projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Fix missing address type check for removing LTKs
[deliverable/linux.git] / net / bluetooth / mgmt.c
CommitLineData
0381101f
JH		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
ea585ab5 3
0381101f 4 Copyright (C) 2010 Nokia Corporation
ea585ab5 5 Copyright (C) 2011-2012 Intel Corporation
0381101f
JH		 6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI Management interface */
26
3a9a231d 27#include <linux/module.h>
0381101f
JH		 28#include <asm/unaligned.h>
29
30#include <net/bluetooth/bluetooth.h>
31#include <net/bluetooth/hci_core.h>
32#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 33
34#include "smp.h"
0381101f 35
2da9c55c 36#define MGMT_VERSION 1
40456644 37#define MGMT_REVISION 5
02d98129 38
e70bb2e8
JH		 39static const u16 mgmt_commands[] = {
40 MGMT_OP_READ_INDEX_LIST,
41 MGMT_OP_READ_INFO,
42 MGMT_OP_SET_POWERED,
43 MGMT_OP_SET_DISCOVERABLE,
44 MGMT_OP_SET_CONNECTABLE,
45 MGMT_OP_SET_FAST_CONNECTABLE,
46 MGMT_OP_SET_PAIRABLE,
47 MGMT_OP_SET_LINK_SECURITY,
48 MGMT_OP_SET_SSP,
49 MGMT_OP_SET_HS,
50 MGMT_OP_SET_LE,
51 MGMT_OP_SET_DEV_CLASS,
52 MGMT_OP_SET_LOCAL_NAME,
53 MGMT_OP_ADD_UUID,
54 MGMT_OP_REMOVE_UUID,
55 MGMT_OP_LOAD_LINK_KEYS,
56 MGMT_OP_LOAD_LONG_TERM_KEYS,
57 MGMT_OP_DISCONNECT,
58 MGMT_OP_GET_CONNECTIONS,
59 MGMT_OP_PIN_CODE_REPLY,
60 MGMT_OP_PIN_CODE_NEG_REPLY,
61 MGMT_OP_SET_IO_CAPABILITY,
62 MGMT_OP_PAIR_DEVICE,
63 MGMT_OP_CANCEL_PAIR_DEVICE,
64 MGMT_OP_UNPAIR_DEVICE,
65 MGMT_OP_USER_CONFIRM_REPLY,
66 MGMT_OP_USER_CONFIRM_NEG_REPLY,
67 MGMT_OP_USER_PASSKEY_REPLY,
68 MGMT_OP_USER_PASSKEY_NEG_REPLY,
69 MGMT_OP_READ_LOCAL_OOB_DATA,
70 MGMT_OP_ADD_REMOTE_OOB_DATA,
71 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
72 MGMT_OP_START_DISCOVERY,
73 MGMT_OP_STOP_DISCOVERY,
74 MGMT_OP_CONFIRM_NAME,
75 MGMT_OP_BLOCK_DEVICE,
76 MGMT_OP_UNBLOCK_DEVICE,
cdbaccca 77 MGMT_OP_SET_DEVICE_ID,
4375f103 78 MGMT_OP_SET_ADVERTISING,
0663ca2a 79 MGMT_OP_SET_BREDR,
d13eafce 80 MGMT_OP_SET_STATIC_ADDRESS,
7f72134e 81 MGMT_OP_SET_SCAN_PARAMS,
e98d2ce2 82 MGMT_OP_SET_SECURE_CONN,
4e39ac81 83 MGMT_OP_SET_DEBUG_KEYS,
41edf160 84 MGMT_OP_LOAD_IRKS,
e70bb2e8
JH		 85};
86
87static const u16 mgmt_events[] = {
88 MGMT_EV_CONTROLLER_ERROR,
89 MGMT_EV_INDEX_ADDED,
90 MGMT_EV_INDEX_REMOVED,
91 MGMT_EV_NEW_SETTINGS,
92 MGMT_EV_CLASS_OF_DEV_CHANGED,
93 MGMT_EV_LOCAL_NAME_CHANGED,
94 MGMT_EV_NEW_LINK_KEY,
95 MGMT_EV_NEW_LONG_TERM_KEY,
96 MGMT_EV_DEVICE_CONNECTED,
97 MGMT_EV_DEVICE_DISCONNECTED,
98 MGMT_EV_CONNECT_FAILED,
99 MGMT_EV_PIN_CODE_REQUEST,
100 MGMT_EV_USER_CONFIRM_REQUEST,
101 MGMT_EV_USER_PASSKEY_REQUEST,
102 MGMT_EV_AUTH_FAILED,
103 MGMT_EV_DEVICE_FOUND,
104 MGMT_EV_DISCOVERING,
105 MGMT_EV_DEVICE_BLOCKED,
106 MGMT_EV_DEVICE_UNBLOCKED,
107 MGMT_EV_DEVICE_UNPAIRED,
92a25256 108 MGMT_EV_PASSKEY_NOTIFY,
e70bb2e8
JH		 109};
110
17b02e62 111#define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
7d78525d 112
4b34ee78
JH		 113#define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
114 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
115
eec8d2bc
JH		 116struct pending_cmd {
117 struct list_head list;
fc2f4b13 118 u16 opcode;
eec8d2bc 119 int index;
c68fb7ff 120 void *param;
eec8d2bc 121 struct sock *sk;
e9a416b5 122 void *user_data;
eec8d2bc
JH		 123};
124
ca69b795
JH		 125/* HCI to MGMT error code conversion table */
126static u8 mgmt_status_table[] = {
127 MGMT_STATUS_SUCCESS,
128 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
129 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
130 MGMT_STATUS_FAILED, /* Hardware Failure */
131 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
132 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
eadd663a 133 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
ca69b795
JH		 134 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
135 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
136 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
137 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
138 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
139 MGMT_STATUS_BUSY, /* Command Disallowed */
140 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
141 MGMT_STATUS_REJECTED, /* Rejected Security */
142 MGMT_STATUS_REJECTED, /* Rejected Personal */
143 MGMT_STATUS_TIMEOUT, /* Host Timeout */
144 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
145 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
146 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
147 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
148 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
149 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
150 MGMT_STATUS_BUSY, /* Repeated Attempts */
151 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
152 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
153 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
154 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
155 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
156 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
157 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
158 MGMT_STATUS_FAILED, /* Unspecified Error */
159 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
160 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
161 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
162 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
163 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
164 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
165 MGMT_STATUS_FAILED, /* Unit Link Key Used */
166 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
167 MGMT_STATUS_TIMEOUT, /* Instant Passed */
168 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
169 MGMT_STATUS_FAILED, /* Transaction Collision */
170 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
171 MGMT_STATUS_REJECTED, /* QoS Rejected */
172 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
173 MGMT_STATUS_REJECTED, /* Insufficient Security */
174 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
175 MGMT_STATUS_BUSY, /* Role Switch Pending */
176 MGMT_STATUS_FAILED, /* Slot Violation */
177 MGMT_STATUS_FAILED, /* Role Switch Failed */
178 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
179 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
180 MGMT_STATUS_BUSY, /* Host Busy Pairing */
181 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
182 MGMT_STATUS_BUSY, /* Controller Busy */
183 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
184 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
185 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
186 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
187 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
188};
189
190static u8 mgmt_status(u8 hci_status)
191{
192 if (hci_status < ARRAY_SIZE(mgmt_status_table))
193 return mgmt_status_table[hci_status];
194
195 return MGMT_STATUS_FAILED;
196}
197
4e51eae9 198static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
f7b64e69
JH		 199{
200 struct sk_buff *skb;
201 struct mgmt_hdr *hdr;
202 struct mgmt_ev_cmd_status *ev;
56b7d137 203 int err;
f7b64e69 204
34eb525c 205 BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
f7b64e69 206
790eff44 207 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
f7b64e69
JH		 208 if (!skb)
209 return -ENOMEM;
210
211 hdr = (void *) skb_put(skb, sizeof(*hdr));
212
612dfce9 213 hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
4e51eae9 214 hdr->index = cpu_to_le16(index);
f7b64e69
JH		 215 hdr->len = cpu_to_le16(sizeof(*ev));
216
217 ev = (void *) skb_put(skb, sizeof(*ev));
218 ev->status = status;
eb55ef07 219 ev->opcode = cpu_to_le16(cmd);
f7b64e69 220
56b7d137
GP		 221 err = sock_queue_rcv_skb(sk, skb);
222 if (err < 0)
f7b64e69
JH		 223 kfree_skb(skb);
224
56b7d137 225 return err;
f7b64e69
JH		 226}
227
aee9b218 228static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
04124681 229 void *rp, size_t rp_len)
02d98129
JH		 230{
231 struct sk_buff *skb;
232 struct mgmt_hdr *hdr;
233 struct mgmt_ev_cmd_complete *ev;
56b7d137 234 int err;
02d98129
JH		 235
236 BT_DBG("sock %p", sk);
237
790eff44 238 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
02d98129
JH		 239 if (!skb)
240 return -ENOMEM;
241
242 hdr = (void *) skb_put(skb, sizeof(*hdr));
02d98129 243
612dfce9 244 hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
4e51eae9 245 hdr->index = cpu_to_le16(index);
a38528f1 246 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
02d98129 247
a38528f1 248 ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
eb55ef07 249 ev->opcode = cpu_to_le16(cmd);
aee9b218 250 ev->status = status;
8020c16a
SJ		 251
252 if (rp)
253 memcpy(ev->data, rp, rp_len);
02d98129 254
56b7d137
GP		 255 err = sock_queue_rcv_skb(sk, skb);
256 if (err < 0)
02d98129
JH		 257 kfree_skb(skb);
258
e5f0e151 259 return err;
02d98129
JH		 260}
261
04124681
GP		 262static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
263 u16 data_len)
a38528f1
JH		 264{
265 struct mgmt_rp_read_version rp;
266
267 BT_DBG("sock %p", sk);
268
269 rp.version = MGMT_VERSION;
eb55ef07 270 rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
a38528f1 271
aee9b218 272 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
04124681 273 sizeof(rp));
a38528f1
JH		 274}
275
04124681
GP		 276static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
277 u16 data_len)
e70bb2e8
JH		 278{
279 struct mgmt_rp_read_commands *rp;
eb55ef07
MH		 280 const u16 num_commands = ARRAY_SIZE(mgmt_commands);
281 const u16 num_events = ARRAY_SIZE(mgmt_events);
2e3c35ea 282 __le16 *opcode;
e70bb2e8
JH		 283 size_t rp_size;
284 int i, err;
285
286 BT_DBG("sock %p", sk);
287
288 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
289
290 rp = kmalloc(rp_size, GFP_KERNEL);
291 if (!rp)
292 return -ENOMEM;
293
eb55ef07
MH		 294 rp->num_commands = __constant_cpu_to_le16(num_commands);
295 rp->num_events = __constant_cpu_to_le16(num_events);
e70bb2e8
JH		 296
297 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
298 put_unaligned_le16(mgmt_commands[i], opcode);
299
300 for (i = 0; i < num_events; i++, opcode++)
301 put_unaligned_le16(mgmt_events[i], opcode);
302
aee9b218 303 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
04124681 304 rp_size);
e70bb2e8
JH		 305 kfree(rp);
306
307 return err;
308}
309
04124681
GP		 310static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
311 u16 data_len)
faba42eb 312{
faba42eb 313 struct mgmt_rp_read_index_list *rp;
8035ded4 314 struct hci_dev *d;
a38528f1 315 size_t rp_len;
faba42eb 316 u16 count;
476e44cb 317 int err;
faba42eb
JH		 318
319 BT_DBG("sock %p", sk);
320
321 read_lock(&hci_dev_list_lock);
322
323 count = 0;
bb4b2a9a 324 list_for_each_entry(d, &hci_dev_list, list) {
1514b892
MH		 325 if (d->dev_type == HCI_BREDR)
326 count++;
faba42eb
JH		 327 }
328
a38528f1
JH		 329 rp_len = sizeof(*rp) + (2 * count);
330 rp = kmalloc(rp_len, GFP_ATOMIC);
331 if (!rp) {
b2c60d42 332 read_unlock(&hci_dev_list_lock);
faba42eb 333 return -ENOMEM;
b2c60d42 334 }
faba42eb 335
476e44cb 336 count = 0;
8035ded4 337 list_for_each_entry(d, &hci_dev_list, list) {
a8b2d5c2 338 if (test_bit(HCI_SETUP, &d->dev_flags))
ab81cbf9
JH		 339 continue;
340
0736cfa8
MH		 341 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
342 continue;
343
1514b892
MH		 344 if (d->dev_type == HCI_BREDR) {
345 rp->index[count++] = cpu_to_le16(d->id);
346 BT_DBG("Added hci%u", d->id);
347 }
faba42eb
JH		 348 }
349
476e44cb
JH		 350 rp->num_controllers = cpu_to_le16(count);
351 rp_len = sizeof(*rp) + (2 * count);
352
faba42eb
JH		 353 read_unlock(&hci_dev_list_lock);
354
aee9b218 355 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
04124681 356 rp_len);
faba42eb 357
a38528f1
JH		 358 kfree(rp);
359
360 return err;
faba42eb
JH		 361}
362
69ab39ea
JH		 363static u32 get_supported_settings(struct hci_dev *hdev)
364{
365 u32 settings = 0;
366
367 settings |= MGMT_SETTING_POWERED;
69ab39ea 368 settings |= MGMT_SETTING_PAIRABLE;
b1de97d8 369 settings |= MGMT_SETTING_DEBUG_KEYS;
69ab39ea 370
ed3fa31f 371 if (lmp_bredr_capable(hdev)) {
33c525c0 372 settings |= MGMT_SETTING_CONNECTABLE;
1a47aee8
JH		 373 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
374 settings |= MGMT_SETTING_FAST_CONNECTABLE;
33c525c0 375 settings |= MGMT_SETTING_DISCOVERABLE;
69ab39ea
JH		 376 settings |= MGMT_SETTING_BREDR;
377 settings |= MGMT_SETTING_LINK_SECURITY;
a82974c9
MH		 378
379 if (lmp_ssp_capable(hdev)) {
380 settings |= MGMT_SETTING_SSP;
381 settings |= MGMT_SETTING_HS;
382 }
e98d2ce2 383
5afeac14
MH		 384 if (lmp_sc_capable(hdev) ||
385 test_bit(HCI_FORCE_SC, &hdev->dev_flags))
e98d2ce2 386 settings |= MGMT_SETTING_SECURE_CONN;
848566b3 387 }
d7b7e796 388
eeca6f89 389 if (lmp_le_capable(hdev)) {
9d42820f 390 settings |= MGMT_SETTING_LE;
eeca6f89
JH		 391 settings |= MGMT_SETTING_ADVERTISING;
392 }
69ab39ea
JH		 393
394 return settings;
395}
396
397static u32 get_current_settings(struct hci_dev *hdev)
398{
399 u32 settings = 0;
400
f1f0eb02 401 if (hdev_is_powered(hdev))
f0d4b78a
MH		 402 settings |= MGMT_SETTING_POWERED;
403
5e5282bb 404 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
69ab39ea
JH		 405 settings |= MGMT_SETTING_CONNECTABLE;
406
1a4d3c4b
JH		 407 if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
408 settings |= MGMT_SETTING_FAST_CONNECTABLE;
409
5e5282bb 410 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
69ab39ea
JH		 411 settings |= MGMT_SETTING_DISCOVERABLE;
412
a8b2d5c2 413 if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
69ab39ea
JH		 414 settings |= MGMT_SETTING_PAIRABLE;
415
56f87901 416 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
69ab39ea
JH		 417 settings |= MGMT_SETTING_BREDR;
418
06199cf8 419 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
69ab39ea
JH		 420 settings |= MGMT_SETTING_LE;
421
47990ea0 422 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
69ab39ea
JH		 423 settings |= MGMT_SETTING_LINK_SECURITY;
424
84bde9d6 425 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
69ab39ea
JH		 426 settings |= MGMT_SETTING_SSP;
427
6d80dfd0
JH		 428 if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
429 settings |= MGMT_SETTING_HS;
430
f3d3444a 431 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
eeca6f89
JH		 432 settings |= MGMT_SETTING_ADVERTISING;
433
e98d2ce2
MH		 434 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
435 settings |= MGMT_SETTING_SECURE_CONN;
436
b1de97d8
MH		 437 if (test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags))
438 settings |= MGMT_SETTING_DEBUG_KEYS;
439
69ab39ea
JH		 440 return settings;
441}
442
ef580372
JH		 443#define PNP_INFO_SVCLASS_ID 0x1200
444
213202ed
JH		 445static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
446{
447 u8 *ptr = data, *uuids_start = NULL;
448 struct bt_uuid *uuid;
449
450 if (len < 4)
451 return ptr;
452
453 list_for_each_entry(uuid, &hdev->uuids, list) {
454 u16 uuid16;
455
456 if (uuid->size != 16)
457 continue;
458
459 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
460 if (uuid16 < 0x1100)
461 continue;
462
463 if (uuid16 == PNP_INFO_SVCLASS_ID)
464 continue;
465
466 if (!uuids_start) {
467 uuids_start = ptr;
468 uuids_start[0] = 1;
469 uuids_start[1] = EIR_UUID16_ALL;
470 ptr += 2;
471 }
472
473 /* Stop if not enough space to put next UUID */
474 if ((ptr - data) + sizeof(u16) > len) {
475 uuids_start[1] = EIR_UUID16_SOME;
476 break;
477 }
478
479 *ptr++ = (uuid16 & 0x00ff);
480 *ptr++ = (uuid16 & 0xff00) >> 8;
481 uuids_start[0] += sizeof(uuid16);
482 }
483
484 return ptr;
485}
486
cdf1963f
JH		 487static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
488{
489 u8 *ptr = data, *uuids_start = NULL;
490 struct bt_uuid *uuid;
491
492 if (len < 6)
493 return ptr;
494
495 list_for_each_entry(uuid, &hdev->uuids, list) {
496 if (uuid->size != 32)
497 continue;
498
499 if (!uuids_start) {
500 uuids_start = ptr;
501 uuids_start[0] = 1;
502 uuids_start[1] = EIR_UUID32_ALL;
503 ptr += 2;
504 }
505
506 /* Stop if not enough space to put next UUID */
507 if ((ptr - data) + sizeof(u32) > len) {
508 uuids_start[1] = EIR_UUID32_SOME;
509 break;
510 }
511
512 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
513 ptr += sizeof(u32);
514 uuids_start[0] += sizeof(u32);
515 }
516
517 return ptr;
518}
519
c00d575b
JH		 520static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
521{
522 u8 *ptr = data, *uuids_start = NULL;
523 struct bt_uuid *uuid;
524
525 if (len < 18)
526 return ptr;
527
528 list_for_each_entry(uuid, &hdev->uuids, list) {
529 if (uuid->size != 128)
530 continue;
531
532 if (!uuids_start) {
533 uuids_start = ptr;
534 uuids_start[0] = 1;
535 uuids_start[1] = EIR_UUID128_ALL;
536 ptr += 2;
537 }
538
539 /* Stop if not enough space to put next UUID */
540 if ((ptr - data) + 16 > len) {
541 uuids_start[1] = EIR_UUID128_SOME;
542 break;
543 }
544
545 memcpy(ptr, uuid->uuid, 16);
546 ptr += 16;
547 uuids_start[0] += 16;
548 }
549
550 return ptr;
551}
552
eb2a8d20
JH		 553static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
554{
555 struct pending_cmd *cmd;
556
557 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
558 if (cmd->opcode == opcode)
559 return cmd;
560 }
561
562 return NULL;
563}
564
f14d8f64
MH		 565static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
566{
7a5f4990
MH		 567 u8 ad_len = 0;
568 size_t name_len;
569
570 name_len = strlen(hdev->dev_name);
571 if (name_len > 0) {
572 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
573
574 if (name_len > max_len) {
575 name_len = max_len;
576 ptr[1] = EIR_NAME_SHORT;
577 } else
578 ptr[1] = EIR_NAME_COMPLETE;
579
580 ptr[0] = name_len + 1;
581
582 memcpy(ptr + 2, hdev->dev_name, name_len);
583
584 ad_len += (name_len + 2);
585 ptr += (name_len + 2);
586 }
587
588 return ad_len;
f14d8f64
MH		 589}
590
591static void update_scan_rsp_data(struct hci_request *req)
592{
593 struct hci_dev *hdev = req->hdev;
594 struct hci_cp_le_set_scan_rsp_data cp;
595 u8 len;
596
7751ef1b 597 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
f14d8f64
MH		 598 return;
599
600 memset(&cp, 0, sizeof(cp));
601
602 len = create_scan_rsp_data(hdev, cp.data);
603
eb438b5f
JH		 604 if (hdev->scan_rsp_data_len == len &&
605 memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
f14d8f64
MH		 606 return;
607
eb438b5f
JH		 608 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
609 hdev->scan_rsp_data_len = len;
f14d8f64
MH		 610
611 cp.length = len;
612
613 hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
614}
615
9a43e25f
JH		 616static u8 get_adv_discov_flags(struct hci_dev *hdev)
617{
618 struct pending_cmd *cmd;
619
620 /* If there's a pending mgmt command the flags will not yet have
621 * their final values, so check for this first.
