net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33
  34 #include "smp.h"
  35
  36 #define MGMT_VERSION    1
  37 #define MGMT_REVISION   4
  38
  39 static const u16 mgmt_commands[] = {
  40         MGMT_OP_READ_INDEX_LIST,
  41         MGMT_OP_READ_INFO,
  42         MGMT_OP_SET_POWERED,
  43         MGMT_OP_SET_DISCOVERABLE,
  44         MGMT_OP_SET_CONNECTABLE,
  45         MGMT_OP_SET_FAST_CONNECTABLE,
  46         MGMT_OP_SET_PAIRABLE,
  47         MGMT_OP_SET_LINK_SECURITY,
  48         MGMT_OP_SET_SSP,
  49         MGMT_OP_SET_HS,
  50         MGMT_OP_SET_LE,
  51         MGMT_OP_SET_DEV_CLASS,
  52         MGMT_OP_SET_LOCAL_NAME,
  53         MGMT_OP_ADD_UUID,
  54         MGMT_OP_REMOVE_UUID,
  55         MGMT_OP_LOAD_LINK_KEYS,
  56         MGMT_OP_LOAD_LONG_TERM_KEYS,
  57         MGMT_OP_DISCONNECT,
  58         MGMT_OP_GET_CONNECTIONS,
  59         MGMT_OP_PIN_CODE_REPLY,
  60         MGMT_OP_PIN_CODE_NEG_REPLY,
  61         MGMT_OP_SET_IO_CAPABILITY,
  62         MGMT_OP_PAIR_DEVICE,
  63         MGMT_OP_CANCEL_PAIR_DEVICE,
  64         MGMT_OP_UNPAIR_DEVICE,
  65         MGMT_OP_USER_CONFIRM_REPLY,
  66         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  67         MGMT_OP_USER_PASSKEY_REPLY,
  68         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  69         MGMT_OP_READ_LOCAL_OOB_DATA,
  70         MGMT_OP_ADD_REMOTE_OOB_DATA,
  71         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  72         MGMT_OP_START_DISCOVERY,
  73         MGMT_OP_STOP_DISCOVERY,
  74         MGMT_OP_CONFIRM_NAME,
  75         MGMT_OP_BLOCK_DEVICE,
  76         MGMT_OP_UNBLOCK_DEVICE,
  77         MGMT_OP_SET_DEVICE_ID,
  78         MGMT_OP_SET_ADVERTISING,
  79         MGMT_OP_SET_BREDR,
  80         MGMT_OP_SET_STATIC_ADDRESS,
  81         MGMT_OP_SET_SCAN_PARAMS,
  82 };
  83
  84 static const u16 mgmt_events[] = {
  85         MGMT_EV_CONTROLLER_ERROR,
  86         MGMT_EV_INDEX_ADDED,
  87         MGMT_EV_INDEX_REMOVED,
  88         MGMT_EV_NEW_SETTINGS,
  89         MGMT_EV_CLASS_OF_DEV_CHANGED,
  90         MGMT_EV_LOCAL_NAME_CHANGED,
  91         MGMT_EV_NEW_LINK_KEY,
  92         MGMT_EV_NEW_LONG_TERM_KEY,
  93         MGMT_EV_DEVICE_CONNECTED,
  94         MGMT_EV_DEVICE_DISCONNECTED,
  95         MGMT_EV_CONNECT_FAILED,
  96         MGMT_EV_PIN_CODE_REQUEST,
  97         MGMT_EV_USER_CONFIRM_REQUEST,
  98         MGMT_EV_USER_PASSKEY_REQUEST,
  99         MGMT_EV_AUTH_FAILED,
 100         MGMT_EV_DEVICE_FOUND,
 101         MGMT_EV_DISCOVERING,
 102         MGMT_EV_DEVICE_BLOCKED,
 103         MGMT_EV_DEVICE_UNBLOCKED,
 104         MGMT_EV_DEVICE_UNPAIRED,
 105         MGMT_EV_PASSKEY_NOTIFY,
 106 };
 107
 108 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 109
 110 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 111                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 112
 113 struct pending_cmd {
 114         struct list_head list;
 115         u16 opcode;
 116         int index;
 117         void *param;
 118         struct sock *sk;
 119         void *user_data;
 120 };
 121
 122 /* HCI to MGMT error code conversion table */
 123 static u8 mgmt_status_table[] = {
 124         MGMT_STATUS_SUCCESS,
 125         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 126         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 127         MGMT_STATUS_FAILED,             /* Hardware Failure */
 128         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 129         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 130         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 131         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 132         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 133         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 134         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 135         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 136         MGMT_STATUS_BUSY,               /* Command Disallowed */
 137         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 138         MGMT_STATUS_REJECTED,           /* Rejected Security */
 139         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 140         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 141         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 142         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 143         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 144         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 145         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 146         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 147         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 148         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 149         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 150         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 151         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 152         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 153         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 154         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 155         MGMT_STATUS_FAILED,             /* Unspecified Error */
 156         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 157         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 158         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 159         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 160         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 161         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 162         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 164         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 165         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 166         MGMT_STATUS_FAILED,             /* Transaction Collision */
 167         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 168         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 169         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 170         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 171         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 172         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 173         MGMT_STATUS_FAILED,             /* Slot Violation */
 174         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 175         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 176         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 177         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 178         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 179         MGMT_STATUS_BUSY,               /* Controller Busy */
 180         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 181         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 182         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 183         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 184         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 185 };
 186
 187 static u8 mgmt_status(u8 hci_status)
 188 {
 189         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 190                 return mgmt_status_table[hci_status];
 191
 192         return MGMT_STATUS_FAILED;
 193 }
 194
 195 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 196 {
 197         struct sk_buff *skb;
 198         struct mgmt_hdr *hdr;
 199         struct mgmt_ev_cmd_status *ev;
 200         int err;
 201
 202         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 203
 204         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 205         if (!skb)
 206                 return -ENOMEM;
 207
 208         hdr = (void *) skb_put(skb, sizeof(*hdr));
 209
 210         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 211         hdr->index = cpu_to_le16(index);
 212         hdr->len = cpu_to_le16(sizeof(*ev));
 213
 214         ev = (void *) skb_put(skb, sizeof(*ev));
 215         ev->status = status;
 216         ev->opcode = cpu_to_le16(cmd);
 217
 218         err = sock_queue_rcv_skb(sk, skb);
 219         if (err < 0)
 220                 kfree_skb(skb);
 221
 222         return err;
 223 }
 224
 225 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 226                         void *rp, size_t rp_len)
 227 {
 228         struct sk_buff *skb;
 229         struct mgmt_hdr *hdr;
 230         struct mgmt_ev_cmd_complete *ev;
 231         int err;
 232
 233         BT_DBG("sock %p", sk);
 234
 235         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 236         if (!skb)
 237                 return -ENOMEM;
 238
 239         hdr = (void *) skb_put(skb, sizeof(*hdr));
 240
 241         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 242         hdr->index = cpu_to_le16(index);
 243         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 244
 245         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 246         ev->opcode = cpu_to_le16(cmd);
 247         ev->status = status;
 248
 249         if (rp)
 250                 memcpy(ev->data, rp, rp_len);
 251
 252         err = sock_queue_rcv_skb(sk, skb);
 253         if (err < 0)
 254                 kfree_skb(skb);
 255
 256         return err;
 257 }
 258
 259 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 260                         u16 data_len)
 261 {
 262         struct mgmt_rp_read_version rp;
 263
 264         BT_DBG("sock %p", sk);
 265
 266         rp.version = MGMT_VERSION;
 267         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 268
 269         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 270                             sizeof(rp));
 271 }
 272
 273 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 274                          u16 data_len)
 275 {
 276         struct mgmt_rp_read_commands *rp;
 277         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 278         const u16 num_events = ARRAY_SIZE(mgmt_events);
 279         __le16 *opcode;
 280         size_t rp_size;
 281         int i, err;
 282
 283         BT_DBG("sock %p", sk);
 284
 285         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 286
 287         rp = kmalloc(rp_size, GFP_KERNEL);
 288         if (!rp)
 289                 return -ENOMEM;
 290
 291         rp->num_commands = __constant_cpu_to_le16(num_commands);
 292         rp->num_events = __constant_cpu_to_le16(num_events);
 293
 294         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 295                 put_unaligned_le16(mgmt_commands[i], opcode);
 296
 297         for (i = 0; i < num_events; i++, opcode++)
 298                 put_unaligned_le16(mgmt_events[i], opcode);
 299
 300         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 301                            rp_size);
 302         kfree(rp);
 303
 304         return err;
 305 }
 306
 307 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 308                            u16 data_len)
 309 {
 310         struct mgmt_rp_read_index_list *rp;
 311         struct hci_dev *d;
 312         size_t rp_len;
 313         u16 count;
 314         int err;
 315
 316         BT_DBG("sock %p", sk);
 317
 318         read_lock(&hci_dev_list_lock);
 319
 320         count = 0;
 321         list_for_each_entry(d, &hci_dev_list, list) {
 322                 if (d->dev_type == HCI_BREDR)
 323                         count++;
 324         }
 325
 326         rp_len = sizeof(*rp) + (2 * count);
 327         rp = kmalloc(rp_len, GFP_ATOMIC);
 328         if (!rp) {
 329                 read_unlock(&hci_dev_list_lock);
 330                 return -ENOMEM;
 331         }
 332
 333         count = 0;
 334         list_for_each_entry(d, &hci_dev_list, list) {
 335                 if (test_bit(HCI_SETUP, &d->dev_flags))
 336                         continue;
 337
 338                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 339                         continue;
 340
 341                 if (d->dev_type == HCI_BREDR) {
 342                         rp->index[count++] = cpu_to_le16(d->id);
 343                         BT_DBG("Added hci%u", d->id);
 344                 }
 345         }
 346
 347         rp->num_controllers = cpu_to_le16(count);
 348         rp_len = sizeof(*rp) + (2 * count);
 349
 350         read_unlock(&hci_dev_list_lock);
 351
 352         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 353                            rp_len);
 354
 355         kfree(rp);
 356
 357         return err;
 358 }
 359
 360 static u32 get_supported_settings(struct hci_dev *hdev)
 361 {
 362         u32 settings = 0;
 363
 364         settings |= MGMT_SETTING_POWERED;
 365         settings |= MGMT_SETTING_PAIRABLE;
 366
 367         if (lmp_bredr_capable(hdev)) {
 368                 settings |= MGMT_SETTING_CONNECTABLE;
 369                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 370                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 371                 settings |= MGMT_SETTING_DISCOVERABLE;
 372                 settings |= MGMT_SETTING_BREDR;
 373                 settings |= MGMT_SETTING_LINK_SECURITY;
 374
 375                 if (lmp_ssp_capable(hdev)) {
 376                         settings |= MGMT_SETTING_SSP;
 377                         settings |= MGMT_SETTING_HS;
 378                 }
 379         }
 380
 381         if (lmp_le_capable(hdev)) {
 382                 settings |= MGMT_SETTING_LE;
 383                 settings |= MGMT_SETTING_ADVERTISING;
 384         }
 385
 386         return settings;
 387 }
 388
 389 static u32 get_current_settings(struct hci_dev *hdev)
 390 {
 391         u32 settings = 0;
 392
 393         if (hdev_is_powered(hdev))
 394                 settings |= MGMT_SETTING_POWERED;
 395
 396         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 397                 settings |= MGMT_SETTING_CONNECTABLE;
 398
 399         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 400                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 401
 402         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 403                 settings |= MGMT_SETTING_DISCOVERABLE;
 404
 405         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 406                 settings |= MGMT_SETTING_PAIRABLE;
 407
 408         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 409                 settings |= MGMT_SETTING_BREDR;
 410
 411         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 412                 settings |= MGMT_SETTING_LE;
 413
 414         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 415                 settings |= MGMT_SETTING_LINK_SECURITY;
 416
 417         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 418                 settings |= MGMT_SETTING_SSP;
 419
 420         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 421                 settings |= MGMT_SETTING_HS;
 422
 423         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 424                 settings |= MGMT_SETTING_ADVERTISING;
 425
 426         return settings;
 427 }
 428
 429 #define PNP_INFO_SVCLASS_ID             0x1200
 430
 431 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 432 {
 433         u8 *ptr = data, *uuids_start = NULL;
 434         struct bt_uuid *uuid;
 435
 436         if (len < 4)
 437                 return ptr;
 438
 439         list_for_each_entry(uuid, &hdev->uuids, list) {
 440                 u16 uuid16;
 441
 442                 if (uuid->size != 16)
 443                         continue;
 444
 445                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 446                 if (uuid16 < 0x1100)
 447                         continue;
 448
 449                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 450                         continue;
 451
 452                 if (!uuids_start) {
 453                         uuids_start = ptr;
 454                         uuids_start[0] = 1;
 455                         uuids_start[1] = EIR_UUID16_ALL;
 456                         ptr += 2;
 457                 }
 458
 459                 /* Stop if not enough space to put next UUID */
 460                 if ((ptr - data) + sizeof(u16) > len) {
 461                         uuids_start[1] = EIR_UUID16_SOME;
 462                         break;
 463                 }
 464
 465                 *ptr++ = (uuid16 & 0x00ff);
 466                 *ptr++ = (uuid16 & 0xff00) >> 8;
 467                 uuids_start[0] += sizeof(uuid16);
 468         }
 469
 470         return ptr;
 471 }
 472
 473 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 474 {
 475         u8 *ptr = data, *uuids_start = NULL;
 476         struct bt_uuid *uuid;
 477
 478         if (len < 6)
 479                 return ptr;
 480
 481         list_for_each_entry(uuid, &hdev->uuids, list) {
 482                 if (uuid->size != 32)
 483                         continue;
 484
 485                 if (!uuids_start) {
 486                         uuids_start = ptr;
 487                         uuids_start[0] = 1;
 488                         uuids_start[1] = EIR_UUID32_ALL;
 489                         ptr += 2;
 490                 }
 491
 492                 /* Stop if not enough space to put next UUID */
 493                 if ((ptr - data) + sizeof(u32) > len) {
 494                         uuids_start[1] = EIR_UUID32_SOME;
 495                         break;
 496                 }
 497
 498                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 499                 ptr += sizeof(u32);
 500                 uuids_start[0] += sizeof(u32);
 501         }
 502
 503         return ptr;
 504 }
 505
 506 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 507 {
 508         u8 *ptr = data, *uuids_start = NULL;
 509         struct bt_uuid *uuid;
 510
 511         if (len < 18)
 512                 return ptr;
 513
 514         list_for_each_entry(uuid, &hdev->uuids, list) {
 515                 if (uuid->size != 128)
 516                         continue;
 517
 518                 if (!uuids_start) {
 519                         uuids_start = ptr;
 520                         uuids_start[0] = 1;
 521                         uuids_start[1] = EIR_UUID128_ALL;
 522                         ptr += 2;
 523                 }
 524
 525                 /* Stop if not enough space to put next UUID */
 526                 if ((ptr - data) + 16 > len) {
 527                         uuids_start[1] = EIR_UUID128_SOME;
 528                         break;
 529                 }
 530
 531                 memcpy(ptr, uuid->uuid, 16);
 532                 ptr += 16;
 533                 uuids_start[0] += 16;
 534         }
 535
 536         return ptr;
 537 }
 538
 539 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 540 {
 541         u8 ad_len = 0;
 542         size_t name_len;
 543
 544         name_len = strlen(hdev->dev_name);
 545         if (name_len > 0) {
 546                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 547
 548                 if (name_len > max_len) {
 549                         name_len = max_len;
 550                         ptr[1] = EIR_NAME_SHORT;
 551                 } else
 552                         ptr[1] = EIR_NAME_COMPLETE;
 553
 554                 ptr[0] = name_len + 1;
 555
 556                 memcpy(ptr + 2, hdev->dev_name, name_len);
 557
 558                 ad_len += (name_len + 2);
 559                 ptr += (name_len + 2);
 560         }
 561
 562         return ad_len;
 563 }
 564
 565 static void update_scan_rsp_data(struct hci_request *req)
 566 {
 567         struct hci_dev *hdev = req->hdev;
 568         struct hci_cp_le_set_scan_rsp_data cp;
 569         u8 len;
 570
 571         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 572                 return;
 573
 574         memset(&cp, 0, sizeof(cp));
 575
 576         len = create_scan_rsp_data(hdev, cp.data);
 577
 578         if (hdev->scan_rsp_data_len == len &&
 579             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 580                 return;
 581
 582         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 583         hdev->scan_rsp_data_len = len;
 584
 585         cp.length = len;
 586
 587         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 588 }
 589
 590 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 591 {
 592         u8 ad_len = 0, flags = 0;
 593
 594         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 595                 flags |= LE_AD_GENERAL;
