net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33
  34 #include "smp.h"
  35
  36 #define MGMT_VERSION    1
  37 #define MGMT_REVISION   4
  38
  39 static const u16 mgmt_commands[] = {
  40         MGMT_OP_READ_INDEX_LIST,
  41         MGMT_OP_READ_INFO,
  42         MGMT_OP_SET_POWERED,
  43         MGMT_OP_SET_DISCOVERABLE,
  44         MGMT_OP_SET_CONNECTABLE,
  45         MGMT_OP_SET_FAST_CONNECTABLE,
  46         MGMT_OP_SET_PAIRABLE,
  47         MGMT_OP_SET_LINK_SECURITY,
  48         MGMT_OP_SET_SSP,
  49         MGMT_OP_SET_HS,
  50         MGMT_OP_SET_LE,
  51         MGMT_OP_SET_DEV_CLASS,
  52         MGMT_OP_SET_LOCAL_NAME,
  53         MGMT_OP_ADD_UUID,
  54         MGMT_OP_REMOVE_UUID,
  55         MGMT_OP_LOAD_LINK_KEYS,
  56         MGMT_OP_LOAD_LONG_TERM_KEYS,
  57         MGMT_OP_DISCONNECT,
  58         MGMT_OP_GET_CONNECTIONS,
  59         MGMT_OP_PIN_CODE_REPLY,
  60         MGMT_OP_PIN_CODE_NEG_REPLY,
  61         MGMT_OP_SET_IO_CAPABILITY,
  62         MGMT_OP_PAIR_DEVICE,
  63         MGMT_OP_CANCEL_PAIR_DEVICE,
  64         MGMT_OP_UNPAIR_DEVICE,
  65         MGMT_OP_USER_CONFIRM_REPLY,
  66         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  67         MGMT_OP_USER_PASSKEY_REPLY,
  68         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  69         MGMT_OP_READ_LOCAL_OOB_DATA,
  70         MGMT_OP_ADD_REMOTE_OOB_DATA,
  71         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  72         MGMT_OP_START_DISCOVERY,
  73         MGMT_OP_STOP_DISCOVERY,
  74         MGMT_OP_CONFIRM_NAME,
  75         MGMT_OP_BLOCK_DEVICE,
  76         MGMT_OP_UNBLOCK_DEVICE,
  77         MGMT_OP_SET_DEVICE_ID,
  78         MGMT_OP_SET_ADVERTISING,
  79         MGMT_OP_SET_BREDR,
  80         MGMT_OP_SET_STATIC_ADDRESS,
  81         MGMT_OP_SET_SCAN_PARAMS,
  82 };
  83
  84 static const u16 mgmt_events[] = {
  85         MGMT_EV_CONTROLLER_ERROR,
  86         MGMT_EV_INDEX_ADDED,
  87         MGMT_EV_INDEX_REMOVED,
  88         MGMT_EV_NEW_SETTINGS,
  89         MGMT_EV_CLASS_OF_DEV_CHANGED,
  90         MGMT_EV_LOCAL_NAME_CHANGED,
  91         MGMT_EV_NEW_LINK_KEY,
  92         MGMT_EV_NEW_LONG_TERM_KEY,
  93         MGMT_EV_DEVICE_CONNECTED,
  94         MGMT_EV_DEVICE_DISCONNECTED,
  95         MGMT_EV_CONNECT_FAILED,
  96         MGMT_EV_PIN_CODE_REQUEST,
  97         MGMT_EV_USER_CONFIRM_REQUEST,
  98         MGMT_EV_USER_PASSKEY_REQUEST,
  99         MGMT_EV_AUTH_FAILED,
 100         MGMT_EV_DEVICE_FOUND,
 101         MGMT_EV_DISCOVERING,
 102         MGMT_EV_DEVICE_BLOCKED,
 103         MGMT_EV_DEVICE_UNBLOCKED,
 104         MGMT_EV_DEVICE_UNPAIRED,
 105         MGMT_EV_PASSKEY_NOTIFY,
 106 };
 107
 108 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 109
 110 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 111                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 112
 113 struct pending_cmd {
 114         struct list_head list;
 115         u16 opcode;
 116         int index;
 117         void *param;
 118         struct sock *sk;
 119         void *user_data;
 120 };
 121
 122 /* HCI to MGMT error code conversion table */
 123 static u8 mgmt_status_table[] = {
 124         MGMT_STATUS_SUCCESS,
 125         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 126         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 127         MGMT_STATUS_FAILED,             /* Hardware Failure */
 128         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 129         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 130         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 131         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 132         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 133         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 134         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 135         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 136         MGMT_STATUS_BUSY,               /* Command Disallowed */
 137         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 138         MGMT_STATUS_REJECTED,           /* Rejected Security */
 139         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 140         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 141         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 142         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 143         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 144         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 145         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 146         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 147         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 148         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 149         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 150         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 151         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 152         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 153         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 154         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 155         MGMT_STATUS_FAILED,             /* Unspecified Error */
