net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33
  34 #include "smp.h"
  35
  36 #define MGMT_VERSION    1
  37 #define MGMT_REVISION   4
  38
  39 static const u16 mgmt_commands[] = {
  40         MGMT_OP_READ_INDEX_LIST,
  41         MGMT_OP_READ_INFO,
  42         MGMT_OP_SET_POWERED,
  43         MGMT_OP_SET_DISCOVERABLE,
  44         MGMT_OP_SET_CONNECTABLE,
  45         MGMT_OP_SET_FAST_CONNECTABLE,
  46         MGMT_OP_SET_PAIRABLE,
  47         MGMT_OP_SET_LINK_SECURITY,
  48         MGMT_OP_SET_SSP,
  49         MGMT_OP_SET_HS,
  50         MGMT_OP_SET_LE,
  51         MGMT_OP_SET_DEV_CLASS,
  52         MGMT_OP_SET_LOCAL_NAME,
  53         MGMT_OP_ADD_UUID,
  54         MGMT_OP_REMOVE_UUID,
  55         MGMT_OP_LOAD_LINK_KEYS,
  56         MGMT_OP_LOAD_LONG_TERM_KEYS,
  57         MGMT_OP_DISCONNECT,
  58         MGMT_OP_GET_CONNECTIONS,
  59         MGMT_OP_PIN_CODE_REPLY,
  60         MGMT_OP_PIN_CODE_NEG_REPLY,
  61         MGMT_OP_SET_IO_CAPABILITY,
  62         MGMT_OP_PAIR_DEVICE,
  63         MGMT_OP_CANCEL_PAIR_DEVICE,
  64         MGMT_OP_UNPAIR_DEVICE,
  65         MGMT_OP_USER_CONFIRM_REPLY,
  66         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  67         MGMT_OP_USER_PASSKEY_REPLY,
  68         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  69         MGMT_OP_READ_LOCAL_OOB_DATA,
  70         MGMT_OP_ADD_REMOTE_OOB_DATA,
  71         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  72         MGMT_OP_START_DISCOVERY,
  73         MGMT_OP_STOP_DISCOVERY,
  74         MGMT_OP_CONFIRM_NAME,
  75         MGMT_OP_BLOCK_DEVICE,
  76         MGMT_OP_UNBLOCK_DEVICE,
  77         MGMT_OP_SET_DEVICE_ID,
  78         MGMT_OP_SET_ADVERTISING,
  79         MGMT_OP_SET_BREDR,
  80         MGMT_OP_SET_STATIC_ADDRESS,
  81         MGMT_OP_SET_SCAN_PARAMS,
  82 };
  83
  84 static const u16 mgmt_events[] = {
  85         MGMT_EV_CONTROLLER_ERROR,
  86         MGMT_EV_INDEX_ADDED,
  87         MGMT_EV_INDEX_REMOVED,
  88         MGMT_EV_NEW_SETTINGS,
  89         MGMT_EV_CLASS_OF_DEV_CHANGED,
  90         MGMT_EV_LOCAL_NAME_CHANGED,
  91         MGMT_EV_NEW_LINK_KEY,
  92         MGMT_EV_NEW_LONG_TERM_KEY,
  93         MGMT_EV_DEVICE_CONNECTED,
  94         MGMT_EV_DEVICE_DISCONNECTED,
  95         MGMT_EV_CONNECT_FAILED,
  96         MGMT_EV_PIN_CODE_REQUEST,
  97         MGMT_EV_USER_CONFIRM_REQUEST,
  98         MGMT_EV_USER_PASSKEY_REQUEST,
  99         MGMT_EV_AUTH_FAILED,
 100         MGMT_EV_DEVICE_FOUND,
 101         MGMT_EV_DISCOVERING,
 102         MGMT_EV_DEVICE_BLOCKED,
 103         MGMT_EV_DEVICE_UNBLOCKED,
 104         MGMT_EV_DEVICE_UNPAIRED,
 105         MGMT_EV_PASSKEY_NOTIFY,
 106 };
 107
 108 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 109
 110 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 111                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 112
 113 struct pending_cmd {
 114         struct list_head list;
 115         u16 opcode;
 116         int index;
 117         void *param;
 118         struct sock *sk;
 119         void *user_data;
 120 };
 121
 122 /* HCI to MGMT error code conversion table */
 123 static u8 mgmt_status_table[] = {
 124         MGMT_STATUS_SUCCESS,
 125         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 126         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 127         MGMT_STATUS_FAILED,             /* Hardware Failure */
 128         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 129         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 130         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 131         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 132         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 133         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 134         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 135         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 136         MGMT_STATUS_BUSY,               /* Command Disallowed */
 137         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 138         MGMT_STATUS_REJECTED,           /* Rejected Security */
 139         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 140         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 141         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 142         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 143         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 144         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 145         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 146         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 147         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 148         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 149         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 150         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 151         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 152         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 153         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 154         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 155         MGMT_STATUS_FAILED,             /* Unspecified Error */
 156         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 157         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 158         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 159         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 160         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 161         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 162         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 164         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 165         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 166         MGMT_STATUS_FAILED,             /* Transaction Collision */
 167         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 168         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 169         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 170         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 171         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 172         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 173         MGMT_STATUS_FAILED,             /* Slot Violation */
 174         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 175         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 176         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 177         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 178         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 179         MGMT_STATUS_BUSY,               /* Controller Busy */
 180         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 181         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 182         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 183         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 184         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 185 };
 186
 187 static u8 mgmt_status(u8 hci_status)
 188 {
 189         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 190                 return mgmt_status_table[hci_status];
 191
 192         return MGMT_STATUS_FAILED;
 193 }
 194
 195 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 196 {
 197         struct sk_buff *skb;
 198         struct mgmt_hdr *hdr;
 199         struct mgmt_ev_cmd_status *ev;
 200         int err;
 201
 202         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 203
 204         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 205         if (!skb)
 206                 return -ENOMEM;
 207
 208         hdr = (void *) skb_put(skb, sizeof(*hdr));
 209
 210         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 211         hdr->index = cpu_to_le16(index);
 212         hdr->len = cpu_to_le16(sizeof(*ev));
 213
 214         ev = (void *) skb_put(skb, sizeof(*ev));
 215         ev->status = status;
 216         ev->opcode = cpu_to_le16(cmd);
 217
 218         err = sock_queue_rcv_skb(sk, skb);
 219         if (err < 0)
 220                 kfree_skb(skb);
 221
 222         return err;
 223 }
 224
 225 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 226                         void *rp, size_t rp_len)
 227 {
 228         struct sk_buff *skb;
 229         struct mgmt_hdr *hdr;
 230         struct mgmt_ev_cmd_complete *ev;
 231         int err;
 232
 233         BT_DBG("sock %p", sk);
 234
 235         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 236         if (!skb)
 237                 return -ENOMEM;
 238
 239         hdr = (void *) skb_put(skb, sizeof(*hdr));
 240
 241         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 242         hdr->index = cpu_to_le16(index);
 243         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 244
 245         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 246         ev->opcode = cpu_to_le16(cmd);
 247         ev->status = status;
 248
 249         if (rp)
 250                 memcpy(ev->data, rp, rp_len);
 251
 252         err = sock_queue_rcv_skb(sk, skb);
 253         if (err < 0)
 254                 kfree_skb(skb);
 255
 256         return err;
 257 }
 258
 259 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 260                         u16 data_len)
 261 {
 262         struct mgmt_rp_read_version rp;
 263
 264         BT_DBG("sock %p", sk);
 265
 266         rp.version = MGMT_VERSION;
 267         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 268
 269         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 270                             sizeof(rp));
 271 }
 272
 273 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 274                          u16 data_len)
 275 {
 276         struct mgmt_rp_read_commands *rp;
 277         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 278         const u16 num_events = ARRAY_SIZE(mgmt_events);
 279         __le16 *opcode;
 280         size_t rp_size;
 281         int i, err;
 282
 283         BT_DBG("sock %p", sk);
 284
 285         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 286
 287         rp = kmalloc(rp_size, GFP_KERNEL);
 288         if (!rp)
 289                 return -ENOMEM;
 290
 291         rp->num_commands = __constant_cpu_to_le16(num_commands);
 292         rp->num_events = __constant_cpu_to_le16(num_events);
 293
 294         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 295                 put_unaligned_le16(mgmt_commands[i], opcode);
 296
 297         for (i = 0; i < num_events; i++, opcode++)
 298                 put_unaligned_le16(mgmt_events[i], opcode);
 299
 300         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 301                            rp_size);
 302         kfree(rp);
 303
 304         return err;
 305 }
 306
 307 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 308                            u16 data_len)
 309 {
 310         struct mgmt_rp_read_index_list *rp;
 311         struct hci_dev *d;
 312         size_t rp_len;
 313         u16 count;
 314         int err;
 315
 316         BT_DBG("sock %p", sk);
 317
 318         read_lock(&hci_dev_list_lock);
 319
 320         count = 0;
 321         list_for_each_entry(d, &hci_dev_list, list) {
 322                 if (d->dev_type == HCI_BREDR)
 323                         count++;
 324         }
 325
 326         rp_len = sizeof(*rp) + (2 * count);
 327         rp = kmalloc(rp_len, GFP_ATOMIC);
 328         if (!rp) {
 329                 read_unlock(&hci_dev_list_lock);
 330                 return -ENOMEM;
 331         }
 332
 333         count = 0;
 334         list_for_each_entry(d, &hci_dev_list, list) {
 335                 if (test_bit(HCI_SETUP, &d->dev_flags))
 336                         continue;
 337
 338                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 339                         continue;
 340
 341                 if (d->dev_type == HCI_BREDR) {
 342                         rp->index[count++] = cpu_to_le16(d->id);
 343                         BT_DBG("Added hci%u", d->id);
 344                 }
 345         }
 346
 347         rp->num_controllers = cpu_to_le16(count);
 348         rp_len = sizeof(*rp) + (2 * count);
 349
 350         read_unlock(&hci_dev_list_lock);
 351
 352         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 353                            rp_len);
 354
 355         kfree(rp);
 356
 357         return err;
 358 }
 359
 360 static u32 get_supported_settings(struct hci_dev *hdev)
 361 {
 362         u32 settings = 0;
 363
 364         settings |= MGMT_SETTING_POWERED;
 365         settings |= MGMT_SETTING_PAIRABLE;
 366
 367         if (lmp_bredr_capable(hdev)) {
 368                 settings |= MGMT_SETTING_CONNECTABLE;
 369                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 370                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 371                 settings |= MGMT_SETTING_DISCOVERABLE;
 372                 settings |= MGMT_SETTING_BREDR;
 373                 settings |= MGMT_SETTING_LINK_SECURITY;
 374
 375                 if (lmp_ssp_capable(hdev)) {
 376                         settings |= MGMT_SETTING_SSP;
 377                         settings |= MGMT_SETTING_HS;
 378                 }
 379         }
 380
 381         if (lmp_le_capable(hdev)) {
 382                 settings |= MGMT_SETTING_LE;
 383                 settings |= MGMT_SETTING_ADVERTISING;
 384         }
 385
 386         return settings;
 387 }
 388
 389 static u32 get_current_settings(struct hci_dev *hdev)
 390 {
 391         u32 settings = 0;
 392
 393         if (hdev_is_powered(hdev))
 394                 settings |= MGMT_SETTING_POWERED;
 395
 396         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 397                 settings |= MGMT_SETTING_CONNECTABLE;
 398
 399         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 400                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 401
 402         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 403                 settings |= MGMT_SETTING_DISCOVERABLE;
 404
 405         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 406                 settings |= MGMT_SETTING_PAIRABLE;
 407
 408         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 409                 settings |= MGMT_SETTING_BREDR;
 410
 411         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 412                 settings |= MGMT_SETTING_LE;
 413
 414         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 415                 settings |= MGMT_SETTING_LINK_SECURITY;
 416
 417         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 418                 settings |= MGMT_SETTING_SSP;
 419
 420         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 421                 settings |= MGMT_SETTING_HS;
 422
 423         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 424                 settings |= MGMT_SETTING_ADVERTISING;
 425
 426         return settings;
 427 }
 428
 429 #define PNP_INFO_SVCLASS_ID             0x1200
 430
 431 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 432 {
 433         u8 *ptr = data, *uuids_start = NULL;
 434         struct bt_uuid *uuid;
 435
 436         if (len < 4)
 437                 return ptr;
 438
 439         list_for_each_entry(uuid, &hdev->uuids, list) {
 440                 u16 uuid16;
 441
 442                 if (uuid->size != 16)
 443                         continue;
 444
 445                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 446                 if (uuid16 < 0x1100)
 447                         continue;
 448
 449                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 450                         continue;
 451
 452                 if (!uuids_start) {
 453                         uuids_start = ptr;
 454                         uuids_start[0] = 1;
 455                         uuids_start[1] = EIR_UUID16_ALL;
 456                         ptr += 2;
 457                 }
 458
 459                 /* Stop if not enough space to put next UUID */
 460                 if ((ptr - data) + sizeof(u16) > len) {
 461                         uuids_start[1] = EIR_UUID16_SOME;
 462                         break;
 463                 }
 464
 465                 *ptr++ = (uuid16 & 0x00ff);
 466                 *ptr++ = (uuid16 & 0xff00) >> 8;
 467                 uuids_start[0] += sizeof(uuid16);
 468         }
 469
 470         return ptr;
 471 }
 472
 473 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 474 {
 475         u8 *ptr = data, *uuids_start = NULL;
 476         struct bt_uuid *uuid;
 477
 478         if (len < 6)
 479                 return ptr;
 480
 481         list_for_each_entry(uuid, &hdev->uuids, list) {
 482                 if (uuid->size != 32)
 483                         continue;
 484
 485                 if (!uuids_start) {
 486                         uuids_start = ptr;
 487                         uuids_start[0] = 1;
 488                         uuids_start[1] = EIR_UUID32_ALL;
 489                         ptr += 2;
 490                 }
 491
 492                 /* Stop if not enough space to put next UUID */
 493                 if ((ptr - data) + sizeof(u32) > len) {
 494                         uuids_start[1] = EIR_UUID32_SOME;
 495                         break;
 496                 }
 497
 498                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 499                 ptr += sizeof(u32);
 500                 uuids_start[0] += sizeof(u32);
 501         }
 502
 503         return ptr;
 504 }
 505
 506 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 507 {
 508         u8 *ptr = data, *uuids_start = NULL;
 509         struct bt_uuid *uuid;
 510
 511         if (len < 18)
 512                 return ptr;
 513
 514         list_for_each_entry(uuid, &hdev->uuids, list) {
 515                 if (uuid->size != 128)
 516                         continue;
 517
 518                 if (!uuids_start) {
 519                         uuids_start = ptr;
 520                         uuids_start[0] = 1;
 521                         uuids_start[1] = EIR_UUID128_ALL;
 522                         ptr += 2;
 523                 }
 524
 525                 /* Stop if not enough space to put next UUID */
 526                 if ((ptr - data) + 16 > len) {
 527                         uuids_start[1] = EIR_UUID128_SOME;
 528                         break;
 529                 }
 530
 531                 memcpy(ptr, uuid->uuid, 16);
 532                 ptr += 16;
 533                 uuids_start[0] += 16;
 534         }
 535
 536         return ptr;
 537 }
 538
 539 static u8 create_ad(struct hci_dev *hdev, u8 *ptr)
 540 {
 541         u8 ad_len = 0, flags = 0;
 542         size_t name_len;
 543
 544         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 545                 flags |= LE_AD_GENERAL;
 546
 547         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
 548                 if (lmp_le_br_capable(hdev))
 549                         flags |= LE_AD_SIM_LE_BREDR_CTRL;
 550                 if (lmp_host_le_br_capable(hdev))
 551                         flags |= LE_AD_SIM_LE_BREDR_HOST;
 552         } else {
 553                 flags |= LE_AD_NO_BREDR;
 554         }
 555
 556         if (flags) {
 557                 BT_DBG("adv flags 0x%02x", flags);
 558
 559                 ptr[0] = 2;
 560                 ptr[1] = EIR_FLAGS;
 561                 ptr[2] = flags;
 562
 563                 ad_len += 3;
 564                 ptr += 3;
 565         }
 566
 567         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 568                 ptr[0] = 2;
 569                 ptr[1] = EIR_TX_POWER;
 570                 ptr[2] = (u8) hdev->adv_tx_power;
 571
 572                 ad_len += 3;
 573                 ptr += 3;
 574         }
 575
 576         name_len = strlen(hdev->dev_name);
 577         if (name_len > 0) {
 578                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 579
 580                 if (name_len > max_len) {
 581                         name_len = max_len;
