net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33
  34 #include "smp.h"
  35
  36 #define MGMT_VERSION    1
  37 #define MGMT_REVISION   4
  38
  39 static const u16 mgmt_commands[] = {
  40         MGMT_OP_READ_INDEX_LIST,
  41         MGMT_OP_READ_INFO,
  42         MGMT_OP_SET_POWERED,
  43         MGMT_OP_SET_DISCOVERABLE,
  44         MGMT_OP_SET_CONNECTABLE,
  45         MGMT_OP_SET_FAST_CONNECTABLE,
  46         MGMT_OP_SET_PAIRABLE,
  47         MGMT_OP_SET_LINK_SECURITY,
  48         MGMT_OP_SET_SSP,
  49         MGMT_OP_SET_HS,
  50         MGMT_OP_SET_LE,
  51         MGMT_OP_SET_DEV_CLASS,
  52         MGMT_OP_SET_LOCAL_NAME,
  53         MGMT_OP_ADD_UUID,
  54         MGMT_OP_REMOVE_UUID,
  55         MGMT_OP_LOAD_LINK_KEYS,
  56         MGMT_OP_LOAD_LONG_TERM_KEYS,
  57         MGMT_OP_DISCONNECT,
  58         MGMT_OP_GET_CONNECTIONS,
  59         MGMT_OP_PIN_CODE_REPLY,
  60         MGMT_OP_PIN_CODE_NEG_REPLY,
  61         MGMT_OP_SET_IO_CAPABILITY,
  62         MGMT_OP_PAIR_DEVICE,
  63         MGMT_OP_CANCEL_PAIR_DEVICE,
  64         MGMT_OP_UNPAIR_DEVICE,
  65         MGMT_OP_USER_CONFIRM_REPLY,
  66         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  67         MGMT_OP_USER_PASSKEY_REPLY,
  68         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  69         MGMT_OP_READ_LOCAL_OOB_DATA,
  70         MGMT_OP_ADD_REMOTE_OOB_DATA,
  71         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  72         MGMT_OP_START_DISCOVERY,
  73         MGMT_OP_STOP_DISCOVERY,
  74         MGMT_OP_CONFIRM_NAME,
  75         MGMT_OP_BLOCK_DEVICE,
  76         MGMT_OP_UNBLOCK_DEVICE,
  77         MGMT_OP_SET_DEVICE_ID,
  78         MGMT_OP_SET_ADVERTISING,
  79         MGMT_OP_SET_BREDR,
  80         MGMT_OP_SET_STATIC_ADDRESS,
  81         MGMT_OP_SET_SCAN_PARAMS,
  82 };
  83
  84 static const u16 mgmt_events[] = {
  85         MGMT_EV_CONTROLLER_ERROR,
  86         MGMT_EV_INDEX_ADDED,
  87         MGMT_EV_INDEX_REMOVED,
  88         MGMT_EV_NEW_SETTINGS,
  89         MGMT_EV_CLASS_OF_DEV_CHANGED,
  90         MGMT_EV_LOCAL_NAME_CHANGED,
  91         MGMT_EV_NEW_LINK_KEY,
  92         MGMT_EV_NEW_LONG_TERM_KEY,
  93         MGMT_EV_DEVICE_CONNECTED,
  94         MGMT_EV_DEVICE_DISCONNECTED,
  95         MGMT_EV_CONNECT_FAILED,
  96         MGMT_EV_PIN_CODE_REQUEST,
  97         MGMT_EV_USER_CONFIRM_REQUEST,
  98         MGMT_EV_USER_PASSKEY_REQUEST,
  99         MGMT_EV_AUTH_FAILED,
 100         MGMT_EV_DEVICE_FOUND,
 101         MGMT_EV_DISCOVERING,
 102         MGMT_EV_DEVICE_BLOCKED,
 103         MGMT_EV_DEVICE_UNBLOCKED,
 104         MGMT_EV_DEVICE_UNPAIRED,
 105         MGMT_EV_PASSKEY_NOTIFY,
 106 };
 107
 108 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 109
 110 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 111                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 112
 113 struct pending_cmd {
 114         struct list_head list;
 115         u16 opcode;
 116         int index;
 117         void *param;
 118         struct sock *sk;
 119         void *user_data;
 120 };
 121
 122 /* HCI to MGMT error code conversion table */
 123 static u8 mgmt_status_table[] = {
 124         MGMT_STATUS_SUCCESS,
 125         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 126         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 127         MGMT_STATUS_FAILED,             /* Hardware Failure */
 128         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 129         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 130         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 131         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 132         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 133         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 134         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 135         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 136         MGMT_STATUS_BUSY,               /* Command Disallowed */
 137         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 138         MGMT_STATUS_REJECTED,           /* Rejected Security */
 139         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 140         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 141         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 142         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 143         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 144         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 145         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 146         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 147         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 148         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 149         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 150         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 151         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 152         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 153         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 154         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 155         MGMT_STATUS_FAILED,             /* Unspecified Error */
 156         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 157         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 158         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 159         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 160         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 161         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 162         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 164         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 165         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 166         MGMT_STATUS_FAILED,             /* Transaction Collision */
 167         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 168         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 169         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 170         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 171         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 172         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 173         MGMT_STATUS_FAILED,             /* Slot Violation */
 174         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 175         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 176         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 177         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 178         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 179         MGMT_STATUS_BUSY,               /* Controller Busy */
 180         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 181         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 182         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 183         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 184         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 185 };
 186
 187 static u8 mgmt_status(u8 hci_status)
 188 {
 189         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 190                 return mgmt_status_table[hci_status];
 191
 192         return MGMT_STATUS_FAILED;
 193 }
 194
 195 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 196 {
 197         struct sk_buff *skb;
 198         struct mgmt_hdr *hdr;
 199         struct mgmt_ev_cmd_status *ev;
 200         int err;
 201
 202         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 203
 204         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 205         if (!skb)
 206                 return -ENOMEM;
 207
 208         hdr = (void *) skb_put(skb, sizeof(*hdr));
 209
 210         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 211         hdr->index = cpu_to_le16(index);
 212         hdr->len = cpu_to_le16(sizeof(*ev));
 213
 214         ev = (void *) skb_put(skb, sizeof(*ev));
 215         ev->status = status;
 216         ev->opcode = cpu_to_le16(cmd);
 217
 218         err = sock_queue_rcv_skb(sk, skb);
 219         if (err < 0)
 220                 kfree_skb(skb);
 221
 222         return err;
 223 }
 224
 225 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 226                         void *rp, size_t rp_len)
 227 {
 228         struct sk_buff *skb;
 229         struct mgmt_hdr *hdr;
 230         struct mgmt_ev_cmd_complete *ev;
 231         int err;
 232
 233         BT_DBG("sock %p", sk);
 234
 235         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 236         if (!skb)
 237                 return -ENOMEM;
 238
 239         hdr = (void *) skb_put(skb, sizeof(*hdr));
 240
 241         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 242         hdr->index = cpu_to_le16(index);
 243         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 244
 245         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 246         ev->opcode = cpu_to_le16(cmd);
 247         ev->status = status;
 248
 249         if (rp)
 250                 memcpy(ev->data, rp, rp_len);
 251
 252         err = sock_queue_rcv_skb(sk, skb);
 253         if (err < 0)
 254                 kfree_skb(skb);
 255
 256         return err;
 257 }
 258
 259 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 260                         u16 data_len)
 261 {
 262         struct mgmt_rp_read_version rp;
 263
 264         BT_DBG("sock %p", sk);
 265
 266         rp.version = MGMT_VERSION;
 267         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 268
 269         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 270                             sizeof(rp));
 271 }
 272
 273 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 274                          u16 data_len)
 275 {
 276         struct mgmt_rp_read_commands *rp;
 277         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 278         const u16 num_events = ARRAY_SIZE(mgmt_events);
 279         __le16 *opcode;
 280         size_t rp_size;
 281         int i, err;
 282
 283         BT_DBG("sock %p", sk);
 284
 285         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 286
 287         rp = kmalloc(rp_size, GFP_KERNEL);
 288         if (!rp)
 289                 return -ENOMEM;
 290
 291         rp->num_commands = __constant_cpu_to_le16(num_commands);
 292         rp->num_events = __constant_cpu_to_le16(num_events);
 293
 294         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 295                 put_unaligned_le16(mgmt_commands[i], opcode);
 296
 297         for (i = 0; i < num_events; i++, opcode++)
 298                 put_unaligned_le16(mgmt_events[i], opcode);
 299
 300         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 301                            rp_size);
 302         kfree(rp);
 303
 304         return err;
 305 }
 306
 307 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 308                            u16 data_len)
 309 {
 310         struct mgmt_rp_read_index_list *rp;
 311         struct hci_dev *d;
 312         size_t rp_len;
 313         u16 count;
 314         int err;
 315
 316         BT_DBG("sock %p", sk);
 317
 318         read_lock(&hci_dev_list_lock);
 319
 320         count = 0;
 321         list_for_each_entry(d, &hci_dev_list, list) {
 322                 if (d->dev_type == HCI_BREDR)
 323                         count++;
 324         }
 325
 326         rp_len = sizeof(*rp) + (2 * count);
 327         rp = kmalloc(rp_len, GFP_ATOMIC);
 328         if (!rp) {
 329                 read_unlock(&hci_dev_list_lock);
 330                 return -ENOMEM;
 331         }
 332
 333         count = 0;
 334         list_for_each_entry(d, &hci_dev_list, list) {
 335                 if (test_bit(HCI_SETUP, &d->dev_flags))
 336                         continue;
 337
 338                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 339                         continue;
 340
 341                 if (d->dev_type == HCI_BREDR) {
 342                         rp->index[count++] = cpu_to_le16(d->id);
 343                         BT_DBG("Added hci%u", d->id);
 344                 }
 345         }
 346
 347         rp->num_controllers = cpu_to_le16(count);
 348         rp_len = sizeof(*rp) + (2 * count);
 349
 350         read_unlock(&hci_dev_list_lock);
 351
 352         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 353                            rp_len);
 354
 355         kfree(rp);
 356
 357         return err;
 358 }
 359
 360 static u32 get_supported_settings(struct hci_dev *hdev)
 361 {
 362         u32 settings = 0;
 363
 364         settings |= MGMT_SETTING_POWERED;
 365         settings |= MGMT_SETTING_PAIRABLE;
 366
 367         if (lmp_bredr_capable(hdev)) {
 368                 settings |= MGMT_SETTING_CONNECTABLE;
 369                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 370                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 371                 settings |= MGMT_SETTING_DISCOVERABLE;
 372                 settings |= MGMT_SETTING_BREDR;
 373                 settings |= MGMT_SETTING_LINK_SECURITY;
 374
 375                 if (lmp_ssp_capable(hdev)) {
 376                         settings |= MGMT_SETTING_SSP;
 377                         settings |= MGMT_SETTING_HS;
 378                 }
 379         }
 380
 381         if (lmp_le_capable(hdev)) {
 382                 settings |= MGMT_SETTING_LE;
 383                 settings |= MGMT_SETTING_ADVERTISING;
 384         }
 385
 386         return settings;
 387 }
 388
 389 static u32 get_current_settings(struct hci_dev *hdev)
 390 {
 391         u32 settings = 0;
 392
 393         if (hdev_is_powered(hdev))
 394                 settings |= MGMT_SETTING_POWERED;
 395
 396         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 397                 settings |= MGMT_SETTING_CONNECTABLE;
 398
 399         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 400                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 401
 402         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 403                 settings |= MGMT_SETTING_DISCOVERABLE;
 404
 405         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 406                 settings |= MGMT_SETTING_PAIRABLE;
 407
 408         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 409                 settings |= MGMT_SETTING_BREDR;
 410
 411         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 412                 settings |= MGMT_SETTING_LE;
 413
 414         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 415                 settings |= MGMT_SETTING_LINK_SECURITY;
 416
 417         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 418                 settings |= MGMT_SETTING_SSP;
 419
 420         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 421                 settings |= MGMT_SETTING_HS;
 422
 423         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 424                 settings |= MGMT_SETTING_ADVERTISING;
 425
 426         return settings;
 427 }
 428
 429 #define PNP_INFO_SVCLASS_ID             0x1200
 430
 431 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 432 {
 433         u8 *ptr = data, *uuids_start = NULL;
 434         struct bt_uuid *uuid;
 435
 436         if (len < 4)
 437                 return ptr;
 438
 439         list_for_each_entry(uuid, &hdev->uuids, list) {
 440                 u16 uuid16;
 441
 442                 if (uuid->size != 16)
 443                         continue;
 444
 445                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 446                 if (uuid16 < 0x1100)
 447                         continue;
 448
 449                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 450                         continue;
 451
 452                 if (!uuids_start) {
 453                         uuids_start = ptr;
 454                         uuids_start[0] = 1;
 455                         uuids_start[1] = EIR_UUID16_ALL;
 456                         ptr += 2;
 457                 }
 458
 459                 /* Stop if not enough space to put next UUID */
 460                 if ((ptr - data) + sizeof(u16) > len) {
 461                         uuids_start[1] = EIR_UUID16_SOME;
 462                         break;
 463                 }
 464
 465                 *ptr++ = (uuid16 & 0x00ff);
 466                 *ptr++ = (uuid16 & 0xff00) >> 8;
 467                 uuids_start[0] += sizeof(uuid16);
 468         }
 469
 470         return ptr;
 471 }
 472
 473 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 474 {
 475         u8 *ptr = data, *uuids_start = NULL;
 476         struct bt_uuid *uuid;
 477
 478         if (len < 6)
 479                 return ptr;
 480
 481         list_for_each_entry(uuid, &hdev->uuids, list) {
 482                 if (uuid->size != 32)
 483                         continue;
 484
 485                 if (!uuids_start) {
 486                         uuids_start = ptr;
 487                         uuids_start[0] = 1;
 488                         uuids_start[1] = EIR_UUID32_ALL;
 489                         ptr += 2;
 490                 }
 491
 492                 /* Stop if not enough space to put next UUID */
 493                 if ((ptr - data) + sizeof(u32) > len) {
 494                         uuids_start[1] = EIR_UUID32_SOME;
 495                         break;
 496                 }
 497
 498                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 499                 ptr += sizeof(u32);
 500                 uuids_start[0] += sizeof(u32);
 501         }
 502
 503         return ptr;
 504 }
 505
 506 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 507 {
 508         u8 *ptr = data, *uuids_start = NULL;
 509         struct bt_uuid *uuid;
 510
 511         if (len < 18)
 512                 return ptr;
 513
 514         list_for_each_entry(uuid, &hdev->uuids, list) {
 515                 if (uuid->size != 128)
 516                         continue;
 517
 518                 if (!uuids_start) {
 519                         uuids_start = ptr;
 520                         uuids_start[0] = 1;
 521                         uuids_start[1] = EIR_UUID128_ALL;
 522                         ptr += 2;
 523                 }
 524
 525                 /* Stop if not enough space to put next UUID */
 526                 if ((ptr - data) + 16 > len) {
 527                         uuids_start[1] = EIR_UUID128_SOME;
 528                         break;
 529                 }
 530
 531                 memcpy(ptr, uuid->uuid, 16);
 532                 ptr += 16;
 533                 uuids_start[0] += 16;
 534         }
 535
 536         return ptr;
 537 }
 538
 539 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 540 {
 541         struct pending_cmd *cmd;
 542
 543         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 544                 if (cmd->opcode == opcode)
 545                         return cmd;
 546         }
 547
 548         return NULL;
 549 }
 550
 551 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 552 {
 553         u8 ad_len = 0;
 554         size_t name_len;
 555
 556         name_len = strlen(hdev->dev_name);
 557         if (name_len > 0) {
 558                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 559
 560                 if (name_len > max_len) {
 561                         name_len = max_len;
 562                         ptr[1] = EIR_NAME_SHORT;
 563                 } else
 564                         ptr[1] = EIR_NAME_COMPLETE;
 565
 566                 ptr[0] = name_len + 1;
 567
 568                 memcpy(ptr + 2, hdev->dev_name, name_len);
 569
 570                 ad_len += (name_len + 2);
 571                 ptr += (name_len + 2);
 572         }
 573
 574         return ad_len;
 575 }
 576
 577 static void update_scan_rsp_data(struct hci_request *req)
 578 {
 579         struct hci_dev *hdev = req->hdev;
 580         struct hci_cp_le_set_scan_rsp_data cp;
 581         u8 len;
 582
 583         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 584                 return;
 585
 586         memset(&cp, 0, sizeof(cp));
 587
 588         len = create_scan_rsp_data(hdev, cp.data);
 589
 590         if (hdev->scan_rsp_data_len == len &&
 591             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 592                 return;
 593
 594         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 595         hdev->scan_rsp_data_len = len;
 596
 597         cp.length = len;
 598
 599         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 600 }
 601
 602 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 603 {
 604         struct pending_cmd *cmd;
 605
 606         /* If there's a pending mgmt command the flags will not yet have
 607          * their final values, so check for this first.