622 */
623 cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
624 if (cmd) {
625 struct mgmt_mode *cp = cmd->param;
626 if (cp->val == 0x01)
627 return LE_AD_GENERAL;
628 else if (cp->val == 0x02)
629 return LE_AD_LIMITED;
630 } else {
631 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
632 return LE_AD_LIMITED;
633 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
634 return LE_AD_GENERAL;
635 }
636
637 return 0;
638}
639
46cad2ed 640static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
441ad2d0
MH		 641{
642 u8 ad_len = 0, flags = 0;
441ad2d0 643
9a43e25f 644 flags |= get_adv_discov_flags(hdev);
441ad2d0 645
e834004b 646 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
441ad2d0 647 flags |= LE_AD_NO_BREDR;
441ad2d0
MH		 648
649 if (flags) {
650 BT_DBG("adv flags 0x%02x", flags);
651
652 ptr[0] = 2;
653 ptr[1] = EIR_FLAGS;
654 ptr[2] = flags;
655
656 ad_len += 3;
657 ptr += 3;
658 }
659
660 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
661 ptr[0] = 2;
662 ptr[1] = EIR_TX_POWER;
663 ptr[2] = (u8) hdev->adv_tx_power;
664
665 ad_len += 3;
666 ptr += 3;
667 }
668
441ad2d0
MH		 669 return ad_len;
670}
671
5947f4bc 672static void update_adv_data(struct hci_request *req)
441ad2d0
MH		 673{
674 struct hci_dev *hdev = req->hdev;
675 struct hci_cp_le_set_adv_data cp;
676 u8 len;
677
10994ce6 678 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
441ad2d0
MH		 679 return;
680
681 memset(&cp, 0, sizeof(cp));
682
46cad2ed 683 len = create_adv_data(hdev, cp.data);
441ad2d0
MH		 684
685 if (hdev->adv_data_len == len &&
686 memcmp(cp.data, hdev->adv_data, len) == 0)
687 return;
688
689 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
690 hdev->adv_data_len = len;
691
692 cp.length = len;
693
694 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
695}
696
ef580372
JH		 697static void create_eir(struct hci_dev *hdev, u8 *data)
698{
699 u8 *ptr = data;
ef580372
JH		 700 size_t name_len;
701
702 name_len = strlen(hdev->dev_name);
703
704 if (name_len > 0) {
705 /* EIR Data type */
706 if (name_len > 48) {
707 name_len = 48;
708 ptr[1] = EIR_NAME_SHORT;
709 } else
710 ptr[1] = EIR_NAME_COMPLETE;
711
712 /* EIR Data length */
713 ptr[0] = name_len + 1;
714
715 memcpy(ptr + 2, hdev->dev_name, name_len);
716
ef580372
JH		 717 ptr += (name_len + 2);
718 }
719
bbaf444a 720 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
91c4e9b1
MH		 721 ptr[0] = 2;
722 ptr[1] = EIR_TX_POWER;
723 ptr[2] = (u8) hdev->inq_tx_power;
724
91c4e9b1
MH		 725 ptr += 3;
726 }
727
2b9be137
MH		 728 if (hdev->devid_source > 0) {
729 ptr[0] = 9;
730 ptr[1] = EIR_DEVICE_ID;
731
732 put_unaligned_le16(hdev->devid_source, ptr + 2);
733 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
734 put_unaligned_le16(hdev->devid_product, ptr + 6);
735 put_unaligned_le16(hdev->devid_version, ptr + 8);
736
2b9be137
MH		 737 ptr += 10;
738 }
739
213202ed 740 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
cdf1963f 741 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
c00d575b 742 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
ef580372
JH		 743}
744
890ea898 745static void update_eir(struct hci_request *req)
ef580372 746{
890ea898 747 struct hci_dev *hdev = req->hdev;
ef580372
JH		 748 struct hci_cp_write_eir cp;
749
504c8dcd 750 if (!hdev_is_powered(hdev))
890ea898 751 return;
7770c4aa 752
976eb20e 753 if (!lmp_ext_inq_capable(hdev))
890ea898 754 return;
ef580372 755
84bde9d6 756 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
890ea898 757 return;
ef580372 758
a8b2d5c2 759 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
890ea898 760 return;
ef580372
JH		 761
762 memset(&cp, 0, sizeof(cp));
763
764 create_eir(hdev, cp.data);
765
766 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
890ea898 767 return;
ef580372
JH		 768
769 memcpy(hdev->eir, cp.data, sizeof(cp.data));
770
890ea898 771 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
ef580372
JH		 772}
773
774static u8 get_service_classes(struct hci_dev *hdev)
775{
776 struct bt_uuid *uuid;
777 u8 val = 0;
778
779 list_for_each_entry(uuid, &hdev->uuids, list)
780 val |= uuid->svc_hint;
781
782 return val;
783}
784
890ea898 785static void update_class(struct hci_request *req)
ef580372 786{
890ea898 787 struct hci_dev *hdev = req->hdev;
ef580372
JH		 788 u8 cod[3];
789
790 BT_DBG("%s", hdev->name);
791
504c8dcd 792 if (!hdev_is_powered(hdev))
890ea898 793 return;
7770c4aa 794
f87ea1da
JH		 795 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
796 return;
797
a8b2d5c2 798 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
890ea898 799 return;
ef580372
JH		 800
801 cod[0] = hdev->minor_class;
802 cod[1] = hdev->major_class;
803 cod[2] = get_service_classes(hdev);
804
6acd7db4
MH		 805 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
806 cod[1] |= 0x20;
807
ef580372 808 if (memcmp(cod, hdev->dev_class, 3) == 0)
890ea898 809 return;
ef580372 810
890ea898 811 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
ef580372
JH		 812}
813
7d78525d
JH		 814static void service_cache_off(struct work_struct *work)
815{
816 struct hci_dev *hdev = container_of(work, struct hci_dev,
04124681 817 service_cache.work);
890ea898 818 struct hci_request req;
7d78525d 819
a8b2d5c2 820 if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
7d78525d
JH		 821 return;
822
890ea898
JH		 823 hci_req_init(&req, hdev);
824
7d78525d
JH		 825 hci_dev_lock(hdev);
826
890ea898
JH		 827 update_eir(&req);
828 update_class(&req);
7d78525d
JH		 829
830 hci_dev_unlock(hdev);
890ea898
JH		 831
832 hci_req_run(&req, NULL);
7d78525d
JH		 833}
834
6a919082 835static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
7d78525d 836{
4f87da80 837 if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
6a919082
JH		 838 return;
839
4f87da80 840 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
7d78525d 841
4f87da80
JH		 842 /* Non-mgmt controlled devices get this bit set
843 * implicitly so that pairing works for them, however
844 * for mgmt we require user-space to explicitly enable
845 * it
846 */
847 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
7d78525d
JH		 848}
849
0f4e68cf 850static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
04124681 851 void *data, u16 data_len)
0381101f 852{
a38528f1 853 struct mgmt_rp_read_info rp;
f7b64e69 854
bdb6d971 855 BT_DBG("sock %p %s", sk, hdev->name);
f7b64e69 856
09fd0de5 857 hci_dev_lock(hdev);
f7b64e69 858
dc4fe30b
JH		 859 memset(&rp, 0, sizeof(rp));
860
69ab39ea 861 bacpy(&rp.bdaddr, &hdev->bdaddr);
f7b64e69 862
69ab39ea 863 rp.version = hdev->hci_ver;
eb55ef07 864 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
69ab39ea
JH		 865
866 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
867 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
f7b64e69 868
a38528f1 869 memcpy(rp.dev_class, hdev->dev_class, 3);
f7b64e69 870
dc4fe30b 871 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
27fcc362 872 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
dc4fe30b 873
09fd0de5 874 hci_dev_unlock(hdev);
0381101f 875
bdb6d971 876 return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
04124681 877 sizeof(rp));
0381101f
JH		 878}
879
eec8d2bc
JH		 880static void mgmt_pending_free(struct pending_cmd *cmd)
881{
882 sock_put(cmd->sk);
c68fb7ff 883 kfree(cmd->param);
eec8d2bc
JH		 884 kfree(cmd);
885}
886
366a0336 887static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
04124681
GP		 888 struct hci_dev *hdev, void *data,
889 u16 len)
eec8d2bc
JH		 890{
891 struct pending_cmd *cmd;
892
12b94565 893 cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
eec8d2bc 894 if (!cmd)
366a0336 895 return NULL;
eec8d2bc
JH		 896
897 cmd->opcode = opcode;
2e58ef3e 898 cmd->index = hdev->id;
eec8d2bc 899
12b94565 900 cmd->param = kmalloc(len, GFP_KERNEL);
c68fb7ff 901 if (!cmd->param) {
eec8d2bc 902 kfree(cmd);
366a0336 903 return NULL;
eec8d2bc
JH		 904 }
905
8fce6357
SJ		 906 if (data)
907 memcpy(cmd->param, data, len);
eec8d2bc
JH		 908
909 cmd->sk = sk;
910 sock_hold(sk);
911
2e58ef3e 912 list_add(&cmd->list, &hdev->mgmt_pending);
eec8d2bc 913
366a0336 914 return cmd;
eec8d2bc
JH		 915}
916
744cf19e 917static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
8fc9ced3
GP		 918 void (*cb)(struct pending_cmd *cmd,
919 void *data),
04124681 920 void *data)
eec8d2bc 921{
a3d09356 922 struct pending_cmd *cmd, *tmp;
eec8d2bc 923
a3d09356 924 list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
b24752fe 925 if (opcode > 0 && cmd->opcode != opcode)
eec8d2bc
JH		 926 continue;
927
eec8d2bc
JH		 928 cb(cmd, data);
929 }
930}
931
a664b5bc 932static void mgmt_pending_remove(struct pending_cmd *cmd)
73f22f62 933{
73f22f62
JH		 934 list_del(&cmd->list);
935 mgmt_pending_free(cmd);
936}
937
69ab39ea 938static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
8680570b 939{
69ab39ea 940 __le32 settings = cpu_to_le32(get_current_settings(hdev));
8680570b 941
aee9b218 942 return cmd_complete(sk, hdev->id, opcode, 0, &settings,
04124681 943 sizeof(settings));
8680570b
JH		 944}
945
bdb6d971 946static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 947 u16 len)
eec8d2bc 948{
650f726d 949 struct mgmt_mode *cp = data;
366a0336 950 struct pending_cmd *cmd;
4b34ee78 951 int err;
eec8d2bc 952
bdb6d971 953 BT_DBG("request for %s", hdev->name);
eec8d2bc 954
a7e80f25
JH		 955 if (cp->val != 0x00 && cp->val != 0x01)
956 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
957 MGMT_STATUS_INVALID_PARAMS);
958
09fd0de5 959 hci_dev_lock(hdev);
eec8d2bc 960
87b95ba6
JH		 961 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
962 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
963 MGMT_STATUS_BUSY);
964 goto failed;
965 }
966
f0d4b78a
MH		 967 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
968 cancel_delayed_work(&hdev->power_off);
969
970 if (cp->val) {
a1d70450
JH		 971 mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
972 data, len);
973 err = mgmt_powered(hdev, 1);
f0d4b78a
MH		 974 goto failed;
975 }
976 }
977
4b34ee78 978 if (!!cp->val == hdev_is_powered(hdev)) {
69ab39ea 979 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
eec8d2bc
JH		 980 goto failed;
981 }
982
2e58ef3e 983 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
366a0336
JH		 984 if (!cmd) {
985 err = -ENOMEM;
eec8d2bc 986 goto failed;
366a0336 987 }
eec8d2bc 988
72a734ec 989 if (cp->val)
19202573 990 queue_work(hdev->req_workqueue, &hdev->power_on);
eec8d2bc 991 else
19202573 992 queue_work(hdev->req_workqueue, &hdev->power_off.work);
eec8d2bc 993
366a0336 994 err = 0;
eec8d2bc
JH		 995
996failed:
09fd0de5 997 hci_dev_unlock(hdev);
366a0336 998 return err;
eec8d2bc
JH		 999}
1000
04124681
GP		 1001static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
1002 struct sock *skip_sk)
beadb2bd
JH		 1003{
1004 struct sk_buff *skb;
1005 struct mgmt_hdr *hdr;
1006
790eff44 1007 skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
beadb2bd
JH		 1008 if (!skb)
1009 return -ENOMEM;
1010
1011 hdr = (void *) skb_put(skb, sizeof(*hdr));
1012 hdr->opcode = cpu_to_le16(event);
1013 if (hdev)
1014 hdr->index = cpu_to_le16(hdev->id);
1015 else
612dfce9 1016 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
beadb2bd
JH		 1017 hdr->len = cpu_to_le16(data_len);
1018
1019 if (data)
1020 memcpy(skb_put(skb, data_len), data, data_len);
1021
97e0bdeb
MH		 1022 /* Time stamp */
1023 __net_timestamp(skb);
1024
beadb2bd
JH		 1025 hci_send_to_control(skb, skip_sk);
1026 kfree_skb(skb);
1027
1028 return 0;
1029}
1030
1031static int new_settings(struct hci_dev *hdev, struct sock *skip)
1032{
1033 __le32 ev;
1034
1035 ev = cpu_to_le32(get_current_settings(hdev));
1036
1037 return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1038}
1039
bd99abdd
JH		 1040struct cmd_lookup {
1041 struct sock *sk;
1042 struct hci_dev *hdev;
1043 u8 mgmt_status;
1044};
1045
1046static void settings_rsp(struct pending_cmd *cmd, void *data)
1047{
1048 struct cmd_lookup *match = data;
1049
1050 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1051
1052 list_del(&cmd->list);
1053
1054 if (match->sk == NULL) {
1055 match->sk = cmd->sk;
1056 sock_hold(match->sk);
1057 }
1058
1059 mgmt_pending_free(cmd);
1060}
1061
1062static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1063{
1064 u8 *status = data;
1065
1066 cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1067 mgmt_pending_remove(cmd);
1068}
1069
e6fe7986
JH		 1070static u8 mgmt_bredr_support(struct hci_dev *hdev)
1071{
1072 if (!lmp_bredr_capable(hdev))
1073 return MGMT_STATUS_NOT_SUPPORTED;
1074 else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1075 return MGMT_STATUS_REJECTED;
1076 else
1077 return MGMT_STATUS_SUCCESS;
1078}
1079
1080static u8 mgmt_le_support(struct hci_dev *hdev)
1081{
1082 if (!lmp_le_capable(hdev))
1083 return MGMT_STATUS_NOT_SUPPORTED;
1084 else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1085 return MGMT_STATUS_REJECTED;
1086 else
1087 return MGMT_STATUS_SUCCESS;
1088}
1089
bfaf8c9f
JH		 1090static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1091{
1092 struct pending_cmd *cmd;
1093 struct mgmt_mode *cp;
970ba524 1094 struct hci_request req;
bfaf8c9f
JH		 1095 bool changed;
1096
1097 BT_DBG("status 0x%02x", status);
1098
1099 hci_dev_lock(hdev);
1100
1101 cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1102 if (!cmd)
1103 goto unlock;
1104
1105 if (status) {
1106 u8 mgmt_err = mgmt_status(status);
1107 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
310a3d48 1108 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
bfaf8c9f
JH		 1109 goto remove_cmd;
1110 }
1111
1112 cp = cmd->param;
d4462a07 1113 if (cp->val) {
bfaf8c9f
JH		 1114 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1115 &hdev->dev_flags);
d4462a07
MH		 1116
1117 if (hdev->discov_timeout > 0) {
1118 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1119 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1120 to);
1121 }
1122 } else {
bfaf8c9f
JH		 1123 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1124 &hdev->dev_flags);
d4462a07 1125 }
bfaf8c9f
JH		 1126
1127 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1128
1129 if (changed)
1130 new_settings(hdev, cmd->sk);
1131
970ba524
MH		 1132 /* When the discoverable mode gets changed, make sure
1133 * that class of device has the limited discoverable
1134 * bit correctly set.
1135 */
1136 hci_req_init(&req, hdev);
1137 update_class(&req);
1138 hci_req_run(&req, NULL);
1139
bfaf8c9f
JH		 1140remove_cmd:
1141 mgmt_pending_remove(cmd);
1142
1143unlock:
1144 hci_dev_unlock(hdev);
1145}
1146
bdb6d971 1147static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1148 u16 len)
73f22f62 1149{
650f726d 1150 struct mgmt_cp_set_discoverable *cp = data;
366a0336 1151 struct pending_cmd *cmd;
bfaf8c9f 1152 struct hci_request req;
5e5282bb 1153 u16 timeout;
9a43e25f 1154 u8 scan;
73f22f62
JH		 1155 int err;
1156
bdb6d971 1157 BT_DBG("request for %s", hdev->name);
73f22f62 1158
9a43e25f
JH		 1159 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1160 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
33c525c0 1161 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
9a43e25f 1162 MGMT_STATUS_REJECTED);
33c525c0 1163
310a3d48 1164 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a7e80f25
JH		 1165 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1166 MGMT_STATUS_INVALID_PARAMS);
1167
1f350c87 1168 timeout = __le16_to_cpu(cp->timeout);
310a3d48
MH		 1169
1170 /* Disabling discoverable requires that no timeout is set,
1171 * and enabling limited discoverable requires a timeout.
1172 */
1173 if ((cp->val == 0x00 && timeout > 0) ||
1174 (cp->val == 0x02 && timeout == 0))
bdb6d971 1175 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
04124681 1176 MGMT_STATUS_INVALID_PARAMS);
73f22f62 1177
09fd0de5 1178 hci_dev_lock(hdev);
73f22f62 1179
5e5282bb 1180 if (!hdev_is_powered(hdev) && timeout > 0) {
bdb6d971 1181 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
04124681 1182 MGMT_STATUS_NOT_POWERED);
73f22f62
JH		 1183 goto failed;
1184 }
1185
2e58ef3e 1186 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
8ce8e2b5 1187 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
bdb6d971 1188 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
04124681 1189 MGMT_STATUS_BUSY);
73f22f62
JH		 1190 goto failed;
1191 }
1192
5e5282bb 1193 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
bdb6d971 1194 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
04124681 1195 MGMT_STATUS_REJECTED);
5e5282bb
JH		 1196 goto failed;
1197 }
1198
1199 if (!hdev_is_powered(hdev)) {
0224d2fa
JH		 1200 bool changed = false;
1201
310a3d48
MH		 1202 /* Setting limited discoverable when powered off is
1203 * not a valid operation since it requires a timeout
1204 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1205 */
0224d2fa
JH		 1206 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1207 change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1208 changed = true;
1209 }
1210
5e5282bb 1211 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
0224d2fa
JH		 1212 if (err < 0)
1213 goto failed;
1214
1215 if (changed)
1216 err = new_settings(hdev, sk);
1217
5e5282bb
JH		 1218 goto failed;
1219 }
1220
310a3d48
MH		 1221 /* If the current mode is the same, then just update the timeout
1222 * value with the new value. And if only the timeout gets updated,
1223 * then no need for any HCI transactions.
1224 */
1225 if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1226 (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1227 &hdev->dev_flags)) {
36261547
MH		 1228 cancel_delayed_work(&hdev->discov_off);
1229 hdev->discov_timeout = timeout;
955638ec 1230
36261547
MH		 1231 if (cp->val && hdev->discov_timeout > 0) {
1232 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
955638ec 1233 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
36261547 1234 to);
955638ec
MH		 1235 }
1236
69ab39ea 1237 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
73f22f62
JH		 1238 goto failed;
1239 }
1240
2e58ef3e 1241 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
366a0336
JH		 1242 if (!cmd) {
1243 err = -ENOMEM;
73f22f62 1244 goto failed;
366a0336 1245 }
73f22f62 1246
310a3d48
MH		 1247 /* Cancel any potential discoverable timeout that might be
1248 * still active and store new timeout value. The arming of
1249 * the timeout happens in the complete handler.
1250 */
1251 cancel_delayed_work(&hdev->discov_off);
1252 hdev->discov_timeout = timeout;
1253
b456f87c
JH		 1254 /* Limited discoverable mode */
1255 if (cp->val == 0x02)
1256 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1257 else
1258 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1259
bfaf8c9f
JH		 1260 hci_req_init(&req, hdev);
1261
9a43e25f
JH		 1262 /* The procedure for LE-only controllers is much simpler - just
1263 * update the advertising data.
1264 */
1265 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1266 goto update_ad;
1267
73f22f62
JH		 1268 scan = SCAN_PAGE;
1269
310a3d48
MH		 1270 if (cp->val) {
1271 struct hci_cp_write_current_iac_lap hci_cp;
1272
1273 if (cp->val == 0x02) {
1274 /* Limited discoverable mode */
33337dcb 1275 hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
310a3d48
MH		 1276 hci_cp.iac_lap[0] = 0x00; /* LIAC */
1277 hci_cp.iac_lap[1] = 0x8b;
1278 hci_cp.iac_lap[2] = 0x9e;
1279 hci_cp.iac_lap[3] = 0x33; /* GIAC */
1280 hci_cp.iac_lap[4] = 0x8b;
1281 hci_cp.iac_lap[5] = 0x9e;
1282 } else {
1283 /* General discoverable mode */
310a3d48
MH		 1284 hci_cp.num_iac = 1;
1285 hci_cp.iac_lap[0] = 0x33; /* GIAC */
1286 hci_cp.iac_lap[1] = 0x8b;
1287 hci_cp.iac_lap[2] = 0x9e;
1288 }
1289
1290 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1291 (hci_cp.num_iac * 3) + 1, &hci_cp);
1292
73f22f62 1293 scan |= SCAN_INQUIRY;
310a3d48
MH		 1294 } else {
1295 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1296 }
73f22f62 1297
310a3d48 1298 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
bfaf8c9f 1299
9a43e25f
JH		 1300update_ad:
1301 update_adv_data(&req);
1302
bfaf8c9f 1303 err = hci_req_run(&req, set_discoverable_complete);
73f22f62 1304 if (err < 0)
a664b5bc 1305 mgmt_pending_remove(cmd);
73f22f62
JH		 1306
1307failed:
09fd0de5 1308 hci_dev_unlock(hdev);
73f22f62
JH		 1309 return err;
1310}
1311
406d7804
JH		 1312static void write_fast_connectable(struct hci_request *req, bool enable)
1313{
bd98b996 1314 struct hci_dev *hdev = req->hdev;
406d7804
JH		 1315 struct hci_cp_write_page_scan_activity acp;
1316 u8 type;
1317
547003b1
JH		 1318 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1319 return;
1320
4c01f8b8
JH		 1321 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1322 return;
1323
406d7804
JH		 1324 if (enable) {
1325 type = PAGE_SCAN_TYPE_INTERLACED;
1326
1327 /* 160 msec page scan interval */
1328 acp.interval = __constant_cpu_to_le16(0x0100);
1329 } else {
1330 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1331
1332 /* default 1.28 sec page scan */
1333 acp.interval = __constant_cpu_to_le16(0x0800);
1334 }
1335
1336 acp.window = __constant_cpu_to_le16(0x0012);
1337
bd98b996
JH		 1338 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1339 __cpu_to_le16(hdev->page_scan_window) != acp.window)
1340 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1341 sizeof(acp), &acp);
1342
1343 if (hdev->page_scan_type != type)
1344 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
406d7804
JH		 1345}
1346
1987fdc7
JH		 1347static u8 get_adv_type(struct hci_dev *hdev)
1348{
1349 struct pending_cmd *cmd;
1350 bool connectable;
1351
1352 /* If there's a pending mgmt command the flag will not yet have
1353 * it's final value, so check for this first.