 582                         ptr[1] = EIR_NAME_SHORT;
 583                 } else
 584                         ptr[1] = EIR_NAME_COMPLETE;
 585
 586                 ptr[0] = name_len + 1;
 587
 588                 memcpy(ptr + 2, hdev->dev_name, name_len);
 589
 590                 ad_len += (name_len + 2);
 591                 ptr += (name_len + 2);
 592         }
 593
 594         return ad_len;
 595 }
 596
 597 static void update_ad(struct hci_request *req)
 598 {
 599         struct hci_dev *hdev = req->hdev;
 600         struct hci_cp_le_set_adv_data cp;
 601         u8 len;
 602
 603         if (!lmp_le_capable(hdev))
 604                 return;
 605
 606         memset(&cp, 0, sizeof(cp));
 607
 608         len = create_ad(hdev, cp.data);
 609
 610         if (hdev->adv_data_len == len &&
 611             memcmp(cp.data, hdev->adv_data, len) == 0)
 612                 return;
 613
 614         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 615         hdev->adv_data_len = len;
 616
 617         cp.length = len;
 618
 619         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 620 }
 621
 622 static void create_eir(struct hci_dev *hdev, u8 *data)
 623 {
 624         u8 *ptr = data;
 625         size_t name_len;
 626
 627         name_len = strlen(hdev->dev_name);
 628
 629         if (name_len > 0) {
 630                 /* EIR Data type */
 631                 if (name_len > 48) {
 632                         name_len = 48;
 633                         ptr[1] = EIR_NAME_SHORT;
 634                 } else
 635                         ptr[1] = EIR_NAME_COMPLETE;
 636
 637                 /* EIR Data length */
 638                 ptr[0] = name_len + 1;
 639
 640                 memcpy(ptr + 2, hdev->dev_name, name_len);
 641
 642                 ptr += (name_len + 2);
 643         }
 644
 645         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 646                 ptr[0] = 2;
 647                 ptr[1] = EIR_TX_POWER;
 648                 ptr[2] = (u8) hdev->inq_tx_power;
 649
 650                 ptr += 3;
 651         }
 652
 653         if (hdev->devid_source > 0) {
 654                 ptr[0] = 9;
 655                 ptr[1] = EIR_DEVICE_ID;
 656
 657                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 658                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 659                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 660                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 661
 662                 ptr += 10;
 663         }
 664
 665         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 666         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 667         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 668 }
 669
 670 static void update_eir(struct hci_request *req)
 671 {
 672         struct hci_dev *hdev = req->hdev;
 673         struct hci_cp_write_eir cp;
 674
 675         if (!hdev_is_powered(hdev))
 676                 return;
 677
 678         if (!lmp_ext_inq_capable(hdev))
 679                 return;
 680
 681         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 682                 return;
 683
 684         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 685                 return;
 686
 687         memset(&cp, 0, sizeof(cp));
 688
 689         create_eir(hdev, cp.data);
 690
 691         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 692                 return;
 693
 694         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 695
 696         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 697 }
 698
 699 static u8 get_service_classes(struct hci_dev *hdev)
 700 {
 701         struct bt_uuid *uuid;
 702         u8 val = 0;
 703
 704         list_for_each_entry(uuid, &hdev->uuids, list)
 705                 val |= uuid->svc_hint;
 706
 707         return val;
 708 }
 709
 710 static void update_class(struct hci_request *req)
 711 {
 712         struct hci_dev *hdev = req->hdev;
 713         u8 cod[3];
 714
 715         BT_DBG("%s", hdev->name);
 716
 717         if (!hdev_is_powered(hdev))
 718                 return;
 719
 720         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 721                 return;
 722
 723         cod[0] = hdev->minor_class;
 724         cod[1] = hdev->major_class;
 725         cod[2] = get_service_classes(hdev);
 726
 727         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 728                 cod[1] |= 0x20;
 729
 730         if (memcmp(cod, hdev->dev_class, 3) == 0)
 731                 return;
 732
 733         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 734 }
 735
 736 static void service_cache_off(struct work_struct *work)
 737 {
 738         struct hci_dev *hdev = container_of(work, struct hci_dev,
 739                                             service_cache.work);
 740         struct hci_request req;
 741
 742         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 743                 return;
 744
 745         hci_req_init(&req, hdev);
 746
 747         hci_dev_lock(hdev);
 748
 749         update_eir(&req);
 750         update_class(&req);
 751
 752         hci_dev_unlock(hdev);
 753
 754         hci_req_run(&req, NULL);
 755 }
 756
 757 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 758 {
 759         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 760                 return;
 761
 762         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 763
 764         /* Non-mgmt controlled devices get this bit set
 765          * implicitly so that pairing works for them, however
 766          * for mgmt we require user-space to explicitly enable
 767          * it
 768          */
 769         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 770 }
 771
 772 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 773                                 void *data, u16 data_len)
 774 {
 775         struct mgmt_rp_read_info rp;
 776
 777         BT_DBG("sock %p %s", sk, hdev->name);
 778
 779         hci_dev_lock(hdev);
 780
 781         memset(&rp, 0, sizeof(rp));
 782
 783         bacpy(&rp.bdaddr, &hdev->bdaddr);
 784
 785         rp.version = hdev->hci_ver;
 786         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 787
 788         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 789         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 790
 791         memcpy(rp.dev_class, hdev->dev_class, 3);
 792
 793         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 794         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 795
 796         hci_dev_unlock(hdev);
 797
 798         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 799                             sizeof(rp));
 800 }
 801
 802 static void mgmt_pending_free(struct pending_cmd *cmd)
 803 {
 804         sock_put(cmd->sk);
 805         kfree(cmd->param);
 806         kfree(cmd);
 807 }
 808
 809 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 810                                             struct hci_dev *hdev, void *data,
 811                                             u16 len)
 812 {
 813         struct pending_cmd *cmd;
 814
 815         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 816         if (!cmd)
 817                 return NULL;
 818
 819         cmd->opcode = opcode;
 820         cmd->index = hdev->id;
 821
 822         cmd->param = kmalloc(len, GFP_KERNEL);
 823         if (!cmd->param) {
 824                 kfree(cmd);
 825                 return NULL;
 826         }
 827
 828         if (data)
 829                 memcpy(cmd->param, data, len);
 830
 831         cmd->sk = sk;
 832         sock_hold(sk);
 833
 834         list_add(&cmd->list, &hdev->mgmt_pending);
 835
 836         return cmd;
 837 }
 838
 839 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 840                                  void (*cb)(struct pending_cmd *cmd,
 841                                             void *data),
 842                                  void *data)
 843 {
 844         struct pending_cmd *cmd, *tmp;
 845
 846         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 847                 if (opcode > 0 && cmd->opcode != opcode)
 848                         continue;
 849
 850                 cb(cmd, data);
 851         }
 852 }
 853
 854 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 855 {
 856         struct pending_cmd *cmd;
 857
 858         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 859                 if (cmd->opcode == opcode)
 860                         return cmd;
 861         }
 862
 863         return NULL;
 864 }
 865
 866 static void mgmt_pending_remove(struct pending_cmd *cmd)
 867 {
 868         list_del(&cmd->list);
 869         mgmt_pending_free(cmd);
 870 }
 871
 872 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 873 {
 874         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 875
 876         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 877                             sizeof(settings));
 878 }
 879
 880 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 881                        u16 len)
 882 {
 883         struct mgmt_mode *cp = data;
 884         struct pending_cmd *cmd;
 885         int err;
 886
 887         BT_DBG("request for %s", hdev->name);
 888
 889         if (cp->val != 0x00 && cp->val != 0x01)
 890                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 891                                   MGMT_STATUS_INVALID_PARAMS);
 892
 893         hci_dev_lock(hdev);
 894
 895         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 896                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 897                                  MGMT_STATUS_BUSY);
 898                 goto failed;
 899         }
 900
 901         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 902                 cancel_delayed_work(&hdev->power_off);
 903
 904                 if (cp->val) {
 905                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 906                                          data, len);
 907                         err = mgmt_powered(hdev, 1);
 908                         goto failed;
 909                 }
 910         }
 911
 912         if (!!cp->val == hdev_is_powered(hdev)) {
 913                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 914                 goto failed;
 915         }
 916
 917         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 918         if (!cmd) {
 919                 err = -ENOMEM;
 920                 goto failed;
 921         }
 922
 923         if (cp->val)
 924                 queue_work(hdev->req_workqueue, &hdev->power_on);
 925         else
 926                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 927
 928         err = 0;
 929
 930 failed:
 931         hci_dev_unlock(hdev);
 932         return err;
 933 }
 934
 935 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 936                       struct sock *skip_sk)
 937 {
 938         struct sk_buff *skb;
 939         struct mgmt_hdr *hdr;
 940
 941         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 942         if (!skb)
 943                 return -ENOMEM;
 944
 945         hdr = (void *) skb_put(skb, sizeof(*hdr));
 946         hdr->opcode = cpu_to_le16(event);
 947         if (hdev)
 948                 hdr->index = cpu_to_le16(hdev->id);
 949         else
 950                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 951         hdr->len = cpu_to_le16(data_len);
 952
 953         if (data)
 954                 memcpy(skb_put(skb, data_len), data, data_len);
 955
 956         /* Time stamp */
 957         __net_timestamp(skb);
 958
 959         hci_send_to_control(skb, skip_sk);
 960         kfree_skb(skb);
 961
 962         return 0;
 963 }
 964
 965 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 966 {
 967         __le32 ev;
 968
 969         ev = cpu_to_le32(get_current_settings(hdev));
 970
 971         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 972 }
 973
 974 struct cmd_lookup {
 975         struct sock *sk;
 976         struct hci_dev *hdev;
 977         u8 mgmt_status;
 978 };
 979
 980 static void settings_rsp(struct pending_cmd *cmd, void *data)
 981 {
 982         struct cmd_lookup *match = data;
 983
 984         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
 985
 986         list_del(&cmd->list);
 987
 988         if (match->sk == NULL) {
 989                 match->sk = cmd->sk;
 990                 sock_hold(match->sk);
 991         }
 992
 993         mgmt_pending_free(cmd);
 994 }
 995
 996 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
 997 {
 998         u8 *status = data;
 999
1000         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1001         mgmt_pending_remove(cmd);
1002 }
1003
1004 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1005 {
1006         if (!lmp_bredr_capable(hdev))
1007                 return MGMT_STATUS_NOT_SUPPORTED;
1008         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1009                 return MGMT_STATUS_REJECTED;
1010         else
1011                 return MGMT_STATUS_SUCCESS;
1012 }
1013
1014 static u8 mgmt_le_support(struct hci_dev *hdev)
1015 {
1016         if (!lmp_le_capable(hdev))
1017                 return MGMT_STATUS_NOT_SUPPORTED;
1018         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1019                 return MGMT_STATUS_REJECTED;
1020         else
1021                 return MGMT_STATUS_SUCCESS;
1022 }
1023
1024 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1025 {
1026         struct pending_cmd *cmd;
1027         struct mgmt_mode *cp;
1028         bool changed;
1029
1030         BT_DBG("status 0x%02x", status);
1031
1032         hci_dev_lock(hdev);
1033
1034         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1035         if (!cmd)
1036                 goto unlock;
1037
1038         if (status) {
1039                 u8 mgmt_err = mgmt_status(status);
1040                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1041                 goto remove_cmd;
1042         }
1043
1044         cp = cmd->param;
1045         if (cp->val)
1046                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1047                                             &hdev->dev_flags);
1048         else
1049                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1050                                              &hdev->dev_flags);
1051
1052         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1053
1054         if (changed)
1055                 new_settings(hdev, cmd->sk);
1056
1057 remove_cmd:
1058         mgmt_pending_remove(cmd);
1059
1060 unlock:
1061         hci_dev_unlock(hdev);
1062 }
1063
1064 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1065                             u16 len)
1066 {
1067         struct mgmt_cp_set_discoverable *cp = data;
1068         struct pending_cmd *cmd;
1069         struct hci_request req;
1070         u16 timeout;
1071         u8 scan, status;
1072         int err;
1073
1074         BT_DBG("request for %s", hdev->name);
1075
1076         status = mgmt_bredr_support(hdev);
1077         if (status)
1078                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1079                                   status);
1080
1081         if (cp->val != 0x00 && cp->val != 0x01)
1082                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1083                                   MGMT_STATUS_INVALID_PARAMS);
1084
1085         timeout = __le16_to_cpu(cp->timeout);
1086         if (!cp->val && timeout > 0)
1087                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1088                                   MGMT_STATUS_INVALID_PARAMS);
1089
1090         hci_dev_lock(hdev);
1091
1092         if (!hdev_is_powered(hdev) && timeout > 0) {
1093                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1094                                  MGMT_STATUS_NOT_POWERED);
1095                 goto failed;
1096         }
1097
1098         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1099             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1100                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1101                                  MGMT_STATUS_BUSY);
1102                 goto failed;
1103         }
1104
1105         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1106                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1107                                  MGMT_STATUS_REJECTED);
1108                 goto failed;
1109         }
1110
1111         if (!hdev_is_powered(hdev)) {
1112                 bool changed = false;
1113
1114                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1115                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1116                         changed = true;
1117                 }
1118
1119                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1120                 if (err < 0)
1121                         goto failed;
1122
1123                 if (changed)
1124                         err = new_settings(hdev, sk);
1125
1126                 goto failed;
1127         }
1128
1129         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1130                 if (hdev->discov_timeout > 0) {
1131                         cancel_delayed_work(&hdev->discov_off);
1132                         hdev->discov_timeout = 0;
1133                 }
1134
1135                 if (cp->val && timeout > 0) {
1136                         hdev->discov_timeout = timeout;
1137                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1138                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
1139                 }
1140
1141                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1142                 goto failed;
1143         }
1144
1145         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1146         if (!cmd) {
1147                 err = -ENOMEM;
1148                 goto failed;
1149         }
1150
1151         hci_req_init(&req, hdev);
1152
1153         scan = SCAN_PAGE;
1154
1155         if (cp->val)
1156                 scan |= SCAN_INQUIRY;
1157         else
1158                 cancel_delayed_work(&hdev->discov_off);
1159
1160         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1161
1162         err = hci_req_run(&req, set_discoverable_complete);
1163         if (err < 0)
1164                 mgmt_pending_remove(cmd);
1165
1166         if (cp->val)
1167                 hdev->discov_timeout = timeout;
1168
1169 failed:
1170         hci_dev_unlock(hdev);
1171         return err;
1172 }
1173
1174 static void write_fast_connectable(struct hci_request *req, bool enable)
1175 {
1176         struct hci_dev *hdev = req->hdev;
1177         struct hci_cp_write_page_scan_activity acp;
1178         u8 type;
1179
1180         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1181                 return;
1182
1183         if (enable) {
1184                 type = PAGE_SCAN_TYPE_INTERLACED;
1185
1186                 /* 160 msec page scan interval */
1187                 acp.interval = __constant_cpu_to_le16(0x0100);
1188         } else {
1189                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1190
1191                 /* default 1.28 sec page scan */
1192                 acp.interval = __constant_cpu_to_le16(0x0800);
1193         }
1194
1195         acp.window = __constant_cpu_to_le16(0x0012);
1196
1197         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1198             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1199                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1200                             sizeof(acp), &acp);
1201
1202         if (hdev->page_scan_type != type)
1203                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1204 }
1205
1206 static u8 get_adv_type(struct hci_dev *hdev)
1207 {
1208         struct pending_cmd *cmd;
1209         bool connectable;
1210
1211         /* If there's a pending mgmt command the flag will not yet have
1212          * it's final value, so check for this first.