 608          */
 609         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 610         if (cmd) {
 611                 struct mgmt_mode *cp = cmd->param;
 612                 if (cp->val == 0x01)
 613                         return LE_AD_GENERAL;
 614                 else if (cp->val == 0x02)
 615                         return LE_AD_LIMITED;
 616         } else {
 617                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 618                         return LE_AD_LIMITED;
 619                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 620                         return LE_AD_GENERAL;
 621         }
 622
 623         return 0;
 624 }
 625
 626 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 627 {
 628         u8 ad_len = 0, flags = 0;
 629
 630         flags |= get_adv_discov_flags(hdev);
 631
 632         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
 633                 if (lmp_le_br_capable(hdev))
 634                         flags |= LE_AD_SIM_LE_BREDR_CTRL;
 635                 if (lmp_host_le_br_capable(hdev))
 636                         flags |= LE_AD_SIM_LE_BREDR_HOST;
 637         } else {
 638                 flags |= LE_AD_NO_BREDR;
 639         }
 640
 641         if (flags) {
 642                 BT_DBG("adv flags 0x%02x", flags);
 643
 644                 ptr[0] = 2;
 645                 ptr[1] = EIR_FLAGS;
 646                 ptr[2] = flags;
 647
 648                 ad_len += 3;
 649                 ptr += 3;
 650         }
 651
 652         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 653                 ptr[0] = 2;
 654                 ptr[1] = EIR_TX_POWER;
 655                 ptr[2] = (u8) hdev->adv_tx_power;
 656
 657                 ad_len += 3;
 658                 ptr += 3;
 659         }
 660
 661         return ad_len;
 662 }
 663
 664 static void update_adv_data(struct hci_request *req)
 665 {
 666         struct hci_dev *hdev = req->hdev;
 667         struct hci_cp_le_set_adv_data cp;
 668         u8 len;
 669
 670         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 671                 return;
 672
 673         memset(&cp, 0, sizeof(cp));
 674
 675         len = create_adv_data(hdev, cp.data);
 676
 677         if (hdev->adv_data_len == len &&
 678             memcmp(cp.data, hdev->adv_data, len) == 0)
 679                 return;
 680
 681         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 682         hdev->adv_data_len = len;
 683
 684         cp.length = len;
 685
 686         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 687 }
 688
 689 static void create_eir(struct hci_dev *hdev, u8 *data)
 690 {
 691         u8 *ptr = data;
 692         size_t name_len;
 693
 694         name_len = strlen(hdev->dev_name);
 695
 696         if (name_len > 0) {
 697                 /* EIR Data type */
 698                 if (name_len > 48) {
 699                         name_len = 48;
 700                         ptr[1] = EIR_NAME_SHORT;
 701                 } else
 702                         ptr[1] = EIR_NAME_COMPLETE;
 703
 704                 /* EIR Data length */
 705                 ptr[0] = name_len + 1;
 706
 707                 memcpy(ptr + 2, hdev->dev_name, name_len);
 708
 709                 ptr += (name_len + 2);
 710         }
 711
 712         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 713                 ptr[0] = 2;
 714                 ptr[1] = EIR_TX_POWER;
 715                 ptr[2] = (u8) hdev->inq_tx_power;
 716
 717                 ptr += 3;
 718         }
 719
 720         if (hdev->devid_source > 0) {
 721                 ptr[0] = 9;
 722                 ptr[1] = EIR_DEVICE_ID;
 723
 724                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 725                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 726                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 727                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 728
 729                 ptr += 10;
 730         }
 731
 732         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 733         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 734         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 735 }
 736
 737 static void update_eir(struct hci_request *req)
 738 {
 739         struct hci_dev *hdev = req->hdev;
 740         struct hci_cp_write_eir cp;
 741
 742         if (!hdev_is_powered(hdev))
 743                 return;
 744
 745         if (!lmp_ext_inq_capable(hdev))
 746                 return;
 747
 748         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 749                 return;
 750
 751         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 752                 return;
 753
 754         memset(&cp, 0, sizeof(cp));
 755
 756         create_eir(hdev, cp.data);
 757
 758         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 759                 return;
 760
 761         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 762
 763         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 764 }
 765
 766 static u8 get_service_classes(struct hci_dev *hdev)
 767 {
 768         struct bt_uuid *uuid;
 769         u8 val = 0;
 770
 771         list_for_each_entry(uuid, &hdev->uuids, list)
 772                 val |= uuid->svc_hint;
 773
 774         return val;
 775 }
 776
 777 static void update_class(struct hci_request *req)
 778 {
 779         struct hci_dev *hdev = req->hdev;
 780         u8 cod[3];
 781
 782         BT_DBG("%s", hdev->name);
 783
 784         if (!hdev_is_powered(hdev))
 785                 return;
 786
 787         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 788                 return;
 789
 790         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 791                 return;
 792
 793         cod[0] = hdev->minor_class;
 794         cod[1] = hdev->major_class;
 795         cod[2] = get_service_classes(hdev);
 796
 797         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 798                 cod[1] |= 0x20;
 799
 800         if (memcmp(cod, hdev->dev_class, 3) == 0)
 801                 return;
 802
 803         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 804 }
 805
 806 static void service_cache_off(struct work_struct *work)
 807 {
 808         struct hci_dev *hdev = container_of(work, struct hci_dev,
 809                                             service_cache.work);
 810         struct hci_request req;
 811
 812         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 813                 return;
 814
 815         hci_req_init(&req, hdev);
 816
 817         hci_dev_lock(hdev);
 818
 819         update_eir(&req);
 820         update_class(&req);
 821
 822         hci_dev_unlock(hdev);
 823
 824         hci_req_run(&req, NULL);
 825 }
 826
 827 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 828 {
 829         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 830                 return;
 831
 832         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 833
 834         /* Non-mgmt controlled devices get this bit set
 835          * implicitly so that pairing works for them, however
 836          * for mgmt we require user-space to explicitly enable
 837          * it
 838          */
 839         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 840 }
 841
 842 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 843                                 void *data, u16 data_len)
 844 {
 845         struct mgmt_rp_read_info rp;
 846
 847         BT_DBG("sock %p %s", sk, hdev->name);
 848
 849         hci_dev_lock(hdev);
 850
 851         memset(&rp, 0, sizeof(rp));
 852
 853         bacpy(&rp.bdaddr, &hdev->bdaddr);
 854
 855         rp.version = hdev->hci_ver;
 856         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 857
 858         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 859         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 860
 861         memcpy(rp.dev_class, hdev->dev_class, 3);
 862
 863         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 864         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 865
 866         hci_dev_unlock(hdev);
 867
 868         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 869                             sizeof(rp));
 870 }
 871
 872 static void mgmt_pending_free(struct pending_cmd *cmd)
 873 {
 874         sock_put(cmd->sk);
 875         kfree(cmd->param);
 876         kfree(cmd);
 877 }
 878
 879 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 880                                             struct hci_dev *hdev, void *data,
 881                                             u16 len)
 882 {
 883         struct pending_cmd *cmd;
 884
 885         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 886         if (!cmd)
 887                 return NULL;
 888
 889         cmd->opcode = opcode;
 890         cmd->index = hdev->id;
 891
 892         cmd->param = kmalloc(len, GFP_KERNEL);
 893         if (!cmd->param) {
 894                 kfree(cmd);
 895                 return NULL;
 896         }
 897
 898         if (data)
 899                 memcpy(cmd->param, data, len);
 900
 901         cmd->sk = sk;
 902         sock_hold(sk);
 903
 904         list_add(&cmd->list, &hdev->mgmt_pending);
 905
 906         return cmd;
 907 }
 908
 909 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 910                                  void (*cb)(struct pending_cmd *cmd,
 911                                             void *data),
 912                                  void *data)
 913 {
 914         struct pending_cmd *cmd, *tmp;
 915
 916         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 917                 if (opcode > 0 && cmd->opcode != opcode)
 918                         continue;
 919
 920                 cb(cmd, data);
 921         }
 922 }
 923
 924 static void mgmt_pending_remove(struct pending_cmd *cmd)
 925 {
 926         list_del(&cmd->list);
 927         mgmt_pending_free(cmd);
 928 }
 929
 930 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 931 {
 932         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 933
 934         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 935                             sizeof(settings));
 936 }
 937
 938 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 939                        u16 len)
 940 {
 941         struct mgmt_mode *cp = data;
 942         struct pending_cmd *cmd;
 943         int err;
 944
 945         BT_DBG("request for %s", hdev->name);
 946
 947         if (cp->val != 0x00 && cp->val != 0x01)
 948                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 949                                   MGMT_STATUS_INVALID_PARAMS);
 950
 951         hci_dev_lock(hdev);
 952
 953         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 954                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 955                                  MGMT_STATUS_BUSY);
 956                 goto failed;
 957         }
 958
 959         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 960                 cancel_delayed_work(&hdev->power_off);
 961
 962                 if (cp->val) {
 963                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 964                                          data, len);
 965                         err = mgmt_powered(hdev, 1);
 966                         goto failed;
 967                 }
 968         }
 969
 970         if (!!cp->val == hdev_is_powered(hdev)) {
 971                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 972                 goto failed;
 973         }
 974
 975         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 976         if (!cmd) {
 977                 err = -ENOMEM;
 978                 goto failed;
 979         }
 980
 981         if (cp->val)
 982                 queue_work(hdev->req_workqueue, &hdev->power_on);
 983         else
 984                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 985
 986         err = 0;
 987
 988 failed:
 989         hci_dev_unlock(hdev);
 990         return err;
 991 }
 992
 993 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 994                       struct sock *skip_sk)
 995 {
 996         struct sk_buff *skb;
 997         struct mgmt_hdr *hdr;
 998
 999         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
1000         if (!skb)
1001                 return -ENOMEM;
1002
1003         hdr = (void *) skb_put(skb, sizeof(*hdr));
1004         hdr->opcode = cpu_to_le16(event);
1005         if (hdev)
1006                 hdr->index = cpu_to_le16(hdev->id);
1007         else
1008                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
1009         hdr->len = cpu_to_le16(data_len);
1010
1011         if (data)
1012                 memcpy(skb_put(skb, data_len), data, data_len);
1013
1014         /* Time stamp */
1015         __net_timestamp(skb);
1016
1017         hci_send_to_control(skb, skip_sk);
1018         kfree_skb(skb);
1019
1020         return 0;
1021 }
1022
1023 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1024 {
1025         __le32 ev;
1026
1027         ev = cpu_to_le32(get_current_settings(hdev));
1028
1029         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1030 }
1031
1032 struct cmd_lookup {
1033         struct sock *sk;
1034         struct hci_dev *hdev;
1035         u8 mgmt_status;
1036 };
1037
1038 static void settings_rsp(struct pending_cmd *cmd, void *data)
1039 {
1040         struct cmd_lookup *match = data;
1041
1042         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1043
1044         list_del(&cmd->list);
1045
1046         if (match->sk == NULL) {
1047                 match->sk = cmd->sk;
1048                 sock_hold(match->sk);
1049         }
1050
1051         mgmt_pending_free(cmd);
1052 }
1053
1054 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1055 {
1056         u8 *status = data;
1057
1058         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1059         mgmt_pending_remove(cmd);
1060 }
1061
1062 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1063 {
1064         if (!lmp_bredr_capable(hdev))
1065                 return MGMT_STATUS_NOT_SUPPORTED;
1066         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1067                 return MGMT_STATUS_REJECTED;
1068         else
1069                 return MGMT_STATUS_SUCCESS;
1070 }
1071
1072 static u8 mgmt_le_support(struct hci_dev *hdev)
1073 {
1074         if (!lmp_le_capable(hdev))
1075                 return MGMT_STATUS_NOT_SUPPORTED;
1076         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1077                 return MGMT_STATUS_REJECTED;
1078         else
1079                 return MGMT_STATUS_SUCCESS;
1080 }
1081
1082 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1083 {
1084         struct pending_cmd *cmd;
1085         struct mgmt_mode *cp;
1086         struct hci_request req;
1087         bool changed;
1088
1089         BT_DBG("status 0x%02x", status);
1090
1091         hci_dev_lock(hdev);
1092
1093         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1094         if (!cmd)
1095                 goto unlock;
1096
1097         if (status) {
1098                 u8 mgmt_err = mgmt_status(status);
1099                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1100                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1101                 goto remove_cmd;
1102         }
1103
1104         cp = cmd->param;
1105         if (cp->val) {
1106                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1107                                             &hdev->dev_flags);
1108
1109                 if (hdev->discov_timeout > 0) {
1110                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1111                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1112                                            to);
1113                 }
1114         } else {
1115                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1116                                              &hdev->dev_flags);
1117         }
1118
1119         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1120
1121         if (changed)
1122                 new_settings(hdev, cmd->sk);
1123
1124         /* When the discoverable mode gets changed, make sure
1125          * that class of device has the limited discoverable
1126          * bit correctly set.
1127          */
1128         hci_req_init(&req, hdev);
1129         update_class(&req);
1130         hci_req_run(&req, NULL);
1131
1132 remove_cmd:
1133         mgmt_pending_remove(cmd);
1134
1135 unlock:
1136         hci_dev_unlock(hdev);
1137 }
1138
1139 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1140                             u16 len)
1141 {
1142         struct mgmt_cp_set_discoverable *cp = data;
1143         struct pending_cmd *cmd;
1144         struct hci_request req;
1145         u16 timeout;
1146         u8 scan;
1147         int err;
1148
1149         BT_DBG("request for %s", hdev->name);
1150
1151         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1152             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1153                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1154                                   MGMT_STATUS_REJECTED);
1155
1156         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1157                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1158                                   MGMT_STATUS_INVALID_PARAMS);
1159
1160         timeout = __le16_to_cpu(cp->timeout);
1161
1162         /* Disabling discoverable requires that no timeout is set,
1163          * and enabling limited discoverable requires a timeout.
1164          */
1165         if ((cp->val == 0x00 && timeout > 0) ||
1166             (cp->val == 0x02 && timeout == 0))
1167                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1168                                   MGMT_STATUS_INVALID_PARAMS);
1169
1170         hci_dev_lock(hdev);
1171
1172         if (!hdev_is_powered(hdev) && timeout > 0) {
1173                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1174                                  MGMT_STATUS_NOT_POWERED);
1175                 goto failed;
1176         }
1177
1178         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1179             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1180                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1181                                  MGMT_STATUS_BUSY);
1182                 goto failed;
1183         }
1184
1185         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1186                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1187                                  MGMT_STATUS_REJECTED);
1188                 goto failed;
1189         }
1190
1191         if (!hdev_is_powered(hdev)) {
1192                 bool changed = false;
1193
1194                 /* Setting limited discoverable when powered off is
1195                  * not a valid operation since it requires a timeout
1196                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1197                  */
1198                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1199                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1200                         changed = true;
1201                 }
1202
1203                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1204                 if (err < 0)
1205                         goto failed;
1206
1207                 if (changed)
1208                         err = new_settings(hdev, sk);
1209
1210                 goto failed;
1211         }
1212
1213         /* If the current mode is the same, then just update the timeout
1214          * value with the new value. And if only the timeout gets updated,
1215          * then no need for any HCI transactions.
1216          */
1217         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1218             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1219                                           &hdev->dev_flags)) {
1220                 cancel_delayed_work(&hdev->discov_off);
1221                 hdev->discov_timeout = timeout;
1222
1223                 if (cp->val && hdev->discov_timeout > 0) {
1224                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1225                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1226                                            to);
1227                 }
1228
1229                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1230                 goto failed;
1231         }
1232
1233         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1234         if (!cmd) {
1235                 err = -ENOMEM;
1236                 goto failed;
1237         }
1238
1239         /* Cancel any potential discoverable timeout that might be
1240          * still active and store new timeout value. The arming of
1241          * the timeout happens in the complete handler.