1354 */
1355 cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1356 if (cmd) {
1357 struct mgmt_mode *cp = cmd->param;
1358 connectable = !!cp->val;
1359 } else {
1360 connectable = test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1361 }
1362
1363 return connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1364}
1365
95c66e75
JH		 1366static void enable_advertising(struct hci_request *req)
1367{
1368 struct hci_dev *hdev = req->hdev;
1369 struct hci_cp_le_set_adv_param cp;
1370 u8 enable = 0x01;
1371
1372 memset(&cp, 0, sizeof(cp));
1373 cp.min_interval = __constant_cpu_to_le16(0x0800);
1374 cp.max_interval = __constant_cpu_to_le16(0x0800);
1987fdc7 1375 cp.type = get_adv_type(hdev);
79830f66 1376 cp.own_address_type = hdev->own_addr_type;
95c66e75
JH		 1377 cp.channel_map = 0x07;
1378
1379 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1380
1381 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1382}
1383
1384static void disable_advertising(struct hci_request *req)
1385{
1386 u8 enable = 0x00;
1387
1388 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1389}
1390
2b76f453
JH		 1391static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1392{
1393 struct pending_cmd *cmd;
d7b856f9
JH		 1394 struct mgmt_mode *cp;
1395 bool changed;
2b76f453
JH		 1396
1397 BT_DBG("status 0x%02x", status);
1398
1399 hci_dev_lock(hdev);
1400
1401 cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1402 if (!cmd)
1403 goto unlock;
1404
37438c1f
JH		 1405 if (status) {
1406 u8 mgmt_err = mgmt_status(status);
1407 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1408 goto remove_cmd;
1409 }
1410
d7b856f9
JH		 1411 cp = cmd->param;
1412 if (cp->val)
1413 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1414 else
1415 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1416
2b76f453
JH		 1417 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1418
d7b856f9
JH		 1419 if (changed)
1420 new_settings(hdev, cmd->sk);
1421
37438c1f 1422remove_cmd:
2b76f453
JH		 1423 mgmt_pending_remove(cmd);
1424
1425unlock:
1426 hci_dev_unlock(hdev);
1427}
1428
e8ba3a1f
JH		 1429static int set_connectable_update_settings(struct hci_dev *hdev,
1430 struct sock *sk, u8 val)
1431{
1432 bool changed = false;
1433 int err;
1434
1435 if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1436 changed = true;
1437
1438 if (val) {
1439 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1440 } else {
1441 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1442 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1443 }
1444
1445 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1446 if (err < 0)
1447 return err;
1448
1449 if (changed)
1450 return new_settings(hdev, sk);
1451
1452 return 0;
1453}
1454
bdb6d971 1455static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1456 u16 len)
9fbcbb45 1457{
650f726d 1458 struct mgmt_mode *cp = data;
366a0336 1459 struct pending_cmd *cmd;
2b76f453 1460 struct hci_request req;
1987fdc7 1461 u8 scan;
9fbcbb45
JH		 1462 int err;
1463
bdb6d971 1464 BT_DBG("request for %s", hdev->name);
9fbcbb45 1465
1987fdc7
JH		 1466 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1467 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
33c525c0 1468 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1987fdc7 1469 MGMT_STATUS_REJECTED);
33c525c0 1470
a7e80f25
JH		 1471 if (cp->val != 0x00 && cp->val != 0x01)
1472 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1473 MGMT_STATUS_INVALID_PARAMS);
1474
09fd0de5 1475 hci_dev_lock(hdev);
9fbcbb45 1476
4b34ee78 1477 if (!hdev_is_powered(hdev)) {
e8ba3a1f 1478 err = set_connectable_update_settings(hdev, sk, cp->val);
9fbcbb45
JH		 1479 goto failed;
1480 }
1481
2e58ef3e 1482 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
8ce8e2b5 1483 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
bdb6d971 1484 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
04124681 1485 MGMT_STATUS_BUSY);
9fbcbb45
JH		 1486 goto failed;
1487 }
1488
2e58ef3e 1489 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
366a0336
JH		 1490 if (!cmd) {
1491 err = -ENOMEM;
9fbcbb45 1492 goto failed;
366a0336 1493 }
9fbcbb45 1494
9b74246f 1495 hci_req_init(&req, hdev);
9fbcbb45 1496
9a43e25f
JH		 1497 /* If BR/EDR is not enabled and we disable advertising as a
1498 * by-product of disabling connectable, we need to update the
1499 * advertising flags.
1500 */
1501 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1502 if (!cp->val) {
1503 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1504 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1505 }
1506 update_adv_data(&req);
1507 } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
9b74246f
JH		 1508 if (cp->val) {
1509 scan = SCAN_PAGE;
1510 } else {
1511 scan = 0;
1512
1513 if (test_bit(HCI_ISCAN, &hdev->flags) &&
8d6083fe 1514 hdev->discov_timeout > 0)
9b74246f
JH		 1515 cancel_delayed_work(&hdev->discov_off);
1516 }
2b76f453 1517
9b74246f
JH		 1518 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1519 }
2b76f453 1520
4c01f8b8
JH		 1521 /* If we're going from non-connectable to connectable or
1522 * vice-versa when fast connectable is enabled ensure that fast
1523 * connectable gets disabled. write_fast_connectable won't do
1524 * anything if the page scan parameters are already what they
1525 * should be.
1526 */
1527 if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
e36a3769
JH		 1528 write_fast_connectable(&req, false);
1529
1987fdc7
JH		 1530 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) &&
1531 hci_conn_num(hdev, LE_LINK) == 0) {
1532 disable_advertising(&req);
1533 enable_advertising(&req);
1534 }
1535
2b76f453 1536 err = hci_req_run(&req, set_connectable_complete);
9b74246f 1537 if (err < 0) {
a664b5bc 1538 mgmt_pending_remove(cmd);
9b74246f 1539 if (err == -ENODATA)
a81070ba
JH		 1540 err = set_connectable_update_settings(hdev, sk,
1541 cp->val);
9b74246f
JH		 1542 goto failed;
1543 }
9fbcbb45
JH		 1544
1545failed:
09fd0de5 1546 hci_dev_unlock(hdev);
9fbcbb45
JH		 1547 return err;
1548}
1549
bdb6d971 1550static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1551 u16 len)
c542a06c 1552{
650f726d 1553 struct mgmt_mode *cp = data;
55594356 1554 bool changed;
c542a06c
JH		 1555 int err;
1556
bdb6d971 1557 BT_DBG("request for %s", hdev->name);
c542a06c 1558
a7e80f25
JH		 1559 if (cp->val != 0x00 && cp->val != 0x01)
1560 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1561 MGMT_STATUS_INVALID_PARAMS);
1562
09fd0de5 1563 hci_dev_lock(hdev);
c542a06c
JH		 1564
1565 if (cp->val)
55594356 1566 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
c542a06c 1567 else
55594356 1568 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
c542a06c 1569
69ab39ea 1570 err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
c542a06c 1571 if (err < 0)
55594356 1572 goto unlock;
c542a06c 1573
55594356
MH		 1574 if (changed)
1575 err = new_settings(hdev, sk);
c542a06c 1576
55594356 1577unlock:
09fd0de5 1578 hci_dev_unlock(hdev);
c542a06c
JH		 1579 return err;
1580}
1581
04124681
GP		 1582static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1583 u16 len)
33ef95ed
JH		 1584{
1585 struct mgmt_mode *cp = data;
1586 struct pending_cmd *cmd;
e6fe7986 1587 u8 val, status;
33ef95ed
JH		 1588 int err;
1589
bdb6d971 1590 BT_DBG("request for %s", hdev->name);
33ef95ed 1591
e6fe7986
JH		 1592 status = mgmt_bredr_support(hdev);
1593 if (status)
33c525c0 1594 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
e6fe7986 1595 status);
33c525c0 1596
a7e80f25
JH		 1597 if (cp->val != 0x00 && cp->val != 0x01)
1598 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1599 MGMT_STATUS_INVALID_PARAMS);
1600
33ef95ed
JH		 1601 hci_dev_lock(hdev);
1602
4b34ee78 1603 if (!hdev_is_powered(hdev)) {
47990ea0
JH		 1604 bool changed = false;
1605
1606 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
8ce8e2b5 1607 &hdev->dev_flags)) {
47990ea0
JH		 1608 change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1609 changed = true;
1610 }
1611
1612 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1613 if (err < 0)
1614 goto failed;
1615
1616 if (changed)
1617 err = new_settings(hdev, sk);
1618
33ef95ed
JH		 1619 goto failed;
1620 }
1621
1622 if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
bdb6d971 1623 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
04124681 1624 MGMT_STATUS_BUSY);
33ef95ed
JH		 1625 goto failed;
1626 }
1627
1628 val = !!cp->val;
1629
1630 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1631 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1632 goto failed;
1633 }
1634
1635 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1636 if (!cmd) {
1637 err = -ENOMEM;
1638 goto failed;
1639 }
1640
1641 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1642 if (err < 0) {
1643 mgmt_pending_remove(cmd);
1644 goto failed;
1645 }
1646
1647failed:
1648 hci_dev_unlock(hdev);
33ef95ed
JH		 1649 return err;
1650}
1651
bdb6d971 1652static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
ed2c4ee3
JH		 1653{
1654 struct mgmt_mode *cp = data;
1655 struct pending_cmd *cmd;
72ef0c1a 1656 u8 status;
ed2c4ee3
JH		 1657 int err;
1658
bdb6d971 1659 BT_DBG("request for %s", hdev->name);
ed2c4ee3 1660
cdba5281
MH		 1661 status = mgmt_bredr_support(hdev);
1662 if (status)
1663 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1664
13ecd8b6
JH		 1665 if (!lmp_ssp_capable(hdev))
1666 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1667 MGMT_STATUS_NOT_SUPPORTED);
ed2c4ee3 1668
a7e80f25
JH		 1669 if (cp->val != 0x00 && cp->val != 0x01)
1670 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1671 MGMT_STATUS_INVALID_PARAMS);
1672
13ecd8b6 1673 hci_dev_lock(hdev);
6c8f12c1 1674
4b34ee78 1675 if (!hdev_is_powered(hdev)) {
9ecb3e24 1676 bool changed;
c0ecddc2 1677
9ecb3e24
MH		 1678 if (cp->val) {
1679 changed = !test_and_set_bit(HCI_SSP_ENABLED,
1680 &hdev->dev_flags);
1681 } else {
1682 changed = test_and_clear_bit(HCI_SSP_ENABLED,
1683 &hdev->dev_flags);
1684 if (!changed)
1685 changed = test_and_clear_bit(HCI_HS_ENABLED,
1686 &hdev->dev_flags);
1687 else
1688 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
c0ecddc2
JH		 1689 }
1690
1691 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1692 if (err < 0)
1693 goto failed;
1694
1695 if (changed)
1696 err = new_settings(hdev, sk);
1697
ed2c4ee3
JH		 1698 goto failed;
1699 }
1700
9ecb3e24
MH		 1701 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
1702 mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
d97dcb66
SJ		 1703 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1704 MGMT_STATUS_BUSY);
ed2c4ee3
JH		 1705 goto failed;
1706 }
1707
72ef0c1a 1708 if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
ed2c4ee3
JH		 1709 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1710 goto failed;
1711 }
1712
1713 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1714 if (!cmd) {
1715 err = -ENOMEM;
1716 goto failed;
1717 }
1718
72ef0c1a 1719 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
ed2c4ee3
JH		 1720 if (err < 0) {
1721 mgmt_pending_remove(cmd);
1722 goto failed;
1723 }
1724
1725failed:
1726 hci_dev_unlock(hdev);
ed2c4ee3
JH		 1727 return err;
1728}
1729
bdb6d971 1730static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6d80dfd0
JH		 1731{
1732 struct mgmt_mode *cp = data;
ee392693 1733 bool changed;
e6fe7986 1734 u8 status;
ee392693 1735 int err;
6d80dfd0 1736
bdb6d971 1737 BT_DBG("request for %s", hdev->name);
6d80dfd0 1738
e6fe7986
JH		 1739 status = mgmt_bredr_support(hdev);
1740 if (status)
1741 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
6d80dfd0 1742
9ecb3e24
MH		 1743 if (!lmp_ssp_capable(hdev))
1744 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1745 MGMT_STATUS_NOT_SUPPORTED);
1746
1747 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
1748 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1749 MGMT_STATUS_REJECTED);
1750
a7e80f25
JH		 1751 if (cp->val != 0x00 && cp->val != 0x01)
1752 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1753 MGMT_STATUS_INVALID_PARAMS);
1754
ee392693
MH		 1755 hci_dev_lock(hdev);
1756
a0cdf960 1757 if (cp->val) {
ee392693 1758 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
a0cdf960
MH		 1759 } else {
1760 if (hdev_is_powered(hdev)) {
1761 err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1762 MGMT_STATUS_REJECTED);
1763 goto unlock;
1764 }
1765
ee392693 1766 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
a0cdf960 1767 }
ee392693
MH		 1768
1769 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1770 if (err < 0)
1771 goto unlock;
1772
1773 if (changed)
1774 err = new_settings(hdev, sk);
6d80dfd0 1775
ee392693
MH		 1776unlock:
1777 hci_dev_unlock(hdev);
1778 return err;
6d80dfd0
JH		 1779}
1780
416a4ae5
JH		 1781static void le_enable_complete(struct hci_dev *hdev, u8 status)
1782{
1783 struct cmd_lookup match = { NULL, hdev };
1784
1785 if (status) {
1786 u8 mgmt_err = mgmt_status(status);
1787
1788 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1789 &mgmt_err);
1790 return;
1791 }
1792
1793 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1794
1795 new_settings(hdev, match.sk);
1796
1797 if (match.sk)
1798 sock_put(match.sk);
441ad2d0
MH		 1799
1800 /* Make sure the controller has a good default for
1801 * advertising data. Restrict the update to when LE
1802 * has actually been enabled. During power on, the
1803 * update in powered_update_hci will take care of it.
1804 */
1805 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1806 struct hci_request req;
1807
1808 hci_dev_lock(hdev);
1809
1810 hci_req_init(&req, hdev);
5947f4bc 1811 update_adv_data(&req);
f14d8f64 1812 update_scan_rsp_data(&req);
441ad2d0
MH		 1813 hci_req_run(&req, NULL);
1814
1815 hci_dev_unlock(hdev);
1816 }
416a4ae5
JH		 1817}
1818
bdb6d971 1819static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
06199cf8
JH		 1820{
1821 struct mgmt_mode *cp = data;
1822 struct hci_cp_write_le_host_supported hci_cp;
1823 struct pending_cmd *cmd;
416a4ae5 1824 struct hci_request req;
06199cf8 1825 int err;
0b60eba1 1826 u8 val, enabled;
06199cf8 1827
bdb6d971 1828 BT_DBG("request for %s", hdev->name);
06199cf8 1829
13ecd8b6
JH		 1830 if (!lmp_le_capable(hdev))
1831 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1832 MGMT_STATUS_NOT_SUPPORTED);
1de028ce 1833
a7e80f25
JH		 1834 if (cp->val != 0x00 && cp->val != 0x01)
1835 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1836 MGMT_STATUS_INVALID_PARAMS);
1837
c73eee91 1838 /* LE-only devices do not allow toggling LE on/off */
56f87901 1839 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
c73eee91
JH		 1840 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1841 MGMT_STATUS_REJECTED);
1842
13ecd8b6 1843 hci_dev_lock(hdev);
06199cf8
JH		 1844
1845 val = !!cp->val;
ffa88e02 1846 enabled = lmp_host_le_capable(hdev);
06199cf8 1847
0b60eba1 1848 if (!hdev_is_powered(hdev) || val == enabled) {
06199cf8
JH		 1849 bool changed = false;
1850
1851 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1852 change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1853 changed = true;
1854 }
1855
f3d3444a
JH		 1856 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
1857 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
eeca6f89
JH		 1858 changed = true;
1859 }
1860
06199cf8
JH		 1861 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1862 if (err < 0)
1de028ce 1863 goto unlock;
06199cf8
JH		 1864
1865 if (changed)
1866 err = new_settings(hdev, sk);
1867
1de028ce 1868 goto unlock;
06199cf8
JH		 1869 }
1870
4375f103
JH		 1871 if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1872 mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
bdb6d971 1873 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
04124681 1874 MGMT_STATUS_BUSY);
1de028ce 1875 goto unlock;
06199cf8
JH		 1876 }
1877
1878 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1879 if (!cmd) {
1880 err = -ENOMEM;
1de028ce 1881 goto unlock;
06199cf8
JH		 1882 }
1883
441ad2d0
MH		 1884 hci_req_init(&req, hdev);
1885
06199cf8
JH		 1886 memset(&hci_cp, 0, sizeof(hci_cp));
1887
1888 if (val) {
1889 hci_cp.le = val;
ffa88e02 1890 hci_cp.simul = lmp_le_br_capable(hdev);
441ad2d0
MH		 1891 } else {
1892 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1893 disable_advertising(&req);
06199cf8
JH		 1894 }
1895
416a4ae5
JH		 1896 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1897 &hci_cp);
1898
1899 err = hci_req_run(&req, le_enable_complete);
0c01bc48 1900 if (err < 0)
06199cf8 1901 mgmt_pending_remove(cmd);
06199cf8 1902
1de028ce
JH		 1903unlock:
1904 hci_dev_unlock(hdev);
06199cf8
JH		 1905 return err;
1906}
1907
0cab9c80
JH		 1908/* This is a helper function to test for pending mgmt commands that can
1909 * cause CoD or EIR HCI commands. We can only allow one such pending
1910 * mgmt command at a time since otherwise we cannot easily track what
1911 * the current values are, will be, and based on that calculate if a new
1912 * HCI command needs to be sent and if yes with what value.