 156         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 157         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 158         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 159         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 160         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 161         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 162         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 164         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 165         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 166         MGMT_STATUS_FAILED,             /* Transaction Collision */
 167         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 168         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 169         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 170         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 171         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 172         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 173         MGMT_STATUS_FAILED,             /* Slot Violation */
 174         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 175         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 176         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 177         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 178         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 179         MGMT_STATUS_BUSY,               /* Controller Busy */
 180         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 181         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 182         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 183         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 184         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 185 };
 186
 187 static u8 mgmt_status(u8 hci_status)
 188 {
 189         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 190                 return mgmt_status_table[hci_status];
 191
 192         return MGMT_STATUS_FAILED;
 193 }
 194
 195 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 196 {
 197         struct sk_buff *skb;
 198         struct mgmt_hdr *hdr;
 199         struct mgmt_ev_cmd_status *ev;
 200         int err;
 201
 202         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 203
 204         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 205         if (!skb)
 206                 return -ENOMEM;
 207
 208         hdr = (void *) skb_put(skb, sizeof(*hdr));
 209
 210         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 211         hdr->index = cpu_to_le16(index);
 212         hdr->len = cpu_to_le16(sizeof(*ev));
 213
 214         ev = (void *) skb_put(skb, sizeof(*ev));
 215         ev->status = status;
 216         ev->opcode = cpu_to_le16(cmd);
 217
 218         err = sock_queue_rcv_skb(sk, skb);
 219         if (err < 0)
 220                 kfree_skb(skb);
 221
 222         return err;
 223 }
 224
 225 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 226                         void *rp, size_t rp_len)
 227 {
 228         struct sk_buff *skb;
 229         struct mgmt_hdr *hdr;
 230         struct mgmt_ev_cmd_complete *ev;
 231         int err;
 232
 233         BT_DBG("sock %p", sk);
 234
 235         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 236         if (!skb)
 237                 return -ENOMEM;
 238
 239         hdr = (void *) skb_put(skb, sizeof(*hdr));
 240
 241         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 242         hdr->index = cpu_to_le16(index);
 243         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 244
 245         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 246         ev->opcode = cpu_to_le16(cmd);
 247         ev->status = status;
 248
 249         if (rp)
 250                 memcpy(ev->data, rp, rp_len);
 251
 252         err = sock_queue_rcv_skb(sk, skb);
 253         if (err < 0)
 254                 kfree_skb(skb);
 255
 256         return err;
 257 }
 258
 259 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 260                         u16 data_len)
 261 {
 262         struct mgmt_rp_read_version rp;
 263
 264         BT_DBG("sock %p", sk);
 265
 266         rp.version = MGMT_VERSION;
 267         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 268
 269         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 270                             sizeof(rp));
 271 }
 272
 273 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 274                          u16 data_len)
 275 {
 276         struct mgmt_rp_read_commands *rp;
 277         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 278         const u16 num_events = ARRAY_SIZE(mgmt_events);
 279         __le16 *opcode;
 280         size_t rp_size;
 281         int i, err;
 282
 283         BT_DBG("sock %p", sk);
 284
 285         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 286
 287         rp = kmalloc(rp_size, GFP_KERNEL);
 288         if (!rp)
 289                 return -ENOMEM;
 290
 291         rp->num_commands = __constant_cpu_to_le16(num_commands);
 292         rp->num_events = __constant_cpu_to_le16(num_events);
 293
 294         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 295                 put_unaligned_le16(mgmt_commands[i], opcode);
 296