 596
 597         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
 598                 if (lmp_le_br_capable(hdev))
 599                         flags |= LE_AD_SIM_LE_BREDR_CTRL;
 600                 if (lmp_host_le_br_capable(hdev))
 601                         flags |= LE_AD_SIM_LE_BREDR_HOST;
 602         } else {
 603                 flags |= LE_AD_NO_BREDR;
 604         }
 605
 606         if (flags) {
 607                 BT_DBG("adv flags 0x%02x", flags);
 608
 609                 ptr[0] = 2;
 610                 ptr[1] = EIR_FLAGS;
 611                 ptr[2] = flags;
 612
 613                 ad_len += 3;
 614                 ptr += 3;
 615         }
 616
 617         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 618                 ptr[0] = 2;
 619                 ptr[1] = EIR_TX_POWER;
 620                 ptr[2] = (u8) hdev->adv_tx_power;
 621
 622                 ad_len += 3;
 623                 ptr += 3;
 624         }
 625
 626         return ad_len;
 627 }
 628
 629 static void update_adv_data(struct hci_request *req)
 630 {
 631         struct hci_dev *hdev = req->hdev;
 632         struct hci_cp_le_set_adv_data cp;
 633         u8 len;
 634
 635         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 636                 return;
 637
 638         memset(&cp, 0, sizeof(cp));
 639
 640         len = create_adv_data(hdev, cp.data);
 641
 642         if (hdev->adv_data_len == len &&
 643             memcmp(cp.data, hdev->adv_data, len) == 0)
 644                 return;
 645
 646         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 647         hdev->adv_data_len = len;
 648
 649         cp.length = len;
 650
 651         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 652 }
 653
 654 static void create_eir(struct hci_dev *hdev, u8 *data)
 655 {
 656         u8 *ptr = data;
 657         size_t name_len;
 658
 659         name_len = strlen(hdev->dev_name);
 660
 661         if (name_len > 0) {
 662                 /* EIR Data type */
 663                 if (name_len > 48) {
 664                         name_len = 48;
 665                         ptr[1] = EIR_NAME_SHORT;
 666                 } else
 667                         ptr[1] = EIR_NAME_COMPLETE;
 668
 669                 /* EIR Data length */
 670                 ptr[0] = name_len + 1;
 671
 672                 memcpy(ptr + 2, hdev->dev_name, name_len);
 673
 674                 ptr += (name_len + 2);
 675         }
 676
 677         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 678                 ptr[0] = 2;
 679                 ptr[1] = EIR_TX_POWER;
 680                 ptr[2] = (u8) hdev->inq_tx_power;
 681
 682                 ptr += 3;
 683         }
 684
 685         if (hdev->devid_source > 0) {
 686                 ptr[0] = 9;
 687                 ptr[1] = EIR_DEVICE_ID;
 688
 689                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 690                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 691                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 692                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 693
 694                 ptr += 10;
 695         }
 696
 697         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 698         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 699         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 700 }
 701
 702 static void update_eir(struct hci_request *req)
 703 {
 704         struct hci_dev *hdev = req->hdev;
 705         struct hci_cp_write_eir cp;
 706
 707         if (!hdev_is_powered(hdev))
 708                 return;
 709
 710         if (!lmp_ext_inq_capable(hdev))
 711                 return;
 712
 713         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 714                 return;
 715
 716         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 717                 return;
 718
 719         memset(&cp, 0, sizeof(cp));
 720
 721         create_eir(hdev, cp.data);
 722
 723         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 724                 return;
 725
 726         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 727
 728         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 729 }
 730
 731 static u8 get_service_classes(struct hci_dev *hdev)
 732 {
 733         struct bt_uuid *uuid;
 734         u8 val = 0;
 735
 736         list_for_each_entry(uuid, &hdev->uuids, list)
 737                 val |= uuid->svc_hint;
 738
 739         return val;
 740 }
 741
 742 static void update_class(struct hci_request *req)
 743 {
 744         struct hci_dev *hdev = req->hdev;
 745         u8 cod[3];
 746
 747         BT_DBG("%s", hdev->name);
 748
 749         if (!hdev_is_powered(hdev))
 750                 return;
 751
 752         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 753                 return;
 754
 755         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 756                 return;
 757
 758         cod[0] = hdev->minor_class;
 759         cod[1] = hdev->major_class;
 760         cod[2] = get_service_classes(hdev);
 761
 762         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 763                 cod[1] |= 0x20;
 764
 765         if (memcmp(cod, hdev->dev_class, 3) == 0)
 766                 return;
 767
 768         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 769 }
 770
 771 static void service_cache_off(struct work_struct *work)
 772 {
 773         struct hci_dev *hdev = container_of(work, struct hci_dev,
 774                                             service_cache.work);
 775         struct hci_request req;
 776
 777         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 778                 return;
 779
 780         hci_req_init(&req, hdev);
 781
 782         hci_dev_lock(hdev);
 783
 784         update_eir(&req);
 785         update_class(&req);
 786
 787         hci_dev_unlock(hdev);
 788
 789         hci_req_run(&req, NULL);
 790 }
 791
 792 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 793 {
 794         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 795                 return;
 796
 797         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 798
 799         /* Non-mgmt controlled devices get this bit set
 800          * implicitly so that pairing works for them, however
 801          * for mgmt we require user-space to explicitly enable
 802          * it
 803          */
 804         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 805 }
 806
 807 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 808                                 void *data, u16 data_len)
 809 {
 810         struct mgmt_rp_read_info rp;
 811
 812         BT_DBG("sock %p %s", sk, hdev->name);
 813
 814         hci_dev_lock(hdev);
 815
 816         memset(&rp, 0, sizeof(rp));
 817
 818         bacpy(&rp.bdaddr, &hdev->bdaddr);
 819
 820         rp.version = hdev->hci_ver;
 821         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 822
 823         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 824         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 825
 826         memcpy(rp.dev_class, hdev->dev_class, 3);
 827
 828         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 829         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 830
 831         hci_dev_unlock(hdev);
 832
 833         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 834                             sizeof(rp));
 835 }
 836
 837 static void mgmt_pending_free(struct pending_cmd *cmd)
 838 {
 839         sock_put(cmd->sk);
 840         kfree(cmd->param);
 841         kfree(cmd);
 842 }
 843
 844 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 845                                             struct hci_dev *hdev, void *data,
 846                                             u16 len)
 847 {
 848         struct pending_cmd *cmd;
 849
 850         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 851         if (!cmd)
 852                 return NULL;
 853
 854         cmd->opcode = opcode;
 855         cmd->index = hdev->id;
 856
 857         cmd->param = kmalloc(len, GFP_KERNEL);
 858         if (!cmd->param) {
 859                 kfree(cmd);
 860                 return NULL;
 861         }
 862
 863         if (data)
 864                 memcpy(cmd->param, data, len);
 865
 866         cmd->sk = sk;
 867         sock_hold(sk);
 868
 869         list_add(&cmd->list, &hdev->mgmt_pending);
 870
 871         return cmd;
 872 }
 873
 874 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 875                                  void (*cb)(struct pending_cmd *cmd,
 876                                             void *data),
 877                                  void *data)
 878 {
 879         struct pending_cmd *cmd, *tmp;
 880
 881         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 882                 if (opcode > 0 && cmd->opcode != opcode)
 883                         continue;
 884
 885                 cb(cmd, data);
 886         }
 887 }
 888
 889 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 890 {
 891         struct pending_cmd *cmd;
 892
 893         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 894                 if (cmd->opcode == opcode)
 895                         return cmd;
 896         }
 897
 898         return NULL;
 899 }
 900
 901 static void mgmt_pending_remove(struct pending_cmd *cmd)
 902 {
 903         list_del(&cmd->list);
 904         mgmt_pending_free(cmd);
 905 }
 906
 907 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 908 {
 909         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 910
 911         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 912                             sizeof(settings));
 913 }
 914
 915 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 916                        u16 len)
 917 {
 918         struct mgmt_mode *cp = data;
 919         struct pending_cmd *cmd;
 920         int err;
 921
 922         BT_DBG("request for %s", hdev->name);
 923
 924         if (cp->val != 0x00 && cp->val != 0x01)
 925                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 926                                   MGMT_STATUS_INVALID_PARAMS);
 927
 928         hci_dev_lock(hdev);
 929
 930         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 931                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 932                                  MGMT_STATUS_BUSY);
 933                 goto failed;
 934         }
 935
 936         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 937                 cancel_delayed_work(&hdev->power_off);
 938
 939                 if (cp->val) {
 940                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 941                                          data, len);
 942                         err = mgmt_powered(hdev, 1);
 943                         goto failed;
 944                 }
 945         }
 946
 947         if (!!cp->val == hdev_is_powered(hdev)) {
 948                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 949                 goto failed;
 950         }
 951
 952         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 953         if (!cmd) {
 954                 err = -ENOMEM;
 955                 goto failed;
 956         }
 957
 958         if (cp->val)
 959                 queue_work(hdev->req_workqueue, &hdev->power_on);
 960         else
 961                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 962
 963         err = 0;
 964
 965 failed:
 966         hci_dev_unlock(hdev);
 967         return err;
 968 }
 969
 970 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 971                       struct sock *skip_sk)
 972 {
 973         struct sk_buff *skb;
 974         struct mgmt_hdr *hdr;
 975
 976         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 977         if (!skb)
 978                 return -ENOMEM;
 979
 980         hdr = (void *) skb_put(skb, sizeof(*hdr));
 981         hdr->opcode = cpu_to_le16(event);
 982         if (hdev)
 983                 hdr->index = cpu_to_le16(hdev->id);
 984         else
 985                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 986         hdr->len = cpu_to_le16(data_len);
 987
 988         if (data)
 989                 memcpy(skb_put(skb, data_len), data, data_len);
 990
 991         /* Time stamp */
 992         __net_timestamp(skb);
 993
 994         hci_send_to_control(skb, skip_sk);
 995         kfree_skb(skb);
 996
 997         return 0;
 998 }
 999
1000 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1001 {
1002         __le32 ev;
1003
1004         ev = cpu_to_le32(get_current_settings(hdev));
1005
1006         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1007 }
1008
1009 struct cmd_lookup {
1010         struct sock *sk;
1011         struct hci_dev *hdev;
1012         u8 mgmt_status;
1013 };
1014
1015 static void settings_rsp(struct pending_cmd *cmd, void *data)
1016 {
1017         struct cmd_lookup *match = data;
1018
1019         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1020
1021         list_del(&cmd->list);
1022
1023         if (match->sk == NULL) {
1024                 match->sk = cmd->sk;
1025                 sock_hold(match->sk);
1026         }
1027
1028         mgmt_pending_free(cmd);
1029 }
1030
1031 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1032 {
1033         u8 *status = data;
1034
1035         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1036         mgmt_pending_remove(cmd);
1037 }
1038
1039 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1040 {
1041         if (!lmp_bredr_capable(hdev))
1042                 return MGMT_STATUS_NOT_SUPPORTED;
1043         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1044                 return MGMT_STATUS_REJECTED;
1045         else
1046                 return MGMT_STATUS_SUCCESS;
1047 }
1048
1049 static u8 mgmt_le_support(struct hci_dev *hdev)
1050 {
1051         if (!lmp_le_capable(hdev))
1052                 return MGMT_STATUS_NOT_SUPPORTED;
1053         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1054                 return MGMT_STATUS_REJECTED;
1055         else
1056                 return MGMT_STATUS_SUCCESS;
1057 }
1058
1059 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1060 {
1061         struct pending_cmd *cmd;
1062         struct mgmt_mode *cp;
1063         struct hci_request req;
1064         bool changed;
1065
1066         BT_DBG("status 0x%02x", status);
1067
1068         hci_dev_lock(hdev);
1069
1070         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1071         if (!cmd)
1072                 goto unlock;
1073
1074         if (status) {
1075                 u8 mgmt_err = mgmt_status(status);
1076                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1077                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1078                 goto remove_cmd;
1079         }
1080
1081         cp = cmd->param;
1082         if (cp->val) {
1083                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1084                                             &hdev->dev_flags);
1085
1086                 if (hdev->discov_timeout > 0) {
1087                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1088                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1089                                            to);
1090                 }
1091         } else {
1092                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1093                                              &hdev->dev_flags);
1094         }
1095
1096         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1097
1098         if (changed)
1099                 new_settings(hdev, cmd->sk);
1100
1101         /* When the discoverable mode gets changed, make sure
1102          * that class of device has the limited discoverable
1103          * bit correctly set.
1104          */
1105         hci_req_init(&req, hdev);
1106         update_class(&req);
1107         hci_req_run(&req, NULL);
1108
1109 remove_cmd:
1110         mgmt_pending_remove(cmd);
1111
1112 unlock:
1113         hci_dev_unlock(hdev);
1114 }
1115
1116 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1117                             u16 len)
1118 {
1119         struct mgmt_cp_set_discoverable *cp = data;
1120         struct pending_cmd *cmd;
1121         struct hci_request req;
1122         u16 timeout;
1123         u8 scan, status;
1124         int err;
1125
1126         BT_DBG("request for %s", hdev->name);
1127
1128         status = mgmt_bredr_support(hdev);
1129         if (status)
1130                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1131                                   status);
1132
1133         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1134                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1135                                   MGMT_STATUS_INVALID_PARAMS);
1136
1137         timeout = __le16_to_cpu(cp->timeout);
1138
1139         /* Disabling discoverable requires that no timeout is set,
1140          * and enabling limited discoverable requires a timeout.
1141          */
1142         if ((cp->val == 0x00 && timeout > 0) ||
1143             (cp->val == 0x02 && timeout == 0))
1144                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1145                                   MGMT_STATUS_INVALID_PARAMS);
1146
1147         hci_dev_lock(hdev);
1148
1149         if (!hdev_is_powered(hdev) && timeout > 0) {
1150                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1151                                  MGMT_STATUS_NOT_POWERED);
1152                 goto failed;
1153         }
1154
1155         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1156             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1157                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1158                                  MGMT_STATUS_BUSY);
1159                 goto failed;
1160         }
1161
1162         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1163                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1164                                  MGMT_STATUS_REJECTED);
1165                 goto failed;
1166         }
1167
1168         if (!hdev_is_powered(hdev)) {
1169                 bool changed = false;
1170
1171                 /* Setting limited discoverable when powered off is
1172                  * not a valid operation since it requires a timeout
1173                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1174                  */
1175                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1176                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1177                         changed = true;
1178                 }
1179
1180                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1181                 if (err < 0)
1182                         goto failed;
1183
1184                 if (changed)
1185                         err = new_settings(hdev, sk);
1186
1187                 goto failed;
1188         }
1189
1190         /* If the current mode is the same, then just update the timeout
1191          * value with the new value. And if only the timeout gets updated,
1192          * then no need for any HCI transactions.
1193          */
1194         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1195             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1196                                           &hdev->dev_flags)) {
1197                 cancel_delayed_work(&hdev->discov_off);
1198                 hdev->discov_timeout = timeout;
1199
1200                 if (cp->val && hdev->discov_timeout > 0) {
1201                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1202                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1203                                            to);
1204                 }
1205
1206                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1207                 goto failed;
1208         }
1209
1210         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1211         if (!cmd) {
1212                 err = -ENOMEM;
1213                 goto failed;
1214         }
1215
1216         /* Cancel any potential discoverable timeout that might be
1217          * still active and store new timeout value. The arming of
1218          * the timeout happens in the complete handler.