1213          */
1214         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1215         if (cmd) {
1216                 struct mgmt_mode *cp = cmd->param;
1217                 connectable = !!cp->val;
1218         } else {
1219                 connectable = test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1220         }
1221
1222         return connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1223 }
1224
1225 static void enable_advertising(struct hci_request *req)
1226 {
1227         struct hci_dev *hdev = req->hdev;
1228         struct hci_cp_le_set_adv_param cp;
1229         u8 enable = 0x01;
1230
1231         memset(&cp, 0, sizeof(cp));
1232         cp.min_interval = __constant_cpu_to_le16(0x0800);
1233         cp.max_interval = __constant_cpu_to_le16(0x0800);
1234         cp.type = get_adv_type(hdev);
1235         if (bacmp(&hdev->bdaddr, BDADDR_ANY))
1236                 cp.own_address_type = ADDR_LE_DEV_PUBLIC;
1237         else
1238                 cp.own_address_type = ADDR_LE_DEV_RANDOM;
1239         cp.channel_map = 0x07;
1240
1241         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1242
1243         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1244 }
1245
1246 static void disable_advertising(struct hci_request *req)
1247 {
1248         u8 enable = 0x00;
1249
1250         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1251 }
1252
1253 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1254 {
1255         struct pending_cmd *cmd;
1256         struct mgmt_mode *cp;
1257         bool changed;
1258
1259         BT_DBG("status 0x%02x", status);
1260
1261         hci_dev_lock(hdev);
1262
1263         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1264         if (!cmd)
1265                 goto unlock;
1266
1267         if (status) {
1268                 u8 mgmt_err = mgmt_status(status);
1269                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1270                 goto remove_cmd;
1271         }
1272
1273         cp = cmd->param;
1274         if (cp->val)
1275                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1276         else
1277                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1278
1279         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1280
1281         if (changed)
1282                 new_settings(hdev, cmd->sk);
1283
1284 remove_cmd:
1285         mgmt_pending_remove(cmd);
1286
1287 unlock:
1288         hci_dev_unlock(hdev);
1289 }
1290
1291 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1292                            u16 len)
1293 {
1294         struct mgmt_mode *cp = data;
1295         struct pending_cmd *cmd;
1296         struct hci_request req;
1297         u8 scan;
1298         int err;
1299
1300         BT_DBG("request for %s", hdev->name);
1301
1302         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1303             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1304                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1305                                   MGMT_STATUS_REJECTED);
1306
1307         if (cp->val != 0x00 && cp->val != 0x01)
1308                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1309                                   MGMT_STATUS_INVALID_PARAMS);
1310
1311         hci_dev_lock(hdev);
1312
1313         if (!hdev_is_powered(hdev)) {
1314                 bool changed = false;
1315
1316                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1317                         changed = true;
1318
1319                 if (cp->val) {
1320                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1321                 } else {
1322                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1323                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1324                 }
1325
1326                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1327                 if (err < 0)
1328                         goto failed;
1329
1330                 if (changed)
1331                         err = new_settings(hdev, sk);
1332
1333                 goto failed;
1334         }
1335
1336         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1337             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1338                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1339                                  MGMT_STATUS_BUSY);
1340                 goto failed;
1341         }
1342
1343         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1344         if (!cmd) {
1345                 err = -ENOMEM;
1346                 goto failed;
1347         }
1348
1349         hci_req_init(&req, hdev);
1350
1351         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
1352             cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1353                 if (cp->val) {
1354                         scan = SCAN_PAGE;
1355                 } else {
1356                         scan = 0;
1357
1358                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1359                             hdev->discov_timeout > 0)
1360                                 cancel_delayed_work(&hdev->discov_off);
1361                 }
1362
1363                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1364         }
1365
1366         /* If we're going from non-connectable to connectable or
1367          * vice-versa when fast connectable is enabled ensure that fast
1368          * connectable gets disabled. write_fast_connectable won't do
1369          * anything if the page scan parameters are already what they
1370          * should be.
1371          */
1372         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1373                 write_fast_connectable(&req, false);
1374
1375         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) &&
1376             hci_conn_num(hdev, LE_LINK) == 0) {
1377                 disable_advertising(&req);
1378                 enable_advertising(&req);
1379         }
1380
1381         err = hci_req_run(&req, set_connectable_complete);
1382         if (err < 0) {
1383                 mgmt_pending_remove(cmd);
1384                 if (err == -ENODATA)
1385                         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE,
1386                                                 hdev);
1387                 goto failed;
1388         }
1389
1390 failed:
1391         hci_dev_unlock(hdev);
1392         return err;
1393 }
1394
1395 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1396                         u16 len)
1397 {
1398         struct mgmt_mode *cp = data;
1399         bool changed;
1400         int err;
1401
1402         BT_DBG("request for %s", hdev->name);
1403
1404         if (cp->val != 0x00 && cp->val != 0x01)
1405                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1406                                   MGMT_STATUS_INVALID_PARAMS);
1407
1408         hci_dev_lock(hdev);
1409
1410         if (cp->val)
1411                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1412         else
1413                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1414
1415         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1416         if (err < 0)
1417                 goto unlock;
1418
1419         if (changed)
1420                 err = new_settings(hdev, sk);
1421
1422 unlock:
1423         hci_dev_unlock(hdev);
1424         return err;
1425 }
1426
1427 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1428                              u16 len)
1429 {
1430         struct mgmt_mode *cp = data;
1431         struct pending_cmd *cmd;
1432         u8 val, status;
1433         int err;
1434
1435         BT_DBG("request for %s", hdev->name);
1436
1437         status = mgmt_bredr_support(hdev);
1438         if (status)
1439                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1440                                   status);
1441
1442         if (cp->val != 0x00 && cp->val != 0x01)
1443                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1444                                   MGMT_STATUS_INVALID_PARAMS);
1445
1446         hci_dev_lock(hdev);
1447
1448         if (!hdev_is_powered(hdev)) {
1449                 bool changed = false;
1450
1451                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1452                                           &hdev->dev_flags)) {
1453                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1454                         changed = true;
1455                 }
1456
1457                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1458                 if (err < 0)
1459                         goto failed;
1460
1461                 if (changed)
1462                         err = new_settings(hdev, sk);
1463
1464                 goto failed;
1465         }
1466
1467         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1468                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1469                                  MGMT_STATUS_BUSY);
1470                 goto failed;
1471         }
1472
1473         val = !!cp->val;
1474
1475         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1476                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1477                 goto failed;
1478         }
1479
1480         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1481         if (!cmd) {
1482                 err = -ENOMEM;
1483                 goto failed;
1484         }
1485
1486         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1487         if (err < 0) {
1488                 mgmt_pending_remove(cmd);
1489                 goto failed;
1490         }
1491
1492 failed:
1493         hci_dev_unlock(hdev);
1494         return err;
1495 }
1496
1497 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1498 {
1499         struct mgmt_mode *cp = data;
1500         struct pending_cmd *cmd;
1501         u8 status;
1502         int err;
1503
1504         BT_DBG("request for %s", hdev->name);
1505
1506         status = mgmt_bredr_support(hdev);
1507         if (status)
1508                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1509
1510         if (!lmp_ssp_capable(hdev))
1511                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1512                                   MGMT_STATUS_NOT_SUPPORTED);
1513
1514         if (cp->val != 0x00 && cp->val != 0x01)
1515                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1516                                   MGMT_STATUS_INVALID_PARAMS);
1517
1518         hci_dev_lock(hdev);
1519
1520         if (!hdev_is_powered(hdev)) {
1521                 bool changed;
1522
1523                 if (cp->val) {
1524                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
1525                                                     &hdev->dev_flags);
1526                 } else {
1527                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
1528                                                      &hdev->dev_flags);
1529                         if (!changed)
1530                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
1531                                                              &hdev->dev_flags);
1532                         else
1533                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1534                 }
1535
1536                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1537                 if (err < 0)
1538                         goto failed;
1539
1540                 if (changed)
1541                         err = new_settings(hdev, sk);
1542
1543                 goto failed;
1544         }
1545
1546         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
1547             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
1548                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1549                                  MGMT_STATUS_BUSY);
1550                 goto failed;
1551         }
1552
1553         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1554                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1555                 goto failed;
1556         }
1557
1558         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1559         if (!cmd) {
1560                 err = -ENOMEM;
1561                 goto failed;
1562         }
1563
1564         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1565         if (err < 0) {
1566                 mgmt_pending_remove(cmd);
1567                 goto failed;
1568         }
1569
1570 failed:
1571         hci_dev_unlock(hdev);
1572         return err;
1573 }
1574
1575 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1576 {
1577         struct mgmt_mode *cp = data;
1578         bool changed;
1579         u8 status;
1580         int err;
1581
1582         BT_DBG("request for %s", hdev->name);
1583
1584         status = mgmt_bredr_support(hdev);
1585         if (status)
1586                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1587
1588         if (!lmp_ssp_capable(hdev))
1589                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1590                                   MGMT_STATUS_NOT_SUPPORTED);
1591
1592         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
1593                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1594                                   MGMT_STATUS_REJECTED);
1595
1596         if (cp->val != 0x00 && cp->val != 0x01)
1597                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1598                                   MGMT_STATUS_INVALID_PARAMS);
1599
1600         hci_dev_lock(hdev);
1601
1602         if (cp->val) {
1603                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1604         } else {
1605                 if (hdev_is_powered(hdev)) {
1606                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1607                                          MGMT_STATUS_REJECTED);
1608                         goto unlock;
1609                 }
1610
1611                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1612         }
1613
1614         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1615         if (err < 0)
1616                 goto unlock;
1617
1618         if (changed)
1619                 err = new_settings(hdev, sk);
1620
1621 unlock:
1622         hci_dev_unlock(hdev);
1623         return err;
1624 }
1625
1626 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1627 {
1628         struct cmd_lookup match = { NULL, hdev };
1629
1630         if (status) {
1631                 u8 mgmt_err = mgmt_status(status);
1632
1633                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1634                                      &mgmt_err);
1635                 return;
1636         }
1637
1638         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1639
1640         new_settings(hdev, match.sk);
1641
1642         if (match.sk)
1643                 sock_put(match.sk);
1644
1645         /* Make sure the controller has a good default for
1646          * advertising data. Restrict the update to when LE
1647          * has actually been enabled. During power on, the
1648          * update in powered_update_hci will take care of it.
1649          */
1650         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1651                 struct hci_request req;
1652
1653                 hci_dev_lock(hdev);
1654
1655                 hci_req_init(&req, hdev);
1656                 update_ad(&req);
1657                 hci_req_run(&req, NULL);
1658
1659                 hci_dev_unlock(hdev);
1660         }
1661 }
1662
1663 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1664 {
1665         struct mgmt_mode *cp = data;
1666         struct hci_cp_write_le_host_supported hci_cp;
1667         struct pending_cmd *cmd;
1668         struct hci_request req;
1669         int err;
1670         u8 val, enabled;
1671
1672         BT_DBG("request for %s", hdev->name);
1673
1674         if (!lmp_le_capable(hdev))
1675                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1676                                   MGMT_STATUS_NOT_SUPPORTED);
1677
1678         if (cp->val != 0x00 && cp->val != 0x01)
1679                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1680                                   MGMT_STATUS_INVALID_PARAMS);
1681
1682         /* LE-only devices do not allow toggling LE on/off */
1683         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1684                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1685                                   MGMT_STATUS_REJECTED);
1686
1687         hci_dev_lock(hdev);
1688
1689         val = !!cp->val;
1690         enabled = lmp_host_le_capable(hdev);
1691
1692         if (!hdev_is_powered(hdev) || val == enabled) {
1693                 bool changed = false;
1694
1695                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1696                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1697                         changed = true;
1698                 }
1699
1700                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
1701                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1702                         changed = true;
1703                 }
1704
1705                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1706                 if (err < 0)
1707                         goto unlock;
1708
1709                 if (changed)
1710                         err = new_settings(hdev, sk);
1711
1712                 goto unlock;
1713         }
1714
1715         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1716             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1717                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1718                                  MGMT_STATUS_BUSY);
1719                 goto unlock;
1720         }
1721
1722         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1723         if (!cmd) {
1724                 err = -ENOMEM;
1725                 goto unlock;
1726         }
1727
1728         hci_req_init(&req, hdev);
1729
1730         memset(&hci_cp, 0, sizeof(hci_cp));
1731
1732         if (val) {
1733                 hci_cp.le = val;
1734                 hci_cp.simul = lmp_le_br_capable(hdev);
1735         } else {
1736                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1737                         disable_advertising(&req);
1738         }
1739
1740         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1741                     &hci_cp);
1742
1743         err = hci_req_run(&req, le_enable_complete);
1744         if (err < 0)
1745                 mgmt_pending_remove(cmd);
1746
1747 unlock:
1748         hci_dev_unlock(hdev);
1749         return err;
1750 }
1751
1752 /* This is a helper function to test for pending mgmt commands that can
1753  * cause CoD or EIR HCI commands. We can only allow one such pending
1754  * mgmt command at a time since otherwise we cannot easily track what
1755  * the current values are, will be, and based on that calculate if a new
1756  * HCI command needs to be sent and if yes with what value.