1913 */
1914static bool pending_eir_or_class(struct hci_dev *hdev)
1915{
1916 struct pending_cmd *cmd;
1917
1918 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1919 switch (cmd->opcode) {
1920 case MGMT_OP_ADD_UUID:
1921 case MGMT_OP_REMOVE_UUID:
1922 case MGMT_OP_SET_DEV_CLASS:
1923 case MGMT_OP_SET_POWERED:
1924 return true;
1925 }
1926 }
1927
1928 return false;
1929}
1930
83be8eca
JH		 1931static const u8 bluetooth_base_uuid[] = {
1932 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1933 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1934};
1935
1936static u8 get_uuid_size(const u8 *uuid)
1937{
1938 u32 val;
1939
1940 if (memcmp(uuid, bluetooth_base_uuid, 12))
1941 return 128;
1942
1943 val = get_unaligned_le32(&uuid[12]);
1944 if (val > 0xffff)
1945 return 32;
1946
1947 return 16;
1948}
1949
92da6097
JH		 1950static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1951{
1952 struct pending_cmd *cmd;
1953
1954 hci_dev_lock(hdev);
1955
1956 cmd = mgmt_pending_find(mgmt_op, hdev);
1957 if (!cmd)
1958 goto unlock;
1959
1960 cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1961 hdev->dev_class, 3);
1962
1963 mgmt_pending_remove(cmd);
1964
1965unlock:
1966 hci_dev_unlock(hdev);
1967}
1968
1969static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1970{
1971 BT_DBG("status 0x%02x", status);
1972
1973 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1974}
1975
bdb6d971 1976static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2aeb9a1a 1977{
650f726d 1978 struct mgmt_cp_add_uuid *cp = data;
90e70454 1979 struct pending_cmd *cmd;
890ea898 1980 struct hci_request req;
2aeb9a1a 1981 struct bt_uuid *uuid;
2aeb9a1a
JH		 1982 int err;
1983
bdb6d971 1984 BT_DBG("request for %s", hdev->name);
2aeb9a1a 1985
09fd0de5 1986 hci_dev_lock(hdev);
2aeb9a1a 1987
0cab9c80 1988 if (pending_eir_or_class(hdev)) {
bdb6d971 1989 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
04124681 1990 MGMT_STATUS_BUSY);
c95f0ba7
JH		 1991 goto failed;
1992 }
1993
92c4c204 1994 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2aeb9a1a
JH		 1995 if (!uuid) {
1996 err = -ENOMEM;
1997 goto failed;
1998 }
1999
2000 memcpy(uuid->uuid, cp->uuid, 16);
1aff6f09 2001 uuid->svc_hint = cp->svc_hint;
83be8eca 2002 uuid->size = get_uuid_size(cp->uuid);
2aeb9a1a 2003
de66aa63 2004 list_add_tail(&uuid->list, &hdev->uuids);
2aeb9a1a 2005
890ea898 2006 hci_req_init(&req, hdev);
1aff6f09 2007
890ea898
JH		 2008 update_class(&req);
2009 update_eir(&req);
2010
92da6097
JH		 2011 err = hci_req_run(&req, add_uuid_complete);
2012 if (err < 0) {
2013 if (err != -ENODATA)
2014 goto failed;
80a1e1db 2015
bdb6d971 2016 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
04124681 2017 hdev->dev_class, 3);
90e70454
JH		 2018 goto failed;
2019 }
2020
2021 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
890ea898 2022 if (!cmd) {
90e70454 2023 err = -ENOMEM;
890ea898
JH		 2024 goto failed;
2025 }
2026
2027 err = 0;
2aeb9a1a
JH		 2028
2029failed:
09fd0de5 2030 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2031 return err;
2032}
2033
24b78d0f
JH		 2034static bool enable_service_cache(struct hci_dev *hdev)
2035{
2036 if (!hdev_is_powered(hdev))
2037 return false;
2038
2039 if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
46818ed5
JH		 2040 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2041 CACHE_TIMEOUT);
24b78d0f
JH		 2042 return true;
2043 }
2044
2045 return false;
2046}
2047
92da6097
JH		 2048static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2049{
2050 BT_DBG("status 0x%02x", status);
2051
2052 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2053}
2054
bdb6d971 2055static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2056 u16 len)
2aeb9a1a 2057{
650f726d 2058 struct mgmt_cp_remove_uuid *cp = data;
90e70454 2059 struct pending_cmd *cmd;
056341c8 2060 struct bt_uuid *match, *tmp;
2aeb9a1a 2061 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
890ea898 2062 struct hci_request req;
2aeb9a1a
JH		 2063 int err, found;
2064
bdb6d971 2065 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2066
09fd0de5 2067 hci_dev_lock(hdev);
2aeb9a1a 2068
0cab9c80 2069 if (pending_eir_or_class(hdev)) {
bdb6d971 2070 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
04124681 2071 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2072 goto unlock;
2073 }
2074
2aeb9a1a
JH		 2075 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2076 err = hci_uuids_clear(hdev);
4004b6d9 2077
24b78d0f 2078 if (enable_service_cache(hdev)) {
bdb6d971 2079 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
04124681 2080 0, hdev->dev_class, 3);
24b78d0f
JH		 2081 goto unlock;
2082 }
4004b6d9 2083
9246a869 2084 goto update_class;
2aeb9a1a
JH		 2085 }
2086
2087 found = 0;
2088
056341c8 2089 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2aeb9a1a
JH		 2090 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2091 continue;
2092
2093 list_del(&match->list);
482049f7 2094 kfree(match);
2aeb9a1a
JH		 2095 found++;
2096 }
2097
2098 if (found == 0) {
bdb6d971 2099 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
04124681 2100 MGMT_STATUS_INVALID_PARAMS);
2aeb9a1a
JH		 2101 goto unlock;
2102 }
2103
9246a869 2104update_class:
890ea898 2105 hci_req_init(&req, hdev);
1aff6f09 2106
890ea898
JH		 2107 update_class(&req);
2108 update_eir(&req);
2109
92da6097
JH		 2110 err = hci_req_run(&req, remove_uuid_complete);
2111 if (err < 0) {
2112 if (err != -ENODATA)
2113 goto unlock;
80a1e1db 2114
bdb6d971 2115 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
04124681 2116 hdev->dev_class, 3);
90e70454
JH		 2117 goto unlock;
2118 }
2119
2120 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
890ea898 2121 if (!cmd) {
90e70454 2122 err = -ENOMEM;
890ea898
JH		 2123 goto unlock;
2124 }
2125
2126 err = 0;
2aeb9a1a
JH		 2127
2128unlock:
09fd0de5 2129 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2130 return err;
2131}
2132
92da6097
JH		 2133static void set_class_complete(struct hci_dev *hdev, u8 status)
2134{
2135 BT_DBG("status 0x%02x", status);
2136
2137 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2138}
2139
bdb6d971 2140static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2141 u16 len)
1aff6f09 2142{
650f726d 2143 struct mgmt_cp_set_dev_class *cp = data;
90e70454 2144 struct pending_cmd *cmd;
890ea898 2145 struct hci_request req;
1aff6f09
JH		 2146 int err;
2147
bdb6d971 2148 BT_DBG("request for %s", hdev->name);
1aff6f09 2149
6203fc98 2150 if (!lmp_bredr_capable(hdev))
13ecd8b6
JH		 2151 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2152 MGMT_STATUS_NOT_SUPPORTED);
1aff6f09 2153
0cab9c80 2154 hci_dev_lock(hdev);
ee98f473 2155
0cab9c80
JH		 2156 if (pending_eir_or_class(hdev)) {
2157 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2158 MGMT_STATUS_BUSY);
2159 goto unlock;
2160 }
c95f0ba7 2161
0cab9c80
JH		 2162 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2163 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2164 MGMT_STATUS_INVALID_PARAMS);
2165 goto unlock;
2166 }
575b3a02 2167
932f5ff5
JH		 2168 hdev->major_class = cp->major;
2169 hdev->minor_class = cp->minor;
2170
b5235a65 2171 if (!hdev_is_powered(hdev)) {
bdb6d971 2172 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
04124681 2173 hdev->dev_class, 3);
b5235a65
JH		 2174 goto unlock;
2175 }
2176
890ea898
JH		 2177 hci_req_init(&req, hdev);
2178
a8b2d5c2 2179 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
7d78525d
JH		 2180 hci_dev_unlock(hdev);
2181 cancel_delayed_work_sync(&hdev->service_cache);
2182 hci_dev_lock(hdev);
890ea898 2183 update_eir(&req);
7d78525d 2184 }
14c0b608 2185
890ea898
JH		 2186 update_class(&req);
2187
92da6097
JH		 2188 err = hci_req_run(&req, set_class_complete);
2189 if (err < 0) {
2190 if (err != -ENODATA)
2191 goto unlock;
1aff6f09 2192
bdb6d971 2193 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
04124681 2194 hdev->dev_class, 3);
90e70454
JH		 2195 goto unlock;
2196 }
2197
2198 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
890ea898 2199 if (!cmd) {
90e70454 2200 err = -ENOMEM;
890ea898
JH		 2201 goto unlock;
2202 }
2203
2204 err = 0;
1aff6f09 2205
b5235a65 2206unlock:
09fd0de5 2207 hci_dev_unlock(hdev);
1aff6f09
JH		 2208 return err;
2209}
2210
bdb6d971 2211static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2212 u16 len)
55ed8ca1 2213{
650f726d 2214 struct mgmt_cp_load_link_keys *cp = data;
4e51eae9 2215 u16 key_count, expected_len;
b1de97d8 2216 bool changed;
a492cd52 2217 int i;
55ed8ca1 2218
9060d5cf
MH		 2219 BT_DBG("request for %s", hdev->name);
2220
2221 if (!lmp_bredr_capable(hdev))
2222 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2223 MGMT_STATUS_NOT_SUPPORTED);
2224
1f350c87 2225 key_count = __le16_to_cpu(cp->key_count);
55ed8ca1 2226
86742e1e
JH		 2227 expected_len = sizeof(*cp) + key_count *
2228 sizeof(struct mgmt_link_key_info);
a492cd52 2229 if (expected_len != len) {
86742e1e 2230 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
8ce8e2b5 2231 len, expected_len);
bdb6d971 2232 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
04124681 2233 MGMT_STATUS_INVALID_PARAMS);
55ed8ca1
JH		 2234 }
2235
4ae14301
JH		 2236 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2237 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2238 MGMT_STATUS_INVALID_PARAMS);
2239
bdb6d971 2240 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
8ce8e2b5 2241 key_count);
55ed8ca1 2242
4ee71b20
JH		 2243 for (i = 0; i < key_count; i++) {
2244 struct mgmt_link_key_info *key = &cp->keys[i];
2245
8e991132 2246 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
4ee71b20
JH		 2247 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2248 MGMT_STATUS_INVALID_PARAMS);
2249 }
2250
09fd0de5 2251 hci_dev_lock(hdev);
55ed8ca1
JH		 2252
2253 hci_link_keys_clear(hdev);
2254
55ed8ca1 2255 if (cp->debug_keys)
b1de97d8 2256 changed = !test_and_set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
55ed8ca1 2257 else
b1de97d8
MH		 2258 changed = test_and_clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2259
2260 if (changed)
2261 new_settings(hdev, NULL);
55ed8ca1 2262
a492cd52 2263 for (i = 0; i < key_count; i++) {
86742e1e 2264 struct mgmt_link_key_info *key = &cp->keys[i];
55ed8ca1 2265
d753fdc4 2266 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
04124681 2267 key->type, key->pin_len);
55ed8ca1
JH		 2268 }
2269
bdb6d971 2270 cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
0e5f875a 2271
09fd0de5 2272 hci_dev_unlock(hdev);
55ed8ca1 2273
a492cd52 2274 return 0;
55ed8ca1
JH		 2275}
2276
b1078ad0 2277static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 2278 u8 addr_type, struct sock *skip_sk)
b1078ad0
JH		 2279{
2280 struct mgmt_ev_device_unpaired ev;
2281
2282 bacpy(&ev.addr.bdaddr, bdaddr);
2283 ev.addr.type = addr_type;
2284
2285 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
04124681 2286 skip_sk);
b1078ad0
JH		 2287}
2288
bdb6d971 2289static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2290 u16 len)
55ed8ca1 2291{
124f6e35
JH		 2292 struct mgmt_cp_unpair_device *cp = data;
2293 struct mgmt_rp_unpair_device rp;
a8a1d19e
JH		 2294 struct hci_cp_disconnect dc;
2295 struct pending_cmd *cmd;
55ed8ca1 2296 struct hci_conn *conn;
55ed8ca1
JH		 2297 int err;
2298
a8a1d19e 2299 memset(&rp, 0, sizeof(rp));
124f6e35
JH		 2300 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2301 rp.addr.type = cp->addr.type;
a8a1d19e 2302
4ee71b20
JH		 2303 if (!bdaddr_type_is_valid(cp->addr.type))
2304 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2305 MGMT_STATUS_INVALID_PARAMS,
2306 &rp, sizeof(rp));
2307
118da70b
JH		 2308 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2309 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2310 MGMT_STATUS_INVALID_PARAMS,
2311 &rp, sizeof(rp));
2312
4ee71b20
JH		 2313 hci_dev_lock(hdev);
2314
86a8cfc6 2315 if (!hdev_is_powered(hdev)) {
bdb6d971 2316 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
04124681 2317 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
86a8cfc6
JH		 2318 goto unlock;
2319 }
2320
e0b2b27e 2321 if (cp->addr.type == BDADDR_BREDR) {
124f6e35 2322 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
e0b2b27e
JH		 2323 } else {
2324 u8 addr_type;
2325
2326 if (cp->addr.type == BDADDR_LE_PUBLIC)
2327 addr_type = ADDR_LE_DEV_PUBLIC;
2328 else
2329 addr_type = ADDR_LE_DEV_RANDOM;
2330
2331 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2332 }
b0dbfb46 2333
55ed8ca1 2334 if (err < 0) {
bdb6d971 2335 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
04124681 2336 MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
55ed8ca1
JH		 2337 goto unlock;
2338 }
2339
86a8cfc6 2340 if (cp->disconnect) {
591f47f3 2341 if (cp->addr.type == BDADDR_BREDR)
86a8cfc6 2342 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8ce8e2b5 2343 &cp->addr.bdaddr);
86a8cfc6
JH		 2344 else
2345 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
8ce8e2b5 2346 &cp->addr.bdaddr);
86a8cfc6
JH		 2347 } else {
2348 conn = NULL;
2349 }
124f6e35 2350
a8a1d19e 2351 if (!conn) {
bdb6d971 2352 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
04124681 2353 &rp, sizeof(rp));
b1078ad0 2354 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
a8a1d19e
JH		 2355 goto unlock;
2356 }
55ed8ca1 2357
124f6e35 2358 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
04124681 2359 sizeof(*cp));
a8a1d19e
JH		 2360 if (!cmd) {
2361 err = -ENOMEM;
2362 goto unlock;
55ed8ca1
JH		 2363 }
2364
eb55ef07 2365 dc.handle = cpu_to_le16(conn->handle);
a8a1d19e
JH		 2366 dc.reason = 0x13; /* Remote User Terminated Connection */
2367 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2368 if (err < 0)
2369 mgmt_pending_remove(cmd);
2370
55ed8ca1 2371unlock:
09fd0de5 2372 hci_dev_unlock(hdev);
55ed8ca1
JH		 2373 return err;
2374}
2375
bdb6d971 2376static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2377 u16 len)
8962ee74 2378{
650f726d 2379 struct mgmt_cp_disconnect *cp = data;
06a63b19 2380 struct mgmt_rp_disconnect rp;
8962ee74 2381 struct hci_cp_disconnect dc;
366a0336 2382 struct pending_cmd *cmd;
8962ee74 2383 struct hci_conn *conn;
8962ee74
JH		 2384 int err;
2385
2386 BT_DBG("");
2387
06a63b19
JH		 2388 memset(&rp, 0, sizeof(rp));
2389 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2390 rp.addr.type = cp->addr.type;
2391
4ee71b20 2392 if (!bdaddr_type_is_valid(cp->addr.type))
06a63b19
JH		 2393 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2394 MGMT_STATUS_INVALID_PARAMS,
2395 &rp, sizeof(rp));
4ee71b20 2396
09fd0de5 2397 hci_dev_lock(hdev);
8962ee74
JH		 2398
2399 if (!test_bit(HCI_UP, &hdev->flags)) {
06a63b19
JH		 2400 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2401 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
8962ee74
JH		 2402 goto failed;
2403 }
2404
2e58ef3e 2405 if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
06a63b19
JH		 2406 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2407 MGMT_STATUS_BUSY, &rp, sizeof(rp));
8962ee74
JH		 2408 goto failed;
2409 }
2410
591f47f3 2411 if (cp->addr.type == BDADDR_BREDR)
8fc9ced3
GP		 2412 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2413 &cp->addr.bdaddr);
88c3df13
JH		 2414 else
2415 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
365227e5 2416
f960727e 2417 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
06a63b19
JH		 2418 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2419 MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
8962ee74
JH		 2420 goto failed;
2421 }
2422
2e58ef3e 2423 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
366a0336
JH		 2424 if (!cmd) {
2425 err = -ENOMEM;
8962ee74 2426 goto failed;
366a0336 2427 }
8962ee74 2428
eb55ef07 2429 dc.handle = cpu_to_le16(conn->handle);
3701f944 2430 dc.reason = HCI_ERROR_REMOTE_USER_TERM;
8962ee74
JH		 2431
2432 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2433 if (err < 0)
a664b5bc 2434 mgmt_pending_remove(cmd);
8962ee74
JH		 2435
2436failed:
09fd0de5 2437 hci_dev_unlock(hdev);
8962ee74
JH		 2438 return err;
2439}
2440
57c1477c 2441static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
4c659c39
JH		 2442{
2443 switch (link_type) {
2444 case LE_LINK:
48264f06
JH		 2445 switch (addr_type) {
2446 case ADDR_LE_DEV_PUBLIC:
591f47f3 2447 return BDADDR_LE_PUBLIC;
0ed09148 2448
48264f06 2449 default:
0ed09148 2450 /* Fallback to LE Random address type */
591f47f3 2451 return BDADDR_LE_RANDOM;
48264f06 2452 }
0ed09148 2453
4c659c39 2454 default:
0ed09148 2455 /* Fallback to BR/EDR type */
591f47f3 2456 return BDADDR_BREDR;
4c659c39
JH		 2457 }
2458}
2459
04124681
GP		 2460static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2461 u16 data_len)
2784eb41 2462{
2784eb41 2463 struct mgmt_rp_get_connections *rp;
8035ded4 2464 struct hci_conn *c;
a38528f1 2465 size_t rp_len;
60fc5fb6
JH		 2466 int err;
2467 u16 i;
2784eb41
JH		 2468
2469 BT_DBG("");
2470
09fd0de5 2471 hci_dev_lock(hdev);
2784eb41 2472
5f97c1df 2473 if (!hdev_is_powered(hdev)) {
bdb6d971 2474 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
04124681 2475 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 2476 goto unlock;
2477 }
2478
60fc5fb6 2479 i = 0;
b644ba33
JH		 2480 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2481 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
60fc5fb6 2482 i++;
2784eb41
JH		 2483 }
2484
60fc5fb6 2485 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
92c4c204 2486 rp = kmalloc(rp_len, GFP_KERNEL);
a38528f1 2487 if (!rp) {
2784eb41
JH		 2488 err = -ENOMEM;
2489 goto unlock;
2490 }
2491
2784eb41 2492 i = 0;
4c659c39 2493 list_for_each_entry(c, &hdev->conn_hash.list, list) {
b644ba33
JH		 2494 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2495 continue;
4c659c39 2496 bacpy(&rp->addr[i].bdaddr, &c->dst);
57c1477c 2497 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
0ed09148 2498 if (c->type == SCO_LINK || c->type == ESCO_LINK)
4c659c39
JH		 2499 continue;
2500 i++;
2501 }
2502
eb55ef07 2503 rp->conn_count = cpu_to_le16(i);
60fc5fb6 2504
4c659c39
JH		 2505 /* Recalculate length in case of filtered SCO connections, etc */
2506 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2784eb41 2507
bdb6d971 2508 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
04124681 2509 rp_len);
2784eb41 2510
a38528f1 2511 kfree(rp);
5f97c1df
JH		 2512
2513unlock:
09fd0de5 2514 hci_dev_unlock(hdev);
2784eb41
JH		 2515 return err;
2516}
2517
bdb6d971 2518static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 2519 struct mgmt_cp_pin_code_neg_reply *cp)
96d97a67
WR		 2520{
2521 struct pending_cmd *cmd;
2522 int err;
2523
2e58ef3e 2524 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
04124681 2525 sizeof(*cp));
96d97a67
WR		 2526 if (!cmd)
2527 return -ENOMEM;
2528
d8457698 2529 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
04124681 2530 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
96d97a67
WR		 2531 if (err < 0)
2532 mgmt_pending_remove(cmd);
2533
2534 return err;
2535}
2536
bdb6d971 2537static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2538 u16 len)
980e1a53 2539{
96d97a67 2540 struct hci_conn *conn;
650f726d 2541 struct mgmt_cp_pin_code_reply *cp = data;
980e1a53 2542 struct hci_cp_pin_code_reply reply;
366a0336 2543 struct pending_cmd *cmd;
980e1a53
JH		 2544 int err;
2545
2546 BT_DBG("");
2547
09fd0de5 2548 hci_dev_lock(hdev);
980e1a53 2549
4b34ee78 2550 if (!hdev_is_powered(hdev)) {
bdb6d971 2551 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
04124681 2552 MGMT_STATUS_NOT_POWERED);
980e1a53
JH		 2553 goto failed;
2554 }
2555
d8457698 2556 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
96d97a67 2557 if (!conn) {
bdb6d971 2558 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
04124681 2559 MGMT_STATUS_NOT_CONNECTED);
96d97a67
WR		 2560 goto failed;
2561 }
2562
2563 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
d8457698
JH		 2564 struct mgmt_cp_pin_code_neg_reply ncp;
2565
2566 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
96d97a67
WR		 2567
2568 BT_ERR("PIN code is not 16 bytes long");
2569
bdb6d971 2570 err = send_pin_code_neg_reply(sk, hdev, &ncp);
96d97a67 2571 if (err >= 0)
bdb6d971 2572 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
04124681 2573 MGMT_STATUS_INVALID_PARAMS);
96d97a67
WR		 2574
2575 goto failed;
2576 }
2577
00abfe44 2578 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
366a0336
JH		 2579 if (!cmd) {
2580 err = -ENOMEM;
980e1a53 2581 goto failed;
366a0336 2582 }
980e1a53 2583
d8457698 2584 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
980e1a53 2585 reply.pin_len = cp->pin_len;
24718ca5 2586 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
980e1a53
JH		 2587
2588 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2589 if (err < 0)
a664b5bc 2590 mgmt_pending_remove(cmd);
980e1a53
JH		 2591
2592failed:
09fd0de5 2593 hci_dev_unlock(hdev);
980e1a53
JH		 2594 return err;
2595}
2596
04124681
GP		 2597static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2598 u16 len)
17fa4b9d 2599{
650f726d 2600 struct mgmt_cp_set_io_capability *cp = data;
17fa4b9d
JH		 2601
2602 BT_DBG("");
2603
09fd0de5 2604 hci_dev_lock(hdev);
17fa4b9d
JH		 2605
2606 hdev->io_capability = cp->io_capability;
2607
2608 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
8ce8e2b5 2609 hdev->io_capability);
17fa4b9d 2610
09fd0de5 2611 hci_dev_unlock(hdev);
17fa4b9d 2612