 297         for (i = 0; i < num_events; i++, opcode++)
 298                 put_unaligned_le16(mgmt_events[i], opcode);
 299
 300         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 301                            rp_size);
 302         kfree(rp);
 303
 304         return err;
 305 }
 306
 307 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 308                            u16 data_len)
 309 {
 310         struct mgmt_rp_read_index_list *rp;
 311         struct hci_dev *d;
 312         size_t rp_len;
 313         u16 count;
 314         int err;
 315
 316         BT_DBG("sock %p", sk);
 317
 318         read_lock(&hci_dev_list_lock);
 319
 320         count = 0;
 321         list_for_each_entry(d, &hci_dev_list, list) {
 322                 if (d->dev_type == HCI_BREDR)
 323                         count++;
 324         }
 325
 326         rp_len = sizeof(*rp) + (2 * count);
 327         rp = kmalloc(rp_len, GFP_ATOMIC);
 328         if (!rp) {
 329                 read_unlock(&hci_dev_list_lock);
 330                 return -ENOMEM;
 331         }
 332
 333         count = 0;
 334         list_for_each_entry(d, &hci_dev_list, list) {
 335                 if (test_bit(HCI_SETUP, &d->dev_flags))
 336                         continue;
 337
 338                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 339                         continue;
 340
 341                 if (d->dev_type == HCI_BREDR) {
 342                         rp->index[count++] = cpu_to_le16(d->id);
 343                         BT_DBG("Added hci%u", d->id);
 344                 }
 345         }
 346
 347         rp->num_controllers = cpu_to_le16(count);
 348         rp_len = sizeof(*rp) + (2 * count);
 349
 350         read_unlock(&hci_dev_list_lock);
 351
 352         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 353                            rp_len);
 354
 355         kfree(rp);
 356
 357         return err;
 358 }
 359
 360 static u32 get_supported_settings(struct hci_dev *hdev)
 361 {
 362         u32 settings = 0;
 363
 364         settings |= MGMT_SETTING_POWERED;
 365         settings |= MGMT_SETTING_PAIRABLE;
 366
 367         if (lmp_bredr_capable(hdev)) {
 368                 settings |= MGMT_SETTING_CONNECTABLE;
 369                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 370                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 371                 settings |= MGMT_SETTING_DISCOVERABLE;
 372                 settings |= MGMT_SETTING_BREDR;
 373                 settings |= MGMT_SETTING_LINK_SECURITY;
 374
 375                 if (lmp_ssp_capable(hdev)) {
 376                         settings |= MGMT_SETTING_SSP;
 377                         settings |= MGMT_SETTING_HS;
 378                 }
 379         }
 380
 381         if (lmp_le_capable(hdev)) {
 382                 settings |= MGMT_SETTING_LE;
 383                 settings |= MGMT_SETTING_ADVERTISING;
 384         }
 385
 386         return settings;
 387 }
 388
 389 static u32 get_current_settings(struct hci_dev *hdev)
 390 {
 391         u32 settings = 0;
 392
 393         if (hdev_is_powered(hdev))
 394                 settings |= MGMT_SETTING_POWERED;
 395
 396         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 397                 settings |= MGMT_SETTING_CONNECTABLE;
 398
 399         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 400                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 401
 402         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 403                 settings |= MGMT_SETTING_DISCOVERABLE;
 404
 405         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 406                 settings |= MGMT_SETTING_PAIRABLE;
 407
 408         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 409                 settings |= MGMT_SETTING_BREDR;
 410
 411         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 412                 settings |= MGMT_SETTING_LE;
 413
 414         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 415                 settings |= MGMT_SETTING_LINK_SECURITY;
 416
 417         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 418                 settings |= MGMT_SETTING_SSP;
 419
 420         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 421                 settings |= MGMT_SETTING_HS;
 422
 423         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 424                 settings |= MGMT_SETTING_ADVERTISING;
 425
 426         return settings;
 427 }
 428
 429 #define PNP_INFO_SVCLASS_ID             0x1200
 430
 431 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 432 {
 433         u8 *ptr = data, *uuids_start = NULL;
 434         struct bt_uuid *uuid;
 435
 436         if (len < 4)
 437                 return ptr;
 438
 439         list_for_each_entry(uuid, &hdev->uuids, list) {
 440                 u16 uuid16;
 441
 442                 if (uuid->size != 16)
 443                         continue;
 444
 445                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 446                 if (uuid16 < 0x1100)
 447                         continue;
 448
 449                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 450                         continue;
 451
 452                 if (!uuids_start) {
 453                         uuids_start = ptr;
