820         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3821                 scan |= SCAN_PAGE;
3822         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3823                 scan |= SCAN_INQUIRY;
3824
3825         if (scan)
3826                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3827 }
3828
3829 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
3830 {
3831         struct pending_cmd *cmd;
3832
3833         BT_DBG("status 0x%02x", status);
3834
3835         hci_dev_lock(hdev);
3836
3837         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
3838         if (!cmd)
3839                 goto unlock;
3840
3841         if (status) {
3842                 u8 mgmt_err = mgmt_status(status);
3843
3844                 /* We need to restore the flag if related HCI commands
3845                  * failed.
3846                  */
3847                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3848
3849                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
3850         } else {
3851                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
3852                 new_settings(hdev, cmd->sk);
3853         }
3854
3855         mgmt_pending_remove(cmd);
3856
3857 unlock:
3858         hci_dev_unlock(hdev);
3859 }
3860
3861 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3862 {
3863         struct mgmt_mode *cp = data;
3864         struct pending_cmd *cmd;
3865         struct hci_request req;
3866         int err;
3867
3868         BT_DBG("request for %s", hdev->name);
3869
3870         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
3871                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3872                                   MGMT_STATUS_NOT_SUPPORTED);
3873
3874         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3875                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3876                                   MGMT_STATUS_REJECTED);
3877
3878         if (cp->val != 0x00 && cp->val != 0x01)
3879                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3880                                   MGMT_STATUS_INVALID_PARAMS);
3881
3882         hci_dev_lock(hdev);
3883
3884         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3885                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3886                 goto unlock;
3887         }
3888
3889         if (!hdev_is_powered(hdev)) {
3890                 if (!cp->val) {
3891                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
3892                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
3893                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3894                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3895                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3896                 }
3897
3898                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3899
3900                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3901                 if (err < 0)
3902                         goto unlock;
3903
3904                 err = new_settings(hdev, sk);
3905                 goto unlock;
3906         }
3907
3908         /* Reject disabling when powered on */
3909         if (!cp->val) {
3910                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3911                                  MGMT_STATUS_REJECTED);
3912                 goto unlock;
3913         }
3914
3915         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
3916                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3917                                  MGMT_STATUS_BUSY);
3918                 goto unlock;
3919         }
3920
3921         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
3922         if (!cmd) {
3923                 err = -ENOMEM;
3924                 goto unlock;
3925         }
3926
3927         /* We need to flip the bit already here so that update_ad
3928          * generates the correct flags.
3929          */
3930         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3931
3932         hci_req_init(&req, hdev);
3933
3934         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3935                 set_bredr_scan(&req);
3936
3937         /* Since only the advertising data flags will change, there
3938          * is no need to update the scan response data.
3939          */
3940         update_ad(&req);
3941
3942         err = hci_req_run(&req, set_bredr_complete);
3943         if (err < 0)
3944                 mgmt_pending_remove(cmd);
3945
3946 unlock:
3947         hci_dev_unlock(hdev);
3948         return err;
3949 }
3950
3951 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3952 {
3953         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3954                 return false;
3955         if (key->master != 0x00 && key->master != 0x01)
3956                 return false;
3957         if (!bdaddr_type_is_le(key->addr.type))
3958                 return false;
3959         return true;
3960 }
3961
3962 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3963                                void *cp_data, u16 len)
3964 {
3965         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3966         u16 key_count, expected_len;
3967         int i, err;
3968
3969         BT_DBG("request for %s", hdev->name);
3970
3971         if (!lmp_le_capable(hdev))
3972                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3973                                   MGMT_STATUS_NOT_SUPPORTED);