1219          */
1220         cancel_delayed_work(&hdev->discov_off);
1221         hdev->discov_timeout = timeout;
1222
1223         hci_req_init(&req, hdev);
1224
1225         scan = SCAN_PAGE;
1226
1227         if (cp->val) {
1228                 struct hci_cp_write_current_iac_lap hci_cp;
1229
1230                 if (cp->val == 0x02) {
1231                         /* Limited discoverable mode */
1232                         set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1233
1234                         hci_cp.num_iac = 2;
1235                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1236                         hci_cp.iac_lap[1] = 0x8b;
1237                         hci_cp.iac_lap[2] = 0x9e;
1238                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1239                         hci_cp.iac_lap[4] = 0x8b;
1240                         hci_cp.iac_lap[5] = 0x9e;
1241                 } else {
1242                         /* General discoverable mode */
1243                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1244
1245                         hci_cp.num_iac = 1;
1246                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1247                         hci_cp.iac_lap[1] = 0x8b;
1248                         hci_cp.iac_lap[2] = 0x9e;
1249                 }
1250
1251                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1252                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1253
1254                 scan |= SCAN_INQUIRY;
1255         } else {
1256                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1257         }
1258
1259         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1260
1261         err = hci_req_run(&req, set_discoverable_complete);
1262         if (err < 0)
1263                 mgmt_pending_remove(cmd);
1264
1265 failed:
1266         hci_dev_unlock(hdev);
1267         return err;
1268 }
1269
1270 static void write_fast_connectable(struct hci_request *req, bool enable)
1271 {
1272         struct hci_dev *hdev = req->hdev;
1273         struct hci_cp_write_page_scan_activity acp;
1274         u8 type;
1275
1276         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1277                 return;
1278
1279         if (enable) {
1280                 type = PAGE_SCAN_TYPE_INTERLACED;
1281
1282                 /* 160 msec page scan interval */
1283                 acp.interval = __constant_cpu_to_le16(0x0100);
1284         } else {
1285                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1286
1287                 /* default 1.28 sec page scan */
1288                 acp.interval = __constant_cpu_to_le16(0x0800);
1289         }
1290
1291         acp.window = __constant_cpu_to_le16(0x0012);
1292
1293         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1294             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1295                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1296                             sizeof(acp), &acp);
1297
1298         if (hdev->page_scan_type != type)
1299                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1300 }
1301
1302 static u8 get_adv_type(struct hci_dev *hdev)
1303 {
1304         struct pending_cmd *cmd;
1305         bool connectable;
1306
1307         /* If there's a pending mgmt command the flag will not yet have
1308          * it's final value, so check for this first.
1309          */
1310         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1311         if (cmd) {
1312                 struct mgmt_mode *cp = cmd->param;
1313                 connectable = !!cp->val;
1314         } else {
1315                 connectable = test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1316         }
1317
1318         return connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1319 }
1320
1321 static void enable_advertising(struct hci_request *req)
1322 {
1323         struct hci_dev *hdev = req->hdev;
1324         struct hci_cp_le_set_adv_param cp;
1325         u8 enable = 0x01;
1326
1327         memset(&cp, 0, sizeof(cp));
1328         cp.min_interval = __constant_cpu_to_le16(0x0800);
1329         cp.max_interval = __constant_cpu_to_le16(0x0800);
1330         cp.type = get_adv_type(hdev);
1331         cp.own_address_type = hdev->own_addr_type;
1332         cp.channel_map = 0x07;
1333
1334         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1335
1336         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1337 }
1338
1339 static void disable_advertising(struct hci_request *req)
1340 {
1341         u8 enable = 0x00;
1342
1343         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1344 }
1345
1346 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1347 {
1348         struct pending_cmd *cmd;
1349         struct mgmt_mode *cp;
1350         bool changed;
1351
1352         BT_DBG("status 0x%02x", status);
1353
1354         hci_dev_lock(hdev);
1355
1356         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1357         if (!cmd)
1358                 goto unlock;
1359
1360         if (status) {
1361                 u8 mgmt_err = mgmt_status(status);
1362                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1363                 goto remove_cmd;
1364         }
1365
1366         cp = cmd->param;
1367         if (cp->val)
1368                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1369         else
1370                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1371
1372         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1373
1374         if (changed)
1375                 new_settings(hdev, cmd->sk);
1376
1377 remove_cmd:
1378         mgmt_pending_remove(cmd);
1379
1380 unlock:
1381         hci_dev_unlock(hdev);
1382 }
1383
1384 static int set_connectable_update_settings(struct hci_dev *hdev,
1385                                            struct sock *sk, u8 val)
1386 {
1387         bool changed = false;
1388         int err;
1389
1390         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1391                 changed = true;
1392
1393         if (val) {
1394                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1395         } else {
1396                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1397                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1398         }
1399
1400         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1401         if (err < 0)
1402                 return err;
1403
1404         if (changed)
1405                 return new_settings(hdev, sk);
1406
1407         return 0;
1408 }
1409
1410 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1411                            u16 len)
1412 {
1413         struct mgmt_mode *cp = data;
1414         struct pending_cmd *cmd;
1415         struct hci_request req;
1416         u8 scan;
1417         int err;
1418
1419         BT_DBG("request for %s", hdev->name);
1420
1421         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1422             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1423                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1424                                   MGMT_STATUS_REJECTED);
1425
1426         if (cp->val != 0x00 && cp->val != 0x01)
1427                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1428                                   MGMT_STATUS_INVALID_PARAMS);
1429
1430         hci_dev_lock(hdev);
1431
1432         if (!hdev_is_powered(hdev)) {
1433                 err = set_connectable_update_settings(hdev, sk, cp->val);
1434                 goto failed;
1435         }
1436
1437         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1438             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1439                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1440                                  MGMT_STATUS_BUSY);
1441                 goto failed;
1442         }
1443
1444         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1445         if (!cmd) {
1446                 err = -ENOMEM;
1447                 goto failed;
1448         }
1449
1450         hci_req_init(&req, hdev);
1451
1452         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
1453             cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1454                 if (cp->val) {
1455                         scan = SCAN_PAGE;
1456                 } else {
1457                         scan = 0;
1458
1459                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1460                             hdev->discov_timeout > 0)
1461                                 cancel_delayed_work(&hdev->discov_off);
1462                 }
1463
1464                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1465         }
1466
1467         /* If we're going from non-connectable to connectable or
1468          * vice-versa when fast connectable is enabled ensure that fast
1469          * connectable gets disabled. write_fast_connectable won't do
1470          * anything if the page scan parameters are already what they
1471          * should be.
1472          */
1473         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1474                 write_fast_connectable(&req, false);
1475
1476         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) &&
1477             hci_conn_num(hdev, LE_LINK) == 0) {
1478                 disable_advertising(&req);
1479                 enable_advertising(&req);
1480         }
1481
1482         err = hci_req_run(&req, set_connectable_complete);
1483         if (err < 0) {
1484                 mgmt_pending_remove(cmd);
1485                 if (err == -ENODATA)
1486                         err = set_connectable_update_settings(hdev, sk,
1487                                                               cp->val);
1488                 goto failed;
1489         }
1490
1491 failed:
1492         hci_dev_unlock(hdev);
1493         return err;
1494 }
1495
1496 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1497                         u16 len)
1498 {
1499         struct mgmt_mode *cp = data;
1500         bool changed;
1501         int err;
1502
1503         BT_DBG("request for %s", hdev->name);
1504
1505         if (cp->val != 0x00 && cp->val != 0x01)
1506                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1507                                   MGMT_STATUS_INVALID_PARAMS);
1508
1509         hci_dev_lock(hdev);
1510
1511         if (cp->val)
1512                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1513         else
1514                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1515
1516         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1517         if (err < 0)
1518                 goto unlock;
1519
1520         if (changed)
1521                 err = new_settings(hdev, sk);
1522
1523 unlock:
1524         hci_dev_unlock(hdev);
1525         return err;
1526 }
1527
1528 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1529                              u16 len)
1530 {
1531         struct mgmt_mode *cp = data;
1532         struct pending_cmd *cmd;
1533         u8 val, status;
1534         int err;
1535
1536         BT_DBG("request for %s", hdev->name);
1537
1538         status = mgmt_bredr_support(hdev);
1539         if (status)
1540                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1541                                   status);
1542
1543         if (cp->val != 0x00 && cp->val != 0x01)
1544                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1545                                   MGMT_STATUS_INVALID_PARAMS);
1546
1547         hci_dev_lock(hdev);
1548
1549         if (!hdev_is_powered(hdev)) {
1550                 bool changed = false;
1551
1552                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1553                                           &hdev->dev_flags)) {
1554                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1555                         changed = true;
1556                 }
1557
1558                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1559                 if (err < 0)
1560                         goto failed;
1561
1562                 if (changed)
1563                         err = new_settings(hdev, sk);
1564
1565                 goto failed;
1566         }
1567
1568         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1569                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1570                                  MGMT_STATUS_BUSY);
1571                 goto failed;
1572         }
1573
1574         val = !!cp->val;
1575
1576         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1577                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1578                 goto failed;
1579         }
1580
1581         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1582         if (!cmd) {
1583                 err = -ENOMEM;
1584                 goto failed;
1585         }
1586
1587         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1588         if (err < 0) {
1589                 mgmt_pending_remove(cmd);
1590                 goto failed;
1591         }
1592
1593 failed:
1594         hci_dev_unlock(hdev);
1595         return err;
1596 }
1597
1598 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1599 {
1600         struct mgmt_mode *cp = data;
1601         struct pending_cmd *cmd;
1602         u8 status;
1603         int err;
1604
1605         BT_DBG("request for %s", hdev->name);
1606
1607         status = mgmt_bredr_support(hdev);
1608         if (status)
1609                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1610
1611         if (!lmp_ssp_capable(hdev))
1612                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1613                                   MGMT_STATUS_NOT_SUPPORTED);
1614
1615         if (cp->val != 0x00 && cp->val != 0x01)
1616                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1617                                   MGMT_STATUS_INVALID_PARAMS);
1618
1619         hci_dev_lock(hdev);
1620
1621         if (!hdev_is_powered(hdev)) {
1622                 bool changed;
1623
1624                 if (cp->val) {
1625                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
1626                                                     &hdev->dev_flags);
1627                 } else {
1628                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
1629                                                      &hdev->dev_flags);
1630                         if (!changed)
1631                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
1632                                                              &hdev->dev_flags);
1633                         else
1634                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1635                 }
1636
1637                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1638                 if (err < 0)
1639                         goto failed;
1640
1641                 if (changed)
1642                         err = new_settings(hdev, sk);
1643
1644                 goto failed;
1645         }
1646
1647         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
1648             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
1649                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1650                                  MGMT_STATUS_BUSY);
1651                 goto failed;
1652         }
1653
1654         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1655                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1656                 goto failed;
1657         }
1658
1659         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1660         if (!cmd) {
1661                 err = -ENOMEM;
1662                 goto failed;
1663         }
1664
1665         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1666         if (err < 0) {
1667                 mgmt_pending_remove(cmd);
1668                 goto failed;
1669         }
1670
1671 failed:
1672         hci_dev_unlock(hdev);
1673         return err;
1674 }
1675
1676 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1677 {
1678         struct mgmt_mode *cp = data;
1679         bool changed;
1680         u8 status;
1681         int err;
1682
1683         BT_DBG("request for %s", hdev->name);
1684
1685         status = mgmt_bredr_support(hdev);
1686         if (status)
1687                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1688
1689         if (!lmp_ssp_capable(hdev))
1690                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1691                                   MGMT_STATUS_NOT_SUPPORTED);
1692
1693         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
1694                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1695                                   MGMT_STATUS_REJECTED);
1696
1697         if (cp->val != 0x00 && cp->val != 0x01)
1698                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1699                                   MGMT_STATUS_INVALID_PARAMS);
1700
1701         hci_dev_lock(hdev);
1702
1703         if (cp->val) {
1704                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1705         } else {
1706                 if (hdev_is_powered(hdev)) {
1707                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1708                                          MGMT_STATUS_REJECTED);
1709                         goto unlock;
1710                 }
1711
1712                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1713         }
1714
1715         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1716         if (err < 0)
1717                 goto unlock;
1718
1719         if (changed)
1720                 err = new_settings(hdev, sk);
1721
1722 unlock:
1723         hci_dev_unlock(hdev);
1724         return err;
1725 }
1726
1727 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1728 {
1729         struct cmd_lookup match = { NULL, hdev };
1730
1731         if (status) {
1732                 u8 mgmt_err = mgmt_status(status);
1733
1734                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1735                                      &mgmt_err);
1736                 return;
1737         }
1738
1739         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1740
1741         new_settings(hdev, match.sk);
1742
1743         if (match.sk)
1744                 sock_put(match.sk);
1745
1746         /* Make sure the controller has a good default for
1747          * advertising data. Restrict the update to when LE
1748          * has actually been enabled. During power on, the
1749          * update in powered_update_hci will take care of it.
1750          */
1751         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1752                 struct hci_request req;
1753
1754                 hci_dev_lock(hdev);
1755
1756                 hci_req_init(&req, hdev);
1757                 update_adv_data(&req);
1758                 update_scan_rsp_data(&req);
1759                 hci_req_run(&req, NULL);
1760
1761                 hci_dev_unlock(hdev);
1762         }
1763 }
1764
1765 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1766 {
1767         struct mgmt_mode *cp = data;
1768         struct hci_cp_write_le_host_supported hci_cp;
1769         struct pending_cmd *cmd;
1770         struct hci_request req;
1771         int err;
1772         u8 val, enabled;
1773
1774         BT_DBG("request for %s", hdev->name);
1775
1776         if (!lmp_le_capable(hdev))
1777                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1778                                   MGMT_STATUS_NOT_SUPPORTED);
1779
1780         if (cp->val != 0x00 && cp->val != 0x01)
1781                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1782                                   MGMT_STATUS_INVALID_PARAMS);
1783
1784         /* LE-only devices do not allow toggling LE on/off */
1785         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1786                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1787                                   MGMT_STATUS_REJECTED);
1788
1789         hci_dev_lock(hdev);
1790
1791         val = !!cp->val;
1792         enabled = lmp_host_le_capable(hdev);
1793
1794         if (!hdev_is_powered(hdev) || val == enabled) {
1795                 bool changed = false;
1796
1797                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1798                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1799                         changed = true;
1800                 }
1801
1802                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
1803                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1804                         changed = true;
1805                 }
1806
1807                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1808                 if (err < 0)
1809                         goto unlock;
1810
1811                 if (changed)
1812                         err = new_settings(hdev, sk);
1813
1814                 goto unlock;
1815         }
1816
1817         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1818             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1819                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1820                                  MGMT_STATUS_BUSY);
1821                 goto unlock;
1822         }
1823
1824         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1825         if (!cmd) {
1826                 err = -ENOMEM;
1827                 goto unlock;
1828         }
1829
1830         hci_req_init(&req, hdev);
1831
1832         memset(&hci_cp, 0, sizeof(hci_cp));
1833
1834         if (val) {
1835                 hci_cp.le = val;
1836                 hci_cp.simul = lmp_le_br_capable(hdev);
1837         } else {
1838                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1839                         disable_advertising(&req);
1840         }
1841
1842         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1843                     &hci_cp);
1844
1845         err = hci_req_run(&req, le_enable_complete);
1846         if (err < 0)
1847                 mgmt_pending_remove(cmd);
1848
1849 unlock:
1850         hci_dev_unlock(hdev);
1851         return err;
1852 }
1853
1854 /* This is a helper function to test for pending mgmt commands that can
1855  * cause CoD or EIR HCI commands. We can only allow one such pending
1856  * mgmt command at a time since otherwise we cannot easily track what
1857  * the current values are, will be, and based on that calculate if a new
1858  * HCI command needs to be sent and if yes with what value.