1242          */
1243         cancel_delayed_work(&hdev->discov_off);
1244         hdev->discov_timeout = timeout;
1245
1246         /* Limited discoverable mode */
1247         if (cp->val == 0x02)
1248                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1249         else
1250                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1251
1252         hci_req_init(&req, hdev);
1253
1254         /* The procedure for LE-only controllers is much simpler - just
1255          * update the advertising data.
1256          */
1257         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1258                 goto update_ad;
1259
1260         scan = SCAN_PAGE;
1261
1262         if (cp->val) {
1263                 struct hci_cp_write_current_iac_lap hci_cp;
1264
1265                 if (cp->val == 0x02) {
1266                         /* Limited discoverable mode */
1267                         hci_cp.num_iac = 2;
1268                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1269                         hci_cp.iac_lap[1] = 0x8b;
1270                         hci_cp.iac_lap[2] = 0x9e;
1271                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1272                         hci_cp.iac_lap[4] = 0x8b;
1273                         hci_cp.iac_lap[5] = 0x9e;
1274                 } else {
1275                         /* General discoverable mode */
1276                         hci_cp.num_iac = 1;
1277                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1278                         hci_cp.iac_lap[1] = 0x8b;
1279                         hci_cp.iac_lap[2] = 0x9e;
1280                 }
1281
1282                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1283                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1284
1285                 scan |= SCAN_INQUIRY;
1286         } else {
1287                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1288         }
1289
1290         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1291
1292 update_ad:
1293         update_adv_data(&req);
1294
1295         err = hci_req_run(&req, set_discoverable_complete);
1296         if (err < 0)
1297                 mgmt_pending_remove(cmd);
1298
1299 failed:
1300         hci_dev_unlock(hdev);
1301         return err;
1302 }
1303
1304 static void write_fast_connectable(struct hci_request *req, bool enable)
1305 {
1306         struct hci_dev *hdev = req->hdev;
1307         struct hci_cp_write_page_scan_activity acp;
1308         u8 type;
1309
1310         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1311                 return;
1312
1313         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1314                 return;
1315
1316         if (enable) {
1317                 type = PAGE_SCAN_TYPE_INTERLACED;
1318
1319                 /* 160 msec page scan interval */
1320                 acp.interval = __constant_cpu_to_le16(0x0100);
1321         } else {
1322                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1323
1324                 /* default 1.28 sec page scan */
1325                 acp.interval = __constant_cpu_to_le16(0x0800);
1326         }
1327
1328         acp.window = __constant_cpu_to_le16(0x0012);
1329
1330         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1331             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1332                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1333                             sizeof(acp), &acp);
1334
1335         if (hdev->page_scan_type != type)
1336                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1337 }
1338
1339 static u8 get_adv_type(struct hci_dev *hdev)
1340 {
1341         struct pending_cmd *cmd;
1342         bool connectable;
1343
1344         /* If there's a pending mgmt command the flag will not yet have
1345          * it's final value, so check for this first.
1346          */
1347         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1348         if (cmd) {
1349                 struct mgmt_mode *cp = cmd->param;
1350                 connectable = !!cp->val;
1351         } else {
1352                 connectable = test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1353         }
1354
1355         return connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1356 }
1357
1358 static void enable_advertising(struct hci_request *req)
1359 {
1360         struct hci_dev *hdev = req->hdev;
1361         struct hci_cp_le_set_adv_param cp;
1362         u8 enable = 0x01;
1363
1364         memset(&cp, 0, sizeof(cp));
1365         cp.min_interval = __constant_cpu_to_le16(0x0800);
1366         cp.max_interval = __constant_cpu_to_le16(0x0800);
1367         cp.type = get_adv_type(hdev);
1368         cp.own_address_type = hdev->own_addr_type;
1369         cp.channel_map = 0x07;
1370
1371         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1372
1373         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1374 }
1375
1376 static void disable_advertising(struct hci_request *req)
1377 {
1378         u8 enable = 0x00;
1379
1380         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1381 }
1382
1383 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1384 {
1385         struct pending_cmd *cmd;
1386         struct mgmt_mode *cp;
1387         bool changed;
1388
1389         BT_DBG("status 0x%02x", status);
1390
1391         hci_dev_lock(hdev);
1392
1393         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1394         if (!cmd)
1395                 goto unlock;
1396
1397         if (status) {
1398                 u8 mgmt_err = mgmt_status(status);
1399                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1400                 goto remove_cmd;
1401         }
1402
1403         cp = cmd->param;
1404         if (cp->val)
1405                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1406         else
1407                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1408
1409         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1410
1411         if (changed)
1412                 new_settings(hdev, cmd->sk);
1413
1414 remove_cmd:
1415         mgmt_pending_remove(cmd);
1416
1417 unlock:
1418         hci_dev_unlock(hdev);
1419 }
1420
1421 static int set_connectable_update_settings(struct hci_dev *hdev,
1422                                            struct sock *sk, u8 val)
1423 {
1424         bool changed = false;
1425         int err;
1426
1427         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1428                 changed = true;
1429
1430         if (val) {
1431                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1432         } else {
1433                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1434                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1435         }
1436
1437         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1438         if (err < 0)
1439                 return err;
1440
1441         if (changed)
1442                 return new_settings(hdev, sk);
1443
1444         return 0;
1445 }
1446
1447 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1448                            u16 len)
1449 {
1450         struct mgmt_mode *cp = data;
1451         struct pending_cmd *cmd;
1452         struct hci_request req;
1453         u8 scan;
1454         int err;
1455
1456         BT_DBG("request for %s", hdev->name);
1457
1458         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1459             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1460                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1461                                   MGMT_STATUS_REJECTED);
1462
1463         if (cp->val != 0x00 && cp->val != 0x01)
1464                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1465                                   MGMT_STATUS_INVALID_PARAMS);
1466
1467         hci_dev_lock(hdev);
1468
1469         if (!hdev_is_powered(hdev)) {
1470                 err = set_connectable_update_settings(hdev, sk, cp->val);
1471                 goto failed;
1472         }
1473
1474         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1475             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1476                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1477                                  MGMT_STATUS_BUSY);
1478                 goto failed;
1479         }
1480
1481         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1482         if (!cmd) {
1483                 err = -ENOMEM;
1484                 goto failed;
1485         }
1486
1487         hci_req_init(&req, hdev);
1488
1489         /* If BR/EDR is not enabled and we disable advertising as a
1490          * by-product of disabling connectable, we need to update the
1491          * advertising flags.
1492          */
1493         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1494                 if (!cp->val) {
1495                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1496                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1497                 }
1498                 update_adv_data(&req);
1499         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1500                 if (cp->val) {
1501                         scan = SCAN_PAGE;
1502                 } else {
1503                         scan = 0;
1504
1505                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1506                             hdev->discov_timeout > 0)
1507                                 cancel_delayed_work(&hdev->discov_off);
1508                 }
1509
1510                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1511         }
1512
1513         /* If we're going from non-connectable to connectable or
1514          * vice-versa when fast connectable is enabled ensure that fast
1515          * connectable gets disabled. write_fast_connectable won't do
1516          * anything if the page scan parameters are already what they
1517          * should be.
1518          */
1519         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1520                 write_fast_connectable(&req, false);
1521
1522         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) &&
1523             hci_conn_num(hdev, LE_LINK) == 0) {
1524                 disable_advertising(&req);
1525                 enable_advertising(&req);
1526         }
1527
1528         err = hci_req_run(&req, set_connectable_complete);
1529         if (err < 0) {
1530                 mgmt_pending_remove(cmd);
1531                 if (err == -ENODATA)
1532                         err = set_connectable_update_settings(hdev, sk,
1533                                                               cp->val);
1534                 goto failed;
1535         }
1536
1537 failed:
1538         hci_dev_unlock(hdev);
1539         return err;
1540 }
1541
1542 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1543                         u16 len)
1544 {
1545         struct mgmt_mode *cp = data;
1546         bool changed;
1547         int err;
1548
1549         BT_DBG("request for %s", hdev->name);
1550
1551         if (cp->val != 0x00 && cp->val != 0x01)
1552                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1553                                   MGMT_STATUS_INVALID_PARAMS);
1554
1555         hci_dev_lock(hdev);
1556
1557         if (cp->val)
1558                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1559         else
1560                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1561
1562         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1563         if (err < 0)
1564                 goto unlock;
1565
1566         if (changed)
1567                 err = new_settings(hdev, sk);
1568
1569 unlock:
1570         hci_dev_unlock(hdev);
1571         return err;
1572 }
1573
1574 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1575                              u16 len)
1576 {
1577         struct mgmt_mode *cp = data;
1578         struct pending_cmd *cmd;
1579         u8 val, status;
1580         int err;
1581
1582         BT_DBG("request for %s", hdev->name);
1583
1584         status = mgmt_bredr_support(hdev);
1585         if (status)
1586                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1587                                   status);
1588
1589         if (cp->val != 0x00 && cp->val != 0x01)
1590                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1591                                   MGMT_STATUS_INVALID_PARAMS);
1592
1593         hci_dev_lock(hdev);
1594
1595         if (!hdev_is_powered(hdev)) {
1596                 bool changed = false;
1597
1598                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1599                                           &hdev->dev_flags)) {
1600                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1601                         changed = true;
1602                 }
1603
1604                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1605                 if (err < 0)
1606                         goto failed;
1607
1608                 if (changed)
1609                         err = new_settings(hdev, sk);
1610
1611                 goto failed;
1612         }
1613
1614         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1615                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1616                                  MGMT_STATUS_BUSY);
1617                 goto failed;
1618         }
1619
1620         val = !!cp->val;
1621
1622         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1623                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1624                 goto failed;
1625         }
1626
1627         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1628         if (!cmd) {
1629                 err = -ENOMEM;
1630                 goto failed;
1631         }
1632
1633         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1634         if (err < 0) {
1635                 mgmt_pending_remove(cmd);
1636                 goto failed;
1637         }
1638
1639 failed:
1640         hci_dev_unlock(hdev);
1641         return err;
1642 }
1643
1644 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1645 {
1646         struct mgmt_mode *cp = data;
1647         struct pending_cmd *cmd;
1648         u8 status;
1649         int err;
1650
1651         BT_DBG("request for %s", hdev->name);
1652
1653         status = mgmt_bredr_support(hdev);
1654         if (status)
1655                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1656
1657         if (!lmp_ssp_capable(hdev))
1658                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1659                                   MGMT_STATUS_NOT_SUPPORTED);
1660
1661         if (cp->val != 0x00 && cp->val != 0x01)
1662                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1663                                   MGMT_STATUS_INVALID_PARAMS);
1664
1665         hci_dev_lock(hdev);
1666
1667         if (!hdev_is_powered(hdev)) {
1668                 bool changed;
1669
1670                 if (cp->val) {
1671                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
1672                                                     &hdev->dev_flags);
1673                 } else {
1674                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
1675                                                      &hdev->dev_flags);
1676                         if (!changed)
1677                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
1678                                                              &hdev->dev_flags);
1679                         else
1680                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1681                 }
1682
1683                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1684                 if (err < 0)
1685                         goto failed;
1686
1687                 if (changed)
1688                         err = new_settings(hdev, sk);
1689
1690                 goto failed;
1691         }
1692
1693         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
1694             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
1695                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1696                                  MGMT_STATUS_BUSY);
1697                 goto failed;
1698         }
1699
1700         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1701                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1702                 goto failed;
1703         }
1704
1705         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1706         if (!cmd) {
1707                 err = -ENOMEM;
1708                 goto failed;
1709         }
1710
1711         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1712         if (err < 0) {
1713                 mgmt_pending_remove(cmd);
1714                 goto failed;
1715         }
1716
1717 failed:
1718         hci_dev_unlock(hdev);
1719         return err;
1720 }
1721
1722 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1723 {
1724         struct mgmt_mode *cp = data;
1725         bool changed;
1726         u8 status;
1727         int err;
1728
1729         BT_DBG("request for %s", hdev->name);
1730
1731         status = mgmt_bredr_support(hdev);
1732         if (status)
1733                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1734
1735         if (!lmp_ssp_capable(hdev))
1736                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1737                                   MGMT_STATUS_NOT_SUPPORTED);
1738
1739         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
1740                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1741                                   MGMT_STATUS_REJECTED);
1742
1743         if (cp->val != 0x00 && cp->val != 0x01)
1744                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1745                                   MGMT_STATUS_INVALID_PARAMS);
1746
1747         hci_dev_lock(hdev);
1748
1749         if (cp->val) {
1750                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1751         } else {
1752                 if (hdev_is_powered(hdev)) {
1753                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1754                                          MGMT_STATUS_REJECTED);
1755                         goto unlock;
1756                 }
1757
1758                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1759         }
1760
1761         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1762         if (err < 0)
1763                 goto unlock;
1764
1765         if (changed)
1766                 err = new_settings(hdev, sk);
1767
1768 unlock:
1769         hci_dev_unlock(hdev);
1770         return err;
1771 }
1772
1773 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1774 {
1775         struct cmd_lookup match = { NULL, hdev };
1776
1777         if (status) {
1778                 u8 mgmt_err = mgmt_status(status);
1779
1780                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1781                                      &mgmt_err);
1782                 return;
1783         }
1784
1785         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1786
1787         new_settings(hdev, match.sk);
1788
1789         if (match.sk)
1790                 sock_put(match.sk);
1791
1792         /* Make sure the controller has a good default for
1793          * advertising data. Restrict the update to when LE
1794          * has actually been enabled. During power on, the
1795          * update in powered_update_hci will take care of it.
1796          */
1797         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1798                 struct hci_request req;
1799
1800                 hci_dev_lock(hdev);
1801
1802                 hci_req_init(&req, hdev);
1803                 update_adv_data(&req);
1804                 update_scan_rsp_data(&req);
1805                 hci_req_run(&req, NULL);
1806
1807                 hci_dev_unlock(hdev);
1808         }
1809 }
1810
1811 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1812 {
1813         struct mgmt_mode *cp = data;
1814         struct hci_cp_write_le_host_supported hci_cp;
1815         struct pending_cmd *cmd;
1816         struct hci_request req;
1817         int err;
1818         u8 val, enabled;
1819
1820         BT_DBG("request for %s", hdev->name);
1821
1822         if (!lmp_le_capable(hdev))
1823                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1824                                   MGMT_STATUS_NOT_SUPPORTED);
1825
1826         if (cp->val != 0x00 && cp->val != 0x01)
1827                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1828                                   MGMT_STATUS_INVALID_PARAMS);
1829
1830         /* LE-only devices do not allow toggling LE on/off */
1831         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1832                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1833                                   MGMT_STATUS_REJECTED);
1834
1835         hci_dev_lock(hdev);
1836
1837         val = !!cp->val;
1838         enabled = lmp_host_le_capable(hdev);
1839
1840         if (!hdev_is_powered(hdev) || val == enabled) {
1841                 bool changed = false;
1842
1843                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1844                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1845                         changed = true;
1846                 }
1847
1848                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
1849                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1850                         changed = true;
1851                 }
1852
1853                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1854                 if (err < 0)
1855                         goto unlock;
1856
1857                 if (changed)
1858                         err = new_settings(hdev, sk);
1859
1860                 goto unlock;
1861         }
1862
1863         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1864             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1865                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1866                                  MGMT_STATUS_BUSY);
1867                 goto unlock;
1868         }
1869
1870         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1871         if (!cmd) {
1872                 err = -ENOMEM;
1873                 goto unlock;
1874         }
1875
1876         hci_req_init(&req, hdev);
1877
1878         memset(&hci_cp, 0, sizeof(hci_cp));
1879
1880         if (val) {
1881                 hci_cp.le = val;
1882                 hci_cp.simul = lmp_le_br_capable(hdev);
1883         } else {
1884                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1885                         disable_advertising(&req);
1886         }
1887
1888         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1889                     &hci_cp);
1890
1891         err = hci_req_run(&req, le_enable_complete);
1892         if (err < 0)
1893                 mgmt_pending_remove(cmd);
1894
1895 unlock:
1896         hci_dev_unlock(hdev);
1897         return err;
1898 }
1899
1900 /* This is a helper function to test for pending mgmt commands that can
1901  * cause CoD or EIR HCI commands. We can only allow one such pending
1902  * mgmt command at a time since otherwise we cannot easily track what
1903  * the current values are, will be, and based on that calculate if a new
1904  * HCI command needs to be sent and if yes with what value.