3974
3975         key_count = __le16_to_cpu(cp->key_count);
3976
3977         expected_len = sizeof(*cp) + key_count *
3978                                         sizeof(struct mgmt_ltk_info);
3979         if (expected_len != len) {
3980                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3981                        len, expected_len);
3982                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3983                                   MGMT_STATUS_INVALID_PARAMS);
3984         }
3985
3986         BT_DBG("%s key_count %u", hdev->name, key_count);
3987
3988         for (i = 0; i < key_count; i++) {
3989                 struct mgmt_ltk_info *key = &cp->keys[i];
3990
3991                 if (!ltk_is_valid(key))
3992                         return cmd_status(sk, hdev->id,
3993                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3994                                           MGMT_STATUS_INVALID_PARAMS);
3995         }
3996
3997         hci_dev_lock(hdev);
3998
3999         hci_smp_ltks_clear(hdev);
4000
4001         for (i = 0; i < key_count; i++) {
4002                 struct mgmt_ltk_info *key = &cp->keys[i];
4003                 u8 type, addr_type;
4004
4005                 if (key->addr.type == BDADDR_LE_PUBLIC)
4006                         addr_type = ADDR_LE_DEV_PUBLIC;
4007                 else
4008                         addr_type = ADDR_LE_DEV_RANDOM;
4009
4010                 if (key->master)
4011                         type = HCI_SMP_LTK;
4012                 else
4013                         type = HCI_SMP_LTK_SLAVE;
4014
4015                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type,
4016                             type, 0, key->authenticated, key->val,
4017                             key->enc_size, key->ediv, key->rand);
4018         }
4019
4020         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4021                            NULL, 0);
4022
4023         hci_dev_unlock(hdev);
4024
4025         return err;
4026 }
4027
4028 static const struct mgmt_handler {
4029         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
4030                      u16 data_len);
4031         bool var_len;
4032         size_t data_len;
4033 } mgmt_handlers[] = {
4034         { NULL }, /* 0x0000 (no command) */
4035         { read_version,           false, MGMT_READ_VERSION_SIZE },
4036         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
4037         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
4038         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
4039         { set_powered,            false, MGMT_SETTING_SIZE },
4040         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
4041         { set_connectable,        false, MGMT_SETTING_SIZE },
4042         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
4043         { set_pairable,           false, MGMT_SETTING_SIZE },
4044         { set_link_security,      false, MGMT_SETTING_SIZE },
4045         { set_ssp,                false, MGMT_SETTING_SIZE },
4046         { set_hs,                 false, MGMT_SETTING_SIZE },
4047         { set_le,                 false, MGMT_SETTING_SIZE },
4048         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
4049         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
4050         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
4051         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
4052         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
4053         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
4054         { disconnect,             false, MGMT_DISCONNECT_SIZE },
4055         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
4056         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
4057         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
4058         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
4059         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
4060         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
4061         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
4062         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
4063         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
4064         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
4065         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
4066         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
4067         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
4068         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
4069         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
4070         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
4071         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
4072         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
4073         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
4074         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
4075         { set_advertising,        false, MGMT_SETTING_SIZE },
4076         { set_bredr,              false, MGMT_SETTING_SIZE },
4077         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
4078         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
4079 };
4080
4081
4082 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
4083 {
4084         void *buf;
4085         u8 *cp;
4086         struct mgmt_hdr *hdr;
4087         u16 opcode, index, len;
4088         struct hci_dev *hdev = NULL;
4089         const struct mgmt_handler *handler;
4090         int err;