1757  */
1758 static bool pending_eir_or_class(struct hci_dev *hdev)
1759 {
1760         struct pending_cmd *cmd;
1761
1762         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1763                 switch (cmd->opcode) {
1764                 case MGMT_OP_ADD_UUID:
1765                 case MGMT_OP_REMOVE_UUID:
1766                 case MGMT_OP_SET_DEV_CLASS:
1767                 case MGMT_OP_SET_POWERED:
1768                         return true;
1769                 }
1770         }
1771
1772         return false;
1773 }
1774
1775 static const u8 bluetooth_base_uuid[] = {
1776                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1777                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1778 };
1779
1780 static u8 get_uuid_size(const u8 *uuid)
1781 {
1782         u32 val;
1783
1784         if (memcmp(uuid, bluetooth_base_uuid, 12))
1785                 return 128;
1786
1787         val = get_unaligned_le32(&uuid[12]);
1788         if (val > 0xffff)
1789                 return 32;
1790
1791         return 16;
1792 }
1793
1794 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1795 {
1796         struct pending_cmd *cmd;
1797
1798         hci_dev_lock(hdev);
1799
1800         cmd = mgmt_pending_find(mgmt_op, hdev);
1801         if (!cmd)
1802                 goto unlock;
1803
1804         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1805                      hdev->dev_class, 3);
1806
1807         mgmt_pending_remove(cmd);
1808
1809 unlock:
1810         hci_dev_unlock(hdev);
1811 }
1812
1813 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1814 {
1815         BT_DBG("status 0x%02x", status);
1816
1817         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1818 }
1819
1820 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1821 {
1822         struct mgmt_cp_add_uuid *cp = data;
1823         struct pending_cmd *cmd;
1824         struct hci_request req;
1825         struct bt_uuid *uuid;
1826         int err;
1827
1828         BT_DBG("request for %s", hdev->name);
1829
1830         hci_dev_lock(hdev);
1831
1832         if (pending_eir_or_class(hdev)) {
1833                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1834                                  MGMT_STATUS_BUSY);
1835                 goto failed;
1836         }
1837
1838         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1839         if (!uuid) {
1840                 err = -ENOMEM;
1841                 goto failed;
1842         }
1843
1844         memcpy(uuid->uuid, cp->uuid, 16);
1845         uuid->svc_hint = cp->svc_hint;
1846         uuid->size = get_uuid_size(cp->uuid);
1847
1848         list_add_tail(&uuid->list, &hdev->uuids);
1849
1850         hci_req_init(&req, hdev);
1851
1852         update_class(&req);
1853         update_eir(&req);
1854
1855         err = hci_req_run(&req, add_uuid_complete);
1856         if (err < 0) {
1857                 if (err != -ENODATA)
1858                         goto failed;
1859
1860                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1861                                    hdev->dev_class, 3);
1862                 goto failed;
1863         }
1864
1865         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1866         if (!cmd) {
1867                 err = -ENOMEM;
1868                 goto failed;
1869         }
1870
1871         err = 0;
1872
1873 failed:
1874         hci_dev_unlock(hdev);
1875         return err;
1876 }
1877
1878 static bool enable_service_cache(struct hci_dev *hdev)
1879 {
1880         if (!hdev_is_powered(hdev))
1881                 return false;
1882
1883         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1884                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1885                                    CACHE_TIMEOUT);
1886                 return true;
1887         }
1888
1889         return false;
1890 }
1891
1892 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1893 {
1894         BT_DBG("status 0x%02x", status);
1895
1896         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1897 }
1898
1899 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1900                        u16 len)
1901 {
1902         struct mgmt_cp_remove_uuid *cp = data;
1903         struct pending_cmd *cmd;
1904         struct bt_uuid *match, *tmp;
1905         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1906         struct hci_request req;
1907         int err, found;
1908
1909         BT_DBG("request for %s", hdev->name);
1910
1911         hci_dev_lock(hdev);
1912
1913         if (pending_eir_or_class(hdev)) {
1914                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1915                                  MGMT_STATUS_BUSY);
1916                 goto unlock;
1917         }
1918
1919         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1920                 err = hci_uuids_clear(hdev);
1921
1922                 if (enable_service_cache(hdev)) {
1923                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1924                                            0, hdev->dev_class, 3);
1925                         goto unlock;
1926                 }
1927
1928                 goto update_class;
1929         }
1930
1931         found = 0;
1932
1933         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1934                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1935                         continue;
1936
1937                 list_del(&match->list);
1938                 kfree(match);
1939                 found++;
1940         }
1941
1942         if (found == 0) {
1943                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1944                                  MGMT_STATUS_INVALID_PARAMS);
1945                 goto unlock;
1946         }
1947
1948 update_class:
1949         hci_req_init(&req, hdev);
1950
1951         update_class(&req);
1952         update_eir(&req);
1953
1954         err = hci_req_run(&req, remove_uuid_complete);
1955         if (err < 0) {
1956                 if (err != -ENODATA)
1957                         goto unlock;
1958
1959                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1960                                    hdev->dev_class, 3);
1961                 goto unlock;
1962         }
1963
1964         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1965         if (!cmd) {
1966                 err = -ENOMEM;
1967                 goto unlock;
1968         }
1969
1970         err = 0;
1971
1972 unlock:
1973         hci_dev_unlock(hdev);
1974         return err;
1975 }
1976
1977 static void set_class_complete(struct hci_dev *hdev, u8 status)
1978 {
1979         BT_DBG("status 0x%02x", status);
1980
1981         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1982 }
1983
1984 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1985                          u16 len)
1986 {
1987         struct mgmt_cp_set_dev_class *cp = data;
1988         struct pending_cmd *cmd;
1989         struct hci_request req;
1990         int err;
1991
1992         BT_DBG("request for %s", hdev->name);
1993
1994         if (!lmp_bredr_capable(hdev))
1995                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1996                                   MGMT_STATUS_NOT_SUPPORTED);
1997
1998         hci_dev_lock(hdev);
1999
2000         if (pending_eir_or_class(hdev)) {
2001                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2002                                  MGMT_STATUS_BUSY);
2003                 goto unlock;
2004         }
2005
2006         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2007                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2008                                  MGMT_STATUS_INVALID_PARAMS);
2009                 goto unlock;
2010         }
2011
2012         hdev->major_class = cp->major;
2013         hdev->minor_class = cp->minor;
2014
2015         if (!hdev_is_powered(hdev)) {
2016                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2017                                    hdev->dev_class, 3);
2018                 goto unlock;
2019         }
2020
2021         hci_req_init(&req, hdev);
2022
2023         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2024                 hci_dev_unlock(hdev);
2025                 cancel_delayed_work_sync(&hdev->service_cache);
2026                 hci_dev_lock(hdev);
2027                 update_eir(&req);
2028         }
2029
2030         update_class(&req);
2031
2032         err = hci_req_run(&req, set_class_complete);
2033         if (err < 0) {
2034                 if (err != -ENODATA)
2035                         goto unlock;
2036
2037                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2038                                    hdev->dev_class, 3);
2039                 goto unlock;
2040         }
2041
2042         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2043         if (!cmd) {
2044                 err = -ENOMEM;
2045                 goto unlock;
2046         }
2047
2048         err = 0;
2049
2050 unlock:
2051         hci_dev_unlock(hdev);
2052         return err;
2053 }
2054
2055 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2056                           u16 len)
2057 {
2058         struct mgmt_cp_load_link_keys *cp = data;
2059         u16 key_count, expected_len;
2060         int i;
2061
2062         BT_DBG("request for %s", hdev->name);
2063
2064         if (!lmp_bredr_capable(hdev))
2065                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2066                                   MGMT_STATUS_NOT_SUPPORTED);
2067
2068         key_count = __le16_to_cpu(cp->key_count);
2069
2070         expected_len = sizeof(*cp) + key_count *
2071                                         sizeof(struct mgmt_link_key_info);
2072         if (expected_len != len) {
2073                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2074                        len, expected_len);
2075                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2076                                   MGMT_STATUS_INVALID_PARAMS);
2077         }
2078
2079         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2080                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2081                                   MGMT_STATUS_INVALID_PARAMS);
2082
2083         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2084                key_count);
2085
2086         for (i = 0; i < key_count; i++) {
2087                 struct mgmt_link_key_info *key = &cp->keys[i];
2088
2089                 if (key->addr.type != BDADDR_BREDR)
2090                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2091                                           MGMT_STATUS_INVALID_PARAMS);
2092         }
2093
2094         hci_dev_lock(hdev);
2095
2096         hci_link_keys_clear(hdev);
2097
2098         if (cp->debug_keys)
2099                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2100         else
2101                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2102
2103         for (i = 0; i < key_count; i++) {
2104                 struct mgmt_link_key_info *key = &cp->keys[i];
2105
2106                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
2107                                  key->type, key->pin_len);
2108         }
2109
2110         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2111
2112         hci_dev_unlock(hdev);
2113
2114         return 0;
2115 }
2116
2117 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2118                            u8 addr_type, struct sock *skip_sk)
2119 {
2120         struct mgmt_ev_device_unpaired ev;
2121
2122         bacpy(&ev.addr.bdaddr, bdaddr);
2123         ev.addr.type = addr_type;
2124
2125         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2126                           skip_sk);
2127 }
2128
2129 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2130                          u16 len)
2131 {
2132         struct mgmt_cp_unpair_device *cp = data;
2133         struct mgmt_rp_unpair_device rp;
2134         struct hci_cp_disconnect dc;
2135         struct pending_cmd *cmd;
2136         struct hci_conn *conn;
2137         int err;
2138
2139         memset(&rp, 0, sizeof(rp));
2140         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2141         rp.addr.type = cp->addr.type;
2142
2143         if (!bdaddr_type_is_valid(cp->addr.type))
2144                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2145                                     MGMT_STATUS_INVALID_PARAMS,
2146                                     &rp, sizeof(rp));
2147
2148         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2149                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2150                                     MGMT_STATUS_INVALID_PARAMS,
2151                                     &rp, sizeof(rp));
2152
2153         hci_dev_lock(hdev);
2154
2155         if (!hdev_is_powered(hdev)) {
2156                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2157                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2158                 goto unlock;
2159         }
2160
2161         if (cp->addr.type == BDADDR_BREDR)
2162                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2163         else
2164                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
2165
2166         if (err < 0) {
2167                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2168                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2169                 goto unlock;
2170         }
2171
2172         if (cp->disconnect) {
2173                 if (cp->addr.type == BDADDR_BREDR)
2174                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2175                                                        &cp->addr.bdaddr);
2176                 else
2177                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2178                                                        &cp->addr.bdaddr);
2179         } else {
2180                 conn = NULL;
2181         }
2182
2183         if (!conn) {
2184                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2185                                    &rp, sizeof(rp));
2186                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2187                 goto unlock;
2188         }
2189
2190         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2191                                sizeof(*cp));
2192         if (!cmd) {
2193                 err = -ENOMEM;
2194                 goto unlock;
2195         }
2196
2197         dc.handle = cpu_to_le16(conn->handle);
2198         dc.reason = 0x13; /* Remote User Terminated Connection */
2199         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2200         if (err < 0)
2201                 mgmt_pending_remove(cmd);
2202
2203 unlock:
2204         hci_dev_unlock(hdev);
2205         return err;
2206 }
2207
2208 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2209                       u16 len)
2210 {
2211         struct mgmt_cp_disconnect *cp = data;
2212         struct mgmt_rp_disconnect rp;
2213         struct hci_cp_disconnect dc;
2214         struct pending_cmd *cmd;
2215         struct hci_conn *conn;
2216         int err;
2217
2218         BT_DBG("");
2219
2220         memset(&rp, 0, sizeof(rp));
2221         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2222         rp.addr.type = cp->addr.type;
2223
2224         if (!bdaddr_type_is_valid(cp->addr.type))
2225                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2226                                     MGMT_STATUS_INVALID_PARAMS,
2227                                     &rp, sizeof(rp));
2228
2229         hci_dev_lock(hdev);
2230
2231         if (!test_bit(HCI_UP, &hdev->flags)) {
2232                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2233                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2234                 goto failed;
2235         }
2236
2237         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2238                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2239                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2240                 goto failed;
2241         }
2242
2243         if (cp->addr.type == BDADDR_BREDR)
2244                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2245                                                &cp->addr.bdaddr);
2246         else
2247                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2248
2249         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2250                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2251                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2252                 goto failed;
2253         }
2254
2255         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2256         if (!cmd) {
2257                 err = -ENOMEM;
2258                 goto failed;
2259         }
2260
2261         dc.handle = cpu_to_le16(conn->handle);
2262         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2263
2264         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2265         if (err < 0)
2266                 mgmt_pending_remove(cmd);
2267
2268 failed:
2269         hci_dev_unlock(hdev);
2270         return err;
2271 }
2272
2273 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2274 {
2275         switch (link_type) {
2276         case LE_LINK:
2277                 switch (addr_type) {
2278                 case ADDR_LE_DEV_PUBLIC:
2279                         return BDADDR_LE_PUBLIC;
2280
2281                 default:
2282                         /* Fallback to LE Random address type */
2283                         return BDADDR_LE_RANDOM;
2284                 }
2285
2286         default:
2287                 /* Fallback to BR/EDR type */
2288                 return BDADDR_BREDR;
2289         }
2290 }
2291
2292 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2293                            u16 data_len)
2294 {
2295         struct mgmt_rp_get_connections *rp;
2296         struct hci_conn *c;
2297         size_t rp_len;
2298         int err;
2299         u16 i;
2300
2301         BT_DBG("");
2302
2303         hci_dev_lock(hdev);
2304
2305         if (!hdev_is_powered(hdev)) {
2306                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2307                                  MGMT_STATUS_NOT_POWERED);
2308                 goto unlock;
2309         }
2310
2311         i = 0;
2312         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2313                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2314                         i++;
2315         }
2316
2317         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2318         rp = kmalloc(rp_len, GFP_KERNEL);
2319         if (!rp) {
2320                 err = -ENOMEM;
2321                 goto unlock;
2322         }
2323
2324         i = 0;
2325         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2326                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2327                         continue;
2328                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2329                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2330                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2331                         continue;
2332                 i++;
2333         }
2334
2335         rp->conn_count = cpu_to_le16(i);
2336
2337         /* Recalculate length in case of filtered SCO connections, etc */
2338         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2339
2340         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2341                            rp_len);
2342
2343         kfree(rp);
2344
2345 unlock:
2346         hci_dev_unlock(hdev);
2347         return err;
2348 }
2349
2350 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2351                                    struct mgmt_cp_pin_code_neg_reply *cp)
2352 {
2353         struct pending_cmd *cmd;
2354         int err;
2355
2356         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2357                                sizeof(*cp));
2358         if (!cmd)
2359                 return -ENOMEM;
2360
2361         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2362                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2363         if (err < 0)
2364                 mgmt_pending_remove(cmd);
2365
2366         return err;
2367 }
2368
2369 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2370                           u16 len)
2371 {
2372         struct hci_conn *conn;
2373         struct mgmt_cp_pin_code_reply *cp = data;
2374         struct hci_cp_pin_code_reply reply;
2375         struct pending_cmd *cmd;
2376         int err;
2377
2378         BT_DBG("");
2379
2380         hci_dev_lock(hdev);
2381
2382         if (!hdev_is_powered(hdev)) {
2383                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2384                                  MGMT_STATUS_NOT_POWERED);
2385                 goto failed;
2386         }
2387
2388         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2389         if (!conn) {
2390                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2391                                  MGMT_STATUS_NOT_CONNECTED);
2392                 goto failed;
2393         }
2394
2395         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2396                 struct mgmt_cp_pin_code_neg_reply ncp;
2397
2398                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2399
2400                 BT_ERR("PIN code is not 16 bytes long");
2401
2402                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2403                 if (err >= 0)
2404                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2405                                          MGMT_STATUS_INVALID_PARAMS);
2406
2407                 goto failed;
2408         }
2409
2410         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2411         if (!cmd) {
2412                 err = -ENOMEM;
2413                 goto failed;
2414         }
2415
2416         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2417         reply.pin_len = cp->pin_len;
2418         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2419
2420         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2421         if (err < 0)
2422                 mgmt_pending_remove(cmd);
2423
2424 failed:
2425         hci_dev_unlock(hdev);