 454                         uuids_start[0] = 1;
 455                         uuids_start[1] = EIR_UUID16_ALL;
 456                         ptr += 2;
 457                 }
 458
 459                 /* Stop if not enough space to put next UUID */
 460                 if ((ptr - data) + sizeof(u16) > len) {
 461                         uuids_start[1] = EIR_UUID16_SOME;
 462                         break;
 463                 }
 464
 465                 *ptr++ = (uuid16 & 0x00ff);
 466                 *ptr++ = (uuid16 & 0xff00) >> 8;
 467                 uuids_start[0] += sizeof(uuid16);
 468         }
 469
 470         return ptr;
 471 }
 472
 473 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 474 {
 475         u8 *ptr = data, *uuids_start = NULL;
 476         struct bt_uuid *uuid;
 477
 478         if (len < 6)
 479                 return ptr;
 480
 481         list_for_each_entry(uuid, &hdev->uuids, list) {
 482                 if (uuid->size != 32)
 483                         continue;
 484
 485                 if (!uuids_start) {
 486                         uuids_start = ptr;
 487                         uuids_start[0] = 1;
 488                         uuids_start[1] = EIR_UUID32_ALL;
 489                         ptr += 2;
 490                 }
 491
 492                 /* Stop if not enough space to put next UUID */
 493                 if ((ptr - data) + sizeof(u32) > len) {
 494                         uuids_start[1] = EIR_UUID32_SOME;
 495                         break;
 496                 }
 497
 498                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 499                 ptr += sizeof(u32);
 500                 uuids_start[0] += sizeof(u32);
 501         }
 502
 503         return ptr;
 504 }
 505
 506 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 507 {
 508         u8 *ptr = data, *uuids_start = NULL;
 509         struct bt_uuid *uuid;
 510
 511         if (len < 18)
 512                 return ptr;
 513
 514         list_for_each_entry(uuid, &hdev->uuids, list) {
 515                 if (uuid->size != 128)
 516                         continue;
 517
 518                 if (!uuids_start) {
 519                         uuids_start = ptr;
 520                         uuids_start[0] = 1;
 521                         uuids_start[1] = EIR_UUID128_ALL;
 522                         ptr += 2;
 523                 }
 524
 525                 /* Stop if not enough space to put next UUID */
 526                 if ((ptr - data) + 16 > len) {
 527                         uuids_start[1] = EIR_UUID128_SOME;
 528                         break;
 529                 }
 530
 531                 memcpy(ptr, uuid->uuid, 16);
 532                 ptr += 16;
 533                 uuids_start[0] += 16;
 534         }
 535
 536         return ptr;
 537 }
 538
 539 static u8 create_ad(struct hci_dev *hdev, u8 *ptr)
 540 {
 541         u8 ad_len = 0, flags = 0;
 542         size_t name_len;
 543
 544         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 545                 flags |= LE_AD_GENERAL;
 546
 547         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
 548                 if (lmp_le_br_capable(hdev))
 549                         flags |= LE_AD_SIM_LE_BREDR_CTRL;
 550                 if (lmp_host_le_br_capable(hdev))
 551                         flags |= LE_AD_SIM_LE_BREDR_HOST;
 552         } else {
 553                 flags |= LE_AD_NO_BREDR;
 554         }
 555
 556         if (flags) {
 557                 BT_DBG("adv flags 0x%02x", flags);
 558
 559                 ptr[0] = 2;
 560                 ptr[1] = EIR_FLAGS;
 561                 ptr[2] = flags;
 562
 563                 ad_len += 3;
 564                 ptr += 3;
 565         }
 566
 567         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 568                 ptr[0] = 2;
 569                 ptr[1] = EIR_TX_POWER;
 570                 ptr[2] = (u8) hdev->adv_tx_power;
 571
 572                 ad_len += 3;
 573                 ptr += 3;
 574         }
 575
 576         name_len = strlen(hdev->dev_name);
 577         if (name_len > 0) {
 578                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 579
 580                 if (name_len > max_len) {
 581                         name_len = max_len;
 582                         ptr[1] = EIR_NAME_SHORT;
 583                 } else
 584                         ptr[1] = EIR_NAME_COMPLETE;
 585
 586                 ptr[0] = name_len + 1;
 587
 588                 memcpy(ptr + 2, hdev->dev_name, name_len);
 589
 590                 ad_len += (name_len + 2);
 591                 ptr += (name_len + 2);
 592         }
 593
 594         return ad_len;
 595 }
 596
 597 static void update_ad(struct hci_request *req)
 598 {
 599         struct hci_dev *hdev = req->hdev;
 600         struct hci_cp_le_set_adv_data cp;
 601         u8 len;
 602
 603         if (!lmp_le_capable(hdev))
 604                 return;
 605
 606         memset(&cp, 0, sizeof(cp));
 607
 608         len = create_ad(hdev, cp.data);
 609
 610         if (hdev->adv_data_len == len &&
 611             memcmp(cp.data, hdev->adv_data, len) == 0)
 612                 return;
 613
 614         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 615         hdev->adv_data_len = len;
 616
 617         cp.length = len;
 618