4091
4092         BT_DBG("got %zu bytes", msglen);
4093
4094         if (msglen < sizeof(*hdr))
4095                 return -EINVAL;
4096
4097         buf = kmalloc(msglen, GFP_KERNEL);
4098         if (!buf)
4099                 return -ENOMEM;
4100
4101         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
4102                 err = -EFAULT;
4103                 goto done;
4104         }
4105
4106         hdr = buf;
4107         opcode = __le16_to_cpu(hdr->opcode);
4108         index = __le16_to_cpu(hdr->index);
4109         len = __le16_to_cpu(hdr->len);
4110
4111         if (len != msglen - sizeof(*hdr)) {
4112                 err = -EINVAL;
4113                 goto done;
4114         }
4115
4116         if (index != MGMT_INDEX_NONE) {
4117                 hdev = hci_dev_get(index);
4118                 if (!hdev) {
4119                         err = cmd_status(sk, index, opcode,
4120                                          MGMT_STATUS_INVALID_INDEX);
4121                         goto done;
4122                 }
4123
4124                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
4125                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
4126                         err = cmd_status(sk, index, opcode,
4127                                          MGMT_STATUS_INVALID_INDEX);
4128                         goto done;
4129                 }
4130         }
4131
4132         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
4133             mgmt_handlers[opcode].func == NULL) {
4134                 BT_DBG("Unknown op %u", opcode);
4135                 err = cmd_status(sk, index, opcode,
4136                                  MGMT_STATUS_UNKNOWN_COMMAND);
4137                 goto done;
4138         }
4139
4140         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
4141             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
4142                 err = cmd_status(sk, index, opcode,
4143                                  MGMT_STATUS_INVALID_INDEX);
4144                 goto done;
4145         }
4146
4147         handler = &mgmt_handlers[opcode];
4148
4149         if ((handler->var_len && len < handler->data_len) ||
4150             (!handler->var_len && len != handler->data_len)) {
4151                 err = cmd_status(sk, index, opcode,
4152                                  MGMT_STATUS_INVALID_PARAMS);
4153                 goto done;
4154         }
4155
4156         if (hdev)
4157                 mgmt_init_hdev(sk, hdev);
4158
4159         cp = buf + sizeof(*hdr);
4160
4161         err = handler->func(sk, hdev, cp, len);
4162         if (err < 0)
4163                 goto done;
4164
4165         err = msglen;
4166
4167 done:
4168         if (hdev)
4169                 hci_dev_put(hdev);
4170
4171         kfree(buf);
4172         return err;
4173 }
4174
4175 void mgmt_index_added(struct hci_dev *hdev)
4176 {
4177         if (hdev->dev_type != HCI_BREDR)
4178                 return;
4179
4180         mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
4181 }
4182
4183 void mgmt_index_removed(struct hci_dev *hdev)
4184 {
4185         u8 status = MGMT_STATUS_INVALID_INDEX;
4186
4187         if (hdev->dev_type != HCI_BREDR)
4188                 return;
4189
4190         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
4191
4192         mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
4193 }
4194
4195 static void powered_complete(struct hci_dev *hdev, u8 status)
4196 {
4197         struct cmd_lookup match = { NULL, hdev };
4198
4199         BT_DBG("status 0x%02x", status);
4200
4201         hci_dev_lock(hdev);
4202
4203         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
4204
4205         new_settings(hdev, match.sk);
4206
4207         hci_dev_unlock(hdev);
4208
4209         if (match.sk)
4210                 sock_put(match.sk);
4211 }
4212
4213 static int powered_update_hci(struct hci_dev *hdev)
4214 {
4215         struct hci_request req;
4216         u8 link_sec;
4217
4218         hci_req_init(&req, hdev);
4219
4220         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
4221             !lmp_host_ssp_capable(hdev)) {
4222                 u8 ssp = 1;
4223
4224                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
4225         }
4226
4227         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
4228             lmp_bredr_capable(hdev)) {
4229                 struct hci_cp_write_le_host_supported cp;
4230
4231                 cp.le = 1;
4232                 cp.simul = lmp_le_br_capable(hdev);
4233
4234                 /* Check first if we already have the right
4235                  * host state (host features set)
4236                  */
4237                 if (cp.le != lmp_host_le_capable(hdev) ||
4238                     cp.simul != lmp_host_le_br_capable(hdev))
4239                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
4240                                     sizeof(cp), &cp);
4241         }
4242
4243         if (lmp_le_capable(hdev)) {
4244                 /* Set random address to static address if configured */
4245                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
4246                         hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
4247                                     &hdev->static_addr);
4248
4249                 /* Make sure the controller has a good default for
4250                  * advertising data. This also applies to the case
4251                  * where BR/EDR was toggled during the AUTO_OFF phase.