2426         return err;
2427 }
2428
2429 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2430                              u16 len)
2431 {
2432         struct mgmt_cp_set_io_capability *cp = data;
2433
2434         BT_DBG("");
2435
2436         hci_dev_lock(hdev);
2437
2438         hdev->io_capability = cp->io_capability;
2439
2440         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2441                hdev->io_capability);
2442
2443         hci_dev_unlock(hdev);
2444
2445         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2446                             0);
2447 }
2448
2449 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2450 {
2451         struct hci_dev *hdev = conn->hdev;
2452         struct pending_cmd *cmd;
2453
2454         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2455                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2456                         continue;
2457
2458                 if (cmd->user_data != conn)
2459                         continue;
2460
2461                 return cmd;
2462         }
2463
2464         return NULL;
2465 }
2466
2467 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2468 {
2469         struct mgmt_rp_pair_device rp;
2470         struct hci_conn *conn = cmd->user_data;
2471
2472         bacpy(&rp.addr.bdaddr, &conn->dst);
2473         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2474
2475         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2476                      &rp, sizeof(rp));
2477
2478         /* So we don't get further callbacks for this connection */
2479         conn->connect_cfm_cb = NULL;
2480         conn->security_cfm_cb = NULL;
2481         conn->disconn_cfm_cb = NULL;
2482
2483         hci_conn_drop(conn);
2484
2485         mgmt_pending_remove(cmd);
2486 }
2487
2488 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2489 {
2490         struct pending_cmd *cmd;
2491
2492         BT_DBG("status %u", status);
2493
2494         cmd = find_pairing(conn);
2495         if (!cmd)
2496                 BT_DBG("Unable to find a pending command");
2497         else
2498                 pairing_complete(cmd, mgmt_status(status));
2499 }
2500
2501 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2502 {
2503         struct pending_cmd *cmd;
2504
2505         BT_DBG("status %u", status);
2506
2507         if (!status)
2508                 return;
2509
2510         cmd = find_pairing(conn);
2511         if (!cmd)
2512                 BT_DBG("Unable to find a pending command");
2513         else
2514                 pairing_complete(cmd, mgmt_status(status));
2515 }
2516
2517 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2518                        u16 len)
2519 {
2520         struct mgmt_cp_pair_device *cp = data;
2521         struct mgmt_rp_pair_device rp;
2522         struct pending_cmd *cmd;
2523         u8 sec_level, auth_type;
2524         struct hci_conn *conn;
2525         int err;
2526
2527         BT_DBG("");
2528
2529         memset(&rp, 0, sizeof(rp));
2530         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2531         rp.addr.type = cp->addr.type;
2532
2533         if (!bdaddr_type_is_valid(cp->addr.type))
2534                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2535                                     MGMT_STATUS_INVALID_PARAMS,
2536                                     &rp, sizeof(rp));
2537
2538         hci_dev_lock(hdev);
2539
2540         if (!hdev_is_powered(hdev)) {
2541                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2542                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2543                 goto unlock;
2544         }
2545
2546         sec_level = BT_SECURITY_MEDIUM;
2547         if (cp->io_cap == 0x03)
2548                 auth_type = HCI_AT_DEDICATED_BONDING;
2549         else
2550                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2551
2552         if (cp->addr.type == BDADDR_BREDR)
2553                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2554                                    cp->addr.type, sec_level, auth_type);
2555         else
2556                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2557                                    cp->addr.type, sec_level, auth_type);
2558
2559         if (IS_ERR(conn)) {
2560                 int status;
2561
2562                 if (PTR_ERR(conn) == -EBUSY)
2563                         status = MGMT_STATUS_BUSY;
2564                 else
2565                         status = MGMT_STATUS_CONNECT_FAILED;
2566
2567                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2568                                    status, &rp,
2569                                    sizeof(rp));
2570                 goto unlock;
2571         }
2572
2573         if (conn->connect_cfm_cb) {
2574                 hci_conn_drop(conn);
2575                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2576                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2577                 goto unlock;
2578         }
2579
2580         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2581         if (!cmd) {
2582                 err = -ENOMEM;
2583                 hci_conn_drop(conn);
2584                 goto unlock;
2585         }
2586
2587         /* For LE, just connecting isn't a proof that the pairing finished */
2588         if (cp->addr.type == BDADDR_BREDR)
2589                 conn->connect_cfm_cb = pairing_complete_cb;
2590         else
2591                 conn->connect_cfm_cb = le_connect_complete_cb;
2592
2593         conn->security_cfm_cb = pairing_complete_cb;
2594         conn->disconn_cfm_cb = pairing_complete_cb;
2595         conn->io_capability = cp->io_cap;
2596         cmd->user_data = conn;
2597
2598         if (conn->state == BT_CONNECTED &&
2599             hci_conn_security(conn, sec_level, auth_type))
2600                 pairing_complete(cmd, 0);
2601
2602         err = 0;
2603
2604 unlock:
2605         hci_dev_unlock(hdev);
2606         return err;
2607 }
2608
2609 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2610                               u16 len)
2611 {
2612         struct mgmt_addr_info *addr = data;
2613         struct pending_cmd *cmd;
2614         struct hci_conn *conn;
2615         int err;
2616
2617         BT_DBG("");
2618
2619         hci_dev_lock(hdev);
2620
2621         if (!hdev_is_powered(hdev)) {
2622                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2623                                  MGMT_STATUS_NOT_POWERED);
2624                 goto unlock;
2625         }
2626
2627         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2628         if (!cmd) {
2629                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2630                                  MGMT_STATUS_INVALID_PARAMS);
2631                 goto unlock;
2632         }
2633
2634         conn = cmd->user_data;
2635
2636         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2637                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2638                                  MGMT_STATUS_INVALID_PARAMS);
2639                 goto unlock;
2640         }
2641
2642         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2643
2644         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2645                            addr, sizeof(*addr));
2646 unlock:
2647         hci_dev_unlock(hdev);
2648         return err;
2649 }
2650
2651 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2652                              struct mgmt_addr_info *addr, u16 mgmt_op,
2653                              u16 hci_op, __le32 passkey)
2654 {
2655         struct pending_cmd *cmd;
2656         struct hci_conn *conn;
2657         int err;
2658
2659         hci_dev_lock(hdev);
2660
2661         if (!hdev_is_powered(hdev)) {
2662                 err = cmd_complete(sk, hdev->id, mgmt_op,
2663                                    MGMT_STATUS_NOT_POWERED, addr,
2664                                    sizeof(*addr));
2665                 goto done;
2666         }
2667
2668         if (addr->type == BDADDR_BREDR)
2669                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2670         else
2671                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2672
2673         if (!conn) {
2674                 err = cmd_complete(sk, hdev->id, mgmt_op,
2675                                    MGMT_STATUS_NOT_CONNECTED, addr,
2676                                    sizeof(*addr));
2677                 goto done;
2678         }
2679
2680         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2681                 /* Continue with pairing via SMP */
2682                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2683
2684                 if (!err)
2685                         err = cmd_complete(sk, hdev->id, mgmt_op,
2686                                            MGMT_STATUS_SUCCESS, addr,
2687                                            sizeof(*addr));
2688                 else
2689                         err = cmd_complete(sk, hdev->id, mgmt_op,
2690                                            MGMT_STATUS_FAILED, addr,
2691                                            sizeof(*addr));
2692
2693                 goto done;
2694         }
2695
2696         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2697         if (!cmd) {
2698                 err = -ENOMEM;
2699                 goto done;
2700         }
2701
2702         /* Continue with pairing via HCI */
2703         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2704                 struct hci_cp_user_passkey_reply cp;
2705
2706                 bacpy(&cp.bdaddr, &addr->bdaddr);
2707                 cp.passkey = passkey;
2708                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2709         } else
2710                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2711                                    &addr->bdaddr);
2712
2713         if (err < 0)
2714                 mgmt_pending_remove(cmd);
2715
2716 done:
2717         hci_dev_unlock(hdev);
2718         return err;
2719 }
2720
2721 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2722                               void *data, u16 len)
2723 {
2724         struct mgmt_cp_pin_code_neg_reply *cp = data;
2725
2726         BT_DBG("");
2727
2728         return user_pairing_resp(sk, hdev, &cp->addr,
2729                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2730                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2731 }
2732
2733 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2734                               u16 len)
2735 {
2736         struct mgmt_cp_user_confirm_reply *cp = data;
2737
2738         BT_DBG("");
2739
2740         if (len != sizeof(*cp))
2741                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2742                                   MGMT_STATUS_INVALID_PARAMS);
2743
2744         return user_pairing_resp(sk, hdev, &cp->addr,
2745                                  MGMT_OP_USER_CONFIRM_REPLY,
2746                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2747 }
2748
2749 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2750                                   void *data, u16 len)
2751 {
2752         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2753
2754         BT_DBG("");
2755
2756         return user_pairing_resp(sk, hdev, &cp->addr,
2757                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2758                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2759 }
2760
2761 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2762                               u16 len)
2763 {
2764         struct mgmt_cp_user_passkey_reply *cp = data;
2765
2766         BT_DBG("");
2767
2768         return user_pairing_resp(sk, hdev, &cp->addr,
2769                                  MGMT_OP_USER_PASSKEY_REPLY,
2770                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2771 }
2772
2773 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2774                                   void *data, u16 len)
2775 {
2776         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2777
2778         BT_DBG("");
2779
2780         return user_pairing_resp(sk, hdev, &cp->addr,
2781                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2782                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2783 }
2784
2785 static void update_name(struct hci_request *req)
2786 {
2787         struct hci_dev *hdev = req->hdev;
2788         struct hci_cp_write_local_name cp;
2789
2790         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2791
2792         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2793 }
2794
2795 static void set_name_complete(struct hci_dev *hdev, u8 status)
2796 {
2797         struct mgmt_cp_set_local_name *cp;
2798         struct pending_cmd *cmd;
2799
2800         BT_DBG("status 0x%02x", status);
2801
2802         hci_dev_lock(hdev);
2803
2804         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2805         if (!cmd)
2806                 goto unlock;
2807
2808         cp = cmd->param;
2809
2810         if (status)
2811                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2812                            mgmt_status(status));
2813         else
2814                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2815                              cp, sizeof(*cp));
2816
2817         mgmt_pending_remove(cmd);
2818
2819 unlock:
2820         hci_dev_unlock(hdev);
2821 }
2822
2823 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2824                           u16 len)
2825 {
2826         struct mgmt_cp_set_local_name *cp = data;
2827         struct pending_cmd *cmd;
2828         struct hci_request req;
2829         int err;
2830
2831         BT_DBG("");
2832
2833         hci_dev_lock(hdev);
2834
2835         /* If the old values are the same as the new ones just return a
2836          * direct command complete event.
2837          */
2838         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2839             !memcmp(hdev->short_name, cp->short_name,
2840                     sizeof(hdev->short_name))) {
2841                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2842                                    data, len);
2843                 goto failed;
2844         }
2845
2846         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2847
2848         if (!hdev_is_powered(hdev)) {
2849                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2850
2851                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2852                                    data, len);
2853                 if (err < 0)
2854                         goto failed;
2855
2856                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2857                                  sk);
2858
2859                 goto failed;
2860         }
2861
2862         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2863         if (!cmd) {
2864                 err = -ENOMEM;
2865                 goto failed;
2866         }
2867
2868         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2869
2870         hci_req_init(&req, hdev);
2871
2872         if (lmp_bredr_capable(hdev)) {
2873                 update_name(&req);
2874                 update_eir(&req);
2875         }
2876
2877         if (lmp_le_capable(hdev))
2878                 update_ad(&req);
2879
2880         err = hci_req_run(&req, set_name_complete);
2881         if (err < 0)
2882                 mgmt_pending_remove(cmd);
2883
2884 failed:
2885         hci_dev_unlock(hdev);
2886         return err;
2887 }
2888
2889 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2890                                void *data, u16 data_len)
2891 {
2892         struct pending_cmd *cmd;
2893         int err;
2894
2895         BT_DBG("%s", hdev->name);
2896
2897         hci_dev_lock(hdev);
2898
2899         if (!hdev_is_powered(hdev)) {
2900                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2901                                  MGMT_STATUS_NOT_POWERED);
2902                 goto unlock;
2903         }
2904
2905         if (!lmp_ssp_capable(hdev)) {
2906                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2907                                  MGMT_STATUS_NOT_SUPPORTED);
2908                 goto unlock;
2909         }
2910
2911         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2912                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2913                                  MGMT_STATUS_BUSY);
2914                 goto unlock;
2915         }
2916
2917         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2918         if (!cmd) {
2919                 err = -ENOMEM;
2920                 goto unlock;
2921         }
2922
2923         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2924         if (err < 0)
2925                 mgmt_pending_remove(cmd);
2926
2927 unlock:
2928         hci_dev_unlock(hdev);
2929         return err;
2930 }
2931
2932 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2933                                void *data, u16 len)
2934 {
2935         struct mgmt_cp_add_remote_oob_data *cp = data;
2936         u8 status;
2937         int err;
2938
2939         BT_DBG("%s ", hdev->name);
2940
2941         hci_dev_lock(hdev);
2942
2943         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2944                                       cp->randomizer);
2945         if (err < 0)
2946                 status = MGMT_STATUS_FAILED;
2947         else
2948                 status = MGMT_STATUS_SUCCESS;
2949
2950         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2951                            &cp->addr, sizeof(cp->addr));
2952
2953         hci_dev_unlock(hdev);
2954         return err;
2955 }
2956
2957 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2958                                   void *data, u16 len)
2959 {
2960         struct mgmt_cp_remove_remote_oob_data *cp = data;
2961         u8 status;
2962         int err;
2963
2964         BT_DBG("%s", hdev->name);
2965
2966         hci_dev_lock(hdev);
2967
2968         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2969         if (err < 0)
2970                 status = MGMT_STATUS_INVALID_PARAMS;
2971         else
2972                 status = MGMT_STATUS_SUCCESS;
2973
2974         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2975                            status, &cp->addr, sizeof(cp->addr));
2976
2977         hci_dev_unlock(hdev);
2978         return err;
2979 }
2980
2981 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2982 {
2983         struct pending_cmd *cmd;
2984         u8 type;
2985         int err;
2986
2987         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2988
2989         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2990         if (!cmd)
2991                 return -ENOENT;
2992
2993         type = hdev->discovery.type;
2994
2995         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2996                            &type, sizeof(type));
2997         mgmt_pending_remove(cmd);
2998
2999         return err;
3000 }
3001
3002 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3003 {
3004         BT_DBG("status %d", status);
3005
3006         if (status) {
3007                 hci_dev_lock(hdev);
3008                 mgmt_start_discovery_failed(hdev, status);
3009                 hci_dev_unlock(hdev);
3010                 return;
3011         }
3012
3013         hci_dev_lock(hdev);
3014         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3015         hci_dev_unlock(hdev);
3016
3017         switch (hdev->discovery.type) {
3018         case DISCOV_TYPE_LE:
3019                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
3020                                    DISCOV_LE_TIMEOUT);
3021                 break;
3022
3023         case DISCOV_TYPE_INTERLEAVED:
3024                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
3025                                    DISCOV_INTERLEAVED_TIMEOUT);
3026                 break;
3027
3028         case DISCOV_TYPE_BREDR:
3029                 break;
3030
3031         default:
3032                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3033         }
3034 }
3035
3036 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3037                            void *data, u16 len)
3038 {
3039         struct mgmt_cp_start_discovery *cp = data;
3040         struct pending_cmd *cmd;
3041         struct hci_cp_le_set_scan_param param_cp;
3042         struct hci_cp_le_set_scan_enable enable_cp;
3043         struct hci_cp_inquiry inq_cp;
3044         struct hci_request req;
3045         /* General inquiry access code (GIAC) */
3046         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3047         u8 status;
3048         int err;
3049
3050         BT_DBG("%s", hdev->name);
3051
3052         hci_dev_lock(hdev);
3053
3054         if (!hdev_is_powered(hdev)) {
3055                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3056                                  MGMT_STATUS_NOT_POWERED);
3057                 goto failed;
3058         }
3059
3060         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3061                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3062                                  MGMT_STATUS_BUSY);
3063                 goto failed;
3064         }
3065
3066         if (hdev->discovery.state != DISCOVERY_STOPPED) {
3067                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3068                                  MGMT_STATUS_BUSY);
3069                 goto failed;
3070         }
3071
3072         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3073         if (!cmd) {
3074                 err = -ENOMEM;
3075                 goto failed;
3076         }
3077
3078         hdev->discovery.type = cp->type;
3079
3080         hci_req_init(&req, hdev);
3081
3082         switch (hdev->discovery.type) {
3083         case DISCOV_TYPE_BREDR:
3084                 status = mgmt_bredr_support(hdev);
3085                 if (status) {
3086                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3087                                          status);
3088                         mgmt_pending_remove(cmd);
3089                         goto failed;
3090                 }
3091
3092                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3093                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3094                                          MGMT_STATUS_BUSY);