1905  */
1906 static bool pending_eir_or_class(struct hci_dev *hdev)
1907 {
1908         struct pending_cmd *cmd;
1909
1910         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1911                 switch (cmd->opcode) {
1912                 case MGMT_OP_ADD_UUID:
1913                 case MGMT_OP_REMOVE_UUID:
1914                 case MGMT_OP_SET_DEV_CLASS:
1915                 case MGMT_OP_SET_POWERED:
1916                         return true;
1917                 }
1918         }
1919
1920         return false;
1921 }
1922
1923 static const u8 bluetooth_base_uuid[] = {
1924                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1925                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1926 };
1927
1928 static u8 get_uuid_size(const u8 *uuid)
1929 {
1930         u32 val;
1931
1932         if (memcmp(uuid, bluetooth_base_uuid, 12))
1933                 return 128;
1934
1935         val = get_unaligned_le32(&uuid[12]);
1936         if (val > 0xffff)
1937                 return 32;
1938
1939         return 16;
1940 }
1941
1942 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1943 {
1944         struct pending_cmd *cmd;
1945
1946         hci_dev_lock(hdev);
1947
1948         cmd = mgmt_pending_find(mgmt_op, hdev);
1949         if (!cmd)
1950                 goto unlock;
1951
1952         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1953                      hdev->dev_class, 3);
1954
1955         mgmt_pending_remove(cmd);
1956
1957 unlock:
1958         hci_dev_unlock(hdev);
1959 }
1960
1961 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1962 {
1963         BT_DBG("status 0x%02x", status);
1964
1965         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1966 }
1967
1968 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1969 {
1970         struct mgmt_cp_add_uuid *cp = data;
1971         struct pending_cmd *cmd;
1972         struct hci_request req;
1973         struct bt_uuid *uuid;
1974         int err;
1975
1976         BT_DBG("request for %s", hdev->name);
1977
1978         hci_dev_lock(hdev);
1979
1980         if (pending_eir_or_class(hdev)) {
1981                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1982                                  MGMT_STATUS_BUSY);
1983                 goto failed;
1984         }
1985
1986         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1987         if (!uuid) {
1988                 err = -ENOMEM;
1989                 goto failed;
1990         }
1991
1992         memcpy(uuid->uuid, cp->uuid, 16);
1993         uuid->svc_hint = cp->svc_hint;
1994         uuid->size = get_uuid_size(cp->uuid);
1995
1996         list_add_tail(&uuid->list, &hdev->uuids);
1997
1998         hci_req_init(&req, hdev);
1999
2000         update_class(&req);
2001         update_eir(&req);
2002
2003         err = hci_req_run(&req, add_uuid_complete);
2004         if (err < 0) {
2005                 if (err != -ENODATA)
2006                         goto failed;
2007
2008                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2009                                    hdev->dev_class, 3);
2010                 goto failed;
2011         }
2012
2013         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2014         if (!cmd) {
2015                 err = -ENOMEM;
2016                 goto failed;
2017         }
2018
2019         err = 0;
2020
2021 failed:
2022         hci_dev_unlock(hdev);
2023         return err;
2024 }
2025
2026 static bool enable_service_cache(struct hci_dev *hdev)
2027 {
2028         if (!hdev_is_powered(hdev))
2029                 return false;
2030
2031         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2032                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2033                                    CACHE_TIMEOUT);
2034                 return true;
2035         }
2036
2037         return false;
2038 }
2039
2040 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2041 {
2042         BT_DBG("status 0x%02x", status);
2043
2044         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2045 }
2046
2047 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2048                        u16 len)
2049 {
2050         struct mgmt_cp_remove_uuid *cp = data;
2051         struct pending_cmd *cmd;
2052         struct bt_uuid *match, *tmp;
2053         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2054         struct hci_request req;
2055         int err, found;
2056
2057         BT_DBG("request for %s", hdev->name);
2058
2059         hci_dev_lock(hdev);
2060
2061         if (pending_eir_or_class(hdev)) {
2062                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2063                                  MGMT_STATUS_BUSY);
2064                 goto unlock;
2065         }
2066
2067         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2068                 err = hci_uuids_clear(hdev);
2069
2070                 if (enable_service_cache(hdev)) {
2071                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2072                                            0, hdev->dev_class, 3);
2073                         goto unlock;
2074                 }
2075
2076                 goto update_class;
2077         }
2078
2079         found = 0;
2080
2081         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2082                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2083                         continue;
2084
2085                 list_del(&match->list);
2086                 kfree(match);
2087                 found++;
2088         }
2089
2090         if (found == 0) {
2091                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2092                                  MGMT_STATUS_INVALID_PARAMS);
2093                 goto unlock;
2094         }
2095
2096 update_class:
2097         hci_req_init(&req, hdev);
2098
2099         update_class(&req);
2100         update_eir(&req);
2101
2102         err = hci_req_run(&req, remove_uuid_complete);
2103         if (err < 0) {
2104                 if (err != -ENODATA)
2105                         goto unlock;
2106
2107                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2108                                    hdev->dev_class, 3);
2109                 goto unlock;
2110         }
2111
2112         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2113         if (!cmd) {
2114                 err = -ENOMEM;
2115                 goto unlock;
2116         }
2117
2118         err = 0;
2119
2120 unlock:
2121         hci_dev_unlock(hdev);
2122         return err;
2123 }
2124
2125 static void set_class_complete(struct hci_dev *hdev, u8 status)
2126 {
2127         BT_DBG("status 0x%02x", status);
2128
2129         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2130 }
2131
2132 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2133                          u16 len)
2134 {
2135         struct mgmt_cp_set_dev_class *cp = data;
2136         struct pending_cmd *cmd;
2137         struct hci_request req;
2138         int err;
2139
2140         BT_DBG("request for %s", hdev->name);
2141
2142         if (!lmp_bredr_capable(hdev))
2143                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2144                                   MGMT_STATUS_NOT_SUPPORTED);
2145
2146         hci_dev_lock(hdev);
2147
2148         if (pending_eir_or_class(hdev)) {
2149                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2150                                  MGMT_STATUS_BUSY);
2151                 goto unlock;
2152         }
2153
2154         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2155                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2156                                  MGMT_STATUS_INVALID_PARAMS);
2157                 goto unlock;
2158         }
2159
2160         hdev->major_class = cp->major;
2161         hdev->minor_class = cp->minor;
2162
2163         if (!hdev_is_powered(hdev)) {
2164                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2165                                    hdev->dev_class, 3);
2166                 goto unlock;
2167         }
2168
2169         hci_req_init(&req, hdev);
2170
2171         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2172                 hci_dev_unlock(hdev);
2173                 cancel_delayed_work_sync(&hdev->service_cache);
2174                 hci_dev_lock(hdev);
2175                 update_eir(&req);
2176         }
2177
2178         update_class(&req);
2179
2180         err = hci_req_run(&req, set_class_complete);
2181         if (err < 0) {
2182                 if (err != -ENODATA)
2183                         goto unlock;
2184
2185                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2186                                    hdev->dev_class, 3);
2187                 goto unlock;
2188         }
2189
2190         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2191         if (!cmd) {
2192                 err = -ENOMEM;
2193                 goto unlock;
2194         }
2195
2196         err = 0;
2197
2198 unlock:
2199         hci_dev_unlock(hdev);
2200         return err;
2201 }
2202
2203 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2204                           u16 len)
2205 {
2206         struct mgmt_cp_load_link_keys *cp = data;
2207         u16 key_count, expected_len;
2208         int i;
2209
2210         BT_DBG("request for %s", hdev->name);
2211
2212         if (!lmp_bredr_capable(hdev))
2213                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2214                                   MGMT_STATUS_NOT_SUPPORTED);
2215
2216         key_count = __le16_to_cpu(cp->key_count);
2217
2218         expected_len = sizeof(*cp) + key_count *
2219                                         sizeof(struct mgmt_link_key_info);
2220         if (expected_len != len) {
2221                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2222                        len, expected_len);
2223                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2224                                   MGMT_STATUS_INVALID_PARAMS);
2225         }
2226
2227         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2228                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2229                                   MGMT_STATUS_INVALID_PARAMS);
2230
2231         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2232                key_count);
2233
2234         for (i = 0; i < key_count; i++) {
2235                 struct mgmt_link_key_info *key = &cp->keys[i];
2236
2237                 if (key->addr.type != BDADDR_BREDR)
2238                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2239                                           MGMT_STATUS_INVALID_PARAMS);
2240         }
2241
2242         hci_dev_lock(hdev);
2243
2244         hci_link_keys_clear(hdev);
2245
2246         if (cp->debug_keys)
2247                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2248         else
2249                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2250
2251         for (i = 0; i < key_count; i++) {
2252                 struct mgmt_link_key_info *key = &cp->keys[i];
2253
2254                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
2255                                  key->type, key->pin_len);
2256         }
2257
2258         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2259
2260         hci_dev_unlock(hdev);
2261
2262         return 0;
2263 }
2264
2265 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2266                            u8 addr_type, struct sock *skip_sk)
2267 {
2268         struct mgmt_ev_device_unpaired ev;
2269
2270         bacpy(&ev.addr.bdaddr, bdaddr);
2271         ev.addr.type = addr_type;
2272
2273         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2274                           skip_sk);
2275 }
2276
2277 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2278                          u16 len)
2279 {
2280         struct mgmt_cp_unpair_device *cp = data;
2281         struct mgmt_rp_unpair_device rp;
2282         struct hci_cp_disconnect dc;
2283         struct pending_cmd *cmd;
2284         struct hci_conn *conn;
2285         int err;
2286
2287         memset(&rp, 0, sizeof(rp));
2288         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2289         rp.addr.type = cp->addr.type;
2290
2291         if (!bdaddr_type_is_valid(cp->addr.type))
2292                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2293                                     MGMT_STATUS_INVALID_PARAMS,
2294                                     &rp, sizeof(rp));
2295
2296         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2297                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2298                                     MGMT_STATUS_INVALID_PARAMS,
2299                                     &rp, sizeof(rp));
2300
2301         hci_dev_lock(hdev);
2302
2303         if (!hdev_is_powered(hdev)) {
2304                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2305                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2306                 goto unlock;
2307         }
2308
2309         if (cp->addr.type == BDADDR_BREDR)
2310                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2311         else
2312                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
2313
2314         if (err < 0) {
2315                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2316                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2317                 goto unlock;
2318         }
2319
2320         if (cp->disconnect) {
2321                 if (cp->addr.type == BDADDR_BREDR)
2322                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2323                                                        &cp->addr.bdaddr);
2324                 else
2325                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2326                                                        &cp->addr.bdaddr);
2327         } else {
2328                 conn = NULL;
2329         }
2330
2331         if (!conn) {
2332                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2333                                    &rp, sizeof(rp));
2334                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2335                 goto unlock;
2336         }
2337
2338         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2339                                sizeof(*cp));
2340         if (!cmd) {
2341                 err = -ENOMEM;
2342                 goto unlock;
2343         }
2344
2345         dc.handle = cpu_to_le16(conn->handle);
2346         dc.reason = 0x13; /* Remote User Terminated Connection */
2347         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2348         if (err < 0)
2349                 mgmt_pending_remove(cmd);
2350
2351 unlock:
2352         hci_dev_unlock(hdev);
2353         return err;
2354 }
2355
2356 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2357                       u16 len)
2358 {
2359         struct mgmt_cp_disconnect *cp = data;
2360         struct mgmt_rp_disconnect rp;
2361         struct hci_cp_disconnect dc;
2362         struct pending_cmd *cmd;
2363         struct hci_conn *conn;
2364         int err;
2365
2366         BT_DBG("");
2367
2368         memset(&rp, 0, sizeof(rp));
2369         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2370         rp.addr.type = cp->addr.type;
2371
2372         if (!bdaddr_type_is_valid(cp->addr.type))
2373                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2374                                     MGMT_STATUS_INVALID_PARAMS,
2375                                     &rp, sizeof(rp));
2376
2377         hci_dev_lock(hdev);
2378
2379         if (!test_bit(HCI_UP, &hdev->flags)) {
2380                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2381                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2382                 goto failed;
2383         }
2384
2385         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2386                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2387                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2388                 goto failed;
2389         }
2390
2391         if (cp->addr.type == BDADDR_BREDR)
2392                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2393                                                &cp->addr.bdaddr);
2394         else
2395                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2396
2397         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2398                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2399                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2400                 goto failed;
2401         }
2402
2403         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2404         if (!cmd) {
2405                 err = -ENOMEM;
2406                 goto failed;
2407         }
2408
2409         dc.handle = cpu_to_le16(conn->handle);
2410         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2411
2412         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2413         if (err < 0)
2414                 mgmt_pending_remove(cmd);
2415
2416 failed:
2417         hci_dev_unlock(hdev);
2418         return err;
2419 }
2420
2421 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2422 {
2423         switch (link_type) {
2424         case LE_LINK:
2425                 switch (addr_type) {
2426                 case ADDR_LE_DEV_PUBLIC:
2427                         return BDADDR_LE_PUBLIC;
2428
2429                 default:
2430                         /* Fallback to LE Random address type */
2431                         return BDADDR_LE_RANDOM;
2432                 }
2433
2434         default:
2435                 /* Fallback to BR/EDR type */
2436                 return BDADDR_BREDR;
2437         }
2438 }
2439
2440 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2441                            u16 data_len)
2442 {
2443         struct mgmt_rp_get_connections *rp;
2444         struct hci_conn *c;
2445         size_t rp_len;
2446         int err;
2447         u16 i;
2448
2449         BT_DBG("");
2450
2451         hci_dev_lock(hdev);
2452
2453         if (!hdev_is_powered(hdev)) {
2454                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2455                                  MGMT_STATUS_NOT_POWERED);
2456                 goto unlock;
2457         }
2458
2459         i = 0;
2460         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2461                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2462                         i++;
2463         }
2464
2465         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2466         rp = kmalloc(rp_len, GFP_KERNEL);
2467         if (!rp) {
2468                 err = -ENOMEM;
2469                 goto unlock;
2470         }
2471
2472         i = 0;