4252                  */
4253                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
4254                         update_ad(&req);
4255                         update_scan_rsp_data(&req);
4256                 }
4257
4258                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
4259                         enable_advertising(&req);
4260         }
4261
4262         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4263         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
4264                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
4265                             sizeof(link_sec), &link_sec);
4266
4267         if (lmp_bredr_capable(hdev)) {
4268                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
4269                         set_bredr_scan(&req);
4270                 update_class(&req);
4271                 update_name(&req);
4272                 update_eir(&req);
4273         }
4274
4275         return hci_req_run(&req, powered_complete);
4276 }
4277
4278 int mgmt_powered(struct hci_dev *hdev, u8 powered)
4279 {
4280         struct cmd_lookup match = { NULL, hdev };
4281         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
4282         u8 zero_cod[] = { 0, 0, 0 };
4283         int err;
4284
4285         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
4286                 return 0;
4287
4288         if (powered) {
4289                 if (powered_update_hci(hdev) == 0)
4290                         return 0;
4291
4292                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
4293                                      &match);
4294                 goto new_settings;
4295         }
4296
4297         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
4298         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
4299
4300         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
4301                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
4302                            zero_cod, sizeof(zero_cod), NULL);
4303
4304 new_settings:
4305         err = new_settings(hdev, match.sk);
4306
4307         if (match.sk)
4308                 sock_put(match.sk);
4309
4310         return err;
4311 }
4312
4313 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
4314 {
4315         struct pending_cmd *cmd;
4316         u8 status;
4317
4318         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
4319         if (!cmd)
4320                 return;
4321
4322         if (err == -ERFKILL)
4323                 status = MGMT_STATUS_RFKILLED;
4324         else
4325                 status = MGMT_STATUS_FAILED;
4326
4327         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
4328
4329         mgmt_pending_remove(cmd);
4330 }
4331
4332 void mgmt_discoverable_timeout(struct hci_dev *hdev)
4333 {
4334         struct hci_request req;
4335         u8 scan = SCAN_PAGE;
4336
4337         hci_dev_lock(hdev);
4338
4339         /* When discoverable timeout triggers, then just make sure
4340          * the limited discoverable flag is cleared. Even in the case
4341          * of a timeout triggered from general discoverable, it is
4342          * safe to unconditionally clear the flag.
4343          */
4344         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
4345
4346         hci_req_init(&req, hdev);
4347         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
4348         update_class(&req);
4349         hci_req_run(&req, NULL);
4350
4351         hdev->discov_timeout = 0;
4352
4353         hci_dev_unlock(hdev);
4354 }
4355
4356 void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
4357 {
4358         bool changed;
4359
4360         /* Nothing needed here if there's a pending command since that
4361          * commands request completion callback takes care of everything
4362          * necessary.
4363          */
4364         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
4365                 return;
4366
4367         if (discoverable)
4368                 changed = !test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4369         else
4370                 changed = test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4371
4372         if (changed)
4373                 new_settings(hdev, NULL);
4374 }
4375
4376 void mgmt_connectable(struct hci_dev *hdev, u8 connectable)
4377 {
4378         bool changed;
4379
4380         /* Nothing needed here if there's a pending command since that
4381          * commands request completion callback takes care of everything
4382          * necessary.