 619         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 620 }
 621
 622 static void create_eir(struct hci_dev *hdev, u8 *data)
 623 {
 624         u8 *ptr = data;
 625         size_t name_len;
 626
 627         name_len = strlen(hdev->dev_name);
 628
 629         if (name_len > 0) {
 630                 /* EIR Data type */
 631                 if (name_len > 48) {
 632                         name_len = 48;
 633                         ptr[1] = EIR_NAME_SHORT;
 634                 } else
 635                         ptr[1] = EIR_NAME_COMPLETE;
 636
 637                 /* EIR Data length */
 638                 ptr[0] = name_len + 1;
 639
 640                 memcpy(ptr + 2, hdev->dev_name, name_len);
 641
 642                 ptr += (name_len + 2);
 643         }
 644
 645         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 646                 ptr[0] = 2;
 647                 ptr[1] = EIR_TX_POWER;
 648                 ptr[2] = (u8) hdev->inq_tx_power;
 649
 650                 ptr += 3;
 651         }
 652
 653         if (hdev->devid_source > 0) {
 654                 ptr[0] = 9;
 655                 ptr[1] = EIR_DEVICE_ID;
 656
 657                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 658                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 659                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 660                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 661
 662                 ptr += 10;
 663         }
 664
 665         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 666         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 667         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 668 }
 669
 670 static void update_eir(struct hci_request *req)
 671 {
 672         struct hci_dev *hdev = req->hdev;
 673         struct hci_cp_write_eir cp;
 674
 675         if (!hdev_is_powered(hdev))
 676                 return;
 677
 678         if (!lmp_ext_inq_capable(hdev))
 679                 return;
 680
 681         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 682                 return;
 683
 684         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 685                 return;
 686
 687         memset(&cp, 0, sizeof(cp));
 688
 689         create_eir(hdev, cp.data);
 690
 691         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 692                 return;
 693
 694         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 695
 696         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 697 }
 698
 699 static u8 get_service_classes(struct hci_dev *hdev)
 700 {
 701         struct bt_uuid *uuid;
 702         u8 val = 0;
 703
 704         list_for_each_entry(uuid, &hdev->uuids, list)
 705                 val |= uuid->svc_hint;
 706
 707         return val;
 708 }
 709
 710 static void update_class(struct hci_request *req)
 711 {
 712         struct hci_dev *hdev = req->hdev;
 713         u8 cod[3];
 714
 715         BT_DBG("%s", hdev->name);
 716
 717         if (!hdev_is_powered(hdev))
 718                 return;
 719
 720         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 721                 return;
 722
 723         cod[0] = hdev->minor_class;
 724         cod[1] = hdev->major_class;
 725         cod[2] = get_service_classes(hdev);
 726
 727         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 728                 cod[1] |= 0x20;
 729
 730         if (memcmp(cod, hdev->dev_class, 3) == 0)
 731                 return;
 732
 733         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 734 }
 735
 736 static void service_cache_off(struct work_struct *work)
 737 {
 738         struct hci_dev *hdev = container_of(work, struct hci_dev,
 739                                             service_cache.work);
 740         struct hci_request req;
 741
 742         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 743                 return;
 744
 745         hci_req_init(&req, hdev);
 746
 747         hci_dev_lock(hdev);
 748
 749         update_eir(&req);
 750         update_class(&req);
 751
 752         hci_dev_unlock(hdev);
 753
 754         hci_req_run(&req, NULL);
 755 }
 756
 757 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 758 {
 759         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 760                 return;
 761
 762         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 763
 764         /* Non-mgmt controlled devices get this bit set
 765          * implicitly so that pairing works for them, however
 766          * for mgmt we require user-space to explicitly enable
 767          * it
 768          */
 769         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 770 }
 771
 772 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 773                                 void *data, u16 data_len)
 774 {
 775         struct mgmt_rp_read_info rp;
 776
 777         BT_DBG("sock %p %s", sk, hdev->name);
 778
 779         hci_dev_lock(hdev);
 780
 781         memset(&rp, 0, sizeof(rp));
 782
 783         bacpy(&rp.bdaddr, &hdev->bdaddr);
 784
 785         rp.version = hdev->hci_ver;
 786         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 787
 788         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 789         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 790