3095                         mgmt_pending_remove(cmd);
3096                         goto failed;
3097                 }
3098
3099                 hci_inquiry_cache_flush(hdev);
3100
3101                 memset(&inq_cp, 0, sizeof(inq_cp));
3102                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3103                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3104                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3105                 break;
3106
3107         case DISCOV_TYPE_LE:
3108         case DISCOV_TYPE_INTERLEAVED:
3109                 status = mgmt_le_support(hdev);
3110                 if (status) {
3111                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3112                                          status);
3113                         mgmt_pending_remove(cmd);
3114                         goto failed;
3115                 }
3116
3117                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3118                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3119                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3120                                          MGMT_STATUS_NOT_SUPPORTED);
3121                         mgmt_pending_remove(cmd);
3122                         goto failed;
3123                 }
3124
3125                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3126                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3127                                          MGMT_STATUS_REJECTED);
3128                         mgmt_pending_remove(cmd);
3129                         goto failed;
3130                 }
3131
3132                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
3133                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3134                                          MGMT_STATUS_BUSY);
3135                         mgmt_pending_remove(cmd);
3136                         goto failed;
3137                 }
3138
3139                 memset(&param_cp, 0, sizeof(param_cp));
3140                 param_cp.type = LE_SCAN_ACTIVE;
3141                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3142                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3143                 if (bacmp(&hdev->bdaddr, BDADDR_ANY))
3144                         param_cp.own_address_type = ADDR_LE_DEV_PUBLIC;
3145                 else
3146                         param_cp.own_address_type = ADDR_LE_DEV_RANDOM;
3147                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3148                             &param_cp);
3149
3150                 memset(&enable_cp, 0, sizeof(enable_cp));
3151                 enable_cp.enable = LE_SCAN_ENABLE;
3152                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3153                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3154                             &enable_cp);
3155                 break;
3156
3157         default:
3158                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3159                                  MGMT_STATUS_INVALID_PARAMS);
3160                 mgmt_pending_remove(cmd);
3161                 goto failed;
3162         }
3163
3164         err = hci_req_run(&req, start_discovery_complete);
3165         if (err < 0)
3166                 mgmt_pending_remove(cmd);
3167         else
3168                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3169
3170 failed:
3171         hci_dev_unlock(hdev);
3172         return err;
3173 }
3174
3175 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3176 {
3177         struct pending_cmd *cmd;
3178         int err;
3179
3180         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3181         if (!cmd)
3182                 return -ENOENT;
3183
3184         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3185                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3186         mgmt_pending_remove(cmd);
3187
3188         return err;
3189 }
3190
3191 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3192 {
3193         BT_DBG("status %d", status);
3194
3195         hci_dev_lock(hdev);
3196
3197         if (status) {
3198                 mgmt_stop_discovery_failed(hdev, status);
3199                 goto unlock;
3200         }
3201
3202         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3203
3204 unlock:
3205         hci_dev_unlock(hdev);
3206 }
3207
3208 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3209                           u16 len)
3210 {
3211         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3212         struct pending_cmd *cmd;
3213         struct hci_cp_remote_name_req_cancel cp;
3214         struct inquiry_entry *e;
3215         struct hci_request req;
3216         struct hci_cp_le_set_scan_enable enable_cp;
3217         int err;
3218
3219         BT_DBG("%s", hdev->name);
3220
3221         hci_dev_lock(hdev);
3222
3223         if (!hci_discovery_active(hdev)) {
3224                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3225                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3226                                    sizeof(mgmt_cp->type));
3227                 goto unlock;
3228         }
3229
3230         if (hdev->discovery.type != mgmt_cp->type) {
3231                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3232                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3233                                    sizeof(mgmt_cp->type));
3234                 goto unlock;
3235         }
3236
3237         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3238         if (!cmd) {
3239                 err = -ENOMEM;
3240                 goto unlock;
3241         }
3242
3243         hci_req_init(&req, hdev);
3244
3245         switch (hdev->discovery.state) {
3246         case DISCOVERY_FINDING:
3247                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3248                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3249                 } else {
3250                         cancel_delayed_work(&hdev->le_scan_disable);
3251
3252                         memset(&enable_cp, 0, sizeof(enable_cp));
3253                         enable_cp.enable = LE_SCAN_DISABLE;
3254                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
3255                                     sizeof(enable_cp), &enable_cp);
3256                 }
3257
3258                 break;
3259
3260         case DISCOVERY_RESOLVING:
3261                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3262                                                      NAME_PENDING);
3263                 if (!e) {
3264                         mgmt_pending_remove(cmd);
3265                         err = cmd_complete(sk, hdev->id,
3266                                            MGMT_OP_STOP_DISCOVERY, 0,
3267                                            &mgmt_cp->type,
3268                                            sizeof(mgmt_cp->type));
3269                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3270                         goto unlock;
3271                 }
3272
3273                 bacpy(&cp.bdaddr, &e->data.bdaddr);
3274                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3275                             &cp);
3276
3277                 break;
3278
3279         default:
3280                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
3281
3282                 mgmt_pending_remove(cmd);
3283                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3284                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
3285                                    sizeof(mgmt_cp->type));
3286                 goto unlock;
3287         }
3288
3289         err = hci_req_run(&req, stop_discovery_complete);
3290         if (err < 0)
3291                 mgmt_pending_remove(cmd);
3292         else
3293                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3294
3295 unlock:
3296         hci_dev_unlock(hdev);
3297         return err;
3298 }
3299
3300 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3301                         u16 len)
3302 {
3303         struct mgmt_cp_confirm_name *cp = data;
3304         struct inquiry_entry *e;
3305         int err;
3306
3307         BT_DBG("%s", hdev->name);
3308
3309         hci_dev_lock(hdev);
3310
3311         if (!hci_discovery_active(hdev)) {
3312                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3313                                  MGMT_STATUS_FAILED);
3314                 goto failed;
3315         }
3316
3317         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3318         if (!e) {
3319                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3320                                  MGMT_STATUS_INVALID_PARAMS);
3321                 goto failed;
3322         }
3323
3324         if (cp->name_known) {
3325                 e->name_state = NAME_KNOWN;
3326                 list_del(&e->list);
3327         } else {
3328                 e->name_state = NAME_NEEDED;
3329                 hci_inquiry_cache_update_resolve(hdev, e);
3330         }
3331
3332         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3333                            sizeof(cp->addr));
3334
3335 failed:
3336         hci_dev_unlock(hdev);
3337         return err;
3338 }
3339
3340 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3341                         u16 len)
3342 {
3343         struct mgmt_cp_block_device *cp = data;
3344         u8 status;
3345         int err;
3346
3347         BT_DBG("%s", hdev->name);
3348
3349         if (!bdaddr_type_is_valid(cp->addr.type))
3350                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3351                                     MGMT_STATUS_INVALID_PARAMS,
3352                                     &cp->addr, sizeof(cp->addr));
3353
3354         hci_dev_lock(hdev);
3355
3356         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3357         if (err < 0)
3358                 status = MGMT_STATUS_FAILED;
3359         else
3360                 status = MGMT_STATUS_SUCCESS;
3361
3362         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3363                            &cp->addr, sizeof(cp->addr));
3364
3365         hci_dev_unlock(hdev);
3366
3367         return err;
3368 }
3369
3370 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3371                           u16 len)
3372 {
3373         struct mgmt_cp_unblock_device *cp = data;
3374         u8 status;
3375         int err;
3376
3377         BT_DBG("%s", hdev->name);
3378
3379         if (!bdaddr_type_is_valid(cp->addr.type))
3380                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3381                                     MGMT_STATUS_INVALID_PARAMS,
3382                                     &cp->addr, sizeof(cp->addr));
3383
3384         hci_dev_lock(hdev);
3385
3386         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3387         if (err < 0)
3388                 status = MGMT_STATUS_INVALID_PARAMS;
3389         else
3390                 status = MGMT_STATUS_SUCCESS;
3391
3392         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3393                            &cp->addr, sizeof(cp->addr));
3394
3395         hci_dev_unlock(hdev);
3396
3397         return err;
3398 }
3399
3400 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3401                          u16 len)
3402 {
3403         struct mgmt_cp_set_device_id *cp = data;
3404         struct hci_request req;
3405         int err;
3406         __u16 source;
3407
3408         BT_DBG("%s", hdev->name);
3409
3410         source = __le16_to_cpu(cp->source);
3411
3412         if (source > 0x0002)
3413                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3414                                   MGMT_STATUS_INVALID_PARAMS);
3415
3416         hci_dev_lock(hdev);
3417
3418         hdev->devid_source = source;
3419         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3420         hdev->devid_product = __le16_to_cpu(cp->product);
3421         hdev->devid_version = __le16_to_cpu(cp->version);
3422
3423         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3424
3425         hci_req_init(&req, hdev);
3426         update_eir(&req);
3427         hci_req_run(&req, NULL);
3428
3429         hci_dev_unlock(hdev);
3430
3431         return err;
3432 }
3433
3434 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3435 {
3436         struct cmd_lookup match = { NULL, hdev };
3437
3438         if (status) {
3439                 u8 mgmt_err = mgmt_status(status);
3440
3441                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3442                                      cmd_status_rsp, &mgmt_err);
3443                 return;
3444         }
3445
3446         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3447                              &match);
3448
3449         new_settings(hdev, match.sk);
3450
3451         if (match.sk)
3452                 sock_put(match.sk);
3453 }
3454
3455 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3456                            u16 len)
3457 {
3458         struct mgmt_mode *cp = data;
3459         struct pending_cmd *cmd;
3460         struct hci_request req;
3461         u8 val, enabled, status;
3462         int err;
3463
3464         BT_DBG("request for %s", hdev->name);
3465
3466         status = mgmt_le_support(hdev);
3467         if (status)
3468                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3469                                   status);
3470
3471         if (cp->val != 0x00 && cp->val != 0x01)
3472                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3473                                   MGMT_STATUS_INVALID_PARAMS);
3474
3475         hci_dev_lock(hdev);
3476
3477         val = !!cp->val;
3478         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3479
3480         /* The following conditions are ones which mean that we should
3481          * not do any HCI communication but directly send a mgmt
3482          * response to user space (after toggling the flag if
3483          * necessary).
3484          */
3485         if (!hdev_is_powered(hdev) || val == enabled ||
3486             hci_conn_num(hdev, LE_LINK) > 0) {
3487                 bool changed = false;
3488
3489                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3490                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3491                         changed = true;
3492                 }
3493
3494                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3495                 if (err < 0)
3496                         goto unlock;
3497
3498                 if (changed)
3499                         err = new_settings(hdev, sk);
3500
3501                 goto unlock;
3502         }
3503
3504         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3505             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3506                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3507                                  MGMT_STATUS_BUSY);
3508                 goto unlock;
3509         }
3510
3511         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3512         if (!cmd) {
3513                 err = -ENOMEM;
3514                 goto unlock;
3515         }
3516
3517         hci_req_init(&req, hdev);
3518
3519         if (val)
3520                 enable_advertising(&req);
3521         else
3522                 disable_advertising(&req);
3523
3524         err = hci_req_run(&req, set_advertising_complete);
3525         if (err < 0)
3526                 mgmt_pending_remove(cmd);
3527
3528 unlock:
3529         hci_dev_unlock(hdev);
3530         return err;
3531 }
3532
3533 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3534                               void *data, u16 len)
3535 {
3536         struct mgmt_cp_set_static_address *cp = data;
3537         int err;
3538
3539         BT_DBG("%s", hdev->name);
3540
3541         if (!lmp_le_capable(hdev))
3542                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3543                                   MGMT_STATUS_NOT_SUPPORTED);
3544
3545         if (hdev_is_powered(hdev))
3546                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3547                                   MGMT_STATUS_REJECTED);
3548
3549         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3550                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3551                         return cmd_status(sk, hdev->id,
3552                                           MGMT_OP_SET_STATIC_ADDRESS,
3553                                           MGMT_STATUS_INVALID_PARAMS);
3554
3555                 /* Two most significant bits shall be set */
3556                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3557                         return cmd_status(sk, hdev->id,
3558                                           MGMT_OP_SET_STATIC_ADDRESS,
3559                                           MGMT_STATUS_INVALID_PARAMS);
3560         }
3561
3562         hci_dev_lock(hdev);
3563
3564         bacpy(&hdev->static_addr, &cp->bdaddr);
3565
3566         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3567
3568         hci_dev_unlock(hdev);
3569
3570         return err;
3571 }
3572
3573 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
3574                            void *data, u16 len)
3575 {
3576         struct mgmt_cp_set_scan_params *cp = data;
3577         __u16 interval, window;
3578         int err;
3579
3580         BT_DBG("%s", hdev->name);
3581
3582         if (!lmp_le_capable(hdev))
3583                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3584                                   MGMT_STATUS_NOT_SUPPORTED);
3585
3586         interval = __le16_to_cpu(cp->interval);
3587
3588         if (interval < 0x0004 || interval > 0x4000)
3589                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3590                                   MGMT_STATUS_INVALID_PARAMS);
3591
3592         window = __le16_to_cpu(cp->window);
3593
3594         if (window < 0x0004 || window > 0x4000)
3595                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3596                                   MGMT_STATUS_INVALID_PARAMS);
3597
3598         if (window > interval)
3599                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3600                                   MGMT_STATUS_INVALID_PARAMS);
3601
3602         hci_dev_lock(hdev);
3603
3604         hdev->le_scan_interval = interval;
3605         hdev->le_scan_window = window;
3606
3607         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
3608
3609         hci_dev_unlock(hdev);
3610
3611         return err;
3612 }
3613
3614 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3615 {
3616         struct pending_cmd *cmd;
3617
3618         BT_DBG("status 0x%02x", status);
3619
3620         hci_dev_lock(hdev);
3621
3622         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3623         if (!cmd)
3624                 goto unlock;
3625
3626         if (status) {
3627                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3628                            mgmt_status(status));
3629         } else {
3630                 struct mgmt_mode *cp = cmd->param;
3631
3632                 if (cp->val)
3633                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3634                 else
3635                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3636
3637                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3638                 new_settings(hdev, cmd->sk);
3639         }
3640
3641         mgmt_pending_remove(cmd);
3642
3643 unlock:
3644         hci_dev_unlock(hdev);
3645 }
3646
3647 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3648                                 void *data, u16 len)
3649 {
3650         struct mgmt_mode *cp = data;
3651         struct pending_cmd *cmd;
3652         struct hci_request req;
3653         int err;
3654
3655         BT_DBG("%s", hdev->name);
3656
3657         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
3658             hdev->hci_ver < BLUETOOTH_VER_1_2)
3659                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3660                                   MGMT_STATUS_NOT_SUPPORTED);
3661
3662         if (cp->val != 0x00 && cp->val != 0x01)
3663                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3664                                   MGMT_STATUS_INVALID_PARAMS);
3665
3666         if (!hdev_is_powered(hdev))
3667                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3668                                   MGMT_STATUS_NOT_POWERED);
3669
3670         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3671                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3672                                   MGMT_STATUS_REJECTED);
3673
3674         hci_dev_lock(hdev);
3675
3676         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3677                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3678                                  MGMT_STATUS_BUSY);
3679                 goto unlock;
3680         }
3681
3682         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3683                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3684                                         hdev);
3685                 goto unlock;
3686         }
3687
3688         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3689                                data, len);
3690         if (!cmd) {
3691                 err = -ENOMEM;
3692                 goto unlock;
3693         }
3694
3695         hci_req_init(&req, hdev);
3696
3697         write_fast_connectable(&req, cp->val);
3698
3699         err = hci_req_run(&req, fast_connectable_complete);
3700         if (err < 0) {
3701                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3702                                  MGMT_STATUS_FAILED);
3703                 mgmt_pending_remove(cmd);
3704         }
3705
3706 unlock:
3707         hci_dev_unlock(hdev);
3708
3709         return err;
3710 }
3711
3712 static void set_bredr_scan(struct hci_request *req)
3713 {
3714         struct hci_dev *hdev = req->hdev;
3715         u8 scan = 0;
3716
3717         /* Ensure that fast connectable is disabled. This function will
3718          * not do anything if the page scan parameters are already what
3719          * they should be.