4383          */
4384         if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
4385                 return;
4386
4387         if (connectable)
4388                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
4389         else
4390                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
4391
4392         if (changed)
4393                 new_settings(hdev, NULL);
4394 }
4395
4396 void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
4397 {
4398         u8 mgmt_err = mgmt_status(status);
4399
4400         if (scan & SCAN_PAGE)
4401                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
4402                                      cmd_status_rsp, &mgmt_err);
4403
4404         if (scan & SCAN_INQUIRY)
4405                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
4406                                      cmd_status_rsp, &mgmt_err);
4407 }
4408
4409 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
4410                        bool persistent)
4411 {
4412         struct mgmt_ev_new_link_key ev;
4413
4414         memset(&ev, 0, sizeof(ev));
4415
4416         ev.store_hint = persistent;
4417         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4418         ev.key.addr.type = BDADDR_BREDR;
4419         ev.key.type = key->type;
4420         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
4421         ev.key.pin_len = key->pin_len;
4422
4423         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
4424 }
4425
4426 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
4427 {
4428         struct mgmt_ev_new_long_term_key ev;
4429
4430         memset(&ev, 0, sizeof(ev));
4431
4432         ev.store_hint = persistent;
4433         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4434         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
4435         ev.key.authenticated = key->authenticated;
4436         ev.key.enc_size = key->enc_size;
4437         ev.key.ediv = key->ediv;
4438
4439         if (key->type == HCI_SMP_LTK)
4440                 ev.key.master = 1;
4441
4442         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
4443         memcpy(ev.key.val, key->val, sizeof(key->val));
4444
4445         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
4446 }
4447
4448 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
4449                                   u8 data_len)
4450 {
4451         eir[eir_len++] = sizeof(type) + data_len;
4452         eir[eir_len++] = type;
4453         memcpy(&eir[eir_len], data, data_len);
4454         eir_len += data_len;
4455
4456         return eir_len;
4457 }
4458
4459 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4460                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
4461                            u8 *dev_class)
4462 {
4463         char buf[512];
4464         struct mgmt_ev_device_connected *ev = (void *) buf;
4465         u16 eir_len = 0;
4466
4467         bacpy(&ev->addr.bdaddr, bdaddr);
4468         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4469
4470         ev->flags = __cpu_to_le32(flags);
4471
4472         if (name_len > 0)
4473                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
4474                                           name, name_len);
4475
4476         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
4477                 eir_len = eir_append_data(ev->eir, eir_len,
4478                                           EIR_CLASS_OF_DEV, dev_class, 3);
4479
4480         ev->eir_len = cpu_to_le16(eir_len);
4481
4482         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
4483                     sizeof(*ev) + eir_len, NULL);
4484 }
4485
4486 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
4487 {
4488         struct mgmt_cp_disconnect *cp = cmd->param;
4489         struct sock **sk = data;
4490         struct mgmt_rp_disconnect rp;
4491
4492         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4493         rp.addr.type = cp->addr.type;
4494
4495         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
4496                      sizeof(rp));
4497
4498         *sk = cmd->sk;
4499         sock_hold(*sk);
4500
4501         mgmt_pending_remove(cmd);
4502 }
4503
4504 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
4505 {
4506         struct hci_dev *hdev = data;
4507         struct mgmt_cp_unpair_device *cp = cmd->param;
4508         struct mgmt_rp_unpair_device rp;
4509
4510         memset(&rp, 0, sizeof(rp));
4511         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4512         rp.addr.type = cp->addr.type;
4513
4514         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
4515
4516         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
4517
4518         mgmt_pending_remove(cmd);
4519 }
4520
4521 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
4522                               u8 link_type, u8 addr_type, u8 reason)
4523 {
4524         struct mgmt_ev_device_disconnected ev;
4525         struct sock *sk = NULL;
4526
4527         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
4528
4529         bacpy(&ev.addr.bdaddr, bdaddr);
4530         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4531         ev.reason = reason;
4532
4533         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
4534
4535         if (sk)
4536                 sock_put(sk);
4537
4538         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4539                              hdev);
4540 }
4541
4542 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
4543                             u8 link_type, u8 addr_type, u8 status)
4544 {
4545         struct mgmt_rp_disconnect rp;
4546         struct pending_cmd *cmd;