1859  */
1860 static bool pending_eir_or_class(struct hci_dev *hdev)
1861 {
1862         struct pending_cmd *cmd;
1863
1864         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1865                 switch (cmd->opcode) {
1866                 case MGMT_OP_ADD_UUID:
1867                 case MGMT_OP_REMOVE_UUID:
1868                 case MGMT_OP_SET_DEV_CLASS:
1869                 case MGMT_OP_SET_POWERED:
1870                         return true;
1871                 }
1872         }
1873
1874         return false;
1875 }
1876
1877 static const u8 bluetooth_base_uuid[] = {
1878                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1879                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1880 };
1881
1882 static u8 get_uuid_size(const u8 *uuid)
1883 {
1884         u32 val;
1885
1886         if (memcmp(uuid, bluetooth_base_uuid, 12))
1887                 return 128;
1888
1889         val = get_unaligned_le32(&uuid[12]);
1890         if (val > 0xffff)
1891                 return 32;
1892
1893         return 16;
1894 }
1895
1896 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1897 {
1898         struct pending_cmd *cmd;
1899
1900         hci_dev_lock(hdev);
1901
1902         cmd = mgmt_pending_find(mgmt_op, hdev);
1903         if (!cmd)
1904                 goto unlock;
1905
1906         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1907                      hdev->dev_class, 3);
1908
1909         mgmt_pending_remove(cmd);
1910
1911 unlock:
1912         hci_dev_unlock(hdev);
1913 }
1914
1915 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1916 {
1917         BT_DBG("status 0x%02x", status);
1918
1919         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1920 }
1921
1922 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1923 {
1924         struct mgmt_cp_add_uuid *cp = data;
1925         struct pending_cmd *cmd;
1926         struct hci_request req;
1927         struct bt_uuid *uuid;
1928         int err;
1929
1930         BT_DBG("request for %s", hdev->name);
1931
1932         hci_dev_lock(hdev);
1933
1934         if (pending_eir_or_class(hdev)) {
1935                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1936                                  MGMT_STATUS_BUSY);
1937                 goto failed;
1938         }
1939
1940         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1941         if (!uuid) {
1942                 err = -ENOMEM;
1943                 goto failed;
1944         }
1945
1946         memcpy(uuid->uuid, cp->uuid, 16);
1947         uuid->svc_hint = cp->svc_hint;
1948         uuid->size = get_uuid_size(cp->uuid);
1949
1950         list_add_tail(&uuid->list, &hdev->uuids);
1951
1952         hci_req_init(&req, hdev);
1953
1954         update_class(&req);
1955         update_eir(&req);
1956
1957         err = hci_req_run(&req, add_uuid_complete);
1958         if (err < 0) {
1959                 if (err != -ENODATA)
1960                         goto failed;
1961
1962                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1963                                    hdev->dev_class, 3);
1964                 goto failed;
1965         }
1966
1967         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1968         if (!cmd) {
1969                 err = -ENOMEM;
1970                 goto failed;
1971         }
1972
1973         err = 0;
1974
1975 failed:
1976         hci_dev_unlock(hdev);
1977         return err;
1978 }
1979
1980 static bool enable_service_cache(struct hci_dev *hdev)
1981 {
1982         if (!hdev_is_powered(hdev))
1983                 return false;
1984
1985         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1986                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1987                                    CACHE_TIMEOUT);
1988                 return true;
1989         }
1990
1991         return false;
1992 }
1993
1994 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1995 {
1996         BT_DBG("status 0x%02x", status);
1997
1998         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1999 }
2000
2001 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2002                        u16 len)
2003 {
2004         struct mgmt_cp_remove_uuid *cp = data;
2005         struct pending_cmd *cmd;
2006         struct bt_uuid *match, *tmp;
2007         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2008         struct hci_request req;
2009         int err, found;
2010
2011         BT_DBG("request for %s", hdev->name);
2012
2013         hci_dev_lock(hdev);
2014
2015         if (pending_eir_or_class(hdev)) {
2016                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2017                                  MGMT_STATUS_BUSY);
2018                 goto unlock;
2019         }
2020
2021         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2022                 err = hci_uuids_clear(hdev);
2023
2024                 if (enable_service_cache(hdev)) {
2025                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2026                                            0, hdev->dev_class, 3);
2027                         goto unlock;
2028                 }
2029
2030                 goto update_class;
2031         }
2032
2033         found = 0;
2034
2035         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2036                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2037                         continue;
2038
2039                 list_del(&match->list);
2040                 kfree(match);
2041                 found++;
2042         }
2043
2044         if (found == 0) {
2045                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2046                                  MGMT_STATUS_INVALID_PARAMS);
2047                 goto unlock;
2048         }
2049
2050 update_class:
2051         hci_req_init(&req, hdev);
2052
2053         update_class(&req);
2054         update_eir(&req);
2055
2056         err = hci_req_run(&req, remove_uuid_complete);
2057         if (err < 0) {
2058                 if (err != -ENODATA)
2059                         goto unlock;
2060
2061                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2062                                    hdev->dev_class, 3);
2063                 goto unlock;
2064         }
2065
2066         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2067         if (!cmd) {
2068                 err = -ENOMEM;
2069                 goto unlock;
2070         }
2071
2072         err = 0;
2073
2074 unlock:
2075         hci_dev_unlock(hdev);
2076         return err;
2077 }
2078
2079 static void set_class_complete(struct hci_dev *hdev, u8 status)
2080 {
2081         BT_DBG("status 0x%02x", status);
2082
2083         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2084 }
2085
2086 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2087                          u16 len)
2088 {
2089         struct mgmt_cp_set_dev_class *cp = data;
2090         struct pending_cmd *cmd;
2091         struct hci_request req;
2092         int err;
2093
2094         BT_DBG("request for %s", hdev->name);
2095
2096         if (!lmp_bredr_capable(hdev))
2097                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2098                                   MGMT_STATUS_NOT_SUPPORTED);
2099
2100         hci_dev_lock(hdev);
2101
2102         if (pending_eir_or_class(hdev)) {
2103                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2104                                  MGMT_STATUS_BUSY);
2105                 goto unlock;
2106         }
2107
2108         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2109                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2110                                  MGMT_STATUS_INVALID_PARAMS);
2111                 goto unlock;
2112         }
2113
2114         hdev->major_class = cp->major;
2115         hdev->minor_class = cp->minor;
2116
2117         if (!hdev_is_powered(hdev)) {
2118                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2119                                    hdev->dev_class, 3);
2120                 goto unlock;
2121         }
2122
2123         hci_req_init(&req, hdev);
2124
2125         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2126                 hci_dev_unlock(hdev);
2127                 cancel_delayed_work_sync(&hdev->service_cache);
2128                 hci_dev_lock(hdev);
2129                 update_eir(&req);
2130         }
2131
2132         update_class(&req);
2133
2134         err = hci_req_run(&req, set_class_complete);
2135         if (err < 0) {
2136                 if (err != -ENODATA)
2137                         goto unlock;
2138
2139                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2140                                    hdev->dev_class, 3);
2141                 goto unlock;
2142         }
2143
2144         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2145         if (!cmd) {
2146                 err = -ENOMEM;
2147                 goto unlock;
2148         }
2149
2150         err = 0;
2151
2152 unlock:
2153         hci_dev_unlock(hdev);
2154         return err;
2155 }
2156
2157 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2158                           u16 len)
2159 {
2160         struct mgmt_cp_load_link_keys *cp = data;
2161         u16 key_count, expected_len;
2162         int i;
2163
2164         BT_DBG("request for %s", hdev->name);
2165
2166         if (!lmp_bredr_capable(hdev))
2167                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2168                                   MGMT_STATUS_NOT_SUPPORTED);
2169
2170         key_count = __le16_to_cpu(cp->key_count);
2171
2172         expected_len = sizeof(*cp) + key_count *
2173                                         sizeof(struct mgmt_link_key_info);
2174         if (expected_len != len) {
2175                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2176                        len, expected_len);
2177                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2178                                   MGMT_STATUS_INVALID_PARAMS);
2179         }
2180
2181         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2182                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2183                                   MGMT_STATUS_INVALID_PARAMS);
2184
2185         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2186                key_count);
2187
2188         for (i = 0; i < key_count; i++) {
2189                 struct mgmt_link_key_info *key = &cp->keys[i];
2190
2191                 if (key->addr.type != BDADDR_BREDR)
2192                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2193                                           MGMT_STATUS_INVALID_PARAMS);
2194         }
2195
2196         hci_dev_lock(hdev);
2197
2198         hci_link_keys_clear(hdev);
2199
2200         if (cp->debug_keys)
2201                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2202         else
2203                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2204
2205         for (i = 0; i < key_count; i++) {
2206                 struct mgmt_link_key_info *key = &cp->keys[i];
2207
2208                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
2209                                  key->type, key->pin_len);
2210         }
2211
2212         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2213
2214         hci_dev_unlock(hdev);
2215
2216         return 0;
2217 }
2218
2219 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2220                            u8 addr_type, struct sock *skip_sk)
2221 {
2222         struct mgmt_ev_device_unpaired ev;
2223
2224         bacpy(&ev.addr.bdaddr, bdaddr);
2225         ev.addr.type = addr_type;
2226
2227         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2228                           skip_sk);
2229 }
2230
2231 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2232                          u16 len)
2233 {
2234         struct mgmt_cp_unpair_device *cp = data;
2235         struct mgmt_rp_unpair_device rp;
2236         struct hci_cp_disconnect dc;
2237         struct pending_cmd *cmd;
2238         struct hci_conn *conn;
2239         int err;
2240
2241         memset(&rp, 0, sizeof(rp));
2242         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2243         rp.addr.type = cp->addr.type;
2244
2245         if (!bdaddr_type_is_valid(cp->addr.type))
2246                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2247                                     MGMT_STATUS_INVALID_PARAMS,
2248                                     &rp, sizeof(rp));
2249
2250         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2251                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2252                                     MGMT_STATUS_INVALID_PARAMS,
2253                                     &rp, sizeof(rp));
2254
2255         hci_dev_lock(hdev);
2256
2257         if (!hdev_is_powered(hdev)) {
2258                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2259                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2260                 goto unlock;
2261         }
2262
2263         if (cp->addr.type == BDADDR_BREDR)
2264                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2265         else
2266                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
2267
2268         if (err < 0) {
2269                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2270                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2271                 goto unlock;
2272         }
2273
2274         if (cp->disconnect) {
2275                 if (cp->addr.type == BDADDR_BREDR)
2276                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2277                                                        &cp->addr.bdaddr);
2278                 else
2279                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2280                                                        &cp->addr.bdaddr);
2281         } else {
2282                 conn = NULL;
2283         }
2284
2285         if (!conn) {
2286                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2287                                    &rp, sizeof(rp));
2288                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2289                 goto unlock;
2290         }
2291
2292         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2293                                sizeof(*cp));
2294         if (!cmd) {
2295                 err = -ENOMEM;
2296                 goto unlock;
2297         }
2298
2299         dc.handle = cpu_to_le16(conn->handle);
2300         dc.reason = 0x13; /* Remote User Terminated Connection */
2301         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2302         if (err < 0)
2303                 mgmt_pending_remove(cmd);
2304
2305 unlock:
2306         hci_dev_unlock(hdev);
2307         return err;
2308 }
2309
2310 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2311                       u16 len)
2312 {
2313         struct mgmt_cp_disconnect *cp = data;
2314         struct mgmt_rp_disconnect rp;
2315         struct hci_cp_disconnect dc;
2316         struct pending_cmd *cmd;
2317         struct hci_conn *conn;
2318         int err;
2319
2320         BT_DBG("");
2321
2322         memset(&rp, 0, sizeof(rp));
2323         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2324         rp.addr.type = cp->addr.type;
2325
2326         if (!bdaddr_type_is_valid(cp->addr.type))
2327                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2328                                     MGMT_STATUS_INVALID_PARAMS,
2329                                     &rp, sizeof(rp));
2330
2331         hci_dev_lock(hdev);
2332
2333         if (!test_bit(HCI_UP, &hdev->flags)) {
2334                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2335                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2336                 goto failed;
2337         }
2338
2339         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2340                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2341                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2342                 goto failed;
2343         }
2344
2345         if (cp->addr.type == BDADDR_BREDR)
2346                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2347                                                &cp->addr.bdaddr);
2348         else
2349                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2350
2351         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2352                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2353                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2354                 goto failed;
2355         }
2356
2357         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2358         if (!cmd) {
2359                 err = -ENOMEM;
2360                 goto failed;
2361         }
2362
2363         dc.handle = cpu_to_le16(conn->handle);
2364         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2365
2366         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2367         if (err < 0)
2368                 mgmt_pending_remove(cmd);
2369
2370 failed:
2371         hci_dev_unlock(hdev);
2372         return err;
2373 }
2374
2375 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2376 {
2377         switch (link_type) {
2378         case LE_LINK:
2379                 switch (addr_type) {
2380                 case ADDR_LE_DEV_PUBLIC:
2381                         return BDADDR_LE_PUBLIC;
2382
2383                 default:
2384                         /* Fallback to LE Random address type */
2385                         return BDADDR_LE_RANDOM;
2386                 }
2387
2388         default:
2389                 /* Fallback to BR/EDR type */
2390                 return BDADDR_BREDR;
2391         }
2392 }
2393
2394 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2395                            u16 data_len)
2396 {
2397         struct mgmt_rp_get_connections *rp;
2398         struct hci_conn *c;
2399         size_t rp_len;
2400         int err;
2401         u16 i;
2402
2403         BT_DBG("");
2404
2405         hci_dev_lock(hdev);
2406
2407         if (!hdev_is_powered(hdev)) {
2408                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2409                                  MGMT_STATUS_NOT_POWERED);
2410                 goto unlock;
2411         }
2412
2413         i = 0;
2414         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2415                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2416                         i++;
2417         }
2418
2419         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2420         rp = kmalloc(rp_len, GFP_KERNEL);
2421         if (!rp) {
2422                 err = -ENOMEM;
2423                 goto unlock;
2424         }
2425
2426         i = 0;