 791         memcpy(rp.dev_class, hdev->dev_class, 3);
 792
 793         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 794         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 795
 796         hci_dev_unlock(hdev);
 797
 798         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 799                             sizeof(rp));
 800 }
 801
 802 static void mgmt_pending_free(struct pending_cmd *cmd)
 803 {
 804         sock_put(cmd->sk);
 805         kfree(cmd->param);
 806         kfree(cmd);
 807 }
 808
 809 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 810                                             struct hci_dev *hdev, void *data,
 811                                             u16 len)
 812 {
 813         struct pending_cmd *cmd;
 814
 815         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 816         if (!cmd)
 817                 return NULL;
 818
 819         cmd->opcode = opcode;
 820         cmd->index = hdev->id;
 821
 822         cmd->param = kmalloc(len, GFP_KERNEL);
 823         if (!cmd->param) {
 824                 kfree(cmd);
 825                 return NULL;
 826         }
 827
 828         if (data)
 829                 memcpy(cmd->param, data, len);
 830
 831         cmd->sk = sk;
 832         sock_hold(sk);
 833
 834         list_add(&cmd->list, &hdev->mgmt_pending);
 835
 836         return cmd;
 837 }
 838
 839 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 840                                  void (*cb)(struct pending_cmd *cmd,
 841                                             void *data),
 842                                  void *data)
 843 {
 844         struct pending_cmd *cmd, *tmp;
 845
 846         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 847                 if (opcode > 0 && cmd->opcode != opcode)
 848                         continue;
 849
 850                 cb(cmd, data);
 851         }
 852 }
 853
 854 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 855 {
 856         struct pending_cmd *cmd;
 857
 858         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 859                 if (cmd->opcode == opcode)
 860                         return cmd;
 861         }
 862
 863         return NULL;
 864 }
 865
 866 static void mgmt_pending_remove(struct pending_cmd *cmd)
 867 {
 868         list_del(&cmd->list);
 869         mgmt_pending_free(cmd);
 870 }
 871
 872 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 873 {
 874         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 875
 876         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 877                             sizeof(settings));
 878 }
 879
 880 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 881                        u16 len)
 882 {
 883         struct mgmt_mode *cp = data;
 884         struct pending_cmd *cmd;
 885         int err;
 886
 887         BT_DBG("request for %s", hdev->name);
 888
 889         if (cp->val != 0x00 && cp->val != 0x01)
 890                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 891                                   MGMT_STATUS_INVALID_PARAMS);
 892
 893         hci_dev_lock(hdev);
 894
 895         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 896                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 897                                  MGMT_STATUS_BUSY);
 898                 goto failed;
 899         }
 900
 901         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 902                 cancel_delayed_work(&hdev->power_off);
 903
 904                 if (cp->val) {
 905                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 906                                          data, len);
 907                         err = mgmt_powered(hdev, 1);
 908                         goto failed;
 909                 }
 910         }
 911
 912         if (!!cp->val == hdev_is_powered(hdev)) {
 913                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 914                 goto failed;
 915         }
 916
 917         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 918         if (!cmd) {
 919                 err = -ENOMEM;
 920                 goto failed;
 921         }
 922
 923         if (cp->val)
 924                 queue_work(hdev->req_workqueue, &hdev->power_on);
 925         else
 926                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 927
 928         err = 0;
 929
 930 failed:
 931         hci_dev_unlock(hdev);
 932         return err;
 933 }
 934
 935 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 936                       struct sock *skip_sk)
 937 {
 938         struct sk_buff *skb;
 939         struct mgmt_hdr *hdr;
 940
 941         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 942         if (!skb)
 943                 return -ENOMEM;
 944
 945         hdr = (void *) skb_put(skb, sizeof(*hdr));
 946         hdr->opcode = cpu_to_le16(event);
 947         if (hdev)
 948                 hdr->index = cpu_to_le16(hdev->id);
 949         else
 950                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 951         hdr->len = cpu_to_le16(data_len);
 952
 953         if (data)
 954                 memcpy(skb_put(skb, data_len), data, data_len);
 955
 956         /* Time stamp */
 957         __net_timestamp(skb);
 958