04124681
GP		 2613 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2614 0);
17fa4b9d
JH		 2615}
2616
6039aa73 2617static struct pending_cmd *find_pairing(struct hci_conn *conn)
e9a416b5
JH		 2618{
2619 struct hci_dev *hdev = conn->hdev;
8035ded4 2620 struct pending_cmd *cmd;
e9a416b5 2621
2e58ef3e 2622 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
e9a416b5
JH		 2623 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2624 continue;
2625
e9a416b5
JH		 2626 if (cmd->user_data != conn)
2627 continue;
2628
2629 return cmd;
2630 }
2631
2632 return NULL;
2633}
2634
2635static void pairing_complete(struct pending_cmd *cmd, u8 status)
2636{
2637 struct mgmt_rp_pair_device rp;
2638 struct hci_conn *conn = cmd->user_data;
2639
ba4e564f 2640 bacpy(&rp.addr.bdaddr, &conn->dst);
57c1477c 2641 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
e9a416b5 2642
aee9b218 2643 cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
04124681 2644 &rp, sizeof(rp));
e9a416b5
JH		 2645
2646 /* So we don't get further callbacks for this connection */
2647 conn->connect_cfm_cb = NULL;
2648 conn->security_cfm_cb = NULL;
2649 conn->disconn_cfm_cb = NULL;
2650
76a68ba0 2651 hci_conn_drop(conn);
e9a416b5 2652
a664b5bc 2653 mgmt_pending_remove(cmd);
e9a416b5
JH		 2654}
2655
2656static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2657{
2658 struct pending_cmd *cmd;
2659
2660 BT_DBG("status %u", status);
2661
2662 cmd = find_pairing(conn);
56e5cb86 2663 if (!cmd)
e9a416b5 2664 BT_DBG("Unable to find a pending command");
56e5cb86 2665 else
e211326c 2666 pairing_complete(cmd, mgmt_status(status));
e9a416b5
JH		 2667}
2668
4c47d739
VA		 2669static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2670{
2671 struct pending_cmd *cmd;
2672
2673 BT_DBG("status %u", status);
2674
2675 if (!status)
2676 return;
2677
2678 cmd = find_pairing(conn);
2679 if (!cmd)
2680 BT_DBG("Unable to find a pending command");
2681 else
2682 pairing_complete(cmd, mgmt_status(status));
2683}
2684
bdb6d971 2685static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2686 u16 len)
e9a416b5 2687{
650f726d 2688 struct mgmt_cp_pair_device *cp = data;
1425acb7 2689 struct mgmt_rp_pair_device rp;
e9a416b5
JH		 2690 struct pending_cmd *cmd;
2691 u8 sec_level, auth_type;
2692 struct hci_conn *conn;
e9a416b5
JH		 2693 int err;
2694
2695 BT_DBG("");
2696
f950a30e
SJ		 2697 memset(&rp, 0, sizeof(rp));
2698 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2699 rp.addr.type = cp->addr.type;
2700
4ee71b20
JH		 2701 if (!bdaddr_type_is_valid(cp->addr.type))
2702 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2703 MGMT_STATUS_INVALID_PARAMS,
2704 &rp, sizeof(rp));
2705
09fd0de5 2706 hci_dev_lock(hdev);
e9a416b5 2707
5f97c1df 2708 if (!hdev_is_powered(hdev)) {
f950a30e
SJ		 2709 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2710 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5f97c1df
JH		 2711 goto unlock;
2712 }
2713
c908df36
VCG		 2714 sec_level = BT_SECURITY_MEDIUM;
2715 if (cp->io_cap == 0x03)
e9a416b5 2716 auth_type = HCI_AT_DEDICATED_BONDING;
c908df36 2717 else
e9a416b5 2718 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
e9a416b5 2719
591f47f3 2720 if (cp->addr.type == BDADDR_BREDR)
b12f62cf
AG		 2721 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2722 cp->addr.type, sec_level, auth_type);
7a512d01 2723 else
b12f62cf
AG		 2724 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2725 cp->addr.type, sec_level, auth_type);
7a512d01 2726
30e76272 2727 if (IS_ERR(conn)) {
489dc48e
AK		 2728 int status;
2729
2730 if (PTR_ERR(conn) == -EBUSY)
2731 status = MGMT_STATUS_BUSY;
2732 else
2733 status = MGMT_STATUS_CONNECT_FAILED;
2734
bdb6d971 2735 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
489dc48e 2736 status, &rp,
04124681 2737 sizeof(rp));
e9a416b5
JH		 2738 goto unlock;
2739 }
2740
2741 if (conn->connect_cfm_cb) {
76a68ba0 2742 hci_conn_drop(conn);
bdb6d971 2743 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
04124681 2744 MGMT_STATUS_BUSY, &rp, sizeof(rp));
e9a416b5
JH		 2745 goto unlock;
2746 }
2747
2e58ef3e 2748 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
e9a416b5
JH		 2749 if (!cmd) {
2750 err = -ENOMEM;
76a68ba0 2751 hci_conn_drop(conn);
e9a416b5
JH		 2752 goto unlock;
2753 }
2754
7a512d01 2755 /* For LE, just connecting isn't a proof that the pairing finished */
591f47f3 2756 if (cp->addr.type == BDADDR_BREDR)
7a512d01 2757 conn->connect_cfm_cb = pairing_complete_cb;
4c47d739
VA		 2758 else
2759 conn->connect_cfm_cb = le_connect_complete_cb;
7a512d01 2760
e9a416b5
JH		 2761 conn->security_cfm_cb = pairing_complete_cb;
2762 conn->disconn_cfm_cb = pairing_complete_cb;
2763 conn->io_capability = cp->io_cap;
2764 cmd->user_data = conn;
2765
2766 if (conn->state == BT_CONNECTED &&
8ce8e2b5 2767 hci_conn_security(conn, sec_level, auth_type))
e9a416b5
JH		 2768 pairing_complete(cmd, 0);
2769
2770 err = 0;
2771
2772unlock:
09fd0de5 2773 hci_dev_unlock(hdev);
e9a416b5
JH		 2774 return err;
2775}
2776
04124681
GP		 2777static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2778 u16 len)
28424707 2779{
0f4e68cf 2780 struct mgmt_addr_info *addr = data;
28424707
JH		 2781 struct pending_cmd *cmd;
2782 struct hci_conn *conn;
2783 int err;
2784
2785 BT_DBG("");
2786
28424707
JH		 2787 hci_dev_lock(hdev);
2788
5f97c1df 2789 if (!hdev_is_powered(hdev)) {
bdb6d971 2790 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
04124681 2791 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 2792 goto unlock;
2793 }
2794
28424707
JH		 2795 cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2796 if (!cmd) {
bdb6d971 2797 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
04124681 2798 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 2799 goto unlock;
2800 }
2801
2802 conn = cmd->user_data;
2803
2804 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
bdb6d971 2805 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
04124681 2806 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 2807 goto unlock;
2808 }
2809
2810 pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2811
bdb6d971 2812 err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
04124681 2813 addr, sizeof(*addr));
28424707
JH		 2814unlock:
2815 hci_dev_unlock(hdev);
28424707
JH		 2816 return err;
2817}
2818
bdb6d971 2819static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
1707c60e 2820 struct mgmt_addr_info *addr, u16 mgmt_op,
04124681 2821 u16 hci_op, __le32 passkey)
a5c29683 2822{
a5c29683 2823 struct pending_cmd *cmd;
0df4c185 2824 struct hci_conn *conn;
a5c29683
JH		 2825 int err;
2826
09fd0de5 2827 hci_dev_lock(hdev);
08ba5382 2828
4b34ee78 2829 if (!hdev_is_powered(hdev)) {
feb94d3d
JH		 2830 err = cmd_complete(sk, hdev->id, mgmt_op,
2831 MGMT_STATUS_NOT_POWERED, addr,
2832 sizeof(*addr));
0df4c185 2833 goto done;
a5c29683
JH		 2834 }
2835
1707c60e
JH		 2836 if (addr->type == BDADDR_BREDR)
2837 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
272d90df 2838 else
1707c60e 2839 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
272d90df
JH		 2840
2841 if (!conn) {
feb94d3d
JH		 2842 err = cmd_complete(sk, hdev->id, mgmt_op,
2843 MGMT_STATUS_NOT_CONNECTED, addr,
2844 sizeof(*addr));
272d90df
JH		 2845 goto done;
2846 }
47c15e2b 2847
1707c60e 2848 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
47c15e2b 2849 /* Continue with pairing via SMP */
5fe57d9e
BG		 2850 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2851
2852 if (!err)
feb94d3d
JH		 2853 err = cmd_complete(sk, hdev->id, mgmt_op,
2854 MGMT_STATUS_SUCCESS, addr,
2855 sizeof(*addr));
5fe57d9e 2856 else
feb94d3d
JH		 2857 err = cmd_complete(sk, hdev->id, mgmt_op,
2858 MGMT_STATUS_FAILED, addr,
2859 sizeof(*addr));
47c15e2b 2860
47c15e2b
BG		 2861 goto done;
2862 }
2863
1707c60e 2864 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
a5c29683
JH		 2865 if (!cmd) {
2866 err = -ENOMEM;
0df4c185 2867 goto done;
a5c29683
JH		 2868 }
2869
0df4c185 2870 /* Continue with pairing via HCI */
604086b7
BG		 2871 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2872 struct hci_cp_user_passkey_reply cp;
2873
1707c60e 2874 bacpy(&cp.bdaddr, &addr->bdaddr);
604086b7
BG		 2875 cp.passkey = passkey;
2876 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2877 } else
1707c60e
JH		 2878 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2879 &addr->bdaddr);
604086b7 2880
a664b5bc
JH		 2881 if (err < 0)
2882 mgmt_pending_remove(cmd);
a5c29683 2883
0df4c185 2884done:
09fd0de5 2885 hci_dev_unlock(hdev);
a5c29683
JH		 2886 return err;
2887}
2888
afeb019d
JK		 2889static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2890 void *data, u16 len)
2891{
2892 struct mgmt_cp_pin_code_neg_reply *cp = data;
2893
2894 BT_DBG("");
2895
1707c60e 2896 return user_pairing_resp(sk, hdev, &cp->addr,
afeb019d
JK		 2897 MGMT_OP_PIN_CODE_NEG_REPLY,
2898 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2899}
2900
04124681
GP		 2901static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2902 u16 len)
0df4c185 2903{
650f726d 2904 struct mgmt_cp_user_confirm_reply *cp = data;
0df4c185
BG		 2905
2906 BT_DBG("");
2907
2908 if (len != sizeof(*cp))
bdb6d971 2909 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
04124681 2910 MGMT_STATUS_INVALID_PARAMS);
0df4c185 2911
1707c60e 2912 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 2913 MGMT_OP_USER_CONFIRM_REPLY,
2914 HCI_OP_USER_CONFIRM_REPLY, 0);
0df4c185
BG		 2915}
2916
bdb6d971 2917static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 2918 void *data, u16 len)
0df4c185 2919{
c9c2659f 2920 struct mgmt_cp_user_confirm_neg_reply *cp = data;
0df4c185
BG		 2921
2922 BT_DBG("");
2923
1707c60e 2924 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 2925 MGMT_OP_USER_CONFIRM_NEG_REPLY,
2926 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
0df4c185
BG		 2927}
2928
04124681
GP		 2929static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2930 u16 len)
604086b7 2931{
650f726d 2932 struct mgmt_cp_user_passkey_reply *cp = data;
604086b7
BG		 2933
2934 BT_DBG("");
2935
1707c60e 2936 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 2937 MGMT_OP_USER_PASSKEY_REPLY,
2938 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
604086b7
BG		 2939}
2940
bdb6d971 2941static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 2942 void *data, u16 len)
604086b7 2943{
650f726d 2944 struct mgmt_cp_user_passkey_neg_reply *cp = data;
604086b7
BG		 2945
2946 BT_DBG("");
2947
1707c60e 2948 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 2949 MGMT_OP_USER_PASSKEY_NEG_REPLY,
2950 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
604086b7
BG		 2951}
2952
13928971 2953static void update_name(struct hci_request *req)
2b4bf397 2954{
13928971 2955 struct hci_dev *hdev = req->hdev;
2b4bf397
JH		 2956 struct hci_cp_write_local_name cp;
2957
13928971 2958 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2b4bf397 2959
890ea898 2960 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2b4bf397
JH		 2961}
2962
13928971
JH		 2963static void set_name_complete(struct hci_dev *hdev, u8 status)
2964{
2965 struct mgmt_cp_set_local_name *cp;
2966 struct pending_cmd *cmd;
2967
2968 BT_DBG("status 0x%02x", status);
2969
2970 hci_dev_lock(hdev);
2971
2972 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2973 if (!cmd)
2974 goto unlock;
2975
2976 cp = cmd->param;
2977
2978 if (status)
2979 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2980 mgmt_status(status));
2981 else
2982 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2983 cp, sizeof(*cp));
2984
2985 mgmt_pending_remove(cmd);
2986
2987unlock:
2988 hci_dev_unlock(hdev);
2989}
2990
bdb6d971 2991static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2992 u16 len)
b312b161 2993{
2b4bf397 2994 struct mgmt_cp_set_local_name *cp = data;
b312b161 2995 struct pending_cmd *cmd;
890ea898 2996 struct hci_request req;
b312b161
JH		 2997 int err;
2998
2999 BT_DBG("");
3000
09fd0de5 3001 hci_dev_lock(hdev);
b312b161 3002
b3f2ca94
JH		 3003 /* If the old values are the same as the new ones just return a
3004 * direct command complete event.
3005 */
3006 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3007 !memcmp(hdev->short_name, cp->short_name,
3008 sizeof(hdev->short_name))) {
3009 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3010 data, len);
3011 goto failed;
3012 }
3013
2b4bf397 3014 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
28cc7bde 3015
b5235a65 3016 if (!hdev_is_powered(hdev)) {
2b4bf397 3017 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
28cc7bde
JH		 3018
3019 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
04124681 3020 data, len);
28cc7bde
JH		 3021 if (err < 0)
3022 goto failed;
3023
3024 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
04124681 3025 sk);
28cc7bde 3026
b5235a65
JH		 3027 goto failed;
3028 }
3029
28cc7bde 3030 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
b312b161
JH		 3031 if (!cmd) {
3032 err = -ENOMEM;
3033 goto failed;
3034 }
3035
13928971
JH		 3036 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3037
890ea898 3038 hci_req_init(&req, hdev);
3f985050
JH		 3039
3040 if (lmp_bredr_capable(hdev)) {
3041 update_name(&req);
3042 update_eir(&req);
3043 }
3044
7a5f4990
MH		 3045 /* The name is stored in the scan response data and so
3046 * no need to udpate the advertising data here.
3047 */
3f985050 3048 if (lmp_le_capable(hdev))
7a5f4990 3049 update_scan_rsp_data(&req);
3f985050 3050
13928971 3051 err = hci_req_run(&req, set_name_complete);
b312b161
JH		 3052 if (err < 0)
3053 mgmt_pending_remove(cmd);
3054
3055failed:
09fd0de5 3056 hci_dev_unlock(hdev);
b312b161
JH		 3057 return err;
3058}
3059
0f4e68cf 3060static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 3061 void *data, u16 data_len)
c35938b2 3062{
c35938b2
SJ		 3063 struct pending_cmd *cmd;
3064 int err;
3065
bdb6d971 3066 BT_DBG("%s", hdev->name);
c35938b2 3067
09fd0de5 3068 hci_dev_lock(hdev);
c35938b2 3069
4b34ee78 3070 if (!hdev_is_powered(hdev)) {
bdb6d971 3071 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
04124681 3072 MGMT_STATUS_NOT_POWERED);
c35938b2
SJ		 3073 goto unlock;
3074 }
3075
9a1a1996 3076 if (!lmp_ssp_capable(hdev)) {
bdb6d971 3077 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
04124681 3078 MGMT_STATUS_NOT_SUPPORTED);
c35938b2
SJ		 3079 goto unlock;
3080 }
3081
2e58ef3e 3082 if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
bdb6d971 3083 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
04124681 3084 MGMT_STATUS_BUSY);
c35938b2
SJ		 3085 goto unlock;
3086 }
3087
2e58ef3e 3088 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
c35938b2
SJ		 3089 if (!cmd) {
3090 err = -ENOMEM;
3091 goto unlock;
3092 }
3093
4d2d2796
MH		 3094 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
3095 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3096 0, NULL);
3097 else
3098 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3099
c35938b2
SJ		 3100 if (err < 0)
3101 mgmt_pending_remove(cmd);
3102
3103unlock:
09fd0de5 3104 hci_dev_unlock(hdev);
c35938b2
SJ		 3105 return err;
3106}
3107
bdb6d971 3108static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 3109 void *data, u16 len)
2763eda6 3110{
2763eda6
SJ		 3111 int err;
3112
bdb6d971 3113 BT_DBG("%s ", hdev->name);
2763eda6 3114
09fd0de5 3115 hci_dev_lock(hdev);
2763eda6 3116
ec109113
MH		 3117 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3118 struct mgmt_cp_add_remote_oob_data *cp = data;
3119 u8 status;
bf1e3541 3120
ec109113
MH		 3121 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3122 cp->hash, cp->randomizer);
3123 if (err < 0)
3124 status = MGMT_STATUS_FAILED;
3125 else
3126 status = MGMT_STATUS_SUCCESS;
3127
3128 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3129 status, &cp->addr, sizeof(cp->addr));
3130 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3131 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3132 u8 status;
3133
3134 err = hci_add_remote_oob_ext_data(hdev, &cp->addr.bdaddr,
3135 cp->hash192,
3136 cp->randomizer192,
3137 cp->hash256,
3138 cp->randomizer256);
3139 if (err < 0)
3140 status = MGMT_STATUS_FAILED;
3141 else
3142 status = MGMT_STATUS_SUCCESS;
3143
3144 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3145 status, &cp->addr, sizeof(cp->addr));
3146 } else {
3147 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3148 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3149 MGMT_STATUS_INVALID_PARAMS);
3150 }
2763eda6 3151
09fd0de5 3152 hci_dev_unlock(hdev);
2763eda6
SJ		 3153 return err;
3154}
3155
bdb6d971 3156static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
8ce8e2b5 3157 void *data, u16 len)
2763eda6 3158{
650f726d 3159 struct mgmt_cp_remove_remote_oob_data *cp = data;
bf1e3541 3160 u8 status;
2763eda6
SJ		 3161 int err;
3162
bdb6d971 3163 BT_DBG("%s", hdev->name);
2763eda6 3164
09fd0de5 3165 hci_dev_lock(hdev);
2763eda6 3166
664ce4cc 3167 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2763eda6 3168 if (err < 0)
bf1e3541 3169 status = MGMT_STATUS_INVALID_PARAMS;
2763eda6 3170 else
a6785be2 3171 status = MGMT_STATUS_SUCCESS;
bf1e3541 3172
bdb6d971 3173 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
04124681 3174 status, &cp->addr, sizeof(cp->addr));
2763eda6 3175
09fd0de5 3176 hci_dev_unlock(hdev);
2763eda6
SJ		 3177 return err;
3178}
3179
41dc2bd6
AG		 3180static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3181{
3182 struct pending_cmd *cmd;
3183 u8 type;
3184 int err;
3185
3186 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3187
3188 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3189 if (!cmd)
3190 return -ENOENT;
3191
3192 type = hdev->discovery.type;
3193
3194 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3195 &type, sizeof(type));
3196 mgmt_pending_remove(cmd);
3197
3198 return err;
3199}
3200
7c307720
AG		 3201static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3202{
3203 BT_DBG("status %d", status);
3204
3205 if (status) {
3206 hci_dev_lock(hdev);
3207 mgmt_start_discovery_failed(hdev, status);
3208 hci_dev_unlock(hdev);
3209 return;
3210 }
3211
3212 hci_dev_lock(hdev);
3213 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3214 hci_dev_unlock(hdev);
3215
3216 switch (hdev->discovery.type) {
3217 case DISCOV_TYPE_LE:
3218 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
0d8cc935 3219 DISCOV_LE_TIMEOUT);
7c307720
AG		 3220 break;
3221
3222 case DISCOV_TYPE_INTERLEAVED:
3223 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
0d8cc935 3224 DISCOV_INTERLEAVED_TIMEOUT);
7c307720
AG		 3225 break;
3226
3227 case DISCOV_TYPE_BREDR:
3228 break;
3229
3230 default:
3231 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3232 }
3233}
3234
bdb6d971 3235static int start_discovery(struct sock *sk, struct hci_dev *hdev,
04124681 3236 void *data, u16 len)
14a53664 3237{
650f726d 3238 struct mgmt_cp_start_discovery *cp = data;
14a53664 3239 struct pending_cmd *cmd;
7c307720
AG		 3240 struct hci_cp_le_set_scan_param param_cp;
3241 struct hci_cp_le_set_scan_enable enable_cp;
3242 struct hci_cp_inquiry inq_cp;
3243 struct hci_request req;
3244 /* General inquiry access code (GIAC) */
3245 u8 lap[3] = { 0x33, 0x8b, 0x9e };
e6fe7986 3246 u8 status;
14a53664
JH		 3247 int err;
3248
bdb6d971 3249 BT_DBG("%s", hdev->name);
14a53664 3250
09fd0de5 3251 hci_dev_lock(hdev);
14a53664 3252
4b34ee78 3253 if (!hdev_is_powered(hdev)) {
bdb6d971 3254 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
04124681 3255 MGMT_STATUS_NOT_POWERED);
bd2d1334
JH		 3256 goto failed;
3257 }
3258
642be6c7
AG		 3259 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3260 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3261 MGMT_STATUS_BUSY);
3262 goto failed;
3263 }
3264
ff9ef578 3265 if (hdev->discovery.state != DISCOVERY_STOPPED) {
bdb6d971 3266 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
04124681 3267 MGMT_STATUS_BUSY);
ff9ef578
JH		 3268 goto failed;
3269 }
3270
2e58ef3e 3271 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
14a53664
JH		 3272 if (!cmd) {
3273 err = -ENOMEM;
3274 goto failed;
3275 }
3276
4aab14e5
AG		 3277 hdev->discovery.type = cp->type;
3278
7c307720
AG		 3279 hci_req_init(&req, hdev);
3280
4aab14e5 3281 switch (hdev->discovery.type) {
f39799f5 3282 case DISCOV_TYPE_BREDR:
e6fe7986
JH		 3283 status = mgmt_bredr_support(hdev);
3284 if (status) {
04106755 3285 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
e6fe7986 3286 status);
04106755
JH		 3287 mgmt_pending_remove(cmd);
3288 goto failed;
3289 }
3290
7c307720
AG		 3291 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3292 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3293 MGMT_STATUS_BUSY);
3294 mgmt_pending_remove(cmd);
3295 goto failed;
3296 }
3297
3298 hci_inquiry_cache_flush(hdev);
3299
3300 memset(&inq_cp, 0, sizeof(inq_cp));
3301 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
0d8cc935 3302 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
7c307720 3303 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
f39799f5
AG		 3304 break;
3305
3306 case DISCOV_TYPE_LE:
7c307720 3307 case DISCOV_TYPE_INTERLEAVED:
e6fe7986
JH		 3308 status = mgmt_le_support(hdev);
3309 if (status) {
04106755 3310 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
e6fe7986 3311 status);
04106755
JH		 3312 mgmt_pending_remove(cmd);
3313 goto failed;
3314 }
3315
7c307720 3316 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