2473         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2474                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2475                         continue;
2476                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2477                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2478                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2479                         continue;
2480                 i++;
2481         }
2482
2483         rp->conn_count = cpu_to_le16(i);
2484
2485         /* Recalculate length in case of filtered SCO connections, etc */
2486         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2487
2488         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2489                            rp_len);
2490
2491         kfree(rp);
2492
2493 unlock:
2494         hci_dev_unlock(hdev);
2495         return err;
2496 }
2497
2498 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2499                                    struct mgmt_cp_pin_code_neg_reply *cp)
2500 {
2501         struct pending_cmd *cmd;
2502         int err;
2503
2504         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2505                                sizeof(*cp));
2506         if (!cmd)
2507                 return -ENOMEM;
2508
2509         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2510                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2511         if (err < 0)
2512                 mgmt_pending_remove(cmd);
2513
2514         return err;
2515 }
2516
2517 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2518                           u16 len)
2519 {
2520         struct hci_conn *conn;
2521         struct mgmt_cp_pin_code_reply *cp = data;
2522         struct hci_cp_pin_code_reply reply;
2523         struct pending_cmd *cmd;
2524         int err;
2525
2526         BT_DBG("");
2527
2528         hci_dev_lock(hdev);
2529
2530         if (!hdev_is_powered(hdev)) {
2531                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2532                                  MGMT_STATUS_NOT_POWERED);
2533                 goto failed;
2534         }
2535
2536         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2537         if (!conn) {
2538                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2539                                  MGMT_STATUS_NOT_CONNECTED);
2540                 goto failed;
2541         }
2542
2543         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2544                 struct mgmt_cp_pin_code_neg_reply ncp;
2545
2546                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2547
2548                 BT_ERR("PIN code is not 16 bytes long");
2549
2550                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2551                 if (err >= 0)
2552                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2553                                          MGMT_STATUS_INVALID_PARAMS);
2554
2555                 goto failed;
2556         }
2557
2558         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2559         if (!cmd) {
2560                 err = -ENOMEM;
2561                 goto failed;
2562         }
2563
2564         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2565         reply.pin_len = cp->pin_len;
2566         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2567
2568         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2569         if (err < 0)
2570                 mgmt_pending_remove(cmd);
2571
2572 failed:
2573         hci_dev_unlock(hdev);
2574         return err;
2575 }
2576
2577 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2578                              u16 len)
2579 {
2580         struct mgmt_cp_set_io_capability *cp = data;
2581
2582         BT_DBG("");
2583
2584         hci_dev_lock(hdev);
2585
2586         hdev->io_capability = cp->io_capability;
2587
2588         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2589                hdev->io_capability);
2590
2591         hci_dev_unlock(hdev);
2592
2593         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2594                             0);
2595 }
2596
2597 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2598 {
2599         struct hci_dev *hdev = conn->hdev;
2600         struct pending_cmd *cmd;
2601
2602         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2603                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2604                         continue;
2605
2606                 if (cmd->user_data != conn)
2607                         continue;
2608
2609                 return cmd;
2610         }
2611
2612         return NULL;
2613 }
2614
2615 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2616 {
2617         struct mgmt_rp_pair_device rp;
2618         struct hci_conn *conn = cmd->user_data;
2619
2620         bacpy(&rp.addr.bdaddr, &conn->dst);
2621         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2622
2623         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2624                      &rp, sizeof(rp));
2625
2626         /* So we don't get further callbacks for this connection */
2627         conn->connect_cfm_cb = NULL;
2628         conn->security_cfm_cb = NULL;
2629         conn->disconn_cfm_cb = NULL;
2630
2631         hci_conn_drop(conn);
2632
2633         mgmt_pending_remove(cmd);
2634 }
2635
2636 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2637 {
2638         struct pending_cmd *cmd;
2639
2640         BT_DBG("status %u", status);
2641
2642         cmd = find_pairing(conn);
2643         if (!cmd)
2644                 BT_DBG("Unable to find a pending command");
2645         else
2646                 pairing_complete(cmd, mgmt_status(status));
2647 }
2648
2649 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2650 {
2651         struct pending_cmd *cmd;
2652
2653         BT_DBG("status %u", status);
2654
2655         if (!status)
2656                 return;
2657
2658         cmd = find_pairing(conn);
2659         if (!cmd)
2660                 BT_DBG("Unable to find a pending command");
2661         else
2662                 pairing_complete(cmd, mgmt_status(status));
2663 }
2664
2665 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2666                        u16 len)
2667 {
2668         struct mgmt_cp_pair_device *cp = data;
2669         struct mgmt_rp_pair_device rp;
2670         struct pending_cmd *cmd;
2671         u8 sec_level, auth_type;
2672         struct hci_conn *conn;
2673         int err;
2674
2675         BT_DBG("");
2676
2677         memset(&rp, 0, sizeof(rp));
2678         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2679         rp.addr.type = cp->addr.type;
2680
2681         if (!bdaddr_type_is_valid(cp->addr.type))
2682                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2683                                     MGMT_STATUS_INVALID_PARAMS,
2684                                     &rp, sizeof(rp));
2685
2686         hci_dev_lock(hdev);
2687
2688         if (!hdev_is_powered(hdev)) {
2689                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2690                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2691                 goto unlock;
2692         }
2693
2694         sec_level = BT_SECURITY_MEDIUM;
2695         if (cp->io_cap == 0x03)
2696                 auth_type = HCI_AT_DEDICATED_BONDING;
2697         else
2698                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2699
2700         if (cp->addr.type == BDADDR_BREDR)
2701                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2702                                    cp->addr.type, sec_level, auth_type);
2703         else
2704                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2705                                    cp->addr.type, sec_level, auth_type);
2706
2707         if (IS_ERR(conn)) {
2708                 int status;
2709
2710                 if (PTR_ERR(conn) == -EBUSY)
2711                         status = MGMT_STATUS_BUSY;
2712                 else
2713                         status = MGMT_STATUS_CONNECT_FAILED;
2714
2715                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2716                                    status, &rp,
2717                                    sizeof(rp));
2718                 goto unlock;
2719         }
2720
2721         if (conn->connect_cfm_cb) {
2722                 hci_conn_drop(conn);
2723                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2724                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2725                 goto unlock;
2726         }
2727
2728         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2729         if (!cmd) {
2730                 err = -ENOMEM;
2731                 hci_conn_drop(conn);
2732                 goto unlock;
2733         }
2734
2735         /* For LE, just connecting isn't a proof that the pairing finished */
2736         if (cp->addr.type == BDADDR_BREDR)
2737                 conn->connect_cfm_cb = pairing_complete_cb;
2738         else
2739                 conn->connect_cfm_cb = le_connect_complete_cb;
2740
2741         conn->security_cfm_cb = pairing_complete_cb;
2742         conn->disconn_cfm_cb = pairing_complete_cb;
2743         conn->io_capability = cp->io_cap;
2744         cmd->user_data = conn;
2745
2746         if (conn->state == BT_CONNECTED &&
2747             hci_conn_security(conn, sec_level, auth_type))
2748                 pairing_complete(cmd, 0);
2749
2750         err = 0;
2751
2752 unlock:
2753         hci_dev_unlock(hdev);
2754         return err;
2755 }
2756
2757 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2758                               u16 len)
2759 {
2760         struct mgmt_addr_info *addr = data;
2761         struct pending_cmd *cmd;
2762         struct hci_conn *conn;
2763         int err;
2764
2765         BT_DBG("");
2766
2767         hci_dev_lock(hdev);
2768
2769         if (!hdev_is_powered(hdev)) {
2770                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2771                                  MGMT_STATUS_NOT_POWERED);
2772                 goto unlock;
2773         }
2774
2775         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2776         if (!cmd) {
2777                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2778                                  MGMT_STATUS_INVALID_PARAMS);
2779                 goto unlock;
2780         }
2781
2782         conn = cmd->user_data;
2783
2784         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2785                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2786                                  MGMT_STATUS_INVALID_PARAMS);
2787                 goto unlock;
2788         }
2789
2790         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2791
2792         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2793                            addr, sizeof(*addr));
2794 unlock:
2795         hci_dev_unlock(hdev);
2796         return err;
2797 }
2798
2799 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2800                              struct mgmt_addr_info *addr, u16 mgmt_op,
2801                              u16 hci_op, __le32 passkey)
2802 {
2803         struct pending_cmd *cmd;
2804         struct hci_conn *conn;
2805         int err;
2806
2807         hci_dev_lock(hdev);
2808
2809         if (!hdev_is_powered(hdev)) {
2810                 err = cmd_complete(sk, hdev->id, mgmt_op,
2811                                    MGMT_STATUS_NOT_POWERED, addr,
2812                                    sizeof(*addr));
2813                 goto done;
2814         }
2815
2816         if (addr->type == BDADDR_BREDR)
2817                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2818         else
2819                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2820
2821         if (!conn) {
2822                 err = cmd_complete(sk, hdev->id, mgmt_op,
2823                                    MGMT_STATUS_NOT_CONNECTED, addr,
2824                                    sizeof(*addr));
2825                 goto done;
2826         }
2827
2828         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2829                 /* Continue with pairing via SMP */
2830                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2831
2832                 if (!err)
2833                         err = cmd_complete(sk, hdev->id, mgmt_op,
2834                                            MGMT_STATUS_SUCCESS, addr,
2835                                            sizeof(*addr));
2836                 else
2837                         err = cmd_complete(sk, hdev->id, mgmt_op,
2838                                            MGMT_STATUS_FAILED, addr,
2839                                            sizeof(*addr));
2840
2841                 goto done;
2842         }
2843
2844         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2845         if (!cmd) {
2846                 err = -ENOMEM;
2847                 goto done;
2848         }
2849
2850         /* Continue with pairing via HCI */
2851         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2852                 struct hci_cp_user_passkey_reply cp;
2853
2854                 bacpy(&cp.bdaddr, &addr->bdaddr);
2855                 cp.passkey = passkey;
2856                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2857         } else
2858                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2859                                    &addr->bdaddr);
2860
2861         if (err < 0)
2862                 mgmt_pending_remove(cmd);
2863
2864 done:
2865         hci_dev_unlock(hdev);
2866         return err;
2867 }
2868
2869 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2870                               void *data, u16 len)
2871 {
2872         struct mgmt_cp_pin_code_neg_reply *cp = data;
2873
2874         BT_DBG("");
2875
2876         return user_pairing_resp(sk, hdev, &cp->addr,
2877                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2878                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2879 }
2880
2881 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2882                               u16 len)
2883 {
2884         struct mgmt_cp_user_confirm_reply *cp = data;
2885
2886         BT_DBG("");
2887
2888         if (len != sizeof(*cp))
2889                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2890                                   MGMT_STATUS_INVALID_PARAMS);
2891
2892         return user_pairing_resp(sk, hdev, &cp->addr,
2893                                  MGMT_OP_USER_CONFIRM_REPLY,
2894                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2895 }
2896
2897 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2898                                   void *data, u16 len)
2899 {
2900         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2901
2902         BT_DBG("");
2903
2904         return user_pairing_resp(sk, hdev, &cp->addr,
2905                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2906                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2907 }
2908
2909 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2910                               u16 len)
2911 {
2912         struct mgmt_cp_user_passkey_reply *cp = data;
2913
2914         BT_DBG("");
2915
2916         return user_pairing_resp(sk, hdev, &cp->addr,
2917                                  MGMT_OP_USER_PASSKEY_REPLY,
2918                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2919 }
2920
2921 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2922                                   void *data, u16 len)
2923 {
2924         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2925
2926         BT_DBG("");
2927
2928         return user_pairing_resp(sk, hdev, &cp->addr,
2929                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2930                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2931 }
2932
2933 static void update_name(struct hci_request *req)
2934 {
2935         struct hci_dev *hdev = req->hdev;
2936         struct hci_cp_write_local_name cp;
2937
2938         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2939
2940         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2941 }
2942
2943 static void set_name_complete(struct hci_dev *hdev, u8 status)
2944 {
2945         struct mgmt_cp_set_local_name *cp;
2946         struct pending_cmd *cmd;
2947
2948         BT_DBG("status 0x%02x", status);
2949
2950         hci_dev_lock(hdev);
2951
2952         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2953         if (!cmd)
2954                 goto unlock;
2955
2956         cp = cmd->param;
2957
2958         if (status)
2959                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2960                            mgmt_status(status));
2961         else
2962                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2963                              cp, sizeof(*cp));
2964
2965         mgmt_pending_remove(cmd);
2966
2967 unlock:
2968         hci_dev_unlock(hdev);
2969 }
2970
2971 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2972                           u16 len)
2973 {
2974         struct mgmt_cp_set_local_name *cp = data;
2975         struct pending_cmd *cmd;
2976         struct hci_request req;
2977         int err;
2978
2979         BT_DBG("");
2980
2981         hci_dev_lock(hdev);
2982
2983         /* If the old values are the same as the new ones just return a
2984          * direct command complete event.
2985          */
2986         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2987             !memcmp(hdev->short_name, cp->short_name,
2988                     sizeof(hdev->short_name))) {
2989                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2990                                    data, len);
2991                 goto failed;
2992         }
2993
2994         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2995
2996         if (!hdev_is_powered(hdev)) {
2997                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2998
2999                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3000                                    data, len);
3001                 if (err < 0)
3002                         goto failed;
3003
3004                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3005                                  sk);
3006
3007                 goto failed;
3008         }
3009
3010         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3011         if (!cmd) {
3012                 err = -ENOMEM;
3013                 goto failed;
3014         }
3015
3016         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3017
3018         hci_req_init(&req, hdev);
3019
3020         if (lmp_bredr_capable(hdev)) {
3021                 update_name(&req);
3022                 update_eir(&req);
3023         }
3024
3025         /* The name is stored in the scan response data and so
3026          * no need to udpate the advertising data here.