4547
4548         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4549                              hdev);
4550
4551         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
4552         if (!cmd)
4553                 return;
4554
4555         bacpy(&rp.addr.bdaddr, bdaddr);
4556         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4557
4558         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
4559                      mgmt_status(status), &rp, sizeof(rp));
4560
4561         mgmt_pending_remove(cmd);
4562 }
4563
4564 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4565                          u8 addr_type, u8 status)
4566 {
4567         struct mgmt_ev_connect_failed ev;
4568
4569         bacpy(&ev.addr.bdaddr, bdaddr);
4570         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4571         ev.status = mgmt_status(status);
4572
4573         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
4574 }
4575
4576 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
4577 {
4578         struct mgmt_ev_pin_code_request ev;
4579
4580         bacpy(&ev.addr.bdaddr, bdaddr);
4581         ev.addr.type = BDADDR_BREDR;
4582         ev.secure = secure;
4583
4584         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
4585 }
4586
4587 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4588                                   u8 status)
4589 {
4590         struct pending_cmd *cmd;
4591         struct mgmt_rp_pin_code_reply rp;
4592
4593         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
4594         if (!cmd)
4595                 return;
4596
4597         bacpy(&rp.addr.bdaddr, bdaddr);
4598         rp.addr.type = BDADDR_BREDR;
4599
4600         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
4601                      mgmt_status(status), &rp, sizeof(rp));
4602
4603         mgmt_pending_remove(cmd);
4604 }
4605
4606 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4607                                       u8 status)
4608 {
4609         struct pending_cmd *cmd;
4610         struct mgmt_rp_pin_code_reply rp;
4611
4612         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
4613         if (!cmd)
4614                 return;
4615
4616         bacpy(&rp.addr.bdaddr, bdaddr);
4617         rp.addr.type = BDADDR_BREDR;
4618
4619         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
4620                      mgmt_status(status), &rp, sizeof(rp));
4621
4622         mgmt_pending_remove(cmd);
4623 }
4624
4625 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4626                               u8 link_type, u8 addr_type, __le32 value,
4627                               u8 confirm_hint)
4628 {
4629         struct mgmt_ev_user_confirm_request ev;
4630
4631         BT_DBG("%s", hdev->name);
4632
4633         bacpy(&ev.addr.bdaddr, bdaddr);
4634         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4635         ev.confirm_hint = confirm_hint;
4636         ev.value = value;
4637
4638         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
4639                           NULL);
4640 }
4641
4642 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4643                               u8 link_type, u8 addr_type)
4644 {
4645         struct mgmt_ev_user_passkey_request ev;
4646
4647         BT_DBG("%s", hdev->name);
4648
4649         bacpy(&ev.addr.bdaddr, bdaddr);
4650         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4651
4652         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
4653                           NULL);
4654 }
4655
4656 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4657                                       u8 link_type, u8 addr_type, u8 status,
4658                                       u8 opcode)
4659 {
4660         struct pending_cmd *cmd;
4661         struct mgmt_rp_user_confirm_reply rp;
4662         int err;
4663
4664         cmd = mgmt_pending_find(opcode, hdev);
4665         if (!cmd)
4666                 return -ENOENT;
4667
4668         bacpy(&rp.addr.bdaddr, bdaddr);
4669         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4670         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
4671                            &rp, sizeof(rp));
4672
4673         mgmt_pending_remove(cmd);
4674
4675         return err;
4676 }
4677
4678 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4679                                      u8 link_type, u8 addr_type, u8 status)
4680 {
4681         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4682                                           status, MGMT_OP_USER_CONFIRM_REPLY);
4683 }
4684
4685 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4686                                          u8 link_type, u8 addr_type, u8 status)
4687 {
4688         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4689                                           status,
4690                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
4691 }
4692
4693 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4694                                      u8 link_type, u8 addr_type, u8 status)
4695 {
4696         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4697                                           status, MGMT_OP_USER_PASSKEY_REPLY);
4698 }
4699
4700 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4701                                          u8 link_type, u8 addr_type, u8 status)
4702 {
4703         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4704                                           status,
4705                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
4706 }
4707
4708 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