3720          */
3721         write_fast_connectable(req, false);
3722
3723         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3724                 scan |= SCAN_PAGE;
3725         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3726                 scan |= SCAN_INQUIRY;
3727
3728         if (scan)
3729                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3730 }
3731
3732 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
3733 {
3734         struct pending_cmd *cmd;
3735
3736         BT_DBG("status 0x%02x", status);
3737
3738         hci_dev_lock(hdev);
3739
3740         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
3741         if (!cmd)
3742                 goto unlock;
3743
3744         if (status) {
3745                 u8 mgmt_err = mgmt_status(status);
3746
3747                 /* We need to restore the flag if related HCI commands
3748                  * failed.
3749                  */
3750                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3751
3752                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
3753         } else {
3754                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
3755                 new_settings(hdev, cmd->sk);
3756         }
3757
3758         mgmt_pending_remove(cmd);
3759
3760 unlock:
3761         hci_dev_unlock(hdev);
3762 }
3763
3764 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3765 {
3766         struct mgmt_mode *cp = data;
3767         struct pending_cmd *cmd;
3768         struct hci_request req;
3769         int err;
3770
3771         BT_DBG("request for %s", hdev->name);
3772
3773         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
3774                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3775                                   MGMT_STATUS_NOT_SUPPORTED);
3776
3777         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3778                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3779                                   MGMT_STATUS_REJECTED);
3780
3781         if (cp->val != 0x00 && cp->val != 0x01)
3782                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3783                                   MGMT_STATUS_INVALID_PARAMS);
3784
3785         hci_dev_lock(hdev);
3786
3787         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3788                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3789                 goto unlock;
3790         }
3791
3792         if (!hdev_is_powered(hdev)) {
3793                 if (!cp->val) {
3794                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
3795                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
3796                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3797                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3798                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3799                 }
3800
3801                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3802
3803                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3804                 if (err < 0)
3805                         goto unlock;
3806
3807                 err = new_settings(hdev, sk);
3808                 goto unlock;
3809         }
3810
3811         /* Reject disabling when powered on */
3812         if (!cp->val) {
3813                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3814                                  MGMT_STATUS_REJECTED);
3815                 goto unlock;
3816         }
3817
3818         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
3819                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3820                                  MGMT_STATUS_BUSY);
3821                 goto unlock;
3822         }
3823
3824         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
3825         if (!cmd) {
3826                 err = -ENOMEM;
3827                 goto unlock;
3828         }
3829
3830         /* We need to flip the bit already here so that update_ad
3831          * generates the correct flags.
3832          */
3833         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3834
3835         hci_req_init(&req, hdev);
3836
3837         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3838                 set_bredr_scan(&req);
3839
3840         update_ad(&req);
3841
3842         err = hci_req_run(&req, set_bredr_complete);
3843         if (err < 0)
3844                 mgmt_pending_remove(cmd);
3845
3846 unlock:
3847         hci_dev_unlock(hdev);
3848         return err;
3849 }
3850
3851 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3852 {
3853         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3854                 return false;
3855         if (key->master != 0x00 && key->master != 0x01)
3856                 return false;
3857         if (!bdaddr_type_is_le(key->addr.type))
3858                 return false;
3859         return true;
3860 }
3861
3862 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3863                                void *cp_data, u16 len)
3864 {
3865         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3866         u16 key_count, expected_len;
3867         int i, err;
3868
3869         BT_DBG("request for %s", hdev->name);
3870
3871         if (!lmp_le_capable(hdev))
3872                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3873                                   MGMT_STATUS_NOT_SUPPORTED);
3874
3875         key_count = __le16_to_cpu(cp->key_count);
3876
3877         expected_len = sizeof(*cp) + key_count *
3878                                         sizeof(struct mgmt_ltk_info);
3879         if (expected_len != len) {
3880                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3881                        len, expected_len);
3882                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3883                                   MGMT_STATUS_INVALID_PARAMS);
3884         }
3885
3886         BT_DBG("%s key_count %u", hdev->name, key_count);
3887
3888         for (i = 0; i < key_count; i++) {
3889                 struct mgmt_ltk_info *key = &cp->keys[i];
3890
3891                 if (!ltk_is_valid(key))
3892                         return cmd_status(sk, hdev->id,
3893                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3894                                           MGMT_STATUS_INVALID_PARAMS);
3895         }
3896
3897         hci_dev_lock(hdev);
3898
3899         hci_smp_ltks_clear(hdev);
3900
3901         for (i = 0; i < key_count; i++) {
3902                 struct mgmt_ltk_info *key = &cp->keys[i];
3903                 u8 type, addr_type;
3904
3905                 if (key->addr.type == BDADDR_LE_PUBLIC)
3906                         addr_type = ADDR_LE_DEV_PUBLIC;
3907                 else
3908                         addr_type = ADDR_LE_DEV_RANDOM;
3909
3910                 if (key->master)
3911                         type = HCI_SMP_LTK;
3912                 else
3913                         type = HCI_SMP_LTK_SLAVE;
3914
3915                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type,
3916                             type, 0, key->authenticated, key->val,
3917                             key->enc_size, key->ediv, key->rand);
3918         }
3919
3920         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3921                            NULL, 0);
3922
3923         hci_dev_unlock(hdev);
3924
3925         return err;
3926 }
3927
3928 static const struct mgmt_handler {
3929         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3930                      u16 data_len);
3931         bool var_len;
3932         size_t data_len;
3933 } mgmt_handlers[] = {
3934         { NULL }, /* 0x0000 (no command) */
3935         { read_version,           false, MGMT_READ_VERSION_SIZE },
3936         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3937         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3938         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3939         { set_powered,            false, MGMT_SETTING_SIZE },
3940         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3941         { set_connectable,        false, MGMT_SETTING_SIZE },
3942         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3943         { set_pairable,           false, MGMT_SETTING_SIZE },
3944         { set_link_security,      false, MGMT_SETTING_SIZE },
3945         { set_ssp,                false, MGMT_SETTING_SIZE },
3946         { set_hs,                 false, MGMT_SETTING_SIZE },
3947         { set_le,                 false, MGMT_SETTING_SIZE },
3948         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3949         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3950         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3951         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3952         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3953         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3954         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3955         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3956         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3957         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3958         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3959         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3960         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3961         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3962         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3963         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3964         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3965         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3966         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3967         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3968         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3969         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3970         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3971         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3972         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3973         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3974         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3975         { set_advertising,        false, MGMT_SETTING_SIZE },
3976         { set_bredr,              false, MGMT_SETTING_SIZE },
3977         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
3978         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
3979 };
3980
3981
3982 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3983 {
3984         void *buf;
3985         u8 *cp;
3986         struct mgmt_hdr *hdr;
3987         u16 opcode, index, len;
3988         struct hci_dev *hdev = NULL;
3989         const struct mgmt_handler *handler;
3990         int err;
3991
3992         BT_DBG("got %zu bytes", msglen);
3993
3994         if (msglen < sizeof(*hdr))
3995                 return -EINVAL;
3996
3997         buf = kmalloc(msglen, GFP_KERNEL);
3998         if (!buf)
3999                 return -ENOMEM;
4000
4001         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
4002                 err = -EFAULT;
4003                 goto done;
4004         }
4005
4006         hdr = buf;
4007         opcode = __le16_to_cpu(hdr->opcode);
4008         index = __le16_to_cpu(hdr->index);
4009         len = __le16_to_cpu(hdr->len);
4010
4011         if (len != msglen - sizeof(*hdr)) {
4012                 err = -EINVAL;
4013                 goto done;
4014         }
4015
4016         if (index != MGMT_INDEX_NONE) {
4017                 hdev = hci_dev_get(index);
4018                 if (!hdev) {
4019                         err = cmd_status(sk, index, opcode,
4020                                          MGMT_STATUS_INVALID_INDEX);
4021                         goto done;
4022                 }
4023
4024                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
4025                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
4026                         err = cmd_status(sk, index, opcode,
4027                                          MGMT_STATUS_INVALID_INDEX);
4028                         goto done;
4029                 }
4030         }
4031
4032         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
4033             mgmt_handlers[opcode].func == NULL) {
4034                 BT_DBG("Unknown op %u", opcode);
4035                 err = cmd_status(sk, index, opcode,
4036                                  MGMT_STATUS_UNKNOWN_COMMAND);
4037                 goto done;
4038         }
4039
4040         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
4041             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
4042                 err = cmd_status(sk, index, opcode,
4043                                  MGMT_STATUS_INVALID_INDEX);
4044                 goto done;
4045         }
4046
4047         handler = &mgmt_handlers[opcode];
4048
4049         if ((handler->var_len && len < handler->data_len) ||
4050             (!handler->var_len && len != handler->data_len)) {
4051                 err = cmd_status(sk, index, opcode,
4052                                  MGMT_STATUS_INVALID_PARAMS);
4053                 goto done;
4054         }
4055
4056         if (hdev)
4057                 mgmt_init_hdev(sk, hdev);
4058
4059         cp = buf + sizeof(*hdr);
4060
4061         err = handler->func(sk, hdev, cp, len);
4062         if (err < 0)
4063                 goto done;
4064
4065         err = msglen;
4066
4067 done:
4068         if (hdev)
4069                 hci_dev_put(hdev);
4070
4071         kfree(buf);
4072         return err;
4073 }
4074
4075 void mgmt_index_added(struct hci_dev *hdev)
4076 {
4077         if (hdev->dev_type != HCI_BREDR)
4078                 return;
4079
4080         mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
4081 }
4082
4083 void mgmt_index_removed(struct hci_dev *hdev)
4084 {
4085         u8 status = MGMT_STATUS_INVALID_INDEX;
4086
4087         if (hdev->dev_type != HCI_BREDR)
4088                 return;
4089
4090         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
4091
4092         mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
4093 }
4094
4095 static void powered_complete(struct hci_dev *hdev, u8 status)
4096 {
4097         struct cmd_lookup match = { NULL, hdev };
4098
4099         BT_DBG("status 0x%02x", status);
4100
4101         hci_dev_lock(hdev);
4102
4103         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
4104
4105         new_settings(hdev, match.sk);
4106
4107         hci_dev_unlock(hdev);
4108
4109         if (match.sk)
4110                 sock_put(match.sk);
4111 }
4112
4113 static int powered_update_hci(struct hci_dev *hdev)
4114 {
4115         struct hci_request req;
4116         u8 link_sec;
4117
4118         hci_req_init(&req, hdev);
4119
4120         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
4121             !lmp_host_ssp_capable(hdev)) {
4122                 u8 ssp = 1;
4123
4124                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
4125         }
4126
4127         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
4128             lmp_bredr_capable(hdev)) {
4129                 struct hci_cp_write_le_host_supported cp;
4130
4131                 cp.le = 1;
4132                 cp.simul = lmp_le_br_capable(hdev);
4133
4134                 /* Check first if we already have the right
4135                  * host state (host features set)
4136                  */
4137                 if (cp.le != lmp_host_le_capable(hdev) ||
4138                     cp.simul != lmp_host_le_br_capable(hdev))
4139                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
4140                                     sizeof(cp), &cp);
4141         }
4142
4143         if (lmp_le_capable(hdev)) {
4144                 /* Set random address to static address if configured */
4145                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
4146                         hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
4147                                     &hdev->static_addr);
4148
4149                 /* Make sure the controller has a good default for
4150                  * advertising data. This also applies to the case
4151                  * where BR/EDR was toggled during the AUTO_OFF phase.
4152                  */
4153                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4154                         update_ad(&req);
4155
4156                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
4157                         enable_advertising(&req);
4158         }
4159
4160         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4161         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
4162                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
4163                             sizeof(link_sec), &link_sec);
4164
4165         if (lmp_bredr_capable(hdev)) {
4166                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
4167                         set_bredr_scan(&req);
4168                 update_class(&req);
4169                 update_name(&req);
4170                 update_eir(&req);
4171         }
4172
4173         return hci_req_run(&req, powered_complete);
4174 }
4175
4176 int mgmt_powered(struct hci_dev *hdev, u8 powered)
4177 {
4178         struct cmd_lookup match = { NULL, hdev };
4179         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
4180         u8 zero_cod[] = { 0, 0, 0 };
4181         int err;
4182
4183         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
4184                 return 0;
4185
4186         if (powered) {
4187                 if (powered_update_hci(hdev) == 0)
4188                         return 0;
4189
4190                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
4191                                      &match);
4192                 goto new_settings;
4193         }
4194
4195         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
4196         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
4197
4198         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
4199                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
4200                            zero_cod, sizeof(zero_cod), NULL);
4201
4202 new_settings:
4203         err = new_settings(hdev, match.sk);
4204
4205         if (match.sk)
4206                 sock_put(match.sk);
4207
4208         return err;
4209 }
4210
4211 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
4212 {
4213         struct pending_cmd *cmd;
4214         u8 status;
4215
4216         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
4217         if (!cmd)
4218                 return;
4219
4220         if (err == -ERFKILL)
4221                 status = MGMT_STATUS_RFKILLED;
4222         else
4223                 status = MGMT_STATUS_FAILED;
4224
4225         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
4226
4227         mgmt_pending_remove(cmd);
4228 }
4229
4230 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
4231 {
4232         bool changed = false;
4233         int err = 0;
4234
4235         /* Nothing needed here if there's a pending command since that
4236          * commands request completion callback takes care of everything
4237          * necessary.
4238          */
4239         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
4240                 return 0;
4241
4242         if (discoverable) {
4243                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
4244                         changed = true;
4245         } else {
4246                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
4247                         changed = true;
4248         }
4249
4250         if (changed)
4251                 err = new_settings(hdev, NULL);
4252
4253         return err;
4254 }
4255
4256 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
4257 {
4258         bool changed = false;
4259         int err = 0;
4260
4261         /* Nothing needed here if there's a pending command since that
4262          * commands request completion callback takes care of everything
4263          * necessary.