3027          */
3028         if (lmp_le_capable(hdev))
3029                 update_scan_rsp_data(&req);
3030
3031         err = hci_req_run(&req, set_name_complete);
3032         if (err < 0)
3033                 mgmt_pending_remove(cmd);
3034
3035 failed:
3036         hci_dev_unlock(hdev);
3037         return err;
3038 }
3039
3040 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3041                                void *data, u16 data_len)
3042 {
3043         struct pending_cmd *cmd;
3044         int err;
3045
3046         BT_DBG("%s", hdev->name);
3047
3048         hci_dev_lock(hdev);
3049
3050         if (!hdev_is_powered(hdev)) {
3051                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3052                                  MGMT_STATUS_NOT_POWERED);
3053                 goto unlock;
3054         }
3055
3056         if (!lmp_ssp_capable(hdev)) {
3057                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3058                                  MGMT_STATUS_NOT_SUPPORTED);
3059                 goto unlock;
3060         }
3061
3062         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3063                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3064                                  MGMT_STATUS_BUSY);
3065                 goto unlock;
3066         }
3067
3068         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3069         if (!cmd) {
3070                 err = -ENOMEM;
3071                 goto unlock;
3072         }
3073
3074         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3075         if (err < 0)
3076                 mgmt_pending_remove(cmd);
3077
3078 unlock:
3079         hci_dev_unlock(hdev);
3080         return err;
3081 }
3082
3083 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3084                                void *data, u16 len)
3085 {
3086         struct mgmt_cp_add_remote_oob_data *cp = data;
3087         u8 status;
3088         int err;
3089
3090         BT_DBG("%s ", hdev->name);
3091
3092         hci_dev_lock(hdev);
3093
3094         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
3095                                       cp->randomizer);
3096         if (err < 0)
3097                 status = MGMT_STATUS_FAILED;
3098         else
3099                 status = MGMT_STATUS_SUCCESS;
3100
3101         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3102                            &cp->addr, sizeof(cp->addr));
3103
3104         hci_dev_unlock(hdev);
3105         return err;
3106 }
3107
3108 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3109                                   void *data, u16 len)
3110 {
3111         struct mgmt_cp_remove_remote_oob_data *cp = data;
3112         u8 status;
3113         int err;
3114
3115         BT_DBG("%s", hdev->name);
3116
3117         hci_dev_lock(hdev);
3118
3119         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
3120         if (err < 0)
3121                 status = MGMT_STATUS_INVALID_PARAMS;
3122         else
3123                 status = MGMT_STATUS_SUCCESS;
3124
3125         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3126                            status, &cp->addr, sizeof(cp->addr));
3127
3128         hci_dev_unlock(hdev);
3129         return err;
3130 }
3131
3132 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3133 {
3134         struct pending_cmd *cmd;
3135         u8 type;
3136         int err;
3137
3138         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3139
3140         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3141         if (!cmd)
3142                 return -ENOENT;
3143
3144         type = hdev->discovery.type;
3145
3146         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3147                            &type, sizeof(type));
3148         mgmt_pending_remove(cmd);
3149
3150         return err;
3151 }
3152
3153 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3154 {
3155         BT_DBG("status %d", status);
3156
3157         if (status) {
3158                 hci_dev_lock(hdev);
3159                 mgmt_start_discovery_failed(hdev, status);
3160                 hci_dev_unlock(hdev);
3161                 return;
3162         }
3163
3164         hci_dev_lock(hdev);
3165         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3166         hci_dev_unlock(hdev);
3167
3168         switch (hdev->discovery.type) {
3169         case DISCOV_TYPE_LE:
3170                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
3171                                    DISCOV_LE_TIMEOUT);
3172                 break;
3173
3174         case DISCOV_TYPE_INTERLEAVED:
3175                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
3176                                    DISCOV_INTERLEAVED_TIMEOUT);
3177                 break;
3178
3179         case DISCOV_TYPE_BREDR:
3180                 break;
3181
3182         default:
3183                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3184         }
3185 }
3186
3187 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3188                            void *data, u16 len)
3189 {
3190         struct mgmt_cp_start_discovery *cp = data;
3191         struct pending_cmd *cmd;
3192         struct hci_cp_le_set_scan_param param_cp;
3193         struct hci_cp_le_set_scan_enable enable_cp;
3194         struct hci_cp_inquiry inq_cp;
3195         struct hci_request req;
3196         /* General inquiry access code (GIAC) */
3197         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3198         u8 status;
3199         int err;
3200
3201         BT_DBG("%s", hdev->name);
3202
3203         hci_dev_lock(hdev);
3204
3205         if (!hdev_is_powered(hdev)) {
3206                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3207                                  MGMT_STATUS_NOT_POWERED);
3208                 goto failed;
3209         }
3210
3211         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3212                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3213                                  MGMT_STATUS_BUSY);
3214                 goto failed;
3215         }
3216
3217         if (hdev->discovery.state != DISCOVERY_STOPPED) {
3218                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3219                                  MGMT_STATUS_BUSY);
3220                 goto failed;
3221         }
3222
3223         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3224         if (!cmd) {
3225                 err = -ENOMEM;
3226                 goto failed;
3227         }
3228
3229         hdev->discovery.type = cp->type;
3230
3231         hci_req_init(&req, hdev);
3232
3233         switch (hdev->discovery.type) {
3234         case DISCOV_TYPE_BREDR:
3235                 status = mgmt_bredr_support(hdev);
3236                 if (status) {
3237                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3238                                          status);
3239                         mgmt_pending_remove(cmd);
3240                         goto failed;
3241                 }
3242
3243                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3244                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3245                                          MGMT_STATUS_BUSY);
3246                         mgmt_pending_remove(cmd);
3247                         goto failed;
3248                 }
3249
3250                 hci_inquiry_cache_flush(hdev);
3251
3252                 memset(&inq_cp, 0, sizeof(inq_cp));
3253                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3254                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3255                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3256                 break;
3257
3258         case DISCOV_TYPE_LE:
3259         case DISCOV_TYPE_INTERLEAVED:
3260                 status = mgmt_le_support(hdev);
3261                 if (status) {
3262                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3263                                          status);
3264                         mgmt_pending_remove(cmd);
3265                         goto failed;
3266                 }
3267
3268                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3269                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3270                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3271                                          MGMT_STATUS_NOT_SUPPORTED);
3272                         mgmt_pending_remove(cmd);
3273                         goto failed;
3274                 }
3275
3276                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3277                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3278                                          MGMT_STATUS_REJECTED);
3279                         mgmt_pending_remove(cmd);
3280                         goto failed;
3281                 }
3282
3283                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
3284                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3285                                          MGMT_STATUS_BUSY);
3286                         mgmt_pending_remove(cmd);
3287                         goto failed;
3288                 }
3289
3290                 memset(&param_cp, 0, sizeof(param_cp));
3291                 param_cp.type = LE_SCAN_ACTIVE;
3292                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3293                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3294                 param_cp.own_address_type = hdev->own_addr_type;
3295                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3296                             &param_cp);
3297
3298                 memset(&enable_cp, 0, sizeof(enable_cp));
3299                 enable_cp.enable = LE_SCAN_ENABLE;
3300                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3301                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3302                             &enable_cp);
3303                 break;
3304
3305         default:
3306                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3307                                  MGMT_STATUS_INVALID_PARAMS);
3308                 mgmt_pending_remove(cmd);
3309                 goto failed;
3310         }
3311
3312         err = hci_req_run(&req, start_discovery_complete);
3313         if (err < 0)
3314                 mgmt_pending_remove(cmd);
3315         else
3316                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3317
3318 failed:
3319         hci_dev_unlock(hdev);
3320         return err;
3321 }
3322
3323 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3324 {
3325         struct pending_cmd *cmd;
3326         int err;
3327
3328         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3329         if (!cmd)
3330                 return -ENOENT;
3331
3332         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3333                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3334         mgmt_pending_remove(cmd);
3335
3336         return err;
3337 }
3338
3339 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3340 {
3341         BT_DBG("status %d", status);
3342
3343         hci_dev_lock(hdev);
3344
3345         if (status) {
3346                 mgmt_stop_discovery_failed(hdev, status);
3347                 goto unlock;
3348         }
3349
3350         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3351
3352 unlock:
3353         hci_dev_unlock(hdev);
3354 }
3355
3356 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3357                           u16 len)
3358 {
3359         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3360         struct pending_cmd *cmd;
3361         struct hci_cp_remote_name_req_cancel cp;
3362         struct inquiry_entry *e;
3363         struct hci_request req;
3364         struct hci_cp_le_set_scan_enable enable_cp;
3365         int err;
3366
3367         BT_DBG("%s", hdev->name);
3368
3369         hci_dev_lock(hdev);
3370
3371         if (!hci_discovery_active(hdev)) {
3372                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3373                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3374                                    sizeof(mgmt_cp->type));
3375                 goto unlock;
3376         }
3377
3378         if (hdev->discovery.type != mgmt_cp->type) {
3379                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3380                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3381                                    sizeof(mgmt_cp->type));
3382                 goto unlock;
3383         }
3384
3385         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3386         if (!cmd) {
3387                 err = -ENOMEM;
3388                 goto unlock;
3389         }
3390
3391         hci_req_init(&req, hdev);
3392
3393         switch (hdev->discovery.state) {
3394         case DISCOVERY_FINDING:
3395                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3396                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3397                 } else {
3398                         cancel_delayed_work(&hdev->le_scan_disable);
3399
3400                         memset(&enable_cp, 0, sizeof(enable_cp));
3401                         enable_cp.enable = LE_SCAN_DISABLE;
3402                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
3403                                     sizeof(enable_cp), &enable_cp);
3404                 }
3405
3406                 break;
3407
3408         case DISCOVERY_RESOLVING:
3409                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3410                                                      NAME_PENDING);
3411                 if (!e) {
3412                         mgmt_pending_remove(cmd);
3413                         err = cmd_complete(sk, hdev->id,
3414                                            MGMT_OP_STOP_DISCOVERY, 0,
3415                                            &mgmt_cp->type,
3416                                            sizeof(mgmt_cp->type));
3417                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3418                         goto unlock;
3419                 }
3420
3421                 bacpy(&cp.bdaddr, &e->data.bdaddr);
3422                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3423                             &cp);
3424
3425                 break;
3426
3427         default:
3428                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
3429
3430                 mgmt_pending_remove(cmd);
3431                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3432                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
3433                                    sizeof(mgmt_cp->type));
3434                 goto unlock;
3435         }
3436
3437         err = hci_req_run(&req, stop_discovery_complete);
3438         if (err < 0)
3439                 mgmt_pending_remove(cmd);
3440         else
3441                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3442
3443 unlock:
3444         hci_dev_unlock(hdev);
3445         return err;
3446 }
3447
3448 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3449                         u16 len)
3450 {
3451         struct mgmt_cp_confirm_name *cp = data;
3452         struct inquiry_entry *e;
3453         int err;
3454
3455         BT_DBG("%s", hdev->name);
3456
3457         hci_dev_lock(hdev);
3458
3459         if (!hci_discovery_active(hdev)) {
3460                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3461                                  MGMT_STATUS_FAILED);
3462                 goto failed;
3463         }
3464
3465         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3466         if (!e) {
3467                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3468                                  MGMT_STATUS_INVALID_PARAMS);
3469                 goto failed;
3470         }
3471
3472         if (cp->name_known) {
3473                 e->name_state = NAME_KNOWN;
3474                 list_del(&e->list);
3475         } else {
3476                 e->name_state = NAME_NEEDED;
3477                 hci_inquiry_cache_update_resolve(hdev, e);
3478         }
3479
3480         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3481                            sizeof(cp->addr));
3482
3483 failed:
3484         hci_dev_unlock(hdev);
3485         return err;
3486 }
3487
3488 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3489                         u16 len)
3490 {
3491         struct mgmt_cp_block_device *cp = data;
3492         u8 status;
3493         int err;
3494
3495         BT_DBG("%s", hdev->name);
3496
3497         if (!bdaddr_type_is_valid(cp->addr.type))
3498                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3499                                     MGMT_STATUS_INVALID_PARAMS,
3500                                     &cp->addr, sizeof(cp->addr));
3501
3502         hci_dev_lock(hdev);
3503
3504         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3505         if (err < 0)
3506                 status = MGMT_STATUS_FAILED;
3507         else
3508                 status = MGMT_STATUS_SUCCESS;
3509
3510         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3511                            &cp->addr, sizeof(cp->addr));
3512
3513         hci_dev_unlock(hdev);
3514
3515         return err;
3516 }
3517
3518 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3519                           u16 len)
3520 {
3521         struct mgmt_cp_unblock_device *cp = data;
3522         u8 status;
3523         int err;
3524
3525         BT_DBG("%s", hdev->name);
3526
3527         if (!bdaddr_type_is_valid(cp->addr.type))
3528                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3529                                     MGMT_STATUS_INVALID_PARAMS,
3530                                     &cp->addr, sizeof(cp->addr));
3531
3532         hci_dev_lock(hdev);
3533
3534         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3535         if (err < 0)
3536                 status = MGMT_STATUS_INVALID_PARAMS;
3537         else
3538                 status = MGMT_STATUS_SUCCESS;
3539
3540         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3541                            &cp->addr, sizeof(cp->addr));
3542
3543         hci_dev_unlock(hdev);
3544
3545         return err;
3546 }
3547
3548 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3549                          u16 len)
3550 {
3551         struct mgmt_cp_set_device_id *cp = data;
3552         struct hci_request req;
3553         int err;
3554         __u16 source;
3555
3556         BT_DBG("%s", hdev->name);
3557
3558         source = __le16_to_cpu(cp->source);
3559
3560         if (source > 0x0002)
3561                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3562                                   MGMT_STATUS_INVALID_PARAMS);
3563
3564         hci_dev_lock(hdev);
3565
3566         hdev->devid_source = source;
3567         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3568         hdev->devid_product = __le16_to_cpu(cp->product);
3569         hdev->devid_version = __le16_to_cpu(cp->version);
3570
3571         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3572
3573         hci_req_init(&req, hdev);
3574         update_eir(&req);
3575         hci_req_run(&req, NULL);
3576
3577         hci_dev_unlock(hdev);
3578
3579         return err;
3580 }
3581
3582 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3583 {
3584         struct cmd_lookup match = { NULL, hdev };
3585
3586         if (status) {
3587                 u8 mgmt_err = mgmt_status(status);
3588
3589                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3590                                      cmd_status_rsp, &mgmt_err);
3591                 return;
3592         }
3593
3594         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3595                              &match);
3596
3597         new_settings(hdev, match.sk);
3598
3599         if (match.sk)
3600                 sock_put(match.sk);
3601 }
3602
3603 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3604                            u16 len)
3605 {
3606         struct mgmt_mode *cp = data;
3607         struct pending_cmd *cmd;
3608         struct hci_request req;
3609         u8 val, enabled, status;
3610         int err;
3611
3612         BT_DBG("request for %s", hdev->name);
3613
3614         status = mgmt_le_support(hdev);
3615         if (status)
3616                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3617                                   status);
3618
3619         if (cp->val != 0x00 && cp->val != 0x01)
3620                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3621                                   MGMT_STATUS_INVALID_PARAMS);
3622
3623         hci_dev_lock(hdev);
3624
3625         val = !!cp->val;
3626         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3627
3628         /* The following conditions are ones which mean that we should
3629          * not do any HCI communication but directly send a mgmt
3630          * response to user space (after toggling the flag if
3631          * necessary).
3632          */
3633         if (!hdev_is_powered(hdev) || val == enabled ||
3634             hci_conn_num(hdev, LE_LINK) > 0) {
3635                 bool changed = false;
3636
3637                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3638                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3639                         changed = true;
3640                 }
3641
3642                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3643                 if (err < 0)
3644                         goto unlock;
3645
3646                 if (changed)
3647                         err = new_settings(hdev, sk);
3648
3649                 goto unlock;
3650         }
3651
3652         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3653             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3654                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3655                                  MGMT_STATUS_BUSY);
3656                 goto unlock;
3657         }
3658
3659         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3660         if (!cmd) {
3661                 err = -ENOMEM;
3662                 goto unlock;
3663         }
3664
3665         hci_req_init(&req, hdev);
3666
3667         if (val)
3668                 enable_advertising(&req);
3669         else
3670                 disable_advertising(&req);
3671
3672         err = hci_req_run(&req, set_advertising_complete);
3673         if (err < 0)
3674                 mgmt_pending_remove(cmd);
3675
3676 unlock:
3677         hci_dev_unlock(hdev);
3678         return err;
3679 }
3680
3681 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3682                               void *data, u16 len)
3683 {
3684         struct mgmt_cp_set_static_address *cp = data;
3685         int err;
3686
3687         BT_DBG("%s", hdev->name);
3688
3689         if (!lmp_le_capable(hdev))
3690                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3691                                   MGMT_STATUS_NOT_SUPPORTED);
3692
3693         if (hdev_is_powered(hdev))
3694                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3695                                   MGMT_STATUS_REJECTED);
3696
3697         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3698                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3699                         return cmd_status(sk, hdev->id,
3700                                           MGMT_OP_SET_STATIC_ADDRESS,
3701                                           MGMT_STATUS_INVALID_PARAMS);
3702
3703                 /* Two most significant bits shall be set */
3704                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3705                         return cmd_status(sk, hdev->id,
3706                                           MGMT_OP_SET_STATIC_ADDRESS,
3707                                           MGMT_STATUS_INVALID_PARAMS);
3708         }
3709
3710         hci_dev_lock(hdev);
3711
3712         bacpy(&hdev->static_addr, &cp->bdaddr);
3713
3714         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3715
3716         hci_dev_unlock(hdev);
3717
3718         return err;
3719 }
3720
3721 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
3722                            void *data, u16 len)
3723 {
3724         struct mgmt_cp_set_scan_params *cp = data;
3725         __u16 interval, window;
3726         int err;
3727
3728         BT_DBG("%s", hdev->name);
3729
3730         if (!lmp_le_capable(hdev))
3731                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3732                                   MGMT_STATUS_NOT_SUPPORTED);
3733
3734         interval = __le16_to_cpu(cp->interval);
3735
3736         if (interval < 0x0004 || interval > 0x4000)
3737                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3738                                   MGMT_STATUS_INVALID_PARAMS);
3739
3740         window = __le16_to_cpu(cp->window);
3741
3742         if (window < 0x0004 || window > 0x4000)
3743                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3744                                   MGMT_STATUS_INVALID_PARAMS);
3745
3746         if (window > interval)
3747                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3748                                   MGMT_STATUS_INVALID_PARAMS);
3749
3750         hci_dev_lock(hdev);
3751
3752         hdev->le_scan_interval = interval;
3753         hdev->le_scan_window = window;
3754
3755         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
3756
3757         hci_dev_unlock(hdev);
3758
3759         return err;
3760 }
3761
3762 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3763 {
3764         struct pending_cmd *cmd;
3765
3766         BT_DBG("status 0x%02x", status);
3767
3768         hci_dev_lock(hdev);
3769
3770         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3771         if (!cmd)
3772                 goto unlock;
3773
3774         if (status) {
3775                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3776                            mgmt_status(status));
3777         } else {
3778                 struct mgmt_mode *cp = cmd->param;
3779
3780                 if (cp->val)
3781                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3782                 else
3783                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3784
3785                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3786                 new_settings(hdev, cmd->sk);
3787         }
3788
3789         mgmt_pending_remove(cmd);
3790
3791 unlock:
3792         hci_dev_unlock(hdev);
3793 }
3794
3795 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3796                                 void *data, u16 len)
3797 {
3798         struct mgmt_mode *cp = data;
3799         struct pending_cmd *cmd;
3800         struct hci_request req;
3801         int err;
3802
3803         BT_DBG("%s", hdev->name);
3804
3805         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
3806             hdev->hci_ver < BLUETOOTH_VER_1_2)
3807                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3808                                   MGMT_STATUS_NOT_SUPPORTED);
3809
3810         if (cp->val != 0x00 && cp->val != 0x01)
3811                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3812                                   MGMT_STATUS_INVALID_PARAMS);
3813
3814         if (!hdev_is_powered(hdev))
3815                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3816                                   MGMT_STATUS_NOT_POWERED);
3817
3818         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3819                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3820                                   MGMT_STATUS_REJECTED);
3821
3822         hci_dev_lock(hdev);
3823
3824         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3825                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3826                                  MGMT_STATUS_BUSY);
3827                 goto unlock;
3828         }
3829
3830         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3831                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3832                                         hdev);
3833                 goto unlock;
3834         }
3835
3836         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3837                                data, len);
3838         if (!cmd) {
3839                 err = -ENOMEM;
3840                 goto unlock;
3841         }
3842
3843         hci_req_init(&req, hdev);
3844
3845         write_fast_connectable(&req, cp->val);
3846
3847         err = hci_req_run(&req, fast_connectable_complete);
3848         if (err < 0) {
3849                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3850                                  MGMT_STATUS_FAILED);
3851                 mgmt_pending_remove(cmd);
3852         }
3853
3854 unlock:
3855         hci_dev_unlock(hdev);
3856
3857         return err;
3858 }
3859
3860 static void set_bredr_scan(struct hci_request *req)
3861 {
3862         struct hci_dev *hdev = req->hdev;
3863         u8 scan = 0;
3864
3865         /* Ensure that fast connectable is disabled. This function will
3866          * not do anything if the page scan parameters are already what
3867          * they should be.