2427         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2428                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2429                         continue;
2430                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2431                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2432                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2433                         continue;
2434                 i++;
2435         }
2436
2437         rp->conn_count = cpu_to_le16(i);
2438
2439         /* Recalculate length in case of filtered SCO connections, etc */
2440         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2441
2442         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2443                            rp_len);
2444
2445         kfree(rp);
2446
2447 unlock:
2448         hci_dev_unlock(hdev);
2449         return err;
2450 }
2451
2452 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2453                                    struct mgmt_cp_pin_code_neg_reply *cp)
2454 {
2455         struct pending_cmd *cmd;
2456         int err;
2457
2458         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2459                                sizeof(*cp));
2460         if (!cmd)
2461                 return -ENOMEM;
2462
2463         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2464                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2465         if (err < 0)
2466                 mgmt_pending_remove(cmd);
2467
2468         return err;
2469 }
2470
2471 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2472                           u16 len)
2473 {
2474         struct hci_conn *conn;
2475         struct mgmt_cp_pin_code_reply *cp = data;
2476         struct hci_cp_pin_code_reply reply;
2477         struct pending_cmd *cmd;
2478         int err;
2479
2480         BT_DBG("");
2481
2482         hci_dev_lock(hdev);
2483
2484         if (!hdev_is_powered(hdev)) {
2485                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2486                                  MGMT_STATUS_NOT_POWERED);
2487                 goto failed;
2488         }
2489
2490         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2491         if (!conn) {
2492                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2493                                  MGMT_STATUS_NOT_CONNECTED);
2494                 goto failed;
2495         }
2496
2497         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2498                 struct mgmt_cp_pin_code_neg_reply ncp;
2499
2500                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2501
2502                 BT_ERR("PIN code is not 16 bytes long");
2503
2504                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2505                 if (err >= 0)
2506                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2507                                          MGMT_STATUS_INVALID_PARAMS);
2508
2509                 goto failed;
2510         }
2511
2512         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2513         if (!cmd) {
2514                 err = -ENOMEM;
2515                 goto failed;
2516         }
2517
2518         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2519         reply.pin_len = cp->pin_len;
2520         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2521
2522         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2523         if (err < 0)
2524                 mgmt_pending_remove(cmd);
2525
2526 failed:
2527         hci_dev_unlock(hdev);
2528         return err;
2529 }
2530
2531 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2532                              u16 len)
2533 {
2534         struct mgmt_cp_set_io_capability *cp = data;
2535
2536         BT_DBG("");
2537
2538         hci_dev_lock(hdev);
2539
2540         hdev->io_capability = cp->io_capability;
2541
2542         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2543                hdev->io_capability);
2544
2545         hci_dev_unlock(hdev);
2546
2547         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2548                             0);
2549 }
2550
2551 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2552 {
2553         struct hci_dev *hdev = conn->hdev;
2554         struct pending_cmd *cmd;
2555
2556         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2557                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2558                         continue;
2559
2560                 if (cmd->user_data != conn)
2561                         continue;
2562
2563                 return cmd;
2564         }
2565
2566         return NULL;
2567 }
2568
2569 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2570 {
2571         struct mgmt_rp_pair_device rp;
2572         struct hci_conn *conn = cmd->user_data;
2573
2574         bacpy(&rp.addr.bdaddr, &conn->dst);
2575         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2576
2577         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2578                      &rp, sizeof(rp));
2579
2580         /* So we don't get further callbacks for this connection */
2581         conn->connect_cfm_cb = NULL;
2582         conn->security_cfm_cb = NULL;
2583         conn->disconn_cfm_cb = NULL;
2584
2585         hci_conn_drop(conn);
2586
2587         mgmt_pending_remove(cmd);
2588 }
2589
2590 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2591 {
2592         struct pending_cmd *cmd;
2593
2594         BT_DBG("status %u", status);
2595
2596         cmd = find_pairing(conn);
2597         if (!cmd)
2598                 BT_DBG("Unable to find a pending command");
2599         else
2600                 pairing_complete(cmd, mgmt_status(status));
2601 }
2602
2603 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2604 {
2605         struct pending_cmd *cmd;
2606
2607         BT_DBG("status %u", status);
2608
2609         if (!status)
2610                 return;
2611
2612         cmd = find_pairing(conn);
2613         if (!cmd)
2614                 BT_DBG("Unable to find a pending command");
2615         else
2616                 pairing_complete(cmd, mgmt_status(status));
2617 }
2618
2619 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2620                        u16 len)
2621 {
2622         struct mgmt_cp_pair_device *cp = data;
2623         struct mgmt_rp_pair_device rp;
2624         struct pending_cmd *cmd;
2625         u8 sec_level, auth_type;
2626         struct hci_conn *conn;
2627         int err;
2628
2629         BT_DBG("");
2630
2631         memset(&rp, 0, sizeof(rp));
2632         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2633         rp.addr.type = cp->addr.type;
2634
2635         if (!bdaddr_type_is_valid(cp->addr.type))
2636                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2637                                     MGMT_STATUS_INVALID_PARAMS,
2638                                     &rp, sizeof(rp));
2639
2640         hci_dev_lock(hdev);
2641
2642         if (!hdev_is_powered(hdev)) {
2643                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2644                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2645                 goto unlock;
2646         }
2647
2648         sec_level = BT_SECURITY_MEDIUM;
2649         if (cp->io_cap == 0x03)
2650                 auth_type = HCI_AT_DEDICATED_BONDING;
2651         else
2652                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2653
2654         if (cp->addr.type == BDADDR_BREDR)
2655                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2656                                    cp->addr.type, sec_level, auth_type);
2657         else
2658                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2659                                    cp->addr.type, sec_level, auth_type);
2660
2661         if (IS_ERR(conn)) {
2662                 int status;
2663
2664                 if (PTR_ERR(conn) == -EBUSY)
2665                         status = MGMT_STATUS_BUSY;
2666                 else
2667                         status = MGMT_STATUS_CONNECT_FAILED;
2668
2669                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2670                                    status, &rp,
2671                                    sizeof(rp));
2672                 goto unlock;
2673         }
2674
2675         if (conn->connect_cfm_cb) {
2676                 hci_conn_drop(conn);
2677                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2678                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2679                 goto unlock;
2680         }
2681
2682         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2683         if (!cmd) {
2684                 err = -ENOMEM;
2685                 hci_conn_drop(conn);
2686                 goto unlock;
2687         }
2688
2689         /* For LE, just connecting isn't a proof that the pairing finished */
2690         if (cp->addr.type == BDADDR_BREDR)
2691                 conn->connect_cfm_cb = pairing_complete_cb;
2692         else
2693                 conn->connect_cfm_cb = le_connect_complete_cb;
2694
2695         conn->security_cfm_cb = pairing_complete_cb;
2696         conn->disconn_cfm_cb = pairing_complete_cb;
2697         conn->io_capability = cp->io_cap;
2698         cmd->user_data = conn;
2699
2700         if (conn->state == BT_CONNECTED &&
2701             hci_conn_security(conn, sec_level, auth_type))
2702                 pairing_complete(cmd, 0);
2703
2704         err = 0;
2705
2706 unlock:
2707         hci_dev_unlock(hdev);
2708         return err;
2709 }
2710
2711 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2712                               u16 len)
2713 {
2714         struct mgmt_addr_info *addr = data;
2715         struct pending_cmd *cmd;
2716         struct hci_conn *conn;
2717         int err;
2718
2719         BT_DBG("");
2720
2721         hci_dev_lock(hdev);
2722
2723         if (!hdev_is_powered(hdev)) {
2724                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2725                                  MGMT_STATUS_NOT_POWERED);
2726                 goto unlock;
2727         }
2728
2729         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2730         if (!cmd) {
2731                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2732                                  MGMT_STATUS_INVALID_PARAMS);
2733                 goto unlock;
2734         }
2735
2736         conn = cmd->user_data;
2737
2738         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2739                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2740                                  MGMT_STATUS_INVALID_PARAMS);
2741                 goto unlock;
2742         }
2743
2744         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2745
2746         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2747                            addr, sizeof(*addr));
2748 unlock:
2749         hci_dev_unlock(hdev);
2750         return err;
2751 }
2752
2753 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2754                              struct mgmt_addr_info *addr, u16 mgmt_op,
2755                              u16 hci_op, __le32 passkey)
2756 {
2757         struct pending_cmd *cmd;
2758         struct hci_conn *conn;
2759         int err;
2760
2761         hci_dev_lock(hdev);
2762
2763         if (!hdev_is_powered(hdev)) {
2764                 err = cmd_complete(sk, hdev->id, mgmt_op,
2765                                    MGMT_STATUS_NOT_POWERED, addr,
2766                                    sizeof(*addr));
2767                 goto done;
2768         }
2769
2770         if (addr->type == BDADDR_BREDR)
2771                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2772         else
2773                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2774
2775         if (!conn) {
2776                 err = cmd_complete(sk, hdev->id, mgmt_op,
2777                                    MGMT_STATUS_NOT_CONNECTED, addr,
2778                                    sizeof(*addr));
2779                 goto done;
2780         }
2781
2782         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2783                 /* Continue with pairing via SMP */
2784                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2785
2786                 if (!err)
2787                         err = cmd_complete(sk, hdev->id, mgmt_op,
2788                                            MGMT_STATUS_SUCCESS, addr,
2789                                            sizeof(*addr));
2790                 else
2791                         err = cmd_complete(sk, hdev->id, mgmt_op,
2792                                            MGMT_STATUS_FAILED, addr,
2793                                            sizeof(*addr));
2794
2795                 goto done;
2796         }
2797
2798         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2799         if (!cmd) {
2800                 err = -ENOMEM;
2801                 goto done;
2802         }
2803
2804         /* Continue with pairing via HCI */
2805         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2806                 struct hci_cp_user_passkey_reply cp;
2807
2808                 bacpy(&cp.bdaddr, &addr->bdaddr);
2809                 cp.passkey = passkey;
2810                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2811         } else
2812                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2813                                    &addr->bdaddr);
2814
2815         if (err < 0)
2816                 mgmt_pending_remove(cmd);
2817
2818 done:
2819         hci_dev_unlock(hdev);
2820         return err;
2821 }
2822
2823 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2824                               void *data, u16 len)
2825 {
2826         struct mgmt_cp_pin_code_neg_reply *cp = data;
2827
2828         BT_DBG("");
2829
2830         return user_pairing_resp(sk, hdev, &cp->addr,
2831                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2832                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2833 }
2834
2835 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2836                               u16 len)
2837 {
2838         struct mgmt_cp_user_confirm_reply *cp = data;
2839
2840         BT_DBG("");
2841
2842         if (len != sizeof(*cp))
2843                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2844                                   MGMT_STATUS_INVALID_PARAMS);
2845
2846         return user_pairing_resp(sk, hdev, &cp->addr,
2847                                  MGMT_OP_USER_CONFIRM_REPLY,
2848                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2849 }
2850
2851 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2852                                   void *data, u16 len)
2853 {
2854         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2855
2856         BT_DBG("");
2857
2858         return user_pairing_resp(sk, hdev, &cp->addr,
2859                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2860                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2861 }
2862
2863 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2864                               u16 len)
2865 {
2866         struct mgmt_cp_user_passkey_reply *cp = data;
2867
2868         BT_DBG("");
2869
2870         return user_pairing_resp(sk, hdev, &cp->addr,
2871                                  MGMT_OP_USER_PASSKEY_REPLY,
2872                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2873 }
2874
2875 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2876                                   void *data, u16 len)
2877 {
2878         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2879
2880         BT_DBG("");
2881
2882         return user_pairing_resp(sk, hdev, &cp->addr,
2883                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2884                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2885 }
2886
2887 static void update_name(struct hci_request *req)
2888 {
2889         struct hci_dev *hdev = req->hdev;
2890         struct hci_cp_write_local_name cp;
2891
2892         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2893
2894         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2895 }
2896
2897 static void set_name_complete(struct hci_dev *hdev, u8 status)
2898 {
2899         struct mgmt_cp_set_local_name *cp;
2900         struct pending_cmd *cmd;
2901
2902         BT_DBG("status 0x%02x", status);
2903
2904         hci_dev_lock(hdev);
2905
2906         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2907         if (!cmd)
2908                 goto unlock;
2909
2910         cp = cmd->param;
2911
2912         if (status)
2913                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2914                            mgmt_status(status));
2915         else
2916                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2917                              cp, sizeof(*cp));
2918
2919         mgmt_pending_remove(cmd);
2920
2921 unlock:
2922         hci_dev_unlock(hdev);
2923 }
2924
2925 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2926                           u16 len)
2927 {
2928         struct mgmt_cp_set_local_name *cp = data;
2929         struct pending_cmd *cmd;
2930         struct hci_request req;
2931         int err;
2932
2933         BT_DBG("");
2934
2935         hci_dev_lock(hdev);
2936
2937         /* If the old values are the same as the new ones just return a
2938          * direct command complete event.
2939          */
2940         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2941             !memcmp(hdev->short_name, cp->short_name,
2942                     sizeof(hdev->short_name))) {
2943                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2944                                    data, len);
2945                 goto failed;
2946         }
2947
2948         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2949
2950         if (!hdev_is_powered(hdev)) {
2951                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2952
2953                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2954                                    data, len);
2955                 if (err < 0)
2956                         goto failed;
2957
2958                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2959                                  sk);
2960
2961                 goto failed;
2962         }
2963
2964         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2965         if (!cmd) {
2966                 err = -ENOMEM;
2967                 goto failed;
2968         }
2969
2970         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2971
2972         hci_req_init(&req, hdev);
2973
2974         if (lmp_bredr_capable(hdev)) {
2975                 update_name(&req);
2976                 update_eir(&req);
2977         }
2978
2979         /* The name is stored in the scan response data and so
2980          * no need to udpate the advertising data here.