 959         hci_send_to_control(skb, skip_sk);
 960         kfree_skb(skb);
 961
 962         return 0;
 963 }
 964
 965 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 966 {
 967         __le32 ev;
 968
 969         ev = cpu_to_le32(get_current_settings(hdev));
 970
 971         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 972 }
 973
 974 struct cmd_lookup {
 975         struct sock *sk;
 976         struct hci_dev *hdev;
 977         u8 mgmt_status;
 978 };
 979
 980 static void settings_rsp(struct pending_cmd *cmd, void *data)
 981 {
 982         struct cmd_lookup *match = data;
 983
 984         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
 985
 986         list_del(&cmd->list);
 987
 988         if (match->sk == NULL) {
 989                 match->sk = cmd->sk;
 990                 sock_hold(match->sk);
 991         }
 992
 993         mgmt_pending_free(cmd);
 994 }
 995
 996 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
 997 {
 998         u8 *status = data;
 999
1000         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1001         mgmt_pending_remove(cmd);
1002 }
1003
1004 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1005 {
1006         if (!lmp_bredr_capable(hdev))
1007                 return MGMT_STATUS_NOT_SUPPORTED;
1008         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1009                 return MGMT_STATUS_REJECTED;
1010         else
1011                 return MGMT_STATUS_SUCCESS;
1012 }
1013
1014 static u8 mgmt_le_support(struct hci_dev *hdev)
1015 {
1016         if (!lmp_le_capable(hdev))
1017                 return MGMT_STATUS_NOT_SUPPORTED;
1018         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1019                 return MGMT_STATUS_REJECTED;
1020         else
1021                 return MGMT_STATUS_SUCCESS;
1022 }
1023
1024 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1025 {
1026         struct pending_cmd *cmd;
1027         struct mgmt_mode *cp;
1028         struct hci_request req;
1029         bool changed;
1030
1031         BT_DBG("status 0x%02x", status);
1032
1033         hci_dev_lock(hdev);
1034
1035         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1036         if (!cmd)
1037                 goto unlock;
1038
1039         if (status) {
1040                 u8 mgmt_err = mgmt_status(status);
1041                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1042                 goto remove_cmd;
1043         }
1044
1045         cp = cmd->param;
1046         if (cp->val)
1047                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1048                                             &hdev->dev_flags);
1049         else
1050                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1051                                              &hdev->dev_flags);
1052
1053         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1054
1055         if (changed)
1056                 new_settings(hdev, cmd->sk);
1057
1058         /* When the discoverable mode gets changed, make sure
1059          * that class of device has the limited discoverable
1060          * bit correctly set.
1061          */
1062         hci_req_init(&req, hdev);
1063         update_class(&req);
1064         hci_req_run(&req, NULL);
1065
1066 remove_cmd:
1067         mgmt_pending_remove(cmd);
1068
1069 unlock:
1070         hci_dev_unlock(hdev);
1071 }
1072
1073 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1074                             u16 len)
1075 {
1076         struct mgmt_cp_set_discoverable *cp = data;
1077         struct pending_cmd *cmd;
1078         struct hci_request req;
1079         u16 timeout;
1080         u8 scan, status;
1081         int err;
1082
1083         BT_DBG("request for %s", hdev->name);
1084
1085         status = mgmt_bredr_support(hdev);
1086         if (status)
1087                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1088                                   status);
1089
1090         if (cp->val != 0x00 && cp->val != 0x01)
1091                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1092                                   MGMT_STATUS_INVALID_PARAMS);
1093
1094         timeout = __le16_to_cpu(cp->timeout);
1095         if (!cp->val && timeout > 0)
1096                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1097                                   MGMT_STATUS_INVALID_PARAMS);
1098
1099         hci_dev_lock(hdev);
1100
1101         if (!hdev_is_powered(hdev) && timeout > 0) {
1102                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1103                                  MGMT_STATUS_NOT_POWERED);
1104                 goto failed;
1105         }
1106
1107         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1108             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1109                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1110                                  MGMT_STATUS_BUSY);
1111                 goto failed;
1112         }
1113
1114         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1115                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1116                                  MGMT_STATUS_REJECTED);
1117                 goto failed;
1118         }
1119
1120         if (!hdev_is_powered(hdev)) {
1121                 bool changed = false;