4709                              u8 link_type, u8 addr_type, u32 passkey,
4710                              u8 entered)
4711 {
4712         struct mgmt_ev_passkey_notify ev;
4713
4714         BT_DBG("%s", hdev->name);
4715
4716         bacpy(&ev.addr.bdaddr, bdaddr);
4717         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4718         ev.passkey = __cpu_to_le32(passkey);
4719         ev.entered = entered;
4720
4721         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
4722 }
4723
4724 void mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4725                       u8 addr_type, u8 status)
4726 {
4727         struct mgmt_ev_auth_failed ev;
4728
4729         bacpy(&ev.addr.bdaddr, bdaddr);
4730         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4731         ev.status = mgmt_status(status);
4732
4733         mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
4734 }
4735
4736 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
4737 {
4738         struct cmd_lookup match = { NULL, hdev };
4739         bool changed;
4740
4741         if (status) {
4742                 u8 mgmt_err = mgmt_status(status);
4743                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
4744                                      cmd_status_rsp, &mgmt_err);
4745                 return;
4746         }
4747
4748         if (test_bit(HCI_AUTH, &hdev->flags))
4749                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
4750                                             &hdev->dev_flags);
4751         else
4752                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
4753                                              &hdev->dev_flags);
4754
4755         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
4756                              &match);
4757
4758         if (changed)
4759                 new_settings(hdev, match.sk);
4760
4761         if (match.sk)
4762                 sock_put(match.sk);
4763 }
4764
4765 static void clear_eir(struct hci_request *req)
4766 {
4767         struct hci_dev *hdev = req->hdev;
4768         struct hci_cp_write_eir cp;
4769
4770         if (!lmp_ext_inq_capable(hdev))
4771                 return;
4772
4773         memset(hdev->eir, 0, sizeof(hdev->eir));
4774
4775         memset(&cp, 0, sizeof(cp));
4776
4777         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4778 }
4779
4780 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4781 {
4782         struct cmd_lookup match = { NULL, hdev };
4783         struct hci_request req;
4784         bool changed = false;
4785
4786         if (status) {
4787                 u8 mgmt_err = mgmt_status(status);
4788
4789                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4790                                                  &hdev->dev_flags)) {
4791                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4792                         new_settings(hdev, NULL);
4793                 }
4794
4795                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4796                                      &mgmt_err);
4797                 return;
4798         }
4799
4800         if (enable) {
4801                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4802         } else {
4803                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4804                 if (!changed)
4805                         changed = test_and_clear_bit(HCI_HS_ENABLED,
4806                                                      &hdev->dev_flags);
4807                 else
4808                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4809         }
4810
4811         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4812
4813         if (changed)
4814                 new_settings(hdev, match.sk);
4815
4816         if (match.sk)
4817                 sock_put(match.sk);
4818
4819         hci_req_init(&req, hdev);
4820
4821         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4822                 update_eir(&req);
4823         else
4824                 clear_eir(&req);
4825
4826         hci_req_run(&req, NULL);
4827 }
4828
4829 static void sk_lookup(struct pending_cmd *cmd, void *data)
4830 {
4831         struct cmd_lookup *match = data;
4832
4833         if (match->sk == NULL) {
4834                 match->sk = cmd->sk;
4835                 sock_hold(match->sk);
4836         }
4837 }
4838
4839 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4840                                     u8 status)
4841 {
4842         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4843
4844         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4845         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4846         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4847
4848         if (!status)
4849                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
4850                            NULL);
4851
4852         if (match.sk)
4853                 sock_put(match.sk);
4854 }
4855
4856 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4857 {
4858         struct mgmt_cp_set_local_name ev;
4859         struct pending_cmd *cmd;
4860
4861         if (status)
4862                 return;
4863
4864         memset(&ev, 0, sizeof(ev));
4865         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4866         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4867
4868         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4869         if (!cmd) {
4870                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4871
4872                 /* If this is a HCI command related to powering on the
4873                  * HCI dev don't send any mgmt signals.