56f87901 3317 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
04106755
JH		 3318 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3319 MGMT_STATUS_NOT_SUPPORTED);
3320 mgmt_pending_remove(cmd);
3321 goto failed;
3322 }
3323
f3d3444a 3324 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
7c307720
AG		 3325 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3326 MGMT_STATUS_REJECTED);
3327 mgmt_pending_remove(cmd);
3328 goto failed;
3329 }
3330
3331 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
3332 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3333 MGMT_STATUS_BUSY);
3334 mgmt_pending_remove(cmd);
3335 goto failed;
3336 }
3337
3338 memset(&param_cp, 0, sizeof(param_cp));
3339 param_cp.type = LE_SCAN_ACTIVE;
0d8cc935
AG		 3340 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3341 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
79830f66 3342 param_cp.own_address_type = hdev->own_addr_type;
7c307720
AG		 3343 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3344 &param_cp);
3345
3346 memset(&enable_cp, 0, sizeof(enable_cp));
3347 enable_cp.enable = LE_SCAN_ENABLE;
3348 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3349 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3350 &enable_cp);
5e0452c0
AG		 3351 break;
3352
f39799f5 3353 default:
04106755
JH		 3354 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3355 MGMT_STATUS_INVALID_PARAMS);
3356 mgmt_pending_remove(cmd);
3357 goto failed;
f39799f5 3358 }
3fd24153 3359
7c307720 3360 err = hci_req_run(&req, start_discovery_complete);
14a53664
JH		 3361 if (err < 0)
3362 mgmt_pending_remove(cmd);
ff9ef578
JH		 3363 else
3364 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
14a53664
JH		 3365
3366failed:
09fd0de5 3367 hci_dev_unlock(hdev);
14a53664
JH		 3368 return err;
3369}
3370
1183fdca
AG		 3371static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3372{
3373 struct pending_cmd *cmd;
3374 int err;
3375
3376 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3377 if (!cmd)
3378 return -ENOENT;
3379
3380 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3381 &hdev->discovery.type, sizeof(hdev->discovery.type));
3382 mgmt_pending_remove(cmd);
3383
3384 return err;
3385}
3386
0e05bba6
AG		 3387static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3388{
3389 BT_DBG("status %d", status);
3390
3391 hci_dev_lock(hdev);
3392
3393 if (status) {
3394 mgmt_stop_discovery_failed(hdev, status);
3395 goto unlock;
3396 }
3397
3398 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3399
3400unlock:
3401 hci_dev_unlock(hdev);
3402}
3403
bdb6d971 3404static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3405 u16 len)
14a53664 3406{
d930650b 3407 struct mgmt_cp_stop_discovery *mgmt_cp = data;
14a53664 3408 struct pending_cmd *cmd;
30dc78e1
JH		 3409 struct hci_cp_remote_name_req_cancel cp;
3410 struct inquiry_entry *e;
0e05bba6
AG		 3411 struct hci_request req;
3412 struct hci_cp_le_set_scan_enable enable_cp;
14a53664
JH		 3413 int err;
3414
bdb6d971 3415 BT_DBG("%s", hdev->name);
14a53664 3416
09fd0de5 3417 hci_dev_lock(hdev);
14a53664 3418
30dc78e1 3419 if (!hci_discovery_active(hdev)) {
bdb6d971 3420 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
04124681
GP		 3421 MGMT_STATUS_REJECTED, &mgmt_cp->type,
3422 sizeof(mgmt_cp->type));
d930650b
JH		 3423 goto unlock;
3424 }
3425
3426 if (hdev->discovery.type != mgmt_cp->type) {
bdb6d971 3427 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
04124681
GP		 3428 MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3429 sizeof(mgmt_cp->type));
30dc78e1 3430 goto unlock;
ff9ef578
JH		 3431 }
3432
2e58ef3e 3433 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
14a53664
JH		 3434 if (!cmd) {
3435 err = -ENOMEM;
30dc78e1
JH		 3436 goto unlock;
3437 }
3438
0e05bba6
AG		 3439 hci_req_init(&req, hdev);
3440
e0d9727e
AG		 3441 switch (hdev->discovery.state) {
3442 case DISCOVERY_FINDING:
0e05bba6
AG		 3443 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3444 hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3445 } else {
3446 cancel_delayed_work(&hdev->le_scan_disable);
3447
3448 memset(&enable_cp, 0, sizeof(enable_cp));
3449 enable_cp.enable = LE_SCAN_DISABLE;
3450 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
3451 sizeof(enable_cp), &enable_cp);
3452 }
c9ecc48e 3453
e0d9727e
AG		 3454 break;
3455
3456 case DISCOVERY_RESOLVING:
3457 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
8ce8e2b5 3458 NAME_PENDING);
e0d9727e 3459 if (!e) {
30dc78e1 3460 mgmt_pending_remove(cmd);
e0d9727e
AG		 3461 err = cmd_complete(sk, hdev->id,
3462 MGMT_OP_STOP_DISCOVERY, 0,
3463 &mgmt_cp->type,
3464 sizeof(mgmt_cp->type));
3465 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3466 goto unlock;
3467 }
30dc78e1 3468
e0d9727e 3469 bacpy(&cp.bdaddr, &e->data.bdaddr);
0e05bba6
AG		 3470 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3471 &cp);
e0d9727e
AG		 3472
3473 break;
3474
3475 default:
3476 BT_DBG("unknown discovery state %u", hdev->discovery.state);
0e05bba6
AG		 3477
3478 mgmt_pending_remove(cmd);
3479 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3480 MGMT_STATUS_FAILED, &mgmt_cp->type,
3481 sizeof(mgmt_cp->type));
3482 goto unlock;
14a53664
JH		 3483 }
3484
0e05bba6 3485 err = hci_req_run(&req, stop_discovery_complete);
14a53664
JH		 3486 if (err < 0)
3487 mgmt_pending_remove(cmd);
ff9ef578
JH		 3488 else
3489 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
14a53664 3490
30dc78e1 3491unlock:
09fd0de5 3492 hci_dev_unlock(hdev);
14a53664
JH		 3493 return err;
3494}
3495
bdb6d971 3496static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3497 u16 len)
561aafbc 3498{
650f726d 3499 struct mgmt_cp_confirm_name *cp = data;
561aafbc 3500 struct inquiry_entry *e;
561aafbc
JH		 3501 int err;
3502
bdb6d971 3503 BT_DBG("%s", hdev->name);
561aafbc 3504
561aafbc
JH		 3505 hci_dev_lock(hdev);
3506
30dc78e1 3507 if (!hci_discovery_active(hdev)) {
bdb6d971 3508 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
04124681 3509 MGMT_STATUS_FAILED);
30dc78e1
JH		 3510 goto failed;
3511 }
3512
a198e7b1 3513 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
561aafbc 3514 if (!e) {
bdb6d971 3515 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
04124681 3516 MGMT_STATUS_INVALID_PARAMS);
561aafbc
JH		 3517 goto failed;
3518 }
3519
3520 if (cp->name_known) {
3521 e->name_state = NAME_KNOWN;
3522 list_del(&e->list);
3523 } else {
3524 e->name_state = NAME_NEEDED;
a3d4e20a 3525 hci_inquiry_cache_update_resolve(hdev, e);
561aafbc
JH		 3526 }
3527
e384662b
JH		 3528 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3529 sizeof(cp->addr));
561aafbc
JH		 3530
3531failed:
3532 hci_dev_unlock(hdev);
561aafbc
JH		 3533 return err;
3534}
3535
bdb6d971 3536static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3537 u16 len)
7fbec224 3538{
650f726d 3539 struct mgmt_cp_block_device *cp = data;
f0eeea8b 3540 u8 status;
7fbec224
AJ		 3541 int err;
3542
bdb6d971 3543 BT_DBG("%s", hdev->name);
7fbec224 3544
4ee71b20 3545 if (!bdaddr_type_is_valid(cp->addr.type))
5d0846d4
JH		 3546 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3547 MGMT_STATUS_INVALID_PARAMS,
3548 &cp->addr, sizeof(cp->addr));
4ee71b20 3549
09fd0de5 3550 hci_dev_lock(hdev);
5e762444 3551
88c1fe4b 3552 err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
7fbec224 3553 if (err < 0)
f0eeea8b 3554 status = MGMT_STATUS_FAILED;
7fbec224 3555 else
a6785be2 3556 status = MGMT_STATUS_SUCCESS;
f0eeea8b 3557
bdb6d971 3558 err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
04124681 3559 &cp->addr, sizeof(cp->addr));
5e762444 3560
09fd0de5 3561 hci_dev_unlock(hdev);
7fbec224
AJ		 3562
3563 return err;
3564}
3565
bdb6d971 3566static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3567 u16 len)
7fbec224 3568{
650f726d 3569 struct mgmt_cp_unblock_device *cp = data;
f0eeea8b 3570 u8 status;
7fbec224
AJ		 3571 int err;
3572
bdb6d971 3573 BT_DBG("%s", hdev->name);
7fbec224 3574
4ee71b20 3575 if (!bdaddr_type_is_valid(cp->addr.type))
5d0846d4
JH		 3576 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3577 MGMT_STATUS_INVALID_PARAMS,
3578 &cp->addr, sizeof(cp->addr));
4ee71b20 3579
09fd0de5 3580 hci_dev_lock(hdev);
5e762444 3581
88c1fe4b 3582 err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
7fbec224 3583 if (err < 0)
f0eeea8b 3584 status = MGMT_STATUS_INVALID_PARAMS;
7fbec224 3585 else
a6785be2 3586 status = MGMT_STATUS_SUCCESS;
f0eeea8b 3587
bdb6d971 3588 err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
04124681 3589 &cp->addr, sizeof(cp->addr));
5e762444 3590
09fd0de5 3591 hci_dev_unlock(hdev);
7fbec224
AJ		 3592
3593 return err;
3594}
3595
cdbaccca
MH		 3596static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3597 u16 len)
3598{
3599 struct mgmt_cp_set_device_id *cp = data;
890ea898 3600 struct hci_request req;
cdbaccca 3601 int err;
c72d4b8a 3602 __u16 source;
cdbaccca
MH		 3603
3604 BT_DBG("%s", hdev->name);
3605
c72d4b8a
SJ		 3606 source = __le16_to_cpu(cp->source);
3607
3608 if (source > 0x0002)
3609 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3610 MGMT_STATUS_INVALID_PARAMS);
3611
cdbaccca
MH		 3612 hci_dev_lock(hdev);
3613
c72d4b8a 3614 hdev->devid_source = source;
cdbaccca
MH		 3615 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3616 hdev->devid_product = __le16_to_cpu(cp->product);
3617 hdev->devid_version = __le16_to_cpu(cp->version);
3618
3619 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3620
890ea898
JH		 3621 hci_req_init(&req, hdev);
3622 update_eir(&req);
3623 hci_req_run(&req, NULL);
cdbaccca
MH		 3624
3625 hci_dev_unlock(hdev);
3626
3627 return err;
3628}
3629
4375f103
JH		 3630static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3631{
3632 struct cmd_lookup match = { NULL, hdev };
3633
3634 if (status) {
3635 u8 mgmt_err = mgmt_status(status);
3636
3637 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3638 cmd_status_rsp, &mgmt_err);
3639 return;
3640 }
3641
3642 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3643 &match);
3644
3645 new_settings(hdev, match.sk);
3646
3647 if (match.sk)
3648 sock_put(match.sk);
3649}
3650
21b5187f
MH		 3651static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3652 u16 len)
4375f103
JH		 3653{
3654 struct mgmt_mode *cp = data;
3655 struct pending_cmd *cmd;
3656 struct hci_request req;
e6fe7986 3657 u8 val, enabled, status;
4375f103
JH		 3658 int err;
3659
3660 BT_DBG("request for %s", hdev->name);
3661
e6fe7986
JH		 3662 status = mgmt_le_support(hdev);
3663 if (status)
4375f103 3664 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
e6fe7986 3665 status);
4375f103
JH		 3666
3667 if (cp->val != 0x00 && cp->val != 0x01)
3668 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3669 MGMT_STATUS_INVALID_PARAMS);
3670
3671 hci_dev_lock(hdev);
3672
3673 val = !!cp->val;
f3d3444a 3674 enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
4375f103 3675
f74ca9b8
JH		 3676 /* The following conditions are ones which mean that we should
3677 * not do any HCI communication but directly send a mgmt
3678 * response to user space (after toggling the flag if
3679 * necessary).
3680 */
3681 if (!hdev_is_powered(hdev) || val == enabled ||
b145edcd 3682 hci_conn_num(hdev, LE_LINK) > 0) {
4375f103
JH		 3683 bool changed = false;
3684
f3d3444a
JH		 3685 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3686 change_bit(HCI_ADVERTISING, &hdev->dev_flags);
4375f103
JH		 3687 changed = true;
3688 }
3689
3690 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3691 if (err < 0)
3692 goto unlock;
3693
3694 if (changed)
3695 err = new_settings(hdev, sk);
3696
3697 goto unlock;
3698 }
3699
3700 if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3701 mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3702 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3703 MGMT_STATUS_BUSY);
3704 goto unlock;
3705 }
3706
3707 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3708 if (!cmd) {
3709 err = -ENOMEM;
3710 goto unlock;
3711 }
3712
3713 hci_req_init(&req, hdev);
3714
bba3aa55
MH		 3715 if (val)
3716 enable_advertising(&req);
3717 else
3718 disable_advertising(&req);
4375f103
JH		 3719
3720 err = hci_req_run(&req, set_advertising_complete);
3721 if (err < 0)
3722 mgmt_pending_remove(cmd);
3723
3724unlock:
3725 hci_dev_unlock(hdev);
3726 return err;
3727}
3728
d13eafce
MH		 3729static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3730 void *data, u16 len)
3731{
3732 struct mgmt_cp_set_static_address *cp = data;
3733 int err;
3734
3735 BT_DBG("%s", hdev->name);
3736
62af4443 3737 if (!lmp_le_capable(hdev))
d13eafce 3738 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
62af4443 3739 MGMT_STATUS_NOT_SUPPORTED);
d13eafce
MH		 3740
3741 if (hdev_is_powered(hdev))
3742 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3743 MGMT_STATUS_REJECTED);
3744
3745 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3746 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3747 return cmd_status(sk, hdev->id,
3748 MGMT_OP_SET_STATIC_ADDRESS,
3749 MGMT_STATUS_INVALID_PARAMS);
3750
3751 /* Two most significant bits shall be set */
3752 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3753 return cmd_status(sk, hdev->id,
3754 MGMT_OP_SET_STATIC_ADDRESS,
3755 MGMT_STATUS_INVALID_PARAMS);
3756 }
3757
3758 hci_dev_lock(hdev);
3759
3760 bacpy(&hdev->static_addr, &cp->bdaddr);
3761
3762 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3763
3764 hci_dev_unlock(hdev);
3765
3766 return err;
3767}
3768
14b49b9a
MH		 3769static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
3770 void *data, u16 len)
3771{
3772 struct mgmt_cp_set_scan_params *cp = data;
3773 __u16 interval, window;
3774 int err;
3775
3776 BT_DBG("%s", hdev->name);
3777
3778 if (!lmp_le_capable(hdev))
3779 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3780 MGMT_STATUS_NOT_SUPPORTED);
3781
3782 interval = __le16_to_cpu(cp->interval);
3783
3784 if (interval < 0x0004 || interval > 0x4000)
3785 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3786 MGMT_STATUS_INVALID_PARAMS);
3787
3788 window = __le16_to_cpu(cp->window);
3789
3790 if (window < 0x0004 || window > 0x4000)
3791 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3792 MGMT_STATUS_INVALID_PARAMS);
3793
899e1075
MH		 3794 if (window > interval)
3795 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3796 MGMT_STATUS_INVALID_PARAMS);
3797
14b49b9a
MH		 3798 hci_dev_lock(hdev);
3799
3800 hdev->le_scan_interval = interval;
3801 hdev->le_scan_window = window;
3802
3803 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
3804
3805 hci_dev_unlock(hdev);
3806
3807 return err;
3808}
3809
33e38b3e
JH		 3810static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3811{
3812 struct pending_cmd *cmd;
3813
3814 BT_DBG("status 0x%02x", status);
3815
3816 hci_dev_lock(hdev);
3817
3818 cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3819 if (!cmd)
3820 goto unlock;
3821
3822 if (status) {
3823 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3824 mgmt_status(status));
3825 } else {
1a4d3c4b
JH		 3826 struct mgmt_mode *cp = cmd->param;
3827
3828 if (cp->val)
3829 set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3830 else
3831 clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3832
33e38b3e
JH		 3833 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3834 new_settings(hdev, cmd->sk);
3835 }
3836
3837 mgmt_pending_remove(cmd);
3838
3839unlock:
3840 hci_dev_unlock(hdev);
3841}
3842
bdb6d971 3843static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
04124681 3844 void *data, u16 len)
f6422ec6 3845{
650f726d 3846 struct mgmt_mode *cp = data;
33e38b3e
JH		 3847 struct pending_cmd *cmd;
3848 struct hci_request req;
f6422ec6
AJ		 3849 int err;
3850
bdb6d971 3851 BT_DBG("%s", hdev->name);
f6422ec6 3852
56f87901
JH		 3853 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
3854 hdev->hci_ver < BLUETOOTH_VER_1_2)
33c525c0
JH		 3855 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3856 MGMT_STATUS_NOT_SUPPORTED);
3857
a7e80f25
JH		 3858 if (cp->val != 0x00 && cp->val != 0x01)
3859 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3860 MGMT_STATUS_INVALID_PARAMS);
3861
5400c044 3862 if (!hdev_is_powered(hdev))
bdb6d971 3863 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
04124681 3864 MGMT_STATUS_NOT_POWERED);
5400c044
JH		 3865
3866 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
bdb6d971 3867 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
04124681 3868 MGMT_STATUS_REJECTED);
f6422ec6
AJ		 3869
3870 hci_dev_lock(hdev);
3871
05cbf29f
JH		 3872 if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3873 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3874 MGMT_STATUS_BUSY);
3875 goto unlock;
3876 }
3877
1a4d3c4b
JH		 3878 if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3879 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3880 hdev);
3881 goto unlock;
3882 }
3883
33e38b3e
JH		 3884 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3885 data, len);
3886 if (!cmd) {
3887 err = -ENOMEM;
3888 goto unlock;
f6422ec6
AJ		 3889 }
3890
33e38b3e
JH		 3891 hci_req_init(&req, hdev);
3892
406d7804 3893 write_fast_connectable(&req, cp->val);
33e38b3e
JH		 3894
3895 err = hci_req_run(&req, fast_connectable_complete);
f6422ec6 3896 if (err < 0) {
bdb6d971 3897 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
04124681 3898 MGMT_STATUS_FAILED);
33e38b3e 3899 mgmt_pending_remove(cmd);
f6422ec6
AJ		 3900 }
3901
33e38b3e 3902unlock:
f6422ec6 3903 hci_dev_unlock(hdev);
33e38b3e 3904
f6422ec6
AJ		 3905 return err;
3906}
3907
67e5a7a3
JH		 3908static void set_bredr_scan(struct hci_request *req)
3909{
3910 struct hci_dev *hdev = req->hdev;
3911 u8 scan = 0;
3912
3913 /* Ensure that fast connectable is disabled. This function will
3914 * not do anything if the page scan parameters are already what
3915 * they should be.
3916 */
3917 write_fast_connectable(req, false);
3918
3919 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3920 scan |= SCAN_PAGE;
3921 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3922 scan |= SCAN_INQUIRY;
3923
3924 if (scan)
3925 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3926}
3927
0663ca2a
JH		 3928static void set_bredr_complete(struct hci_dev *hdev, u8 status)
3929{
3930 struct pending_cmd *cmd;
3931
3932 BT_DBG("status 0x%02x", status);
3933
3934 hci_dev_lock(hdev);
3935
3936 cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
3937 if (!cmd)
3938 goto unlock;
3939
3940 if (status) {
3941 u8 mgmt_err = mgmt_status(status);
3942
3943 /* We need to restore the flag if related HCI commands
3944 * failed.
3945 */
3946 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3947
3948 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
3949 } else {
3950 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
3951 new_settings(hdev, cmd->sk);
3952 }
3953
3954 mgmt_pending_remove(cmd);
3955
3956unlock:
3957 hci_dev_unlock(hdev);
3958}
3959
3960static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3961{
3962 struct mgmt_mode *cp = data;
3963 struct pending_cmd *cmd;
3964 struct hci_request req;
3965 int err;
3966
3967 BT_DBG("request for %s", hdev->name);
3968
3969 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
3970 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3971 MGMT_STATUS_NOT_SUPPORTED);
3972
3973 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3974 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3975 MGMT_STATUS_REJECTED);
3976
3977 if (cp->val != 0x00 && cp->val != 0x01)
3978 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3979 MGMT_STATUS_INVALID_PARAMS);
3980
3981 hci_dev_lock(hdev);
3982
3983 if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3984 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3985 goto unlock;
3986 }
3987
3988 if (!hdev_is_powered(hdev)) {
3989 if (!cp->val) {
0663ca2a
JH		 3990 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
3991 clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
3992 clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3993 clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3994 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3995 }
3996
3997 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3998
3999 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4000 if (err < 0)
4001 goto unlock;
4002
4003 err = new_settings(hdev, sk);
4004 goto unlock;
4005 }
4006
4007 /* Reject disabling when powered on */
4008 if (!cp->val) {
4009 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4010 MGMT_STATUS_REJECTED);
4011 goto unlock;
4012 }
4013
4014 if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4015 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4016 MGMT_STATUS_BUSY);
4017 goto unlock;
4018 }
4019
4020 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4021 if (!cmd) {
4022 err = -ENOMEM;
4023 goto unlock;
4024 }
4025
5947f4bc 4026 /* We need to flip the bit already here so that update_adv_data
0663ca2a
JH		 4027 * generates the correct flags.
4028 */
4029 set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4030
4031 hci_req_init(&req, hdev);
aa8af46e
JH		 4032
4033 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4034 set_bredr_scan(&req);
4035
f14d8f64
MH		 4036 /* Since only the advertising data flags will change, there
4037 * is no need to update the scan response data.