2981          */
2982         if (lmp_le_capable(hdev))
2983                 update_scan_rsp_data(&req);
2984
2985         err = hci_req_run(&req, set_name_complete);
2986         if (err < 0)
2987                 mgmt_pending_remove(cmd);
2988
2989 failed:
2990         hci_dev_unlock(hdev);
2991         return err;
2992 }
2993
2994 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2995                                void *data, u16 data_len)
2996 {
2997         struct pending_cmd *cmd;
2998         int err;
2999
3000         BT_DBG("%s", hdev->name);
3001
3002         hci_dev_lock(hdev);
3003
3004         if (!hdev_is_powered(hdev)) {
3005                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3006                                  MGMT_STATUS_NOT_POWERED);
3007                 goto unlock;
3008         }
3009
3010         if (!lmp_ssp_capable(hdev)) {
3011                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3012                                  MGMT_STATUS_NOT_SUPPORTED);
3013                 goto unlock;
3014         }
3015
3016         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3017                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3018                                  MGMT_STATUS_BUSY);
3019                 goto unlock;
3020         }
3021
3022         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3023         if (!cmd) {
3024                 err = -ENOMEM;
3025                 goto unlock;
3026         }
3027
3028         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3029         if (err < 0)
3030                 mgmt_pending_remove(cmd);
3031
3032 unlock:
3033         hci_dev_unlock(hdev);
3034         return err;
3035 }
3036
3037 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3038                                void *data, u16 len)
3039 {
3040         struct mgmt_cp_add_remote_oob_data *cp = data;
3041         u8 status;
3042         int err;
3043
3044         BT_DBG("%s ", hdev->name);
3045
3046         hci_dev_lock(hdev);
3047
3048         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
3049                                       cp->randomizer);
3050         if (err < 0)
3051                 status = MGMT_STATUS_FAILED;
3052         else
3053                 status = MGMT_STATUS_SUCCESS;
3054
3055         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3056                            &cp->addr, sizeof(cp->addr));
3057
3058         hci_dev_unlock(hdev);
3059         return err;
3060 }
3061
3062 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3063                                   void *data, u16 len)
3064 {
3065         struct mgmt_cp_remove_remote_oob_data *cp = data;
3066         u8 status;
3067         int err;
3068
3069         BT_DBG("%s", hdev->name);
3070
3071         hci_dev_lock(hdev);
3072
3073         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
3074         if (err < 0)
3075                 status = MGMT_STATUS_INVALID_PARAMS;
3076         else
3077                 status = MGMT_STATUS_SUCCESS;
3078
3079         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3080                            status, &cp->addr, sizeof(cp->addr));
3081
3082         hci_dev_unlock(hdev);
3083         return err;
3084 }
3085
3086 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3087 {
3088         struct pending_cmd *cmd;
3089         u8 type;
3090         int err;
3091
3092         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3093
3094         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3095         if (!cmd)
3096                 return -ENOENT;
3097
3098         type = hdev->discovery.type;
3099
3100         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3101                            &type, sizeof(type));
3102         mgmt_pending_remove(cmd);
3103
3104         return err;
3105 }
3106
3107 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3108 {
3109         BT_DBG("status %d", status);
3110
3111         if (status) {
3112                 hci_dev_lock(hdev);
3113                 mgmt_start_discovery_failed(hdev, status);
3114                 hci_dev_unlock(hdev);
3115                 return;
3116         }
3117
3118         hci_dev_lock(hdev);
3119         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3120         hci_dev_unlock(hdev);
3121
3122         switch (hdev->discovery.type) {
3123         case DISCOV_TYPE_LE:
3124                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
3125                                    DISCOV_LE_TIMEOUT);
3126                 break;
3127
3128         case DISCOV_TYPE_INTERLEAVED:
3129                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
3130                                    DISCOV_INTERLEAVED_TIMEOUT);
3131                 break;
3132
3133         case DISCOV_TYPE_BREDR:
3134                 break;
3135
3136         default:
3137                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3138         }
3139 }
3140
3141 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3142                            void *data, u16 len)
3143 {
3144         struct mgmt_cp_start_discovery *cp = data;
3145         struct pending_cmd *cmd;
3146         struct hci_cp_le_set_scan_param param_cp;
3147         struct hci_cp_le_set_scan_enable enable_cp;
3148         struct hci_cp_inquiry inq_cp;
3149         struct hci_request req;
3150         /* General inquiry access code (GIAC) */
3151         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3152         u8 status;
3153         int err;
3154
3155         BT_DBG("%s", hdev->name);
3156
3157         hci_dev_lock(hdev);
3158
3159         if (!hdev_is_powered(hdev)) {
3160                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3161                                  MGMT_STATUS_NOT_POWERED);
3162                 goto failed;
3163         }
3164
3165         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3166                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3167                                  MGMT_STATUS_BUSY);
3168                 goto failed;
3169         }
3170
3171         if (hdev->discovery.state != DISCOVERY_STOPPED) {
3172                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3173                                  MGMT_STATUS_BUSY);
3174                 goto failed;
3175         }
3176
3177         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3178         if (!cmd) {
3179                 err = -ENOMEM;
3180                 goto failed;
3181         }
3182
3183         hdev->discovery.type = cp->type;
3184
3185         hci_req_init(&req, hdev);
3186
3187         switch (hdev->discovery.type) {
3188         case DISCOV_TYPE_BREDR:
3189                 status = mgmt_bredr_support(hdev);
3190                 if (status) {
3191                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3192                                          status);
3193                         mgmt_pending_remove(cmd);
3194                         goto failed;
3195                 }
3196
3197                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3198                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3199                                          MGMT_STATUS_BUSY);
3200                         mgmt_pending_remove(cmd);
3201                         goto failed;
3202                 }
3203
3204                 hci_inquiry_cache_flush(hdev);
3205
3206                 memset(&inq_cp, 0, sizeof(inq_cp));
3207                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3208                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3209                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3210                 break;
3211
3212         case DISCOV_TYPE_LE:
3213         case DISCOV_TYPE_INTERLEAVED:
3214                 status = mgmt_le_support(hdev);
3215                 if (status) {
3216                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3217                                          status);
3218                         mgmt_pending_remove(cmd);
3219                         goto failed;
3220                 }
3221
3222                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3223                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3224                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3225                                          MGMT_STATUS_NOT_SUPPORTED);
3226                         mgmt_pending_remove(cmd);
3227                         goto failed;
3228                 }
3229
3230                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3231                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3232                                          MGMT_STATUS_REJECTED);
3233                         mgmt_pending_remove(cmd);
3234                         goto failed;
3235                 }
3236
3237                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
3238                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3239                                          MGMT_STATUS_BUSY);
3240                         mgmt_pending_remove(cmd);
3241                         goto failed;
3242                 }
3243
3244                 memset(&param_cp, 0, sizeof(param_cp));
3245                 param_cp.type = LE_SCAN_ACTIVE;
3246                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3247                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3248                 param_cp.own_address_type = hdev->own_addr_type;
3249                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3250                             &param_cp);
3251
3252                 memset(&enable_cp, 0, sizeof(enable_cp));
3253                 enable_cp.enable = LE_SCAN_ENABLE;
3254                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3255                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3256                             &enable_cp);
3257                 break;
3258
3259         default:
3260                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3261                                  MGMT_STATUS_INVALID_PARAMS);
3262                 mgmt_pending_remove(cmd);
3263                 goto failed;
3264         }
3265
3266         err = hci_req_run(&req, start_discovery_complete);
3267         if (err < 0)
3268                 mgmt_pending_remove(cmd);
3269         else
3270                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3271
3272 failed:
3273         hci_dev_unlock(hdev);
3274         return err;
3275 }
3276
3277 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3278 {
3279         struct pending_cmd *cmd;
3280         int err;
3281
3282         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3283         if (!cmd)
3284                 return -ENOENT;
3285
3286         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3287                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3288         mgmt_pending_remove(cmd);
3289
3290         return err;
3291 }
3292
3293 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3294 {
3295         BT_DBG("status %d", status);
3296
3297         hci_dev_lock(hdev);
3298
3299         if (status) {
3300                 mgmt_stop_discovery_failed(hdev, status);
3301                 goto unlock;
3302         }
3303
3304         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3305
3306 unlock:
3307         hci_dev_unlock(hdev);
3308 }
3309
3310 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3311                           u16 len)
3312 {
3313         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3314         struct pending_cmd *cmd;
3315         struct hci_cp_remote_name_req_cancel cp;
3316         struct inquiry_entry *e;
3317         struct hci_request req;
3318         struct hci_cp_le_set_scan_enable enable_cp;
3319         int err;
3320
3321         BT_DBG("%s", hdev->name);
3322
3323         hci_dev_lock(hdev);
3324
3325         if (!hci_discovery_active(hdev)) {
3326                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3327                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3328                                    sizeof(mgmt_cp->type));
3329                 goto unlock;
3330         }
3331
3332         if (hdev->discovery.type != mgmt_cp->type) {
3333                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3334                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3335                                    sizeof(mgmt_cp->type));
3336                 goto unlock;
3337         }
3338
3339         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3340         if (!cmd) {
3341                 err = -ENOMEM;
3342                 goto unlock;
3343         }
3344
3345         hci_req_init(&req, hdev);
3346
3347         switch (hdev->discovery.state) {
3348         case DISCOVERY_FINDING:
3349                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3350                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3351                 } else {
3352                         cancel_delayed_work(&hdev->le_scan_disable);
3353
3354                         memset(&enable_cp, 0, sizeof(enable_cp));
3355                         enable_cp.enable = LE_SCAN_DISABLE;
3356                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
3357                                     sizeof(enable_cp), &enable_cp);
3358                 }
3359
3360                 break;
3361
3362         case DISCOVERY_RESOLVING:
3363                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3364                                                      NAME_PENDING);
3365                 if (!e) {
3366                         mgmt_pending_remove(cmd);
3367                         err = cmd_complete(sk, hdev->id,
3368                                            MGMT_OP_STOP_DISCOVERY, 0,
3369                                            &mgmt_cp->type,
3370                                            sizeof(mgmt_cp->type));
3371                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3372                         goto unlock;
3373                 }
3374
3375                 bacpy(&cp.bdaddr, &e->data.bdaddr);
3376                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3377                             &cp);
3378
3379                 break;
3380
3381         default:
3382                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
3383
3384                 mgmt_pending_remove(cmd);
3385                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3386                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
3387                                    sizeof(mgmt_cp->type));
3388                 goto unlock;
3389         }
3390
3391         err = hci_req_run(&req, stop_discovery_complete);
3392         if (err < 0)
3393                 mgmt_pending_remove(cmd);
3394         else
3395                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3396
3397 unlock:
3398         hci_dev_unlock(hdev);
3399         return err;
3400 }
3401
3402 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3403                         u16 len)
3404 {
3405         struct mgmt_cp_confirm_name *cp = data;
3406         struct inquiry_entry *e;
3407         int err;
3408
3409         BT_DBG("%s", hdev->name);
3410
3411         hci_dev_lock(hdev);
3412
3413         if (!hci_discovery_active(hdev)) {
3414                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3415                                  MGMT_STATUS_FAILED);
3416                 goto failed;
3417         }
3418
3419         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3420         if (!e) {
3421                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3422                                  MGMT_STATUS_INVALID_PARAMS);
3423                 goto failed;
3424         }
3425
3426         if (cp->name_known) {
3427                 e->name_state = NAME_KNOWN;
3428                 list_del(&e->list);
3429         } else {
3430                 e->name_state = NAME_NEEDED;
3431                 hci_inquiry_cache_update_resolve(hdev, e);
3432         }
3433
3434         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3435                            sizeof(cp->addr));
3436
3437 failed:
3438         hci_dev_unlock(hdev);
3439         return err;
3440 }
3441
3442 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3443                         u16 len)
3444 {
3445         struct mgmt_cp_block_device *cp = data;
3446         u8 status;
3447         int err;
3448
3449         BT_DBG("%s", hdev->name);
3450
3451         if (!bdaddr_type_is_valid(cp->addr.type))
3452                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3453                                     MGMT_STATUS_INVALID_PARAMS,
3454                                     &cp->addr, sizeof(cp->addr));
3455
3456         hci_dev_lock(hdev);
3457
3458         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3459         if (err < 0)
3460                 status = MGMT_STATUS_FAILED;
3461         else
3462                 status = MGMT_STATUS_SUCCESS;
3463
3464         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3465                            &cp->addr, sizeof(cp->addr));
3466
3467         hci_dev_unlock(hdev);
3468
3469         return err;
3470 }
3471
3472 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3473                           u16 len)
3474 {
3475         struct mgmt_cp_unblock_device *cp = data;
3476         u8 status;
3477         int err;
3478
3479         BT_DBG("%s", hdev->name);
3480
3481         if (!bdaddr_type_is_valid(cp->addr.type))
3482                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3483                                     MGMT_STATUS_INVALID_PARAMS,
3484                                     &cp->addr, sizeof(cp->addr));
3485
3486         hci_dev_lock(hdev);
3487
3488         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3489         if (err < 0)
3490                 status = MGMT_STATUS_INVALID_PARAMS;
3491         else
3492                 status = MGMT_STATUS_SUCCESS;
3493
3494         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3495                            &cp->addr, sizeof(cp->addr));
3496
3497         hci_dev_unlock(hdev);
3498
3499         return err;
3500 }
3501
3502 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3503                          u16 len)
3504 {
3505         struct mgmt_cp_set_device_id *cp = data;
3506         struct hci_request req;
3507         int err;
3508         __u16 source;
3509
3510         BT_DBG("%s", hdev->name);
3511
3512         source = __le16_to_cpu(cp->source);
3513
3514         if (source > 0x0002)
3515                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3516                                   MGMT_STATUS_INVALID_PARAMS);
3517
3518         hci_dev_lock(hdev);
3519
3520         hdev->devid_source = source;
3521         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3522         hdev->devid_product = __le16_to_cpu(cp->product);
3523         hdev->devid_version = __le16_to_cpu(cp->version);
3524
3525         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3526
3527         hci_req_init(&req, hdev);
3528         update_eir(&req);
3529         hci_req_run(&req, NULL);
3530
3531         hci_dev_unlock(hdev);
3532
3533         return err;
3534 }
3535
3536 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3537 {
3538         struct cmd_lookup match = { NULL, hdev };
3539
3540         if (status) {
3541                 u8 mgmt_err = mgmt_status(status);
3542
3543                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3544                                      cmd_status_rsp, &mgmt_err);
3545                 return;
3546         }
3547
3548         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3549                              &match);
3550
3551         new_settings(hdev, match.sk);
3552
3553         if (match.sk)
3554                 sock_put(match.sk);
3555 }
3556
3557 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3558                            u16 len)
3559 {
3560         struct mgmt_mode *cp = data;
3561         struct pending_cmd *cmd;
3562         struct hci_request req;
3563         u8 val, enabled, status;
3564         int err;
3565
3566         BT_DBG("request for %s", hdev->name);
3567
3568         status = mgmt_le_support(hdev);
3569         if (status)
3570                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3571                                   status);
3572
3573         if (cp->val != 0x00 && cp->val != 0x01)
3574                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3575                                   MGMT_STATUS_INVALID_PARAMS);
3576
3577         hci_dev_lock(hdev);
3578
3579         val = !!cp->val;
3580         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3581
3582         /* The following conditions are ones which mean that we should
3583          * not do any HCI communication but directly send a mgmt
3584          * response to user space (after toggling the flag if
3585          * necessary).
3586          */
3587         if (!hdev_is_powered(hdev) || val == enabled ||
3588             hci_conn_num(hdev, LE_LINK) > 0) {
3589                 bool changed = false;
3590
3591                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3592                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3593                         changed = true;
3594                 }
3595
3596                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3597                 if (err < 0)
3598                         goto unlock;
3599
3600                 if (changed)
3601                         err = new_settings(hdev, sk);
3602
3603                 goto unlock;
3604         }
3605
3606         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3607             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3608                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3609                                  MGMT_STATUS_BUSY);
3610                 goto unlock;
3611         }
3612
3613         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3614         if (!cmd) {
3615                 err = -ENOMEM;
3616                 goto unlock;
3617         }
3618
3619         hci_req_init(&req, hdev);
3620
3621         if (val)
3622                 enable_advertising(&req);
3623         else
3624                 disable_advertising(&req);
3625
3626         err = hci_req_run(&req, set_advertising_complete);
3627         if (err < 0)
3628                 mgmt_pending_remove(cmd);
3629
3630 unlock:
3631         hci_dev_unlock(hdev);
3632         return err;
3633 }
3634
3635 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3636                               void *data, u16 len)
3637 {
3638         struct mgmt_cp_set_static_address *cp = data;
3639         int err;
3640
3641         BT_DBG("%s", hdev->name);
3642
3643         if (!lmp_le_capable(hdev))
3644                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3645                                   MGMT_STATUS_NOT_SUPPORTED);
3646
3647         if (hdev_is_powered(hdev))
3648                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3649                                   MGMT_STATUS_REJECTED);
3650
3651         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3652                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3653                         return cmd_status(sk, hdev->id,
3654                                           MGMT_OP_SET_STATIC_ADDRESS,
3655                                           MGMT_STATUS_INVALID_PARAMS);
3656
3657                 /* Two most significant bits shall be set */
3658                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3659                         return cmd_status(sk, hdev->id,
3660                                           MGMT_OP_SET_STATIC_ADDRESS,
3661                                           MGMT_STATUS_INVALID_PARAMS);
3662         }
3663
3664         hci_dev_lock(hdev);
3665
3666         bacpy(&hdev->static_addr, &cp->bdaddr);
3667
3668         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3669
3670         hci_dev_unlock(hdev);
3671
3672         return err;
3673 }
3674
3675 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
3676                            void *data, u16 len)
3677 {
3678         struct mgmt_cp_set_scan_params *cp = data;
3679         __u16 interval, window;
3680         int err;
3681
3682         BT_DBG("%s", hdev->name);
3683
3684         if (!lmp_le_capable(hdev))
3685                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3686                                   MGMT_STATUS_NOT_SUPPORTED);
3687
3688         interval = __le16_to_cpu(cp->interval);
3689
3690         if (interval < 0x0004 || interval > 0x4000)
3691                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3692                                   MGMT_STATUS_INVALID_PARAMS);
3693
3694         window = __le16_to_cpu(cp->window);
3695
3696         if (window < 0x0004 || window > 0x4000)
3697                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3698                                   MGMT_STATUS_INVALID_PARAMS);
3699
3700         if (window > interval)
3701                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3702                                   MGMT_STATUS_INVALID_PARAMS);
3703
3704         hci_dev_lock(hdev);
3705
3706         hdev->le_scan_interval = interval;
3707         hdev->le_scan_window = window;
3708
3709         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
3710
3711         hci_dev_unlock(hdev);
3712
3713         return err;
3714 }
3715
3716 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3717 {
3718         struct pending_cmd *cmd;
3719
3720         BT_DBG("status 0x%02x", status);
3721
3722         hci_dev_lock(hdev);
3723
3724         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3725         if (!cmd)
3726                 goto unlock;
3727
3728         if (status) {
3729                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3730                            mgmt_status(status));
3731         } else {
3732                 struct mgmt_mode *cp = cmd->param;
3733
3734                 if (cp->val)
3735                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3736                 else
3737                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3738
3739                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3740                 new_settings(hdev, cmd->sk);
3741         }
3742
3743         mgmt_pending_remove(cmd);
3744
3745 unlock:
3746         hci_dev_unlock(hdev);
3747 }
3748
3749 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3750                                 void *data, u16 len)
3751 {
3752         struct mgmt_mode *cp = data;
3753         struct pending_cmd *cmd;
3754         struct hci_request req;
3755         int err;
3756
3757         BT_DBG("%s", hdev->name);
3758
3759         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
3760             hdev->hci_ver < BLUETOOTH_VER_1_2)
3761                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3762                                   MGMT_STATUS_NOT_SUPPORTED);
3763
3764         if (cp->val != 0x00 && cp->val != 0x01)
3765                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3766                                   MGMT_STATUS_INVALID_PARAMS);
3767
3768         if (!hdev_is_powered(hdev))
3769                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3770                                   MGMT_STATUS_NOT_POWERED);
3771
3772         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3773                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3774                                   MGMT_STATUS_REJECTED);
3775
3776         hci_dev_lock(hdev);
3777
3778         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3779                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3780                                  MGMT_STATUS_BUSY);
3781                 goto unlock;
3782         }
3783
3784         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3785                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3786                                         hdev);
3787                 goto unlock;
3788         }
3789
3790         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3791                                data, len);
3792         if (!cmd) {
3793                 err = -ENOMEM;
3794                 goto unlock;
3795         }
3796
3797         hci_req_init(&req, hdev);
3798
3799         write_fast_connectable(&req, cp->val);
3800
3801         err = hci_req_run(&req, fast_connectable_complete);
3802         if (err < 0) {
3803                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3804                                  MGMT_STATUS_FAILED);
3805                 mgmt_pending_remove(cmd);
3806         }
3807
3808 unlock:
3809         hci_dev_unlock(hdev);
3810
3811         return err;
3812 }
3813
3814 static void set_bredr_scan(struct hci_request *req)
3815 {
3816         struct hci_dev *hdev = req->hdev;
3817         u8 scan = 0;
3818
3819         /* Ensure that fast connectable is disabled. This function will
3820          * not do anything if the page scan parameters are already what
3821          * they should be.