3868          */
3869         write_fast_connectable(req, false);
3870
3871         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3872                 scan |= SCAN_PAGE;
3873         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3874                 scan |= SCAN_INQUIRY;
3875
3876         if (scan)
3877                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3878 }
3879
3880 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
3881 {
3882         struct pending_cmd *cmd;
3883
3884         BT_DBG("status 0x%02x", status);
3885
3886         hci_dev_lock(hdev);
3887
3888         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
3889         if (!cmd)
3890                 goto unlock;
3891
3892         if (status) {
3893                 u8 mgmt_err = mgmt_status(status);
3894
3895                 /* We need to restore the flag if related HCI commands
3896                  * failed.
3897                  */
3898                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3899
3900                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
3901         } else {
3902                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
3903                 new_settings(hdev, cmd->sk);
3904         }
3905
3906         mgmt_pending_remove(cmd);
3907
3908 unlock:
3909         hci_dev_unlock(hdev);
3910 }
3911
3912 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3913 {
3914         struct mgmt_mode *cp = data;
3915         struct pending_cmd *cmd;
3916         struct hci_request req;
3917         int err;
3918
3919         BT_DBG("request for %s", hdev->name);
3920
3921         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
3922                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3923                                   MGMT_STATUS_NOT_SUPPORTED);
3924
3925         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3926                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3927                                   MGMT_STATUS_REJECTED);
3928
3929         if (cp->val != 0x00 && cp->val != 0x01)
3930                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3931                                   MGMT_STATUS_INVALID_PARAMS);
3932
3933         hci_dev_lock(hdev);
3934
3935         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3936                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3937                 goto unlock;
3938         }
3939
3940         if (!hdev_is_powered(hdev)) {
3941                 if (!cp->val) {
3942                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
3943                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
3944                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3945                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3946                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3947                 }
3948
3949                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3950
3951                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3952                 if (err < 0)
3953                         goto unlock;
3954
3955                 err = new_settings(hdev, sk);
3956                 goto unlock;
3957         }
3958
3959         /* Reject disabling when powered on */
3960         if (!cp->val) {
3961                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3962                                  MGMT_STATUS_REJECTED);
3963                 goto unlock;
3964         }
3965
3966         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
3967                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3968                                  MGMT_STATUS_BUSY);
3969                 goto unlock;
3970         }
3971
3972         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
3973         if (!cmd) {
3974                 err = -ENOMEM;
3975                 goto unlock;
3976         }
3977
3978         /* We need to flip the bit already here so that update_adv_data
3979          * generates the correct flags.
3980          */
3981         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3982
3983         hci_req_init(&req, hdev);
3984
3985         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3986                 set_bredr_scan(&req);
3987
3988         /* Since only the advertising data flags will change, there
3989          * is no need to update the scan response data.
3990          */
3991         update_adv_data(&req);
3992
3993         err = hci_req_run(&req, set_bredr_complete);
3994         if (err < 0)
3995                 mgmt_pending_remove(cmd);
3996
3997 unlock:
3998         hci_dev_unlock(hdev);
3999         return err;
4000 }
4001
4002 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4003 {
4004         if (key->authenticated != 0x00 && key->authenticated != 0x01)
4005                 return false;
4006         if (key->master != 0x00 && key->master != 0x01)
4007                 return false;
4008         if (!bdaddr_type_is_le(key->addr.type))
4009                 return false;
4010         return true;
4011 }
4012
4013 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4014                                void *cp_data, u16 len)
4015 {
4016         struct mgmt_cp_load_long_term_keys *cp = cp_data;
4017         u16 key_count, expected_len;
4018         int i, err;
4019
4020         BT_DBG("request for %s", hdev->name);
4021
4022         if (!lmp_le_capable(hdev))
4023                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4024                                   MGMT_STATUS_NOT_SUPPORTED);
4025
4026         key_count = __le16_to_cpu(cp->key_count);
4027
4028         expected_len = sizeof(*cp) + key_count *
4029                                         sizeof(struct mgmt_ltk_info);
4030         if (expected_len != len) {
4031                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
4032                        len, expected_len);
4033                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4034                                   MGMT_STATUS_INVALID_PARAMS);
4035         }
4036
4037         BT_DBG("%s key_count %u", hdev->name, key_count);
4038
4039         for (i = 0; i < key_count; i++) {
4040                 struct mgmt_ltk_info *key = &cp->keys[i];
4041
4042                 if (!ltk_is_valid(key))
4043                         return cmd_status(sk, hdev->id,
4044                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
4045                                           MGMT_STATUS_INVALID_PARAMS);
4046         }
4047
4048         hci_dev_lock(hdev);
4049
4050         hci_smp_ltks_clear(hdev);
4051
4052         for (i = 0; i < key_count; i++) {
4053                 struct mgmt_ltk_info *key = &cp->keys[i];
4054                 u8 type, addr_type;
4055
4056                 if (key->addr.type == BDADDR_LE_PUBLIC)
4057                         addr_type = ADDR_LE_DEV_PUBLIC;
4058                 else
4059                         addr_type = ADDR_LE_DEV_RANDOM;
4060
4061                 if (key->master)
4062                         type = HCI_SMP_LTK;
4063                 else
4064                         type = HCI_SMP_LTK_SLAVE;
4065
4066                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type,
4067                             type, 0, key->authenticated, key->val,
4068                             key->enc_size, key->ediv, key->rand);
4069         }
4070
4071         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4072                            NULL, 0);
4073
4074         hci_dev_unlock(hdev);
4075
4076         return err;
4077 }
4078
4079 static const struct mgmt_handler {
4080         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
4081                      u16 data_len);
4082         bool var_len;
4083         size_t data_len;
4084 } mgmt_handlers[] = {
4085         { NULL }, /* 0x0000 (no command) */
4086         { read_version,           false, MGMT_READ_VERSION_SIZE },
4087         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
4088         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
4089         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
4090         { set_powered,            false, MGMT_SETTING_SIZE },
4091         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
4092         { set_connectable,        false, MGMT_SETTING_SIZE },
4093         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
4094         { set_pairable,           false, MGMT_SETTING_SIZE },
4095         { set_link_security,      false, MGMT_SETTING_SIZE },
4096         { set_ssp,                false, MGMT_SETTING_SIZE },
4097         { set_hs,                 false, MGMT_SETTING_SIZE },
4098         { set_le,                 false, MGMT_SETTING_SIZE },
4099         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
4100         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
4101         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
4102         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
4103         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
4104         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
4105         { disconnect,             false, MGMT_DISCONNECT_SIZE },
4106         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
4107         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
4108         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
4109         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
4110         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
4111         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
4112         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
4113         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
4114         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
4115         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
4116         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
4117         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
4118         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
4119         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
4120         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
4121         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
4122         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
4123         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
4124         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
4125         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
4126         { set_advertising,        false, MGMT_SETTING_SIZE },
4127         { set_bredr,              false, MGMT_SETTING_SIZE },
4128         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
4129         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
4130 };
4131
4132
4133 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
4134 {
4135         void *buf;
4136         u8 *cp;
4137         struct mgmt_hdr *hdr;
4138         u16 opcode, index, len;
4139         struct hci_dev *hdev = NULL;
4140         const struct mgmt_handler *handler;
4141         int err;
4142
4143         BT_DBG("got %zu bytes", msglen);
4144
4145         if (msglen < sizeof(*hdr))
4146                 return -EINVAL;
4147
4148         buf = kmalloc(msglen, GFP_KERNEL);
4149         if (!buf)
4150                 return -ENOMEM;
4151
4152         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
4153                 err = -EFAULT;
4154                 goto done;
4155         }
4156
4157         hdr = buf;
4158         opcode = __le16_to_cpu(hdr->opcode);
4159         index = __le16_to_cpu(hdr->index);
4160         len = __le16_to_cpu(hdr->len);
4161
4162         if (len != msglen - sizeof(*hdr)) {
4163                 err = -EINVAL;
4164                 goto done;
4165         }
4166
4167         if (index != MGMT_INDEX_NONE) {
4168                 hdev = hci_dev_get(index);
4169                 if (!hdev) {
4170                         err = cmd_status(sk, index, opcode,
4171                                          MGMT_STATUS_INVALID_INDEX);
4172                         goto done;
4173                 }
4174
4175                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
4176                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
4177                         err = cmd_status(sk, index, opcode,
4178                                          MGMT_STATUS_INVALID_INDEX);
4179                         goto done;
4180                 }
4181         }
4182
4183         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
4184             mgmt_handlers[opcode].func == NULL) {
4185                 BT_DBG("Unknown op %u", opcode);
4186                 err = cmd_status(sk, index, opcode,
4187                                  MGMT_STATUS_UNKNOWN_COMMAND);
4188                 goto done;
4189         }
4190
4191         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
4192             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
4193                 err = cmd_status(sk, index, opcode,
4194                                  MGMT_STATUS_INVALID_INDEX);
4195                 goto done;
4196         }
4197
4198         handler = &mgmt_handlers[opcode];
4199
4200         if ((handler->var_len && len < handler->data_len) ||
4201             (!handler->var_len && len != handler->data_len)) {
4202                 err = cmd_status(sk, index, opcode,
4203                                  MGMT_STATUS_INVALID_PARAMS);
4204                 goto done;
4205         }
4206
4207         if (hdev)
4208                 mgmt_init_hdev(sk, hdev);
4209
4210         cp = buf + sizeof(*hdr);
4211
4212         err = handler->func(sk, hdev, cp, len);
4213         if (err < 0)
4214                 goto done;
4215
4216         err = msglen;
4217
4218 done:
4219         if (hdev)
4220                 hci_dev_put(hdev);
4221
4222         kfree(buf);
4223         return err;
4224 }
4225
4226 void mgmt_index_added(struct hci_dev *hdev)
4227 {
4228         if (hdev->dev_type != HCI_BREDR)
4229                 return;
4230
4231         mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
4232 }
4233
4234 void mgmt_index_removed(struct hci_dev *hdev)
4235 {
4236         u8 status = MGMT_STATUS_INVALID_INDEX;
4237
4238         if (hdev->dev_type != HCI_BREDR)
4239                 return;
4240
4241         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
4242
4243         mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
4244 }
4245
4246 static void powered_complete(struct hci_dev *hdev, u8 status)
4247 {
4248         struct cmd_lookup match = { NULL, hdev };
4249
4250         BT_DBG("status 0x%02x", status);
4251
4252         hci_dev_lock(hdev);
4253
4254         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
4255
4256         new_settings(hdev, match.sk);
4257
4258         hci_dev_unlock(hdev);
4259
4260         if (match.sk)
4261                 sock_put(match.sk);
4262 }
4263
4264 static int powered_update_hci(struct hci_dev *hdev)
4265 {
4266         struct hci_request req;
4267         u8 link_sec;
4268
4269         hci_req_init(&req, hdev);
4270
4271         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
4272             !lmp_host_ssp_capable(hdev)) {
4273                 u8 ssp = 1;
4274
4275                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
4276         }
4277
4278         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
4279             lmp_bredr_capable(hdev)) {
4280                 struct hci_cp_write_le_host_supported cp;
4281
4282                 cp.le = 1;
4283                 cp.simul = lmp_le_br_capable(hdev);
4284
4285                 /* Check first if we already have the right
4286                  * host state (host features set)
4287                  */
4288                 if (cp.le != lmp_host_le_capable(hdev) ||
4289                     cp.simul != lmp_host_le_br_capable(hdev))
4290                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
4291                                     sizeof(cp), &cp);
4292         }
4293
4294         if (lmp_le_capable(hdev)) {
4295                 /* Set random address to static address if configured */
4296                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
4297                         hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
4298                                     &hdev->static_addr);
4299
4300                 /* Make sure the controller has a good default for
4301                  * advertising data. This also applies to the case
4302                  * where BR/EDR was toggled during the AUTO_OFF phase.
4303                  */
4304                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
4305                         update_adv_data(&req);
4306                         update_scan_rsp_data(&req);
4307                 }
4308
4309                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
4310                         enable_advertising(&req);
4311         }
4312
4313         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4314         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
4315                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
4316                             sizeof(link_sec), &link_sec);
4317
4318         if (lmp_bredr_capable(hdev)) {
4319                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
4320                         set_bredr_scan(&req);
4321                 update_class(&req);
4322                 update_name(&req);
4323                 update_eir(&req);
4324         }
4325
4326         return hci_req_run(&req, powered_complete);
4327 }
4328
4329 int mgmt_powered(struct hci_dev *hdev, u8 powered)
4330 {
4331         struct cmd_lookup match = { NULL, hdev };
4332         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
4333         u8 zero_cod[] = { 0, 0, 0 };
4334         int err;
4335
4336         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
4337                 return 0;
4338
4339         if (powered) {
4340                 if (powered_update_hci(hdev) == 0)
4341                         return 0;
4342
4343                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
4344                                      &match);
4345                 goto new_settings;
4346         }
4347
4348         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
4349         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
4350
4351         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
4352                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
4353                            zero_cod, sizeof(zero_cod), NULL);
4354
4355 new_settings:
4356         err = new_settings(hdev, match.sk);
4357
4358         if (match.sk)
4359                 sock_put(match.sk);
4360
4361         return err;
4362 }
4363
4364 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
4365 {
4366         struct pending_cmd *cmd;
4367         u8 status;
4368
4369         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
4370         if (!cmd)
4371                 return;
4372
4373         if (err == -ERFKILL)
4374                 status = MGMT_STATUS_RFKILLED;
4375         else
4376                 status = MGMT_STATUS_FAILED;
4377
4378         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
4379
4380         mgmt_pending_remove(cmd);
4381 }
4382
4383 void mgmt_discoverable_timeout(struct hci_dev *hdev)
4384 {
4385         struct hci_request req;
4386
4387         hci_dev_lock(hdev);
4388
4389         /* When discoverable timeout triggers, then just make sure
4390          * the limited discoverable flag is cleared. Even in the case
4391          * of a timeout triggered from general discoverable, it is
4392          * safe to unconditionally clear the flag.
4393          */
4394         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
4395         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4396
4397         hci_req_init(&req, hdev);
4398         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4399                 u8 scan = SCAN_PAGE;
4400                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
4401                             sizeof(scan), &scan);
4402         }
4403         update_class(&req);
4404         update_adv_data(&req);
4405         hci_req_run(&req, NULL);
4406
4407         hdev->discov_timeout = 0;
4408
4409         new_settings(hdev, NULL);
4410
4411         hci_dev_unlock(hdev);
4412 }
4413
4414 void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
4415 {
4416         bool changed;
4417
4418         /* Nothing needed here if there's a pending command since that
4419          * commands request completion callback takes care of everything
4420          * necessary.
4421          */
4422         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
4423                 return;
4424
4425         if (discoverable) {
4426                 changed = !test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4427         } else {
4428                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
4429                 changed = test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4430         }
4431
4432         if (changed) {
4433                 struct hci_request req;
4434
4435                 /* In case this change in discoverable was triggered by
4436                  * a disabling of connectable there could be a need to
4437                  * update the advertising flags.
4438                  */
4439                 hci_req_init(&req, hdev);
4440                 update_adv_data(&req);
4441                 hci_req_run(&req, NULL);
4442
4443                 new_settings(hdev, NULL);
4444         }
4445 }
4446
4447 void mgmt_connectable(struct hci_dev *hdev, u8 connectable)
4448 {
4449         bool changed;
4450
4451         /* Nothing needed here if there's a pending command since that
4452          * commands request completion callback takes care of everything
4453          * necessary.