4038 */
5947f4bc 4039 update_adv_data(&req);
aa8af46e 4040
0663ca2a
JH		 4041 err = hci_req_run(&req, set_bredr_complete);
4042 if (err < 0)
4043 mgmt_pending_remove(cmd);
4044
4045unlock:
4046 hci_dev_unlock(hdev);
4047 return err;
4048}
4049
eac83dc6
MH		 4050static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4051 void *data, u16 len)
4052{
4053 struct mgmt_mode *cp = data;
4054 struct pending_cmd *cmd;
0ab04a9c 4055 u8 val, status;
eac83dc6
MH		 4056 int err;
4057
4058 BT_DBG("request for %s", hdev->name);
4059
4060 status = mgmt_bredr_support(hdev);
4061 if (status)
4062 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4063 status);
4064
5afeac14
MH		 4065 if (!lmp_sc_capable(hdev) &&
4066 !test_bit(HCI_FORCE_SC, &hdev->dev_flags))
eac83dc6
MH		 4067 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4068 MGMT_STATUS_NOT_SUPPORTED);
4069
0ab04a9c 4070 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
eac83dc6
MH		 4071 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4072 MGMT_STATUS_INVALID_PARAMS);
4073
4074 hci_dev_lock(hdev);
4075
4076 if (!hdev_is_powered(hdev)) {
4077 bool changed;
4078
0ab04a9c 4079 if (cp->val) {
eac83dc6
MH		 4080 changed = !test_and_set_bit(HCI_SC_ENABLED,
4081 &hdev->dev_flags);
0ab04a9c
MH		 4082 if (cp->val == 0x02)
4083 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4084 else
4085 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4086 } else {
eac83dc6
MH		 4087 changed = test_and_clear_bit(HCI_SC_ENABLED,
4088 &hdev->dev_flags);
0ab04a9c
MH		 4089 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4090 }
eac83dc6
MH		 4091
4092 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4093 if (err < 0)
4094 goto failed;
4095
4096 if (changed)
4097 err = new_settings(hdev, sk);
4098
4099 goto failed;
4100 }
4101
4102 if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4103 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4104 MGMT_STATUS_BUSY);
4105 goto failed;
4106 }
4107
0ab04a9c
MH		 4108 val = !!cp->val;
4109
4110 if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4111 (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
eac83dc6
MH		 4112 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4113 goto failed;
4114 }
4115
4116 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4117 if (!cmd) {
4118 err = -ENOMEM;
4119 goto failed;
4120 }
4121
0ab04a9c 4122 err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
eac83dc6
MH		 4123 if (err < 0) {
4124 mgmt_pending_remove(cmd);
4125 goto failed;
4126 }
4127
0ab04a9c
MH		 4128 if (cp->val == 0x02)
4129 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4130 else
4131 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4132
eac83dc6
MH		 4133failed:
4134 hci_dev_unlock(hdev);
4135 return err;
4136}
4137
4e39ac81
MH		 4138static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4139 void *data, u16 len)
4140{
4141 struct mgmt_mode *cp = data;
4142 bool changed;
4143 int err;
4144
4145 BT_DBG("request for %s", hdev->name);
4146
4147 if (cp->val != 0x00 && cp->val != 0x01)
4148 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4149 MGMT_STATUS_INVALID_PARAMS);
4150
4151 hci_dev_lock(hdev);
4152
4153 if (cp->val)
4154 changed = !test_and_set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
4155 else
4156 changed = test_and_clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
4157
4158 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4159 if (err < 0)
4160 goto unlock;
4161
4162 if (changed)
4163 err = new_settings(hdev, sk);
4164
4165unlock:
4166 hci_dev_unlock(hdev);
4167 return err;
4168}
4169
41edf160
JH		 4170static bool irk_is_valid(struct mgmt_irk_info *irk)
4171{
4172 switch (irk->addr.type) {
4173 case BDADDR_LE_PUBLIC:
4174 return true;
4175
4176 case BDADDR_LE_RANDOM:
4177 /* Two most significant bits shall be set */
4178 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4179 return false;
4180 return true;
4181 }
4182
4183 return false;
4184}
4185
4186static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4187 u16 len)
4188{
4189 struct mgmt_cp_load_irks *cp = cp_data;
4190 u16 irk_count, expected_len;
4191 int i, err;
4192
4193 BT_DBG("request for %s", hdev->name);
4194
4195 if (!lmp_le_capable(hdev))
4196 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4197 MGMT_STATUS_NOT_SUPPORTED);
4198
4199 irk_count = __le16_to_cpu(cp->irk_count);
4200
4201 expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4202 if (expected_len != len) {
4203 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4204 len, expected_len);
4205 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4206 MGMT_STATUS_INVALID_PARAMS);
4207 }
4208
4209 BT_DBG("%s irk_count %u", hdev->name, irk_count);
4210
4211 for (i = 0; i < irk_count; i++) {
4212 struct mgmt_irk_info *key = &cp->irks[i];
4213
4214 if (!irk_is_valid(key))
4215 return cmd_status(sk, hdev->id,
4216 MGMT_OP_LOAD_IRKS,
4217 MGMT_STATUS_INVALID_PARAMS);
4218 }
4219
4220 hci_dev_lock(hdev);
4221
4222 hci_smp_irks_clear(hdev);
4223
4224 for (i = 0; i < irk_count; i++) {
4225 struct mgmt_irk_info *irk = &cp->irks[i];
4226 u8 addr_type;
4227
4228 if (irk->addr.type == BDADDR_LE_PUBLIC)
4229 addr_type = ADDR_LE_DEV_PUBLIC;
4230 else
4231 addr_type = ADDR_LE_DEV_RANDOM;
4232
4233 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
4234 BDADDR_ANY);
4235 }
4236
4237 set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4238
4239 err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4240
4241 hci_dev_unlock(hdev);
4242
4243 return err;
4244}
4245
3f706b72
JH		 4246static bool ltk_is_valid(struct mgmt_ltk_info *key)
4247{
4248 if (key->master != 0x00 && key->master != 0x01)
4249 return false;
490cb0b3
MH		 4250
4251 switch (key->addr.type) {
4252 case BDADDR_LE_PUBLIC:
4253 return true;
4254
4255 case BDADDR_LE_RANDOM:
4256 /* Two most significant bits shall be set */
4257 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4258 return false;
4259 return true;
4260 }
4261
4262 return false;
3f706b72
JH		 4263}
4264
bdb6d971 4265static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
04124681 4266 void *cp_data, u16 len)
346af67b 4267{
346af67b
VCG		 4268 struct mgmt_cp_load_long_term_keys *cp = cp_data;
4269 u16 key_count, expected_len;
715a5bf2 4270 int i, err;
346af67b 4271
cf99ba13
MH		 4272 BT_DBG("request for %s", hdev->name);
4273
4274 if (!lmp_le_capable(hdev))
4275 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4276 MGMT_STATUS_NOT_SUPPORTED);
4277
1f350c87 4278 key_count = __le16_to_cpu(cp->key_count);
346af67b
VCG		 4279
4280 expected_len = sizeof(*cp) + key_count *
4281 sizeof(struct mgmt_ltk_info);
4282 if (expected_len != len) {
4283 BT_ERR("load_keys: expected %u bytes, got %u bytes",
8ce8e2b5 4284 len, expected_len);
bdb6d971 4285 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
e57e619f 4286 MGMT_STATUS_INVALID_PARAMS);
346af67b
VCG		 4287 }
4288
bdb6d971 4289 BT_DBG("%s key_count %u", hdev->name, key_count);
346af67b 4290
54ad6d8a
JH		 4291 for (i = 0; i < key_count; i++) {
4292 struct mgmt_ltk_info *key = &cp->keys[i];
4293
3f706b72 4294 if (!ltk_is_valid(key))
54ad6d8a
JH		 4295 return cmd_status(sk, hdev->id,
4296 MGMT_OP_LOAD_LONG_TERM_KEYS,
4297 MGMT_STATUS_INVALID_PARAMS);
4298 }
4299
346af67b
VCG		 4300 hci_dev_lock(hdev);
4301
4302 hci_smp_ltks_clear(hdev);
4303
4304 for (i = 0; i < key_count; i++) {
4305 struct mgmt_ltk_info *key = &cp->keys[i];
79d95a19
MH		 4306 u8 type, addr_type;
4307
4308 if (key->addr.type == BDADDR_LE_PUBLIC)
4309 addr_type = ADDR_LE_DEV_PUBLIC;
4310 else
4311 addr_type = ADDR_LE_DEV_RANDOM;
346af67b
VCG		 4312
4313 if (key->master)
4314 type = HCI_SMP_LTK;
4315 else
4316 type = HCI_SMP_LTK_SLAVE;
4317
79d95a19 4318 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type,
d40f3eef 4319 type, 0, key->type, key->val,
04124681 4320 key->enc_size, key->ediv, key->rand);
346af67b
VCG		 4321 }
4322
715a5bf2
JH		 4323 err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4324 NULL, 0);
4325
346af67b 4326 hci_dev_unlock(hdev);
346af67b 4327
715a5bf2 4328 return err;
346af67b
VCG		 4329}
4330
2e3c35ea 4331static const struct mgmt_handler {
04124681
GP		 4332 int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
4333 u16 data_len);
be22b54e
JH		 4334 bool var_len;
4335 size_t data_len;
0f4e68cf
JH		 4336} mgmt_handlers[] = {
4337 { NULL }, /* 0x0000 (no command) */
be22b54e
JH		 4338 { read_version, false, MGMT_READ_VERSION_SIZE },
4339 { read_commands, false, MGMT_READ_COMMANDS_SIZE },
4340 { read_index_list, false, MGMT_READ_INDEX_LIST_SIZE },
4341 { read_controller_info, false, MGMT_READ_INFO_SIZE },
4342 { set_powered, false, MGMT_SETTING_SIZE },
4343 { set_discoverable, false, MGMT_SET_DISCOVERABLE_SIZE },
4344 { set_connectable, false, MGMT_SETTING_SIZE },
4345 { set_fast_connectable, false, MGMT_SETTING_SIZE },
4346 { set_pairable, false, MGMT_SETTING_SIZE },
4347 { set_link_security, false, MGMT_SETTING_SIZE },
4348 { set_ssp, false, MGMT_SETTING_SIZE },
4349 { set_hs, false, MGMT_SETTING_SIZE },
4350 { set_le, false, MGMT_SETTING_SIZE },
4351 { set_dev_class, false, MGMT_SET_DEV_CLASS_SIZE },
4352 { set_local_name, false, MGMT_SET_LOCAL_NAME_SIZE },
4353 { add_uuid, false, MGMT_ADD_UUID_SIZE },
4354 { remove_uuid, false, MGMT_REMOVE_UUID_SIZE },
4355 { load_link_keys, true, MGMT_LOAD_LINK_KEYS_SIZE },
4356 { load_long_term_keys, true, MGMT_LOAD_LONG_TERM_KEYS_SIZE },
4357 { disconnect, false, MGMT_DISCONNECT_SIZE },
4358 { get_connections, false, MGMT_GET_CONNECTIONS_SIZE },
4359 { pin_code_reply, false, MGMT_PIN_CODE_REPLY_SIZE },
4360 { pin_code_neg_reply, false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
4361 { set_io_capability, false, MGMT_SET_IO_CAPABILITY_SIZE },
4362 { pair_device, false, MGMT_PAIR_DEVICE_SIZE },
4363 { cancel_pair_device, false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
4364 { unpair_device, false, MGMT_UNPAIR_DEVICE_SIZE },
4365 { user_confirm_reply, false, MGMT_USER_CONFIRM_REPLY_SIZE },
4366 { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
4367 { user_passkey_reply, false, MGMT_USER_PASSKEY_REPLY_SIZE },
4368 { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
4369 { read_local_oob_data, false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
ec109113 4370 { add_remote_oob_data, true, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
be22b54e
JH		 4371 { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
4372 { start_discovery, false, MGMT_START_DISCOVERY_SIZE },
4373 { stop_discovery, false, MGMT_STOP_DISCOVERY_SIZE },
4374 { confirm_name, false, MGMT_CONFIRM_NAME_SIZE },
4375 { block_device, false, MGMT_BLOCK_DEVICE_SIZE },
4376 { unblock_device, false, MGMT_UNBLOCK_DEVICE_SIZE },
cdbaccca 4377 { set_device_id, false, MGMT_SET_DEVICE_ID_SIZE },
4375f103 4378 { set_advertising, false, MGMT_SETTING_SIZE },
0663ca2a 4379 { set_bredr, false, MGMT_SETTING_SIZE },
d13eafce 4380 { set_static_address, false, MGMT_SET_STATIC_ADDRESS_SIZE },
14b49b9a 4381 { set_scan_params, false, MGMT_SET_SCAN_PARAMS_SIZE },
eac83dc6 4382 { set_secure_conn, false, MGMT_SETTING_SIZE },
4e39ac81 4383 { set_debug_keys, false, MGMT_SETTING_SIZE },
41edf160
JH		 4384 { },
4385 { load_irks, true, MGMT_LOAD_IRKS_SIZE },
0f4e68cf
JH		 4386};
4387
4388
0381101f
JH		 4389int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
4390{
650f726d
VCG		 4391 void *buf;
4392 u8 *cp;
0381101f 4393 struct mgmt_hdr *hdr;
4e51eae9 4394 u16 opcode, index, len;
bdb6d971 4395 struct hci_dev *hdev = NULL;
2e3c35ea 4396 const struct mgmt_handler *handler;
0381101f
JH		 4397 int err;
4398
4399 BT_DBG("got %zu bytes", msglen);
4400
4401 if (msglen < sizeof(*hdr))
4402 return -EINVAL;
4403
e63a15ec 4404 buf = kmalloc(msglen, GFP_KERNEL);
0381101f
JH		 4405 if (!buf)
4406 return -ENOMEM;
4407
4408 if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
4409 err = -EFAULT;
4410 goto done;
4411 }
4412
650f726d 4413 hdr = buf;
1f350c87
MH		 4414 opcode = __le16_to_cpu(hdr->opcode);
4415 index = __le16_to_cpu(hdr->index);
4416 len = __le16_to_cpu(hdr->len);
0381101f
JH		 4417
4418 if (len != msglen - sizeof(*hdr)) {
4419 err = -EINVAL;
4420 goto done;
4421 }
4422
0f4e68cf 4423 if (index != MGMT_INDEX_NONE) {
bdb6d971
JH		 4424 hdev = hci_dev_get(index);
4425 if (!hdev) {
4426 err = cmd_status(sk, index, opcode,
04124681 4427 MGMT_STATUS_INVALID_INDEX);
bdb6d971
JH		 4428 goto done;
4429 }
0736cfa8 4430
cebf4cfd
JH		 4431 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
4432 test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
0736cfa8
MH		 4433 err = cmd_status(sk, index, opcode,
4434 MGMT_STATUS_INVALID_INDEX);
4435 goto done;
4436 }
bdb6d971
JH		 4437 }
4438
0f4e68cf 4439 if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
8ce8e2b5 4440 mgmt_handlers[opcode].func == NULL) {
0381101f 4441 BT_DBG("Unknown op %u", opcode);
ca69b795 4442 err = cmd_status(sk, index, opcode,
04124681 4443 MGMT_STATUS_UNKNOWN_COMMAND);
0f4e68cf
JH		 4444 goto done;
4445 }
4446
4447 if ((hdev && opcode < MGMT_OP_READ_INFO) ||
8ce8e2b5 4448 (!hdev && opcode >= MGMT_OP_READ_INFO)) {
0f4e68cf 4449 err = cmd_status(sk, index, opcode,
04124681 4450 MGMT_STATUS_INVALID_INDEX);
0f4e68cf 4451 goto done;
0381101f
JH		 4452 }
4453
be22b54e
JH		 4454 handler = &mgmt_handlers[opcode];
4455
4456 if ((handler->var_len && len < handler->data_len) ||
8ce8e2b5 4457 (!handler->var_len && len != handler->data_len)) {
be22b54e 4458 err = cmd_status(sk, index, opcode,
04124681 4459 MGMT_STATUS_INVALID_PARAMS);
be22b54e
JH		 4460 goto done;
4461 }
4462
0f4e68cf
JH		 4463 if (hdev)
4464 mgmt_init_hdev(sk, hdev);
4465
4466 cp = buf + sizeof(*hdr);
4467
be22b54e 4468 err = handler->func(sk, hdev, cp, len);
e41d8b4e
JH		 4469 if (err < 0)
4470 goto done;
4471
0381101f
JH		 4472 err = msglen;
4473
4474done:
bdb6d971
JH		 4475 if (hdev)
4476 hci_dev_put(hdev);
4477
0381101f
JH		 4478 kfree(buf);
4479 return err;
4480}
c71e97bf 4481
bf6b56db 4482void mgmt_index_added(struct hci_dev *hdev)
c71e97bf 4483{
1514b892 4484 if (hdev->dev_type != HCI_BREDR)
bf6b56db 4485 return;
bb4b2a9a 4486
bf6b56db 4487 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
c71e97bf
JH		 4488}
4489
bf6b56db 4490void mgmt_index_removed(struct hci_dev *hdev)
c71e97bf 4491{
5f159032 4492 u8 status = MGMT_STATUS_INVALID_INDEX;
b24752fe 4493
1514b892 4494 if (hdev->dev_type != HCI_BREDR)
bf6b56db 4495 return;
bb4b2a9a 4496
744cf19e 4497 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
b24752fe 4498
bf6b56db 4499 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
eec8d2bc
JH		 4500}
4501
229ab39c
JH		 4502static void powered_complete(struct hci_dev *hdev, u8 status)
4503{
4504 struct cmd_lookup match = { NULL, hdev };
4505
4506 BT_DBG("status 0x%02x", status);
4507
4508 hci_dev_lock(hdev);
4509
4510 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
4511
4512 new_settings(hdev, match.sk);
4513
4514 hci_dev_unlock(hdev);
4515
4516 if (match.sk)
4517 sock_put(match.sk);
4518}
4519
70da6243 4520static int powered_update_hci(struct hci_dev *hdev)
5add6af8 4521{
890ea898 4522 struct hci_request req;
70da6243 4523 u8 link_sec;
5add6af8 4524
890ea898
JH		 4525 hci_req_init(&req, hdev);
4526
70da6243
JH		 4527 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
4528 !lmp_host_ssp_capable(hdev)) {
4529 u8 ssp = 1;
5e5282bb 4530
890ea898 4531 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
70da6243 4532 }
5add6af8 4533
c73eee91
JH		 4534 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
4535 lmp_bredr_capable(hdev)) {
70da6243 4536 struct hci_cp_write_le_host_supported cp;
f0ff92fb 4537
70da6243
JH		 4538 cp.le = 1;
4539 cp.simul = lmp_le_br_capable(hdev);
3d1cbdd6 4540
70da6243
JH		 4541 /* Check first if we already have the right
4542 * host state (host features set)
4543 */
4544 if (cp.le != lmp_host_le_capable(hdev) ||
4545 cp.simul != lmp_host_le_br_capable(hdev))
890ea898
JH		 4546 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
4547 sizeof(cp), &cp);
70da6243 4548 }
3d1cbdd6 4549
d13eafce
MH		 4550 if (lmp_le_capable(hdev)) {
4551 /* Set random address to static address if configured */
4552 if (bacmp(&hdev->static_addr, BDADDR_ANY))
4553 hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
4554 &hdev->static_addr);
eeca6f89 4555
441ad2d0
MH		 4556 /* Make sure the controller has a good default for
4557 * advertising data. This also applies to the case
4558 * where BR/EDR was toggled during the AUTO_OFF phase.
4559 */
f14d8f64 4560 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
5947f4bc 4561 update_adv_data(&req);
f14d8f64
MH		 4562 update_scan_rsp_data(&req);
4563 }
441ad2d0 4564
bba3aa55
MH		 4565 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
4566 enable_advertising(&req);
eeca6f89
JH		 4567 }
4568
70da6243
JH		 4569 link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4570 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
890ea898
JH		 4571 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
4572 sizeof(link_sec), &link_sec);
562fcc24 4573
70da6243 4574 if (lmp_bredr_capable(hdev)) {
56f87901
JH		 4575 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
4576 set_bredr_scan(&req);
890ea898 4577 update_class(&req);
13928971 4578 update_name(&req);
890ea898 4579 update_eir(&req);
70da6243 4580 }
562fcc24 4581
229ab39c 4582 return hci_req_run(&req, powered_complete);
70da6243 4583}
562fcc24 4584
70da6243
JH		 4585int mgmt_powered(struct hci_dev *hdev, u8 powered)
4586{
4587 struct cmd_lookup match = { NULL, hdev };
229ab39c
JH		 4588 u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
4589 u8 zero_cod[] = { 0, 0, 0 };
70da6243 4590 int err;
f0ff92fb 4591
70da6243
JH		 4592 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
4593 return 0;
4594
70da6243 4595 if (powered) {
229ab39c
JH		 4596 if (powered_update_hci(hdev) == 0)
4597 return 0;
fe038884 4598
229ab39c
JH		 4599 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
4600 &match);
4601 goto new_settings;
b24752fe
JH		 4602 }
4603
229ab39c
JH		 4604 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
4605 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
4606
4607 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
4608 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
4609 zero_cod, sizeof(zero_cod), NULL);
4610
4611new_settings:
beadb2bd 4612 err = new_settings(hdev, match.sk);
eec8d2bc
JH		 4613
4614 if (match.sk)
4615 sock_put(match.sk);
4616
7bb895d6 4617 return err;
5add6af8 4618}
73f22f62 4619
3eec705e 4620void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
96570ffc
JH		 4621{
4622 struct pending_cmd *cmd;
4623 u8 status;
4624
4625 cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
4626 if (!cmd)
3eec705e 4627 return;
96570ffc
JH		 4628
4629 if (err == -ERFKILL)
4630 status = MGMT_STATUS_RFKILLED;
4631 else
4632 status = MGMT_STATUS_FAILED;
4633
3eec705e 4634 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
96570ffc
JH		 4635
4636 mgmt_pending_remove(cmd);
96570ffc
JH		 4637}
4638
d1967ff8
MH		 4639void mgmt_discoverable_timeout(struct hci_dev *hdev)
4640{
4641 struct hci_request req;
d1967ff8
MH		 4642
4643 hci_dev_lock(hdev);
4644
4645 /* When discoverable timeout triggers, then just make sure
4646 * the limited discoverable flag is cleared. Even in the case
4647 * of a timeout triggered from general discoverable, it is
4648 * safe to unconditionally clear the flag.
4649 */
4650 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
9a43e25f 4651 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
d1967ff8
MH		 4652
4653 hci_req_init(&req, hdev);
4b580614
JH		 4654 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4655 u8 scan = SCAN_PAGE;
4656 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
4657 sizeof(scan), &scan);
4658 }
d1967ff8 4659 update_class(&req);
9a43e25f 4660 update_adv_data(&req);
d1967ff8
MH		 4661 hci_req_run(&req, NULL);
4662
4663 hdev->discov_timeout = 0;
4664
9a43e25f
JH		 4665 new_settings(hdev, NULL);
4666
d1967ff8
MH		 4667 hci_dev_unlock(hdev);
4668}
4669
86a75645 4670void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
73f22f62 4671{
86a75645 4672 bool changed;
73f22f62 4673
bfaf8c9f
JH		 4674 /* Nothing needed here if there's a pending command since that
4675 * commands request completion callback takes care of everything
4676 * necessary.
4677 */
4678 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
86a75645 4679 return;
bfaf8c9f 4680
9a43e25f 4681 if (discoverable) {
86a75645 4682 changed = !test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
9a43e25f
JH		 4683 } else {
4684 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
86a75645 4685 changed = test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
9a43e25f
JH		 4686 }
4687
4688 if (changed) {
4689 struct hci_request req;
4690
4691 /* In case this change in discoverable was triggered by
4692 * a disabling of connectable there could be a need to
4693 * update the advertising flags.
4694 */
4695 hci_req_init(&req, hdev);
4696 update_adv_data(&req);
4697 hci_req_run(&req, NULL);
73f22f62 4698
86a75645 4699 new_settings(hdev, NULL);
9a43e25f 4700 }
73f22f62 4701}
9fbcbb45 4702
a330916c 4703void mgmt_connectable(struct hci_dev *hdev, u8 connectable)
9fbcbb45 4704{
a330916c 4705 bool changed;
9fbcbb45 4706
d7b856f9
JH		 4707 /* Nothing needed here if there's a pending command since that
4708 * commands request completion callback takes care of everything
4709 * necessary.