4874                  */
4875                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4876                         return;
4877         }
4878
4879         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4880                    cmd ? cmd->sk : NULL);
4881 }
4882
4883 void mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4884                                              u8 *randomizer, u8 status)
4885 {
4886         struct pending_cmd *cmd;
4887
4888         BT_DBG("%s status %u", hdev->name, status);
4889
4890         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4891         if (!cmd)
4892                 return;
4893
4894         if (status) {
4895                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4896                            mgmt_status(status));
4897         } else {
4898                 struct mgmt_rp_read_local_oob_data rp;
4899
4900                 memcpy(rp.hash, hash, sizeof(rp.hash));
4901                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4902
4903                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4904                              0, &rp, sizeof(rp));
4905         }
4906
4907         mgmt_pending_remove(cmd);
4908 }
4909
4910 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4911                        u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4912                        ssp, u8 *eir, u16 eir_len)
4913 {
4914         char buf[512];
4915         struct mgmt_ev_device_found *ev = (void *) buf;
4916         size_t ev_size;
4917
4918         if (!hci_discovery_active(hdev))
4919                 return;
4920
4921         /* Leave 5 bytes for a potential CoD field */
4922         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4923                 return;
4924
4925         memset(buf, 0, sizeof(buf));
4926
4927         bacpy(&ev->addr.bdaddr, bdaddr);
4928         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4929         ev->rssi = rssi;
4930         if (cfm_name)
4931                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4932         if (!ssp)
4933                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4934
4935         if (eir_len > 0)
4936                 memcpy(ev->eir, eir, eir_len);
4937
4938         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4939                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4940                                           dev_class, 3);
4941
4942         ev->eir_len = cpu_to_le16(eir_len);
4943         ev_size = sizeof(*ev) + eir_len;
4944
4945         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4946 }
4947
4948 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4949                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4950 {
4951         struct mgmt_ev_device_found *ev;
4952         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4953         u16 eir_len;
4954
4955         ev = (struct mgmt_ev_device_found *) buf;
4956
4957         memset(buf, 0, sizeof(buf));
4958
4959         bacpy(&ev->addr.bdaddr, bdaddr);
4960         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4961         ev->rssi = rssi;
4962
4963         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4964                                   name_len);
4965
4966         ev->eir_len = cpu_to_le16(eir_len);
4967
4968         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
4969 }
4970
4971 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4972 {
4973         struct mgmt_ev_discovering ev;
4974         struct pending_cmd *cmd;
4975
4976         BT_DBG("%s discovering %u", hdev->name, discovering);
4977
4978         if (discovering)
4979                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4980         else
4981                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4982
4983         if (cmd != NULL) {
4984                 u8 type = hdev->discovery.type;
4985
4986                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4987                              sizeof(type));
4988                 mgmt_pending_remove(cmd);
4989         }
4990
4991         memset(&ev, 0, sizeof(ev));
4992         ev.type = hdev->discovery.type;
4993         ev.discovering = discovering;
4994
4995         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4996 }
4997
4998 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4999 {
5000         struct pending_cmd *cmd;
5001         struct mgmt_ev_device_blocked ev;
5002
5003         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
5004
5005         bacpy(&ev.addr.bdaddr, bdaddr);
5006         ev.addr.type = type;
5007
5008         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
5009                           cmd ? cmd->sk : NULL);
5010 }
5011
5012 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
5013 {
5014         struct pending_cmd *cmd;
5015         struct mgmt_ev_device_unblocked ev;
5016
5017         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
5018
5019         bacpy(&ev.addr.bdaddr, bdaddr);
5020         ev.addr.type = type;
5021
5022         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
5023                           cmd ? cmd->sk : NULL);
5024 }
5025
5026 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
5027 {
5028         BT_DBG("%s status %u", hdev->name, status);
5029
5030         /* Clear the advertising mgmt setting if we failed to re-enable it */
5031         if (status) {
5032                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
5033                 new_settings(hdev, NULL);
5034         }
5035 }
5036
5037 void mgmt_reenable_advertising(struct hci_dev *hdev)
5038 {
5039         struct hci_request req;
5040
5041         if (hci_conn_num(hdev, LE_LINK) > 0)
5042                 return;
5043
5044         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5045                 return;
5046
5047         hci_req_init(&req, hdev);
5048         enable_advertising(&req);
5049
5050         /* If this fails we have no option but to let user space know
5051          * that we've disabled advertising.
5052          */
5053         if (hci_req_run(&req, adv_enable_complete) < 0) {
5054                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
5055                 new_settings(hdev, NULL);
5056         }
5057 }