4454          */
4455         if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
4456                 return;
4457
4458         if (connectable)
4459                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
4460         else
4461                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
4462
4463         if (changed)
4464                 new_settings(hdev, NULL);
4465 }
4466
4467 void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
4468 {
4469         u8 mgmt_err = mgmt_status(status);
4470
4471         if (scan & SCAN_PAGE)
4472                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
4473                                      cmd_status_rsp, &mgmt_err);
4474
4475         if (scan & SCAN_INQUIRY)
4476                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
4477                                      cmd_status_rsp, &mgmt_err);
4478 }
4479
4480 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
4481                        bool persistent)
4482 {
4483         struct mgmt_ev_new_link_key ev;
4484
4485         memset(&ev, 0, sizeof(ev));
4486
4487         ev.store_hint = persistent;
4488         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4489         ev.key.addr.type = BDADDR_BREDR;
4490         ev.key.type = key->type;
4491         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
4492         ev.key.pin_len = key->pin_len;
4493
4494         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
4495 }
4496
4497 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
4498 {
4499         struct mgmt_ev_new_long_term_key ev;
4500
4501         memset(&ev, 0, sizeof(ev));
4502
4503         ev.store_hint = persistent;
4504         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4505         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
4506         ev.key.authenticated = key->authenticated;
4507         ev.key.enc_size = key->enc_size;
4508         ev.key.ediv = key->ediv;
4509
4510         if (key->type == HCI_SMP_LTK)
4511                 ev.key.master = 1;
4512
4513         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
4514         memcpy(ev.key.val, key->val, sizeof(key->val));
4515
4516         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
4517 }
4518
4519 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
4520                                   u8 data_len)
4521 {
4522         eir[eir_len++] = sizeof(type) + data_len;
4523         eir[eir_len++] = type;
4524         memcpy(&eir[eir_len], data, data_len);
4525         eir_len += data_len;
4526
4527         return eir_len;
4528 }
4529
4530 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4531                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
4532                            u8 *dev_class)
4533 {
4534         char buf[512];
4535         struct mgmt_ev_device_connected *ev = (void *) buf;
4536         u16 eir_len = 0;
4537
4538         bacpy(&ev->addr.bdaddr, bdaddr);
4539         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4540
4541         ev->flags = __cpu_to_le32(flags);
4542
4543         if (name_len > 0)
4544                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
4545                                           name, name_len);
4546
4547         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
4548                 eir_len = eir_append_data(ev->eir, eir_len,
4549                                           EIR_CLASS_OF_DEV, dev_class, 3);
4550
4551         ev->eir_len = cpu_to_le16(eir_len);
4552
4553         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
4554                     sizeof(*ev) + eir_len, NULL);
4555 }
4556
4557 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
4558 {
4559         struct mgmt_cp_disconnect *cp = cmd->param;
4560         struct sock **sk = data;
4561         struct mgmt_rp_disconnect rp;
4562
4563         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4564         rp.addr.type = cp->addr.type;
4565
4566         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
4567                      sizeof(rp));
4568
4569         *sk = cmd->sk;
4570         sock_hold(*sk);
4571
4572         mgmt_pending_remove(cmd);
4573 }
4574
4575 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
4576 {
4577         struct hci_dev *hdev = data;
4578         struct mgmt_cp_unpair_device *cp = cmd->param;
4579         struct mgmt_rp_unpair_device rp;
4580
4581         memset(&rp, 0, sizeof(rp));
4582         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4583         rp.addr.type = cp->addr.type;
4584
4585         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
4586
4587         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
4588
4589         mgmt_pending_remove(cmd);
4590 }
4591
4592 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
4593                               u8 link_type, u8 addr_type, u8 reason)
4594 {
4595         struct mgmt_ev_device_disconnected ev;
4596         struct sock *sk = NULL;
4597
4598         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
4599
4600         bacpy(&ev.addr.bdaddr, bdaddr);
4601         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4602         ev.reason = reason;
4603
4604         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
4605
4606         if (sk)
4607                 sock_put(sk);
4608
4609         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4610                              hdev);
4611 }
4612
4613 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
4614                             u8 link_type, u8 addr_type, u8 status)
4615 {
4616         struct mgmt_rp_disconnect rp;
4617         struct pending_cmd *cmd;
4618
4619         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4620                              hdev);
4621
4622         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
4623         if (!cmd)
4624                 return;
4625
4626         bacpy(&rp.addr.bdaddr, bdaddr);
4627         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4628
4629         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
4630                      mgmt_status(status), &rp, sizeof(rp));
4631
4632         mgmt_pending_remove(cmd);
4633 }
4634
4635 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4636                          u8 addr_type, u8 status)
4637 {
4638         struct mgmt_ev_connect_failed ev;
4639
4640         bacpy(&ev.addr.bdaddr, bdaddr);
4641         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4642         ev.status = mgmt_status(status);
4643
4644         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
4645 }
4646
4647 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
4648 {
4649         struct mgmt_ev_pin_code_request ev;
4650
4651         bacpy(&ev.addr.bdaddr, bdaddr);
4652         ev.addr.type = BDADDR_BREDR;
4653         ev.secure = secure;
4654
4655         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
4656 }
4657
4658 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4659                                   u8 status)
4660 {
4661         struct pending_cmd *cmd;
4662         struct mgmt_rp_pin_code_reply rp;
4663
4664         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
4665         if (!cmd)
4666                 return;
4667
4668         bacpy(&rp.addr.bdaddr, bdaddr);
4669         rp.addr.type = BDADDR_BREDR;
4670
4671         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
4672                      mgmt_status(status), &rp, sizeof(rp));
4673
4674         mgmt_pending_remove(cmd);
4675 }
4676
4677 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4678                                       u8 status)
4679 {
4680         struct pending_cmd *cmd;
4681         struct mgmt_rp_pin_code_reply rp;
4682
4683         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
4684         if (!cmd)
4685                 return;
4686
4687         bacpy(&rp.addr.bdaddr, bdaddr);
4688         rp.addr.type = BDADDR_BREDR;
4689
4690         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
4691                      mgmt_status(status), &rp, sizeof(rp));
4692
4693         mgmt_pending_remove(cmd);
4694 }
4695
4696 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4697                               u8 link_type, u8 addr_type, __le32 value,
4698                               u8 confirm_hint)
4699 {
4700         struct mgmt_ev_user_confirm_request ev;
4701
4702         BT_DBG("%s", hdev->name);
4703
4704         bacpy(&ev.addr.bdaddr, bdaddr);
4705         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4706         ev.confirm_hint = confirm_hint;
4707         ev.value = value;
4708
4709         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
4710                           NULL);
4711 }
4712
4713 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4714                               u8 link_type, u8 addr_type)
4715 {
4716         struct mgmt_ev_user_passkey_request ev;
4717
4718         BT_DBG("%s", hdev->name);
4719
4720         bacpy(&ev.addr.bdaddr, bdaddr);
4721         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4722
4723         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
4724                           NULL);
4725 }
4726
4727 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4728                                       u8 link_type, u8 addr_type, u8 status,
4729                                       u8 opcode)
4730 {
4731         struct pending_cmd *cmd;
4732         struct mgmt_rp_user_confirm_reply rp;
4733         int err;
4734
4735         cmd = mgmt_pending_find(opcode, hdev);
4736         if (!cmd)
4737                 return -ENOENT;
4738
4739         bacpy(&rp.addr.bdaddr, bdaddr);
4740         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4741         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
4742                            &rp, sizeof(rp));
4743
4744         mgmt_pending_remove(cmd);
4745
4746         return err;
4747 }
4748
4749 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4750                                      u8 link_type, u8 addr_type, u8 status)
4751 {
4752         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4753                                           status, MGMT_OP_USER_CONFIRM_REPLY);
4754 }
4755
4756 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4757                                          u8 link_type, u8 addr_type, u8 status)
4758 {
4759         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4760                                           status,
4761                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
4762 }
4763
4764 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4765                                      u8 link_type, u8 addr_type, u8 status)
4766 {
4767         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4768                                           status, MGMT_OP_USER_PASSKEY_REPLY);
4769 }
4770
4771 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4772                                          u8 link_type, u8 addr_type, u8 status)
4773 {
4774         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4775                                           status,
4776                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
4777 }
4778
4779 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
4780                              u8 link_type, u8 addr_type, u32 passkey,
4781                              u8 entered)
4782 {
4783         struct mgmt_ev_passkey_notify ev;
4784
4785         BT_DBG("%s", hdev->name);
4786
4787         bacpy(&ev.addr.bdaddr, bdaddr);
4788         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4789         ev.passkey = __cpu_to_le32(passkey);
4790         ev.entered = entered;
4791
4792         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
4793 }
4794
4795 void mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4796                       u8 addr_type, u8 status)
4797 {
4798         struct mgmt_ev_auth_failed ev;
4799
4800         bacpy(&ev.addr.bdaddr, bdaddr);
4801         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4802         ev.status = mgmt_status(status);
4803
4804         mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
4805 }
4806
4807 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
4808 {
4809         struct cmd_lookup match = { NULL, hdev };
4810         bool changed;
4811
4812         if (status) {
4813                 u8 mgmt_err = mgmt_status(status);
4814                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
4815                                      cmd_status_rsp, &mgmt_err);
4816                 return;
4817         }
4818
4819         if (test_bit(HCI_AUTH, &hdev->flags))
4820                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
4821                                             &hdev->dev_flags);
4822         else
4823                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
4824                                              &hdev->dev_flags);
4825
4826         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
4827                              &match);
4828
4829         if (changed)
4830                 new_settings(hdev, match.sk);
4831
4832         if (match.sk)
4833                 sock_put(match.sk);
4834 }
4835
4836 static void clear_eir(struct hci_request *req)
4837 {
4838         struct hci_dev *hdev = req->hdev;
4839         struct hci_cp_write_eir cp;
4840
4841         if (!lmp_ext_inq_capable(hdev))
4842                 return;
4843
4844         memset(hdev->eir, 0, sizeof(hdev->eir));
4845
4846         memset(&cp, 0, sizeof(cp));
4847
4848         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4849 }
4850
4851 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4852 {
4853         struct cmd_lookup match = { NULL, hdev };
4854         struct hci_request req;
4855         bool changed = false;
4856
4857         if (status) {
4858                 u8 mgmt_err = mgmt_status(status);
4859
4860                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4861                                                  &hdev->dev_flags)) {
4862                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4863                         new_settings(hdev, NULL);
4864                 }
4865
4866                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4867                                      &mgmt_err);
4868                 return;
4869         }
4870
4871         if (enable) {
4872                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4873         } else {
4874                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4875                 if (!changed)
4876                         changed = test_and_clear_bit(HCI_HS_ENABLED,
4877                                                      &hdev->dev_flags);
4878                 else
4879                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4880         }
4881
4882         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4883
4884         if (changed)
4885                 new_settings(hdev, match.sk);
4886
4887         if (match.sk)
4888                 sock_put(match.sk);
4889
4890         hci_req_init(&req, hdev);
4891
4892         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4893                 update_eir(&req);
4894         else
4895                 clear_eir(&req);
4896
4897         hci_req_run(&req, NULL);
4898 }
4899
4900 static void sk_lookup(struct pending_cmd *cmd, void *data)
4901 {
4902         struct cmd_lookup *match = data;
4903
4904         if (match->sk == NULL) {
4905                 match->sk = cmd->sk;
4906                 sock_hold(match->sk);
4907         }
4908 }
4909
4910 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4911                                     u8 status)
4912 {
4913         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4914
4915         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4916         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4917         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4918
4919         if (!status)
4920                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
4921                            NULL);
4922
4923         if (match.sk)
4924                 sock_put(match.sk);
4925 }
4926
4927 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4928 {
4929         struct mgmt_cp_set_local_name ev;
4930         struct pending_cmd *cmd;
4931
4932         if (status)
4933                 return;
4934
4935         memset(&ev, 0, sizeof(ev));
4936         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4937         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4938
4939         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4940         if (!cmd) {
4941                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4942
4943                 /* If this is a HCI command related to powering on the
4944                  * HCI dev don't send any mgmt signals.
4945                  */
4946                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4947                         return;
4948         }
4949
4950         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4951                    cmd ? cmd->sk : NULL);
4952 }
4953
4954 void mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4955                                              u8 *randomizer, u8 status)
4956 {
4957         struct pending_cmd *cmd;
4958
4959         BT_DBG("%s status %u", hdev->name, status);
4960
4961         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4962         if (!cmd)
4963                 return;
4964
4965         if (status) {
4966                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4967                            mgmt_status(status));
4968         } else {
4969                 struct mgmt_rp_read_local_oob_data rp;
4970
4971                 memcpy(rp.hash, hash, sizeof(rp.hash));
4972                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4973
4974                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4975                              0, &rp, sizeof(rp));
4976         }
4977
4978         mgmt_pending_remove(cmd);
4979 }
4980
4981 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4982                        u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4983                        ssp, u8 *eir, u16 eir_len)
4984 {
4985         char buf[512];
4986         struct mgmt_ev_device_found *ev = (void *) buf;
4987         size_t ev_size;
4988
4989         if (!hci_discovery_active(hdev))
4990                 return;
4991
4992         /* Leave 5 bytes for a potential CoD field */
4993         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4994                 return;
4995
4996         memset(buf, 0, sizeof(buf));
4997
4998         bacpy(&ev->addr.bdaddr, bdaddr);
4999         ev->addr.type = link_to_bdaddr(link_type, addr_type);
5000         ev->rssi = rssi;
5001         if (cfm_name)
5002                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
5003         if (!ssp)
5004                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
5005
5006         if (eir_len > 0)
5007                 memcpy(ev->eir, eir, eir_len);
5008
5009         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
5010                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
5011                                           dev_class, 3);
5012
5013         ev->eir_len = cpu_to_le16(eir_len);
5014         ev_size = sizeof(*ev) + eir_len;
5015
5016         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
5017 }
5018
5019 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5020                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
5021 {
5022         struct mgmt_ev_device_found *ev;
5023         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
5024         u16 eir_len;
5025
5026         ev = (struct mgmt_ev_device_found *) buf;
5027
5028         memset(buf, 0, sizeof(buf));
5029
5030         bacpy(&ev->addr.bdaddr, bdaddr);
5031         ev->addr.type = link_to_bdaddr(link_type, addr_type);
5032         ev->rssi = rssi;
5033
5034         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
5035                                   name_len);
5036
5037         ev->eir_len = cpu_to_le16(eir_len);
5038
5039         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
5040 }
5041
5042 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
5043 {
5044         struct mgmt_ev_discovering ev;
5045         struct pending_cmd *cmd;
5046
5047         BT_DBG("%s discovering %u", hdev->name, discovering);
5048
5049         if (discovering)
5050                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
5051         else
5052                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
5053
5054         if (cmd != NULL) {
5055                 u8 type = hdev->discovery.type;
5056
5057                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
5058                              sizeof(type));
5059                 mgmt_pending_remove(cmd);
5060         }
5061
5062         memset(&ev, 0, sizeof(ev));
5063         ev.type = hdev->discovery.type;
5064         ev.discovering = discovering;
5065
5066         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
5067 }
5068
5069 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
5070 {
5071         struct pending_cmd *cmd;
5072         struct mgmt_ev_device_blocked ev;
5073
5074         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
5075
5076         bacpy(&ev.addr.bdaddr, bdaddr);
5077         ev.addr.type = type;
5078
5079         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
5080                           cmd ? cmd->sk : NULL);
5081 }
5082
5083 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
5084 {
5085         struct pending_cmd *cmd;
5086         struct mgmt_ev_device_unblocked ev;
5087
5088         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
5089
5090         bacpy(&ev.addr.bdaddr, bdaddr);
5091         ev.addr.type = type;
5092
5093         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
5094                           cmd ? cmd->sk : NULL);
5095 }
5096
5097 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
5098 {
5099         BT_DBG("%s status %u", hdev->name, status);
5100
5101         /* Clear the advertising mgmt setting if we failed to re-enable it */
5102         if (status) {
5103                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
5104                 new_settings(hdev, NULL);
5105         }
5106 }
5107
5108 void mgmt_reenable_advertising(struct hci_dev *hdev)
5109 {
5110         struct hci_request req;
5111
5112         if (hci_conn_num(hdev, LE_LINK) > 0)
5113                 return;
5114
5115         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5116                 return;
5117
5118         hci_req_init(&req, hdev);
5119         enable_advertising(&req);
5120
5121         /* If this fails we have no option but to let user space know
5122          * that we've disabled advertising.
5123          */
5124         if (hci_req_run(&req, adv_enable_complete) < 0) {
5125                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
5126                 new_settings(hdev, NULL);
5127         }
5128 }