4710 */
4711 if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
a330916c 4712 return;
d7b856f9 4713
a330916c
MH		 4714 if (connectable)
4715 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
4716 else
4717 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
9fbcbb45 4718
beadb2bd 4719 if (changed)
a330916c 4720 new_settings(hdev, NULL);
9fbcbb45 4721}
55ed8ca1 4722
4796e8af 4723void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2d7cee58 4724{
ca69b795
JH		 4725 u8 mgmt_err = mgmt_status(status);
4726
2d7cee58 4727 if (scan & SCAN_PAGE)
744cf19e 4728 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
04124681 4729 cmd_status_rsp, &mgmt_err);
2d7cee58
JH		 4730
4731 if (scan & SCAN_INQUIRY)
744cf19e 4732 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
04124681 4733 cmd_status_rsp, &mgmt_err);
2d7cee58
JH		 4734}
4735
dc4a5ee2
MH		 4736void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
4737 bool persistent)
55ed8ca1 4738{
86742e1e 4739 struct mgmt_ev_new_link_key ev;
55ed8ca1 4740
a492cd52 4741 memset(&ev, 0, sizeof(ev));
55ed8ca1 4742
a492cd52 4743 ev.store_hint = persistent;
d753fdc4 4744 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
591f47f3 4745 ev.key.addr.type = BDADDR_BREDR;
a492cd52 4746 ev.key.type = key->type;
9b3b4460 4747 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
a492cd52 4748 ev.key.pin_len = key->pin_len;
55ed8ca1 4749
dc4a5ee2 4750 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
55ed8ca1 4751}
f7520543 4752
083368f7 4753void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
346af67b
VCG		 4754{
4755 struct mgmt_ev_new_long_term_key ev;
4756
4757 memset(&ev, 0, sizeof(ev));
4758
4759 ev.store_hint = persistent;
4760 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
57c1477c 4761 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
d40f3eef 4762 ev.key.type = key->authenticated;
346af67b
VCG		 4763 ev.key.enc_size = key->enc_size;
4764 ev.key.ediv = key->ediv;
4765
4766 if (key->type == HCI_SMP_LTK)
4767 ev.key.master = 1;
4768
4769 memcpy(ev.key.rand, key->rand, sizeof(key->rand));
4770 memcpy(ev.key.val, key->val, sizeof(key->val));
4771
083368f7 4772 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
346af67b
VCG		 4773}
4774
94933991
MH		 4775static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
4776 u8 data_len)
4777{
4778 eir[eir_len++] = sizeof(type) + data_len;
4779 eir[eir_len++] = type;
4780 memcpy(&eir[eir_len], data, data_len);
4781 eir_len += data_len;
4782
4783 return eir_len;
4784}
4785
ecd90ae7
MH		 4786void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4787 u8 addr_type, u32 flags, u8 *name, u8 name_len,
4788 u8 *dev_class)
f7520543 4789{
b644ba33
JH		 4790 char buf[512];
4791 struct mgmt_ev_device_connected *ev = (void *) buf;
4792 u16 eir_len = 0;
f7520543 4793
b644ba33 4794 bacpy(&ev->addr.bdaddr, bdaddr);
57c1477c 4795 ev->addr.type = link_to_bdaddr(link_type, addr_type);
f7520543 4796
c95f0ba7 4797 ev->flags = __cpu_to_le32(flags);
08c79b61 4798
b644ba33
JH		 4799 if (name_len > 0)
4800 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
04124681 4801 name, name_len);
b644ba33
JH		 4802
4803 if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
53156385 4804 eir_len = eir_append_data(ev->eir, eir_len,
04124681 4805 EIR_CLASS_OF_DEV, dev_class, 3);
b644ba33 4806
eb55ef07 4807 ev->eir_len = cpu_to_le16(eir_len);
b644ba33 4808
ecd90ae7
MH		 4809 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
4810 sizeof(*ev) + eir_len, NULL);
f7520543
JH		 4811}
4812
8962ee74
JH		 4813static void disconnect_rsp(struct pending_cmd *cmd, void *data)
4814{
c68fb7ff 4815 struct mgmt_cp_disconnect *cp = cmd->param;
8962ee74 4816 struct sock **sk = data;
a38528f1 4817 struct mgmt_rp_disconnect rp;
8962ee74 4818
88c3df13
JH		 4819 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4820 rp.addr.type = cp->addr.type;
8962ee74 4821
aee9b218 4822 cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
04124681 4823 sizeof(rp));
8962ee74
JH		 4824
4825 *sk = cmd->sk;
4826 sock_hold(*sk);
4827
a664b5bc 4828 mgmt_pending_remove(cmd);
8962ee74
JH		 4829}
4830
124f6e35 4831static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
a8a1d19e 4832{
b1078ad0 4833 struct hci_dev *hdev = data;
124f6e35
JH		 4834 struct mgmt_cp_unpair_device *cp = cmd->param;
4835 struct mgmt_rp_unpair_device rp;
a8a1d19e
JH		 4836
4837 memset(&rp, 0, sizeof(rp));
124f6e35
JH		 4838 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4839 rp.addr.type = cp->addr.type;
a8a1d19e 4840
b1078ad0
JH		 4841 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
4842
aee9b218 4843 cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
a8a1d19e
JH		 4844
4845 mgmt_pending_remove(cmd);
4846}
4847
9b80ec5e
MH		 4848void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
4849 u8 link_type, u8 addr_type, u8 reason)
f7520543 4850{
f0d6a0ea 4851 struct mgmt_ev_device_disconnected ev;
8962ee74 4852 struct sock *sk = NULL;
8962ee74 4853
57eb776f
AG		 4854 if (link_type != ACL_LINK && link_type != LE_LINK)
4855 return;
4856
744cf19e 4857 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
f7520543 4858
f0d6a0ea
MA		 4859 bacpy(&ev.addr.bdaddr, bdaddr);
4860 ev.addr.type = link_to_bdaddr(link_type, addr_type);
4861 ev.reason = reason;
f7520543 4862
9b80ec5e 4863 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8962ee74
JH		 4864
4865 if (sk)
d97dcb66 4866 sock_put(sk);
8962ee74 4867
124f6e35 4868 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
04124681 4869 hdev);
8962ee74
JH		 4870}
4871
7892924c
MH		 4872void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
4873 u8 link_type, u8 addr_type, u8 status)
8962ee74 4874{
3655bba8
AG		 4875 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
4876 struct mgmt_cp_disconnect *cp;
88c3df13 4877 struct mgmt_rp_disconnect rp;
8962ee74 4878 struct pending_cmd *cmd;
8962ee74 4879
36a75f1b
JD		 4880 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4881 hdev);
4882
2e58ef3e 4883 cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
8962ee74 4884 if (!cmd)
7892924c 4885 return;
8962ee74 4886
3655bba8
AG		 4887 cp = cmd->param;
4888
4889 if (bacmp(bdaddr, &cp->addr.bdaddr))
4890 return;
4891
4892 if (cp->addr.type != bdaddr_type)
4893 return;
4894
88c3df13 4895 bacpy(&rp.addr.bdaddr, bdaddr);
3655bba8 4896 rp.addr.type = bdaddr_type;
37d9ef76 4897
7892924c
MH		 4898 cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
4899 mgmt_status(status), &rp, sizeof(rp));
8962ee74 4900
a664b5bc 4901 mgmt_pending_remove(cmd);
f7520543 4902}
17d5c04c 4903
445608d0
MH		 4904void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4905 u8 addr_type, u8 status)
17d5c04c
JH		 4906{
4907 struct mgmt_ev_connect_failed ev;
4908
4c659c39 4909 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 4910 ev.addr.type = link_to_bdaddr(link_type, addr_type);
ca69b795 4911 ev.status = mgmt_status(status);
17d5c04c 4912
445608d0 4913 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
17d5c04c 4914}
980e1a53 4915
ce0e4a0d 4916void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
980e1a53
JH		 4917{
4918 struct mgmt_ev_pin_code_request ev;
4919
d8457698 4920 bacpy(&ev.addr.bdaddr, bdaddr);
591f47f3 4921 ev.addr.type = BDADDR_BREDR;
a770bb5a 4922 ev.secure = secure;
980e1a53 4923
ce0e4a0d 4924 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
980e1a53
JH		 4925}
4926
e669cf80
MH		 4927void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4928 u8 status)
980e1a53
JH		 4929{
4930 struct pending_cmd *cmd;
ac56fb13 4931 struct mgmt_rp_pin_code_reply rp;
980e1a53 4932
2e58ef3e 4933 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
980e1a53 4934 if (!cmd)
e669cf80 4935 return;
980e1a53 4936
d8457698 4937 bacpy(&rp.addr.bdaddr, bdaddr);
591f47f3 4938 rp.addr.type = BDADDR_BREDR;
ac56fb13 4939
e669cf80
MH		 4940 cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
4941 mgmt_status(status), &rp, sizeof(rp));
980e1a53 4942
a664b5bc 4943 mgmt_pending_remove(cmd);
980e1a53
JH		 4944}
4945
3eb38528
MH		 4946void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4947 u8 status)
980e1a53
JH		 4948{
4949 struct pending_cmd *cmd;
ac56fb13 4950 struct mgmt_rp_pin_code_reply rp;
980e1a53 4951
2e58ef3e 4952 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
980e1a53 4953 if (!cmd)
3eb38528 4954 return;
980e1a53 4955
d8457698 4956 bacpy(&rp.addr.bdaddr, bdaddr);
591f47f3 4957 rp.addr.type = BDADDR_BREDR;
ac56fb13 4958
3eb38528
MH		 4959 cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
4960 mgmt_status(status), &rp, sizeof(rp));
980e1a53 4961
a664b5bc 4962 mgmt_pending_remove(cmd);
980e1a53 4963}
a5c29683 4964
744cf19e 4965int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681
GP		 4966 u8 link_type, u8 addr_type, __le32 value,
4967 u8 confirm_hint)
a5c29683
JH		 4968{
4969 struct mgmt_ev_user_confirm_request ev;
4970
744cf19e 4971 BT_DBG("%s", hdev->name);
a5c29683 4972
272d90df 4973 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 4974 ev.addr.type = link_to_bdaddr(link_type, addr_type);
55bc1a37 4975 ev.confirm_hint = confirm_hint;
78e8098e 4976 ev.value = value;
a5c29683 4977
744cf19e 4978 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
04124681 4979 NULL);
a5c29683
JH		 4980}
4981
272d90df 4982int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5 4983 u8 link_type, u8 addr_type)
604086b7
BG		 4984{
4985 struct mgmt_ev_user_passkey_request ev;
4986
4987 BT_DBG("%s", hdev->name);
4988
272d90df 4989 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 4990 ev.addr.type = link_to_bdaddr(link_type, addr_type);
604086b7
BG		 4991
4992 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
04124681 4993 NULL);
604086b7
BG		 4994}
4995
0df4c185 4996static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5
GP		 4997 u8 link_type, u8 addr_type, u8 status,
4998 u8 opcode)
a5c29683
JH		 4999{
5000 struct pending_cmd *cmd;
5001 struct mgmt_rp_user_confirm_reply rp;
5002 int err;
5003
2e58ef3e 5004 cmd = mgmt_pending_find(opcode, hdev);
a5c29683
JH		 5005 if (!cmd)
5006 return -ENOENT;
5007
272d90df 5008 bacpy(&rp.addr.bdaddr, bdaddr);
57c1477c 5009 rp.addr.type = link_to_bdaddr(link_type, addr_type);
aee9b218 5010 err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
04124681 5011 &rp, sizeof(rp));
a5c29683 5012
a664b5bc 5013 mgmt_pending_remove(cmd);
a5c29683
JH		 5014
5015 return err;
5016}
5017
744cf19e 5018int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 5019 u8 link_type, u8 addr_type, u8 status)
a5c29683 5020{
272d90df 5021 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 5022 status, MGMT_OP_USER_CONFIRM_REPLY);
a5c29683
JH		 5023}
5024
272d90df 5025int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 5026 u8 link_type, u8 addr_type, u8 status)
a5c29683 5027{
272d90df 5028 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 5029 status,
5030 MGMT_OP_USER_CONFIRM_NEG_REPLY);
a5c29683 5031}
2a611692 5032
604086b7 5033int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 5034 u8 link_type, u8 addr_type, u8 status)
604086b7 5035{
272d90df 5036 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 5037 status, MGMT_OP_USER_PASSKEY_REPLY);
604086b7
BG		 5038}
5039
272d90df 5040int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 5041 u8 link_type, u8 addr_type, u8 status)
604086b7 5042{
272d90df 5043 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 5044 status,
5045 MGMT_OP_USER_PASSKEY_NEG_REPLY);
604086b7
BG		 5046}
5047
92a25256
JH		 5048int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
5049 u8 link_type, u8 addr_type, u32 passkey,
5050 u8 entered)
5051{
5052 struct mgmt_ev_passkey_notify ev;
5053
5054 BT_DBG("%s", hdev->name);
5055
5056 bacpy(&ev.addr.bdaddr, bdaddr);
5057 ev.addr.type = link_to_bdaddr(link_type, addr_type);
5058 ev.passkey = __cpu_to_le32(passkey);
5059 ev.entered = entered;
5060
5061 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
5062}
5063
e546099c
MH		 5064void mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5065 u8 addr_type, u8 status)
2a611692
JH		 5066{
5067 struct mgmt_ev_auth_failed ev;
5068
bab73cb6 5069 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 5070 ev.addr.type = link_to_bdaddr(link_type, addr_type);
ca69b795 5071 ev.status = mgmt_status(status);
2a611692 5072
e546099c 5073 mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
2a611692 5074}
b312b161 5075
464996ae 5076void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
33ef95ed
JH		 5077{
5078 struct cmd_lookup match = { NULL, hdev };
464996ae 5079 bool changed;
33ef95ed
JH		 5080
5081 if (status) {
5082 u8 mgmt_err = mgmt_status(status);
5083 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
04124681 5084 cmd_status_rsp, &mgmt_err);
464996ae 5085 return;
33ef95ed
JH		 5086 }
5087
464996ae
MH		 5088 if (test_bit(HCI_AUTH, &hdev->flags))
5089 changed = !test_and_set_bit(HCI_LINK_SECURITY,
5090 &hdev->dev_flags);
5091 else
5092 changed = test_and_clear_bit(HCI_LINK_SECURITY,
5093 &hdev->dev_flags);
47990ea0 5094
33ef95ed 5095 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
04124681 5096 &match);
33ef95ed 5097
47990ea0 5098 if (changed)
464996ae 5099 new_settings(hdev, match.sk);
33ef95ed
JH		 5100
5101 if (match.sk)
5102 sock_put(match.sk);
33ef95ed
JH		 5103}
5104
890ea898 5105static void clear_eir(struct hci_request *req)
cacaf52f 5106{
890ea898 5107 struct hci_dev *hdev = req->hdev;
cacaf52f
JH		 5108 struct hci_cp_write_eir cp;
5109
976eb20e 5110 if (!lmp_ext_inq_capable(hdev))
890ea898 5111 return;
cacaf52f 5112
c80da27e
JH		 5113 memset(hdev->eir, 0, sizeof(hdev->eir));
5114
cacaf52f
JH		 5115 memset(&cp, 0, sizeof(cp));
5116
890ea898 5117 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
cacaf52f
JH		 5118}
5119
3e248560 5120void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
ed2c4ee3
JH		 5121{
5122 struct cmd_lookup match = { NULL, hdev };
890ea898 5123 struct hci_request req;
c0ecddc2 5124 bool changed = false;
ed2c4ee3
JH		 5125
5126 if (status) {
5127 u8 mgmt_err = mgmt_status(status);
c0ecddc2
JH		 5128
5129 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
9ecb3e24
MH		 5130 &hdev->dev_flags)) {
5131 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3e248560 5132 new_settings(hdev, NULL);
9ecb3e24 5133 }
c0ecddc2 5134
04124681
GP		 5135 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
5136 &mgmt_err);
3e248560 5137 return;
c0ecddc2
JH		 5138 }
5139
5140 if (enable) {
9ecb3e24 5141 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
c0ecddc2 5142 } else {
9ecb3e24
MH		 5143 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
5144 if (!changed)
5145 changed = test_and_clear_bit(HCI_HS_ENABLED,
5146 &hdev->dev_flags);
5147 else
5148 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
ed2c4ee3
JH		 5149 }
5150
5151 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
5152
c0ecddc2 5153 if (changed)
3e248560 5154 new_settings(hdev, match.sk);
ed2c4ee3 5155
5fc6ebb1 5156 if (match.sk)
ed2c4ee3
JH		 5157 sock_put(match.sk);
5158
890ea898
JH		 5159 hci_req_init(&req, hdev);
5160
5fc6ebb1 5161 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
890ea898 5162 update_eir(&req);
5fc6ebb1 5163 else
890ea898
JH		 5164 clear_eir(&req);
5165
5166 hci_req_run(&req, NULL);
ed2c4ee3
JH		 5167}
5168
eac83dc6
MH		 5169void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
5170{
5171 struct cmd_lookup match = { NULL, hdev };
5172 bool changed = false;
5173
5174 if (status) {
5175 u8 mgmt_err = mgmt_status(status);
5176
0ab04a9c
MH		 5177 if (enable) {
5178 if (test_and_clear_bit(HCI_SC_ENABLED,
5179 &hdev->dev_flags))
5180 new_settings(hdev, NULL);
5181 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
5182 }
eac83dc6
MH		 5183
5184 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
5185 cmd_status_rsp, &mgmt_err);
5186 return;
5187 }
5188
0ab04a9c 5189 if (enable) {
eac83dc6 5190 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
0ab04a9c 5191 } else {
eac83dc6 5192 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
0ab04a9c
MH		 5193 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
5194 }
eac83dc6
MH		 5195
5196 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
5197 settings_rsp, &match);
5198
5199 if (changed)
5200 new_settings(hdev, match.sk);
5201
5202 if (match.sk)
5203 sock_put(match.sk);
5204}
5205
92da6097 5206static void sk_lookup(struct pending_cmd *cmd, void *data)
90e70454
JH		 5207{
5208 struct cmd_lookup *match = data;
5209
90e70454
JH		 5210 if (match->sk == NULL) {
5211 match->sk = cmd->sk;
5212 sock_hold(match->sk);
5213 }
90e70454
JH		 5214}
5215
4e1b0245
MH		 5216void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
5217 u8 status)
7f9a903c 5218{
90e70454 5219 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7f9a903c 5220
92da6097
JH		 5221 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
5222 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
5223 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
90e70454
JH		 5224
5225 if (!status)
4e1b0245
MH		 5226 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
5227 NULL);
90e70454
JH		 5228
5229 if (match.sk)
5230 sock_put(match.sk);
7f9a903c
MH		 5231}
5232
7667da34 5233void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
b312b161 5234{
b312b161 5235 struct mgmt_cp_set_local_name ev;
13928971 5236 struct pending_cmd *cmd;
28cc7bde 5237
13928971 5238 if (status)
7667da34 5239 return;
b312b161
JH		 5240
5241 memset(&ev, 0, sizeof(ev));
5242 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
28cc7bde 5243 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
b312b161 5244
2e58ef3e 5245 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
13928971
JH		 5246 if (!cmd) {
5247 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
28cc7bde 5248
13928971
JH		 5249 /* If this is a HCI command related to powering on the
5250 * HCI dev don't send any mgmt signals.
5251 */
5252 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
7667da34 5253 return;
890ea898 5254 }
b312b161 5255
7667da34
MH		 5256 mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
5257 cmd ? cmd->sk : NULL);
b312b161 5258}
c35938b2 5259
4d2d2796
MH		 5260void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
5261 u8 *randomizer192, u8 *hash256,
5262 u8 *randomizer256, u8 status)
c35938b2
SJ		 5263{
5264 struct pending_cmd *cmd;
c35938b2 5265
744cf19e 5266 BT_DBG("%s status %u", hdev->name, status);
c35938b2 5267
2e58ef3e 5268 cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
c35938b2 5269 if (!cmd)
3edaf092 5270 return;
c35938b2
SJ		 5271
5272 if (status) {
3edaf092
MH		 5273 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5274 mgmt_status(status));
c35938b2 5275 } else {
4d2d2796
MH		 5276 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
5277 hash256 && randomizer256) {
5278 struct mgmt_rp_read_local_oob_ext_data rp;
5279
5280 memcpy(rp.hash192, hash192, sizeof(rp.hash192));
5281 memcpy(rp.randomizer192, randomizer192,
5282 sizeof(rp.randomizer192));
c35938b2 5283
4d2d2796
MH		 5284 memcpy(rp.hash256, hash256, sizeof(rp.hash256));
5285 memcpy(rp.randomizer256, randomizer256,
5286 sizeof(rp.randomizer256));
c35938b2 5287
4d2d2796
MH		 5288 cmd_complete(cmd->sk, hdev->id,
5289 MGMT_OP_READ_LOCAL_OOB_DATA, 0,
5290 &rp, sizeof(rp));
5291 } else {
5292 struct mgmt_rp_read_local_oob_data rp;
5293
5294 memcpy(rp.hash, hash192, sizeof(rp.hash));
5295 memcpy(rp.randomizer, randomizer192,
5296 sizeof(rp.randomizer));
5297
5298 cmd_complete(cmd->sk, hdev->id,
5299 MGMT_OP_READ_LOCAL_OOB_DATA, 0,
5300 &rp, sizeof(rp));
5301 }
c35938b2
SJ		 5302 }
5303
5304 mgmt_pending_remove(cmd);
c35938b2 5305}
e17acd40 5306
901801b9
MH		 5307void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5308 u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
5309 ssp, u8 *eir, u16 eir_len)
e17acd40 5310{
e319d2e7
JH		 5311 char buf[512];
5312 struct mgmt_ev_device_found *ev = (void *) buf;
1dc06093 5313 size_t ev_size;
e17acd40 5314
12602d0c 5315 if (!hci_discovery_active(hdev))
901801b9 5316 return;
12602d0c 5317
1dc06093
JH		 5318 /* Leave 5 bytes for a potential CoD field */
5319 if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
901801b9 5320 return;
7d262f86 5321
1dc06093
JH		 5322 memset(buf, 0, sizeof(buf));
5323
e319d2e7 5324 bacpy(&ev->addr.bdaddr, bdaddr);
57c1477c 5325 ev->addr.type = link_to_bdaddr(link_type, addr_type);
e319d2e7 5326 ev->rssi = rssi;
9a395a80 5327 if (cfm_name)
612dfce9 5328 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
388fc8fa 5329 if (!ssp)
612dfce9 5330 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
e17acd40 5331
1dc06093 5332 if (eir_len > 0)
e319d2e7 5333 memcpy(ev->eir, eir, eir_len);
e17acd40 5334
1dc06093
JH		 5335 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
5336 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
04124681 5337 dev_class, 3);
1dc06093 5338
eb55ef07 5339 ev->eir_len = cpu_to_le16(eir_len);
1dc06093 5340 ev_size = sizeof(*ev) + eir_len;
f8523598 5341
901801b9 5342 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
e17acd40 5343}
a88a9652 5344
9cf12aee
MH		 5345void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5346 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
a88a9652 5347{
b644ba33
JH		 5348 struct mgmt_ev_device_found *ev;
5349 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
5350 u16 eir_len;
a88a9652 5351
b644ba33 5352 ev = (struct mgmt_ev_device_found *) buf;
a88a9652 5353
b644ba33
JH		 5354 memset(buf, 0, sizeof(buf));
5355
5356 bacpy(&ev->addr.bdaddr, bdaddr);
57c1477c 5357 ev->addr.type = link_to_bdaddr(link_type, addr_type);
b644ba33
JH		 5358 ev->rssi = rssi;
5359
5360 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
04124681 5361 name_len);
b644ba33 5362
eb55ef07 5363 ev->eir_len = cpu_to_le16(eir_len);
a88a9652 5364
9cf12aee 5365 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
a88a9652 5366}
314b2381 5367
2f1e063b 5368void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
314b2381 5369{
f963e8e9 5370 struct mgmt_ev_discovering ev;
164a6e78
JH		 5371 struct pending_cmd *cmd;
5372
343fb145
AG		 5373 BT_DBG("%s discovering %u", hdev->name, discovering);
5374
164a6e78 5375 if (discovering)
2e58ef3e 5376 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
164a6e78 5377 else
2e58ef3e 5378 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
164a6e78
JH		 5379
5380 if (cmd != NULL) {
f808e166
JH		 5381 u8 type = hdev->discovery.type;
5382
04124681
GP		 5383 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
5384 sizeof(type));
164a6e78
JH		 5385 mgmt_pending_remove(cmd);
5386 }
5387
f963e8e9
JH		 5388 memset(&ev, 0, sizeof(ev));
5389 ev.type = hdev->discovery.type;
5390 ev.discovering = discovering;
5391
2f1e063b 5392 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
314b2381 5393}
5e762444 5394
88c1fe4b 5395int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
5e762444
AJ		 5396{
5397 struct pending_cmd *cmd;
5398 struct mgmt_ev_device_blocked ev;
5399
2e58ef3e 5400 cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
5e762444 5401
88c1fe4b
JH		 5402 bacpy(&ev.addr.bdaddr, bdaddr);
5403 ev.addr.type = type;
5e762444 5404
744cf19e 5405 return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
04124681 5406 cmd ? cmd->sk : NULL);
5e762444
AJ		 5407}
5408
88c1fe4b 5409int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
5e762444
AJ		 5410{
5411 struct pending_cmd *cmd;
5412 struct mgmt_ev_device_unblocked ev;
5413
2e58ef3e 5414 cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
5e762444 5415
88c1fe4b
JH		 5416 bacpy(&ev.addr.bdaddr, bdaddr);
5417 ev.addr.type = type;
5e762444 5418
744cf19e 5419 return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
04124681 5420 cmd ? cmd->sk : NULL);
5e762444 5421}
5976e608
MH		 5422
5423static void adv_enable_complete(struct hci_dev *hdev, u8 status)
5424{
5425 BT_DBG("%s status %u", hdev->name, status);
5426
5427 /* Clear the advertising mgmt setting if we failed to re-enable it */
5428 if (status) {
5429 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
a6d811ed 5430 new_settings(hdev, NULL);
5976e608
MH		 5431 }
5432}
5433
5434void mgmt_reenable_advertising(struct hci_dev *hdev)
5435{
5436 struct hci_request req;
5437
b145edcd 5438 if (hci_conn_num(hdev, LE_LINK) > 0)
5976e608
MH		 5439 return;
5440
5441 if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5442 return;
5443
5444 hci_req_init(&req, hdev);
5445 enable_advertising(&req);
5446
5447 /* If this fails we have no option but to let user space know
5448 * that we've disabled advertising.
5449 */
5450 if (hci_req_run(&req, adv_enable_complete) < 0) {
5451 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
a6d811ed 5452 new_settings(hdev, NULL);
5976e608
MH		 5453 }
5454}
Linux kernel - Deliverables
This page took 0.59502 seconds and 5 git commands to generate.