4264          */
4265         if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
4266                 return 0;
4267
4268         if (connectable) {
4269                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4270                         changed = true;
4271         } else {
4272                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4273                         changed = true;
4274         }
4275
4276         if (changed)
4277                 err = new_settings(hdev, NULL);
4278
4279         return err;
4280 }
4281
4282 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
4283 {
4284         u8 mgmt_err = mgmt_status(status);
4285
4286         if (scan & SCAN_PAGE)
4287                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
4288                                      cmd_status_rsp, &mgmt_err);
4289
4290         if (scan & SCAN_INQUIRY)
4291                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
4292                                      cmd_status_rsp, &mgmt_err);
4293
4294         return 0;
4295 }
4296
4297 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
4298                       bool persistent)
4299 {
4300         struct mgmt_ev_new_link_key ev;
4301
4302         memset(&ev, 0, sizeof(ev));
4303
4304         ev.store_hint = persistent;
4305         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4306         ev.key.addr.type = BDADDR_BREDR;
4307         ev.key.type = key->type;
4308         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
4309         ev.key.pin_len = key->pin_len;
4310
4311         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
4312 }
4313
4314 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
4315 {
4316         struct mgmt_ev_new_long_term_key ev;
4317
4318         memset(&ev, 0, sizeof(ev));
4319
4320         ev.store_hint = persistent;
4321         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4322         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
4323         ev.key.authenticated = key->authenticated;
4324         ev.key.enc_size = key->enc_size;
4325         ev.key.ediv = key->ediv;
4326
4327         if (key->type == HCI_SMP_LTK)
4328                 ev.key.master = 1;
4329
4330         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
4331         memcpy(ev.key.val, key->val, sizeof(key->val));
4332
4333         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
4334                           NULL);
4335 }
4336
4337 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4338                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
4339                            u8 *dev_class)
4340 {
4341         char buf[512];
4342         struct mgmt_ev_device_connected *ev = (void *) buf;
4343         u16 eir_len = 0;
4344
4345         bacpy(&ev->addr.bdaddr, bdaddr);
4346         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4347
4348         ev->flags = __cpu_to_le32(flags);
4349
4350         if (name_len > 0)
4351                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
4352                                           name, name_len);
4353
4354         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
4355                 eir_len = eir_append_data(ev->eir, eir_len,
4356                                           EIR_CLASS_OF_DEV, dev_class, 3);
4357
4358         ev->eir_len = cpu_to_le16(eir_len);
4359
4360         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
4361                     sizeof(*ev) + eir_len, NULL);
4362 }
4363
4364 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
4365 {
4366         struct mgmt_cp_disconnect *cp = cmd->param;
4367         struct sock **sk = data;
4368         struct mgmt_rp_disconnect rp;
4369
4370         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4371         rp.addr.type = cp->addr.type;
4372
4373         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
4374                      sizeof(rp));
4375
4376         *sk = cmd->sk;
4377         sock_hold(*sk);
4378
4379         mgmt_pending_remove(cmd);
4380 }
4381
4382 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
4383 {
4384         struct hci_dev *hdev = data;
4385         struct mgmt_cp_unpair_device *cp = cmd->param;
4386         struct mgmt_rp_unpair_device rp;
4387
4388         memset(&rp, 0, sizeof(rp));
4389         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4390         rp.addr.type = cp->addr.type;
4391
4392         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
4393
4394         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
4395
4396         mgmt_pending_remove(cmd);
4397 }
4398
4399 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
4400                               u8 link_type, u8 addr_type, u8 reason)
4401 {
4402         struct mgmt_ev_device_disconnected ev;
4403         struct sock *sk = NULL;
4404
4405         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
4406
4407         bacpy(&ev.addr.bdaddr, bdaddr);
4408         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4409         ev.reason = reason;
4410
4411         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
4412
4413         if (sk)
4414                 sock_put(sk);
4415
4416         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4417                              hdev);
4418 }
4419
4420 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
4421                             u8 link_type, u8 addr_type, u8 status)
4422 {
4423         struct mgmt_rp_disconnect rp;
4424         struct pending_cmd *cmd;
4425
4426         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4427                              hdev);
4428
4429         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
4430         if (!cmd)
4431                 return;
4432
4433         bacpy(&rp.addr.bdaddr, bdaddr);
4434         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4435
4436         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
4437                      mgmt_status(status), &rp, sizeof(rp));
4438
4439         mgmt_pending_remove(cmd);
4440 }
4441
4442 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4443                          u8 addr_type, u8 status)
4444 {
4445         struct mgmt_ev_connect_failed ev;
4446
4447         bacpy(&ev.addr.bdaddr, bdaddr);
4448         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4449         ev.status = mgmt_status(status);
4450
4451         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
4452 }
4453
4454 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
4455 {
4456         struct mgmt_ev_pin_code_request ev;
4457
4458         bacpy(&ev.addr.bdaddr, bdaddr);
4459         ev.addr.type = BDADDR_BREDR;
4460         ev.secure = secure;
4461
4462         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
4463                           NULL);
4464 }
4465
4466 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4467                                  u8 status)
4468 {
4469         struct pending_cmd *cmd;
4470         struct mgmt_rp_pin_code_reply rp;
4471         int err;
4472
4473         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
4474         if (!cmd)
4475                 return -ENOENT;
4476
4477         bacpy(&rp.addr.bdaddr, bdaddr);
4478         rp.addr.type = BDADDR_BREDR;
4479
4480         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
4481                            mgmt_status(status), &rp, sizeof(rp));
4482
4483         mgmt_pending_remove(cmd);
4484
4485         return err;
4486 }
4487
4488 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4489                                      u8 status)
4490 {
4491         struct pending_cmd *cmd;
4492         struct mgmt_rp_pin_code_reply rp;
4493         int err;
4494
4495         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
4496         if (!cmd)
4497                 return -ENOENT;
4498
4499         bacpy(&rp.addr.bdaddr, bdaddr);
4500         rp.addr.type = BDADDR_BREDR;
4501
4502         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
4503                            mgmt_status(status), &rp, sizeof(rp));
4504
4505         mgmt_pending_remove(cmd);
4506
4507         return err;
4508 }
4509
4510 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4511                               u8 link_type, u8 addr_type, __le32 value,
4512                               u8 confirm_hint)
4513 {
4514         struct mgmt_ev_user_confirm_request ev;
4515
4516         BT_DBG("%s", hdev->name);
4517
4518         bacpy(&ev.addr.bdaddr, bdaddr);
4519         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4520         ev.confirm_hint = confirm_hint;
4521         ev.value = value;
4522
4523         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
4524                           NULL);
4525 }
4526
4527 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4528                               u8 link_type, u8 addr_type)
4529 {
4530         struct mgmt_ev_user_passkey_request ev;
4531
4532         BT_DBG("%s", hdev->name);
4533
4534         bacpy(&ev.addr.bdaddr, bdaddr);
4535         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4536
4537         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
4538                           NULL);
4539 }
4540
4541 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4542                                       u8 link_type, u8 addr_type, u8 status,
4543                                       u8 opcode)
4544 {
4545         struct pending_cmd *cmd;
4546         struct mgmt_rp_user_confirm_reply rp;
4547         int err;
4548
4549         cmd = mgmt_pending_find(opcode, hdev);
4550         if (!cmd)
4551                 return -ENOENT;
4552
4553         bacpy(&rp.addr.bdaddr, bdaddr);
4554         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4555         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
4556                            &rp, sizeof(rp));
4557
4558         mgmt_pending_remove(cmd);
4559
4560         return err;
4561 }
4562
4563 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4564                                      u8 link_type, u8 addr_type, u8 status)
4565 {
4566         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4567                                           status, MGMT_OP_USER_CONFIRM_REPLY);
4568 }
4569
4570 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4571                                          u8 link_type, u8 addr_type, u8 status)
4572 {
4573         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4574                                           status,
4575                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
4576 }
4577
4578 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4579                                      u8 link_type, u8 addr_type, u8 status)
4580 {
4581         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4582                                           status, MGMT_OP_USER_PASSKEY_REPLY);
4583 }
4584
4585 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4586                                          u8 link_type, u8 addr_type, u8 status)
4587 {
4588         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4589                                           status,
4590                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
4591 }
4592
4593 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
4594                              u8 link_type, u8 addr_type, u32 passkey,
4595                              u8 entered)
4596 {
4597         struct mgmt_ev_passkey_notify ev;
4598
4599         BT_DBG("%s", hdev->name);
4600
4601         bacpy(&ev.addr.bdaddr, bdaddr);
4602         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4603         ev.passkey = __cpu_to_le32(passkey);
4604         ev.entered = entered;
4605
4606         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
4607 }
4608
4609 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4610                      u8 addr_type, u8 status)
4611 {
4612         struct mgmt_ev_auth_failed ev;
4613
4614         bacpy(&ev.addr.bdaddr, bdaddr);
4615         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4616         ev.status = mgmt_status(status);
4617
4618         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
4619 }
4620
4621 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
4622 {
4623         struct cmd_lookup match = { NULL, hdev };
4624         bool changed = false;
4625         int err = 0;
4626
4627         if (status) {
4628                 u8 mgmt_err = mgmt_status(status);
4629                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
4630                                      cmd_status_rsp, &mgmt_err);
4631                 return 0;
4632         }
4633
4634         if (test_bit(HCI_AUTH, &hdev->flags)) {
4635                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4636                         changed = true;
4637         } else {
4638                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4639                         changed = true;
4640         }
4641
4642         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
4643                              &match);
4644
4645         if (changed)
4646                 err = new_settings(hdev, match.sk);
4647
4648         if (match.sk)
4649                 sock_put(match.sk);
4650
4651         return err;
4652 }
4653
4654 static void clear_eir(struct hci_request *req)
4655 {
4656         struct hci_dev *hdev = req->hdev;
4657         struct hci_cp_write_eir cp;
4658
4659         if (!lmp_ext_inq_capable(hdev))
4660                 return;
4661
4662         memset(hdev->eir, 0, sizeof(hdev->eir));
4663
4664         memset(&cp, 0, sizeof(cp));
4665
4666         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4667 }
4668
4669 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4670 {
4671         struct cmd_lookup match = { NULL, hdev };
4672         struct hci_request req;
4673         bool changed = false;
4674         int err = 0;
4675
4676         if (status) {
4677                 u8 mgmt_err = mgmt_status(status);
4678
4679                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4680                                                  &hdev->dev_flags)) {
4681                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4682                         err = new_settings(hdev, NULL);
4683                 }
4684
4685                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4686                                      &mgmt_err);
4687
4688                 return err;
4689         }
4690
4691         if (enable) {
4692                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4693         } else {
4694                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4695                 if (!changed)
4696                         changed = test_and_clear_bit(HCI_HS_ENABLED,
4697                                                      &hdev->dev_flags);
4698                 else
4699                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4700         }
4701
4702         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4703
4704         if (changed)
4705                 err = new_settings(hdev, match.sk);
4706
4707         if (match.sk)
4708                 sock_put(match.sk);
4709
4710         hci_req_init(&req, hdev);
4711
4712         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4713                 update_eir(&req);
4714         else
4715                 clear_eir(&req);
4716
4717         hci_req_run(&req, NULL);
4718
4719         return err;
4720 }
4721
4722 static void sk_lookup(struct pending_cmd *cmd, void *data)
4723 {
4724         struct cmd_lookup *match = data;
4725
4726         if (match->sk == NULL) {
4727                 match->sk = cmd->sk;
4728                 sock_hold(match->sk);
4729         }
4730 }
4731
4732 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4733                                    u8 status)
4734 {
4735         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4736         int err = 0;
4737
4738         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4739         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4740         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4741
4742         if (!status)
4743                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4744                                  3, NULL);
4745
4746         if (match.sk)
4747                 sock_put(match.sk);
4748
4749         return err;
4750 }
4751
4752 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4753 {
4754         struct mgmt_cp_set_local_name ev;
4755         struct pending_cmd *cmd;
4756
4757         if (status)
4758                 return 0;
4759
4760         memset(&ev, 0, sizeof(ev));
4761         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4762         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4763
4764         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4765         if (!cmd) {
4766                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4767
4768                 /* If this is a HCI command related to powering on the
4769                  * HCI dev don't send any mgmt signals.
4770                  */
4771                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4772                         return 0;
4773         }
4774
4775         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4776                           cmd ? cmd->sk : NULL);
4777 }
4778
4779 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4780                                             u8 *randomizer, u8 status)
4781 {
4782         struct pending_cmd *cmd;
4783         int err;
4784
4785         BT_DBG("%s status %u", hdev->name, status);
4786
4787         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4788         if (!cmd)
4789                 return -ENOENT;
4790
4791         if (status) {
4792                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4793                                  mgmt_status(status));
4794         } else {
4795                 struct mgmt_rp_read_local_oob_data rp;
4796
4797                 memcpy(rp.hash, hash, sizeof(rp.hash));
4798                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4799
4800                 err = cmd_complete(cmd->sk, hdev->id,
4801                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4802                                    sizeof(rp));
4803         }
4804
4805         mgmt_pending_remove(cmd);
4806
4807         return err;
4808 }
4809
4810 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4811                        u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4812                        ssp, u8 *eir, u16 eir_len)
4813 {
4814         char buf[512];
4815         struct mgmt_ev_device_found *ev = (void *) buf;
4816         size_t ev_size;
4817
4818         if (!hci_discovery_active(hdev))
4819                 return;
4820
4821         /* Leave 5 bytes for a potential CoD field */
4822         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4823                 return;
4824
4825         memset(buf, 0, sizeof(buf));
4826
4827         bacpy(&ev->addr.bdaddr, bdaddr);
4828         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4829         ev->rssi = rssi;
4830         if (cfm_name)
4831                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4832         if (!ssp)
4833                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4834
4835         if (eir_len > 0)
4836                 memcpy(ev->eir, eir, eir_len);
4837
4838         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4839                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4840                                           dev_class, 3);
4841
4842         ev->eir_len = cpu_to_le16(eir_len);
4843         ev_size = sizeof(*ev) + eir_len;
4844
4845         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4846 }
4847
4848 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4849                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4850 {
4851         struct mgmt_ev_device_found *ev;
4852         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4853         u16 eir_len;
4854
4855         ev = (struct mgmt_ev_device_found *) buf;
4856
4857         memset(buf, 0, sizeof(buf));
4858
4859         bacpy(&ev->addr.bdaddr, bdaddr);
4860         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4861         ev->rssi = rssi;
4862
4863         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4864                                   name_len);
4865
4866         ev->eir_len = cpu_to_le16(eir_len);
4867
4868         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
4869 }
4870
4871 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4872 {
4873         struct mgmt_ev_discovering ev;
4874         struct pending_cmd *cmd;
4875
4876         BT_DBG("%s discovering %u", hdev->name, discovering);
4877
4878         if (discovering)
4879                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4880         else
4881                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4882
4883         if (cmd != NULL) {
4884                 u8 type = hdev->discovery.type;
4885
4886                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4887                              sizeof(type));
4888                 mgmt_pending_remove(cmd);
4889         }
4890
4891         memset(&ev, 0, sizeof(ev));
4892         ev.type = hdev->discovery.type;
4893         ev.discovering = discovering;
4894
4895         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4896 }
4897
4898 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4899 {
4900         struct pending_cmd *cmd;
4901         struct mgmt_ev_device_blocked ev;
4902
4903         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4904
4905         bacpy(&ev.addr.bdaddr, bdaddr);
4906         ev.addr.type = type;
4907
4908         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4909                           cmd ? cmd->sk : NULL);
4910 }
4911
4912 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4913 {
4914         struct pending_cmd *cmd;
4915         struct mgmt_ev_device_unblocked ev;
4916
4917         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4918
4919         bacpy(&ev.addr.bdaddr, bdaddr);
4920         ev.addr.type = type;
4921
4922         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4923                           cmd ? cmd->sk : NULL);
4924 }
4925
4926 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
4927 {
4928         BT_DBG("%s status %u", hdev->name, status);
4929
4930         /* Clear the advertising mgmt setting if we failed to re-enable it */
4931         if (status) {
4932                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4933                 new_settings(hdev, NULL);
4934         }
4935 }
4936
4937 void mgmt_reenable_advertising(struct hci_dev *hdev)
4938 {
4939         struct hci_request req;
4940
4941         if (hci_conn_num(hdev, LE_LINK) > 0)
4942                 return;
4943
4944         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
4945                 return;
4946
4947         hci_req_init(&req, hdev);
4948         enable_advertising(&req);
4949
4950         /* If this fails we have no option but to let user space know
4951          * that we've disabled advertising.
4952          */
4953         if (hci_req_run(&req, adv_enable_complete) < 0) {
4954                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4955                 new_settings(hdev, NULL);
4956         }
4957 }