3822          */
3823         write_fast_connectable(req, false);
3824
3825         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3826                 scan |= SCAN_PAGE;
3827         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3828                 scan |= SCAN_INQUIRY;
3829
3830         if (scan)
3831                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3832 }
3833
3834 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
3835 {
3836         struct pending_cmd *cmd;
3837
3838         BT_DBG("status 0x%02x", status);
3839
3840         hci_dev_lock(hdev);
3841
3842         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
3843         if (!cmd)
3844                 goto unlock;
3845
3846         if (status) {
3847                 u8 mgmt_err = mgmt_status(status);
3848
3849                 /* We need to restore the flag if related HCI commands
3850                  * failed.
3851                  */
3852                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3853
3854                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
3855         } else {
3856                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
3857                 new_settings(hdev, cmd->sk);
3858         }
3859
3860         mgmt_pending_remove(cmd);
3861
3862 unlock:
3863         hci_dev_unlock(hdev);
3864 }
3865
3866 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3867 {
3868         struct mgmt_mode *cp = data;
3869         struct pending_cmd *cmd;
3870         struct hci_request req;
3871         int err;
3872
3873         BT_DBG("request for %s", hdev->name);
3874
3875         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
3876                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3877                                   MGMT_STATUS_NOT_SUPPORTED);
3878
3879         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3880                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3881                                   MGMT_STATUS_REJECTED);
3882
3883         if (cp->val != 0x00 && cp->val != 0x01)
3884                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3885                                   MGMT_STATUS_INVALID_PARAMS);
3886
3887         hci_dev_lock(hdev);
3888
3889         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3890                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3891                 goto unlock;
3892         }
3893
3894         if (!hdev_is_powered(hdev)) {
3895                 if (!cp->val) {
3896                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
3897                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
3898                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3899                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3900                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3901                 }
3902
3903                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3904
3905                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3906                 if (err < 0)
3907                         goto unlock;
3908
3909                 err = new_settings(hdev, sk);
3910                 goto unlock;
3911         }
3912
3913         /* Reject disabling when powered on */
3914         if (!cp->val) {
3915                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3916                                  MGMT_STATUS_REJECTED);
3917                 goto unlock;
3918         }
3919
3920         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
3921                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3922                                  MGMT_STATUS_BUSY);
3923                 goto unlock;
3924         }
3925
3926         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
3927         if (!cmd) {
3928                 err = -ENOMEM;
3929                 goto unlock;
3930         }
3931
3932         /* We need to flip the bit already here so that update_adv_data
3933          * generates the correct flags.
3934          */
3935         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3936
3937         hci_req_init(&req, hdev);
3938
3939         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3940                 set_bredr_scan(&req);
3941
3942         /* Since only the advertising data flags will change, there
3943          * is no need to update the scan response data.
3944          */
3945         update_adv_data(&req);
3946
3947         err = hci_req_run(&req, set_bredr_complete);
3948         if (err < 0)
3949                 mgmt_pending_remove(cmd);
3950
3951 unlock:
3952         hci_dev_unlock(hdev);
3953         return err;
3954 }
3955
3956 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3957 {
3958         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3959                 return false;
3960         if (key->master != 0x00 && key->master != 0x01)
3961                 return false;
3962         if (!bdaddr_type_is_le(key->addr.type))
3963                 return false;
3964         return true;
3965 }
3966
3967 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3968                                void *cp_data, u16 len)
3969 {
3970         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3971         u16 key_count, expected_len;
3972         int i, err;
3973
3974         BT_DBG("request for %s", hdev->name);
3975
3976         if (!lmp_le_capable(hdev))
3977                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3978                                   MGMT_STATUS_NOT_SUPPORTED);
3979
3980         key_count = __le16_to_cpu(cp->key_count);
3981
3982         expected_len = sizeof(*cp) + key_count *
3983                                         sizeof(struct mgmt_ltk_info);
3984         if (expected_len != len) {
3985                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3986                        len, expected_len);
3987                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3988                                   MGMT_STATUS_INVALID_PARAMS);
3989         }
3990
3991         BT_DBG("%s key_count %u", hdev->name, key_count);
3992
3993         for (i = 0; i < key_count; i++) {
3994                 struct mgmt_ltk_info *key = &cp->keys[i];
3995
3996                 if (!ltk_is_valid(key))
3997                         return cmd_status(sk, hdev->id,
3998                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3999                                           MGMT_STATUS_INVALID_PARAMS);
4000         }
4001
4002         hci_dev_lock(hdev);
4003
4004         hci_smp_ltks_clear(hdev);
4005
4006         for (i = 0; i < key_count; i++) {
4007                 struct mgmt_ltk_info *key = &cp->keys[i];
4008                 u8 type, addr_type;
4009
4010                 if (key->addr.type == BDADDR_LE_PUBLIC)
4011                         addr_type = ADDR_LE_DEV_PUBLIC;
4012                 else
4013                         addr_type = ADDR_LE_DEV_RANDOM;
4014
4015                 if (key->master)
4016                         type = HCI_SMP_LTK;
4017                 else
4018                         type = HCI_SMP_LTK_SLAVE;
4019
4020                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type,
4021                             type, 0, key->authenticated, key->val,
4022                             key->enc_size, key->ediv, key->rand);
4023         }
4024
4025         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4026                            NULL, 0);
4027
4028         hci_dev_unlock(hdev);
4029
4030         return err;
4031 }
4032
4033 static const struct mgmt_handler {
4034         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
4035                      u16 data_len);
4036         bool var_len;
4037         size_t data_len;
4038 } mgmt_handlers[] = {
4039         { NULL }, /* 0x0000 (no command) */
4040         { read_version,           false, MGMT_READ_VERSION_SIZE },
4041         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
4042         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
4043         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
4044         { set_powered,            false, MGMT_SETTING_SIZE },
4045         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
4046         { set_connectable,        false, MGMT_SETTING_SIZE },
4047         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
4048         { set_pairable,           false, MGMT_SETTING_SIZE },
4049         { set_link_security,      false, MGMT_SETTING_SIZE },
4050         { set_ssp,                false, MGMT_SETTING_SIZE },
4051         { set_hs,                 false, MGMT_SETTING_SIZE },
4052         { set_le,                 false, MGMT_SETTING_SIZE },
4053         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
4054         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
4055         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
4056         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
4057         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
4058         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
4059         { disconnect,             false, MGMT_DISCONNECT_SIZE },
4060         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
4061         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
4062         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
4063         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
4064         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
4065         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
4066         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
4067         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
4068         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
4069         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
4070         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
4071         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
4072         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
4073         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
4074         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
4075         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
4076         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
4077         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
4078         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
4079         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
4080         { set_advertising,        false, MGMT_SETTING_SIZE },
4081         { set_bredr,              false, MGMT_SETTING_SIZE },
4082         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
4083         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
4084 };
4085
4086
4087 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
4088 {
4089         void *buf;
4090         u8 *cp;
4091         struct mgmt_hdr *hdr;
4092         u16 opcode, index, len;
4093         struct hci_dev *hdev = NULL;
4094         const struct mgmt_handler *handler;
4095         int err;
4096
4097         BT_DBG("got %zu bytes", msglen);
4098
4099         if (msglen < sizeof(*hdr))
4100                 return -EINVAL;
4101
4102         buf = kmalloc(msglen, GFP_KERNEL);
4103         if (!buf)
4104                 return -ENOMEM;
4105
4106         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
4107                 err = -EFAULT;
4108                 goto done;
4109         }
4110
4111         hdr = buf;
4112         opcode = __le16_to_cpu(hdr->opcode);
4113         index = __le16_to_cpu(hdr->index);
4114         len = __le16_to_cpu(hdr->len);
4115
4116         if (len != msglen - sizeof(*hdr)) {
4117                 err = -EINVAL;
4118                 goto done;
4119         }
4120
4121         if (index != MGMT_INDEX_NONE) {
4122                 hdev = hci_dev_get(index);
4123                 if (!hdev) {
4124                         err = cmd_status(sk, index, opcode,
4125                                          MGMT_STATUS_INVALID_INDEX);
4126                         goto done;
4127                 }
4128
4129                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
4130                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
4131                         err = cmd_status(sk, index, opcode,
4132                                          MGMT_STATUS_INVALID_INDEX);
4133                         goto done;
4134                 }
4135         }
4136
4137         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
4138             mgmt_handlers[opcode].func == NULL) {
4139                 BT_DBG("Unknown op %u", opcode);
4140                 err = cmd_status(sk, index, opcode,
4141                                  MGMT_STATUS_UNKNOWN_COMMAND);
4142                 goto done;
4143         }
4144
4145         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
4146             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
4147                 err = cmd_status(sk, index, opcode,
4148                                  MGMT_STATUS_INVALID_INDEX);
4149                 goto done;
4150         }
4151
4152         handler = &mgmt_handlers[opcode];
4153
4154         if ((handler->var_len && len < handler->data_len) ||
4155             (!handler->var_len && len != handler->data_len)) {
4156                 err = cmd_status(sk, index, opcode,
4157                                  MGMT_STATUS_INVALID_PARAMS);
4158                 goto done;
4159         }
4160
4161         if (hdev)
4162                 mgmt_init_hdev(sk, hdev);
4163
4164         cp = buf + sizeof(*hdr);
4165
4166         err = handler->func(sk, hdev, cp, len);
4167         if (err < 0)
4168                 goto done;
4169
4170         err = msglen;
4171
4172 done:
4173         if (hdev)
4174                 hci_dev_put(hdev);
4175
4176         kfree(buf);
4177         return err;
4178 }
4179
4180 void mgmt_index_added(struct hci_dev *hdev)
4181 {
4182         if (hdev->dev_type != HCI_BREDR)
4183                 return;
4184
4185         mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
4186 }
4187
4188 void mgmt_index_removed(struct hci_dev *hdev)
4189 {
4190         u8 status = MGMT_STATUS_INVALID_INDEX;
4191
4192         if (hdev->dev_type != HCI_BREDR)
4193                 return;
4194
4195         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
4196
4197         mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
4198 }
4199
4200 static void powered_complete(struct hci_dev *hdev, u8 status)
4201 {
4202         struct cmd_lookup match = { NULL, hdev };
4203
4204         BT_DBG("status 0x%02x", status);
4205
4206         hci_dev_lock(hdev);
4207
4208         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
4209
4210         new_settings(hdev, match.sk);
4211
4212         hci_dev_unlock(hdev);
4213
4214         if (match.sk)
4215                 sock_put(match.sk);
4216 }
4217
4218 static int powered_update_hci(struct hci_dev *hdev)
4219 {
4220         struct hci_request req;
4221         u8 link_sec;
4222
4223         hci_req_init(&req, hdev);
4224
4225         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
4226             !lmp_host_ssp_capable(hdev)) {
4227                 u8 ssp = 1;
4228
4229                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
4230         }
4231
4232         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
4233             lmp_bredr_capable(hdev)) {
4234                 struct hci_cp_write_le_host_supported cp;
4235
4236                 cp.le = 1;
4237                 cp.simul = lmp_le_br_capable(hdev);
4238
4239                 /* Check first if we already have the right
4240                  * host state (host features set)
4241                  */
4242                 if (cp.le != lmp_host_le_capable(hdev) ||
4243                     cp.simul != lmp_host_le_br_capable(hdev))
4244                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
4245                                     sizeof(cp), &cp);
4246         }
4247
4248         if (lmp_le_capable(hdev)) {
4249                 /* Set random address to static address if configured */
4250                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
4251                         hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
4252                                     &hdev->static_addr);
4253
4254                 /* Make sure the controller has a good default for
4255                  * advertising data. This also applies to the case
4256                  * where BR/EDR was toggled during the AUTO_OFF phase.
4257                  */
4258                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
4259                         update_adv_data(&req);
4260                         update_scan_rsp_data(&req);
4261                 }
4262
4263                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
4264                         enable_advertising(&req);
4265         }
4266
4267         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4268         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
4269                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
4270                             sizeof(link_sec), &link_sec);
4271
4272         if (lmp_bredr_capable(hdev)) {
4273                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
4274                         set_bredr_scan(&req);
4275                 update_class(&req);
4276                 update_name(&req);
4277                 update_eir(&req);
4278         }
4279
4280         return hci_req_run(&req, powered_complete);
4281 }
4282
4283 int mgmt_powered(struct hci_dev *hdev, u8 powered)
4284 {
4285         struct cmd_lookup match = { NULL, hdev };
4286         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
4287         u8 zero_cod[] = { 0, 0, 0 };
4288         int err;
4289
4290         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
4291                 return 0;
4292
4293         if (powered) {
4294                 if (powered_update_hci(hdev) == 0)
4295                         return 0;
4296
4297                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
4298                                      &match);
4299                 goto new_settings;
4300         }
4301
4302         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
4303         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
4304
4305         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
4306                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
4307                            zero_cod, sizeof(zero_cod), NULL);
4308
4309 new_settings:
4310         err = new_settings(hdev, match.sk);
4311
4312         if (match.sk)
4313                 sock_put(match.sk);
4314
4315         return err;
4316 }
4317
4318 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
4319 {
4320         struct pending_cmd *cmd;
4321         u8 status;
4322
4323         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
4324         if (!cmd)
4325                 return;
4326
4327         if (err == -ERFKILL)
4328                 status = MGMT_STATUS_RFKILLED;
4329         else
4330                 status = MGMT_STATUS_FAILED;
4331
4332         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
4333
4334         mgmt_pending_remove(cmd);
4335 }
4336
4337 void mgmt_discoverable_timeout(struct hci_dev *hdev)
4338 {
4339         struct hci_request req;
4340         u8 scan = SCAN_PAGE;
4341
4342         hci_dev_lock(hdev);
4343
4344         /* When discoverable timeout triggers, then just make sure
4345          * the limited discoverable flag is cleared. Even in the case
4346          * of a timeout triggered from general discoverable, it is
4347          * safe to unconditionally clear the flag.
4348          */
4349         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
4350
4351         hci_req_init(&req, hdev);
4352         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
4353         update_class(&req);
4354         hci_req_run(&req, NULL);
4355
4356         hdev->discov_timeout = 0;
4357
4358         hci_dev_unlock(hdev);
4359 }
4360
4361 void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
4362 {
4363         bool changed;
4364
4365         /* Nothing needed here if there's a pending command since that
4366          * commands request completion callback takes care of everything
4367          * necessary.
4368          */
4369         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
4370                 return;
4371
4372         if (discoverable)
4373                 changed = !test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4374         else
4375                 changed = test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4376
4377         if (changed)
4378                 new_settings(hdev, NULL);
4379 }
4380
4381 void mgmt_connectable(struct hci_dev *hdev, u8 connectable)
4382 {
4383         bool changed;
4384
4385         /* Nothing needed here if there's a pending command since that
4386          * commands request completion callback takes care of everything
4387          * necessary.
4388          */
4389         if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
4390                 return;
4391
4392         if (connectable)
4393                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
4394         else
4395                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
4396
4397         if (changed)
4398                 new_settings(hdev, NULL);
4399 }
4400
4401 void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
4402 {
4403         u8 mgmt_err = mgmt_status(status);
4404
4405         if (scan & SCAN_PAGE)
4406                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
4407                                      cmd_status_rsp, &mgmt_err);
4408
4409         if (scan & SCAN_INQUIRY)
4410                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
4411                                      cmd_status_rsp, &mgmt_err);
4412 }
4413
4414 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
4415                        bool persistent)
4416 {
4417         struct mgmt_ev_new_link_key ev;
4418
4419         memset(&ev, 0, sizeof(ev));
4420
4421         ev.store_hint = persistent;
4422         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4423         ev.key.addr.type = BDADDR_BREDR;
4424         ev.key.type = key->type;
4425         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
4426         ev.key.pin_len = key->pin_len;
4427
4428         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
4429 }
4430
4431 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
4432 {
4433         struct mgmt_ev_new_long_term_key ev;
4434
4435         memset(&ev, 0, sizeof(ev));
4436
4437         ev.store_hint = persistent;
4438         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4439         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
4440         ev.key.authenticated = key->authenticated;
4441         ev.key.enc_size = key->enc_size;
4442         ev.key.ediv = key->ediv;
4443
4444         if (key->type == HCI_SMP_LTK)
4445                 ev.key.master = 1;
4446
4447         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
4448         memcpy(ev.key.val, key->val, sizeof(key->val));
4449
4450         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
4451 }
4452
4453 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
4454                                   u8 data_len)
4455 {
4456         eir[eir_len++] = sizeof(type) + data_len;
4457         eir[eir_len++] = type;
4458         memcpy(&eir[eir_len], data, data_len);
4459         eir_len += data_len;
4460
4461         return eir_len;
4462 }
4463
4464 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4465                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
4466                            u8 *dev_class)
4467 {
4468         char buf[512];
4469         struct mgmt_ev_device_connected *ev = (void *) buf;
4470         u16 eir_len = 0;
4471
4472         bacpy(&ev->addr.bdaddr, bdaddr);
4473         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4474
4475         ev->flags = __cpu_to_le32(flags);
4476
4477         if (name_len > 0)
4478                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
4479                                           name, name_len);
4480
4481         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
4482                 eir_len = eir_append_data(ev->eir, eir_len,
4483                                           EIR_CLASS_OF_DEV, dev_class, 3);
4484
4485         ev->eir_len = cpu_to_le16(eir_len);
4486
4487         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
4488                     sizeof(*ev) + eir_len, NULL);
4489 }
4490
4491 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
4492 {
4493         struct mgmt_cp_disconnect *cp = cmd->param;
4494         struct sock **sk = data;
4495         struct mgmt_rp_disconnect rp;
4496
4497         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4498         rp.addr.type = cp->addr.type;
4499
4500         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
4501                      sizeof(rp));
4502
4503         *sk = cmd->sk;
4504         sock_hold(*sk);
4505
4506         mgmt_pending_remove(cmd);
4507 }
4508
4509 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
4510 {
4511         struct hci_dev *hdev = data;
4512         struct mgmt_cp_unpair_device *cp = cmd->param;
4513         struct mgmt_rp_unpair_device rp;
4514
4515         memset(&rp, 0, sizeof(rp));
4516         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4517         rp.addr.type = cp->addr.type;
4518
4519         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
4520
4521         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
4522
4523         mgmt_pending_remove(cmd);
4524 }
4525
4526 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
4527                               u8 link_type, u8 addr_type, u8 reason)
4528 {
4529         struct mgmt_ev_device_disconnected ev;
4530         struct sock *sk = NULL;
4531
4532         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
4533
4534         bacpy(&ev.addr.bdaddr, bdaddr);
4535         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4536         ev.reason = reason;
4537
4538         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
4539
4540         if (sk)
4541                 sock_put(sk);
4542
4543         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4544                              hdev);
4545 }
4546
4547 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
4548                             u8 link_type, u8 addr_type, u8 status)
4549 {
4550         struct mgmt_rp_disconnect rp;
4551         struct pending_cmd *cmd;
4552
4553         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4554                              hdev);
4555
4556         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
4557         if (!cmd)
4558                 return;
4559
4560         bacpy(&rp.addr.bdaddr, bdaddr);
4561         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4562
4563         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
4564                      mgmt_status(status), &rp, sizeof(rp));
4565
4566         mgmt_pending_remove(cmd);
4567 }
4568
4569 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4570                          u8 addr_type, u8 status)
4571 {
4572         struct mgmt_ev_connect_failed ev;
4573
4574         bacpy(&ev.addr.bdaddr, bdaddr);
4575         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4576         ev.status = mgmt_status(status);
4577
4578         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
4579 }
4580
4581 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
4582 {
4583         struct mgmt_ev_pin_code_request ev;
4584
4585         bacpy(&ev.addr.bdaddr, bdaddr);
4586         ev.addr.type = BDADDR_BREDR;
4587         ev.secure = secure;
4588
4589         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
4590 }
4591
4592 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4593                                   u8 status)
4594 {
4595         struct pending_cmd *cmd;
4596         struct mgmt_rp_pin_code_reply rp;
4597
4598         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
4599         if (!cmd)
4600                 return;
4601
4602         bacpy(&rp.addr.bdaddr, bdaddr);
4603         rp.addr.type = BDADDR_BREDR;
4604
4605         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
4606                      mgmt_status(status), &rp, sizeof(rp));
4607
4608         mgmt_pending_remove(cmd);
4609 }
4610
4611 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4612                                       u8 status)
4613 {
4614         struct pending_cmd *cmd;
4615         struct mgmt_rp_pin_code_reply rp;
4616
4617         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
4618         if (!cmd)
4619                 return;
4620
4621         bacpy(&rp.addr.bdaddr, bdaddr);
4622         rp.addr.type = BDADDR_BREDR;
4623
4624         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
4625                      mgmt_status(status), &rp, sizeof(rp));
4626
4627         mgmt_pending_remove(cmd);
4628 }
4629
4630 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4631                               u8 link_type, u8 addr_type, __le32 value,
4632                               u8 confirm_hint)
4633 {
4634         struct mgmt_ev_user_confirm_request ev;
4635
4636         BT_DBG("%s", hdev->name);
4637
4638         bacpy(&ev.addr.bdaddr, bdaddr);
4639         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4640         ev.confirm_hint = confirm_hint;
4641         ev.value = value;
4642
4643         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
4644                           NULL);
4645 }
4646
4647 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4648                               u8 link_type, u8 addr_type)
4649 {
4650         struct mgmt_ev_user_passkey_request ev;
4651
4652         BT_DBG("%s", hdev->name);
4653
4654         bacpy(&ev.addr.bdaddr, bdaddr);
4655         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4656
4657         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
4658                           NULL);
4659 }
4660
4661 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4662                                       u8 link_type, u8 addr_type, u8 status,
4663                                       u8 opcode)
4664 {
4665         struct pending_cmd *cmd;
4666         struct mgmt_rp_user_confirm_reply rp;
4667         int err;
4668
4669         cmd = mgmt_pending_find(opcode, hdev);
4670         if (!cmd)
4671                 return -ENOENT;
4672
4673         bacpy(&rp.addr.bdaddr, bdaddr);
4674         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4675         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
4676                            &rp, sizeof(rp));
4677
4678         mgmt_pending_remove(cmd);
4679
4680         return err;
4681 }
4682
4683 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4684                                      u8 link_type, u8 addr_type, u8 status)
4685 {
4686         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4687                                           status, MGMT_OP_USER_CONFIRM_REPLY);
4688 }
4689
4690 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4691                                          u8 link_type, u8 addr_type, u8 status)
4692 {
4693         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4694                                           status,
4695                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
4696 }
4697
4698 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4699                                      u8 link_type, u8 addr_type, u8 status)
4700 {
4701         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4702                                           status, MGMT_OP_USER_PASSKEY_REPLY);
4703 }
4704
4705 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4706                                          u8 link_type, u8 addr_type, u8 status)
4707 {
4708         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4709                                           status,
4710                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
4711 }
4712
4713 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
4714                              u8 link_type, u8 addr_type, u32 passkey,
4715                              u8 entered)
4716 {
4717         struct mgmt_ev_passkey_notify ev;
4718
4719         BT_DBG("%s", hdev->name);
4720
4721         bacpy(&ev.addr.bdaddr, bdaddr);
4722         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4723         ev.passkey = __cpu_to_le32(passkey);
4724         ev.entered = entered;
4725
4726         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
4727 }
4728
4729 void mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4730                       u8 addr_type, u8 status)
4731 {
4732         struct mgmt_ev_auth_failed ev;
4733
4734         bacpy(&ev.addr.bdaddr, bdaddr);
4735         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4736         ev.status = mgmt_status(status);
4737
4738         mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
4739 }
4740
4741 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
4742 {
4743         struct cmd_lookup match = { NULL, hdev };
4744         bool changed;
4745
4746         if (status) {
4747                 u8 mgmt_err = mgmt_status(status);
4748                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
4749                                      cmd_status_rsp, &mgmt_err);
4750                 return;
4751         }
4752
4753         if (test_bit(HCI_AUTH, &hdev->flags))
4754                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
4755                                             &hdev->dev_flags);
4756         else
4757                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
4758                                              &hdev->dev_flags);
4759
4760         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
4761                              &match);
4762
4763         if (changed)
4764                 new_settings(hdev, match.sk);
4765
4766         if (match.sk)
4767                 sock_put(match.sk);
4768 }
4769
4770 static void clear_eir(struct hci_request *req)
4771 {
4772         struct hci_dev *hdev = req->hdev;
4773         struct hci_cp_write_eir cp;
4774
4775         if (!lmp_ext_inq_capable(hdev))
4776                 return;
4777
4778         memset(hdev->eir, 0, sizeof(hdev->eir));
4779
4780         memset(&cp, 0, sizeof(cp));
4781
4782         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4783 }
4784
4785 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4786 {
4787         struct cmd_lookup match = { NULL, hdev };
4788         struct hci_request req;
4789         bool changed = false;
4790
4791         if (status) {
4792                 u8 mgmt_err = mgmt_status(status);
4793
4794                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4795                                                  &hdev->dev_flags)) {
4796                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4797                         new_settings(hdev, NULL);
4798                 }
4799
4800                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4801                                      &mgmt_err);
4802                 return;
4803         }
4804
4805         if (enable) {
4806                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4807         } else {
4808                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4809                 if (!changed)
4810                         changed = test_and_clear_bit(HCI_HS_ENABLED,
4811                                                      &hdev->dev_flags);
4812                 else
4813                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4814         }
4815
4816         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4817
4818         if (changed)
4819                 new_settings(hdev, match.sk);
4820
4821         if (match.sk)
4822                 sock_put(match.sk);
4823
4824         hci_req_init(&req, hdev);
4825
4826         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4827                 update_eir(&req);
4828         else
4829                 clear_eir(&req);
4830
4831         hci_req_run(&req, NULL);
4832 }
4833
4834 static void sk_lookup(struct pending_cmd *cmd, void *data)
4835 {
4836         struct cmd_lookup *match = data;
4837
4838         if (match->sk == NULL) {
4839                 match->sk = cmd->sk;
4840                 sock_hold(match->sk);
4841         }
4842 }
4843
4844 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4845                                     u8 status)
4846 {
4847         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4848
4849         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4850         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4851         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4852
4853         if (!status)
4854                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
4855                            NULL);
4856
4857         if (match.sk)
4858                 sock_put(match.sk);
4859 }
4860
4861 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4862 {
4863         struct mgmt_cp_set_local_name ev;
4864         struct pending_cmd *cmd;
4865
4866         if (status)
4867                 return;
4868
4869         memset(&ev, 0, sizeof(ev));
4870         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4871         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4872
4873         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4874         if (!cmd) {
4875                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4876
4877                 /* If this is a HCI command related to powering on the
4878                  * HCI dev don't send any mgmt signals.
4879                  */
4880                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4881                         return;
4882         }
4883
4884         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4885                    cmd ? cmd->sk : NULL);
4886 }
4887
4888 void mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4889                                              u8 *randomizer, u8 status)
4890 {
4891         struct pending_cmd *cmd;
4892
4893         BT_DBG("%s status %u", hdev->name, status);
4894
4895         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4896         if (!cmd)
4897                 return;
4898
4899         if (status) {
4900                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4901                            mgmt_status(status));
4902         } else {
4903                 struct mgmt_rp_read_local_oob_data rp;
4904
4905                 memcpy(rp.hash, hash, sizeof(rp.hash));
4906                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4907
4908                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4909                              0, &rp, sizeof(rp));
4910         }
4911
4912         mgmt_pending_remove(cmd);
4913 }
4914
4915 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4916                        u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4917                        ssp, u8 *eir, u16 eir_len)
4918 {
4919         char buf[512];
4920         struct mgmt_ev_device_found *ev = (void *) buf;
4921         size_t ev_size;
4922
4923         if (!hci_discovery_active(hdev))
4924                 return;
4925
4926         /* Leave 5 bytes for a potential CoD field */
4927         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4928                 return;
4929
4930         memset(buf, 0, sizeof(buf));
4931
4932         bacpy(&ev->addr.bdaddr, bdaddr);
4933         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4934         ev->rssi = rssi;
4935         if (cfm_name)
4936                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4937         if (!ssp)
4938                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4939
4940         if (eir_len > 0)
4941                 memcpy(ev->eir, eir, eir_len);
4942
4943         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4944                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4945                                           dev_class, 3);
4946
4947         ev->eir_len = cpu_to_le16(eir_len);
4948         ev_size = sizeof(*ev) + eir_len;
4949
4950         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4951 }
4952
4953 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4954                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4955 {
4956         struct mgmt_ev_device_found *ev;
4957         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4958         u16 eir_len;
4959
4960         ev = (struct mgmt_ev_device_found *) buf;
4961
4962         memset(buf, 0, sizeof(buf));
4963
4964         bacpy(&ev->addr.bdaddr, bdaddr);
4965         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4966         ev->rssi = rssi;
4967
4968         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4969                                   name_len);
4970
4971         ev->eir_len = cpu_to_le16(eir_len);
4972
4973         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
4974 }
4975
4976 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4977 {
4978         struct mgmt_ev_discovering ev;
4979         struct pending_cmd *cmd;
4980
4981         BT_DBG("%s discovering %u", hdev->name, discovering);
4982
4983         if (discovering)
4984                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4985         else
4986                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4987
4988         if (cmd != NULL) {
4989                 u8 type = hdev->discovery.type;
4990
4991                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4992                              sizeof(type));
4993                 mgmt_pending_remove(cmd);
4994         }
4995
4996         memset(&ev, 0, sizeof(ev));
4997         ev.type = hdev->discovery.type;
4998         ev.discovering = discovering;
4999
5000         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
5001 }
5002
5003 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
5004 {
5005         struct pending_cmd *cmd;
5006         struct mgmt_ev_device_blocked ev;
5007
5008         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
5009
5010         bacpy(&ev.addr.bdaddr, bdaddr);
5011         ev.addr.type = type;
5012
5013         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
5014                           cmd ? cmd->sk : NULL);
5015 }
5016
5017 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
5018 {
5019         struct pending_cmd *cmd;
5020         struct mgmt_ev_device_unblocked ev;
5021
5022         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
5023
5024         bacpy(&ev.addr.bdaddr, bdaddr);
5025         ev.addr.type = type;
5026
5027         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
5028                           cmd ? cmd->sk : NULL);
5029 }
5030
5031 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
5032 {
5033         BT_DBG("%s status %u", hdev->name, status);
5034
5035         /* Clear the advertising mgmt setting if we failed to re-enable it */
5036         if (status) {
5037                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
5038                 new_settings(hdev, NULL);
5039         }
5040 }
5041
5042 void mgmt_reenable_advertising(struct hci_dev *hdev)
5043 {
5044         struct hci_request req;
5045
5046         if (hci_conn_num(hdev, LE_LINK) > 0)
5047                 return;
5048
5049         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5050                 return;
5051
5052         hci_req_init(&req, hdev);
5053         enable_advertising(&req);
5054
5055         /* If this fails we have no option but to let user space know
5056          * that we've disabled advertising.
5057          */
5058         if (hci_req_run(&req, adv_enable_complete) < 0) {
5059                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
5060                 new_settings(hdev, NULL);
5061         }
5062 }