1122
1123                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1124                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1125                         changed = true;
1126                 }
1127
1128                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1129                 if (err < 0)
1130                         goto failed;
1131
1132                 if (changed)
1133                         err = new_settings(hdev, sk);
1134
1135                 goto failed;
1136         }
1137
1138         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1139                 if (hdev->discov_timeout > 0) {
1140                         cancel_delayed_work(&hdev->discov_off);
1141                         hdev->discov_timeout = 0;
1142                 }
1143
1144                 if (cp->val && timeout > 0) {
1145                         hdev->discov_timeout = timeout;
1146                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1147                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
1148                 }
1149
1150                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1151                 goto failed;
1152         }
1153
1154         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1155         if (!cmd) {
1156                 err = -ENOMEM;
1157                 goto failed;
1158         }
1159
1160         hci_req_init(&req, hdev);
1161
1162         scan = SCAN_PAGE;
1163
1164         if (cp->val)
1165                 scan |= SCAN_INQUIRY;
1166         else
1167                 cancel_delayed_work(&hdev->discov_off);
1168
1169         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1170
1171         err = hci_req_run(&req, set_discoverable_complete);
1172         if (err < 0)
1173                 mgmt_pending_remove(cmd);
1174
1175         if (cp->val)
1176                 hdev->discov_timeout = timeout;
1177
1178 failed:
1179         hci_dev_unlock(hdev);
1180         return err;
1181 }
1182
1183 static void write_fast_connectable(struct hci_request *req, bool enable)
1184 {
1185         struct hci_dev *hdev = req->hdev;
1186         struct hci_cp_write_page_scan_activity acp;
1187         u8 type;
1188
1189         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1190                 return;
1191
1192         if (enable) {
1193                 type = PAGE_SCAN_TYPE_INTERLACED;
1194
1195                 /* 160 msec page scan interval */
1196                 acp.interval = __constant_cpu_to_le16(0x0100);
1197         } else {
1198                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1199
1200                 /* default 1.28 sec page scan */
1201                 acp.interval = __constant_cpu_to_le16(0x0800);
1202         }
1203
1204         acp.window = __constant_cpu_to_le16(0x0012);
1205
1206         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1207             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1208                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1209                             sizeof(acp), &acp);
1210
1211         if (hdev->page_scan_type != type)
1212                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1213 }
1214
1215 static u8 get_adv_type(struct hci_dev *hdev)
1216 {
1217         struct pending_cmd *cmd;
1218         bool connectable;
1219
1220         /* If there's a pending mgmt command the flag will not yet have
1221          * it's final value, so check for this first.
1222          */
1223         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1224         if (cmd) {
1225                 struct mgmt_mode *cp = cmd->param;
1226                 connectable = !!cp->val;
1227         } else {
1228                 connectable = test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1229         }
1230
1231         return connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1232 }
1233
1234 static void enable_advertising(struct hci_request *req)
1235 {
1236         struct hci_dev *hdev = req->hdev;
1237         struct hci_cp_le_set_adv_param cp;
1238         u8 enable = 0x01;
1239
1240         memset(&cp, 0, sizeof(cp));
1241         cp.min_interval = __constant_cpu_to_le16(0x0800);
1242         cp.max_interval = __constant_cpu_to_le16(0x0800);
1243         cp.type = get_adv_type(hdev);
1244         if (bacmp(&hdev->bdaddr, BDADDR_ANY))
1245                 cp.own_address_type = ADDR_LE_DEV_PUBLIC;
1246         else
1247                 cp.own_address_type = ADDR_LE_DEV_RANDOM;
1248         cp.channel_map = 0x07;
1249
1250         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1251
1252         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1253 }
1254
1255 static void disable_advertising(struct hci_request *req)
1256 {
1257         u8 enable = 0x00;
1258
1259         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1260 }
1261
1262 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1263 {
1264         struct pending_cmd *cmd;
1265         struct mgmt_mode *cp;
1266         bool changed;
1267
1268         BT_DBG("status 0x%02x", status);
1269
1270         hci_dev_lock(hdev);
1271
1272         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1273         if (!cmd)
1274                 goto unlock;
1275
1276         if (status) {
1277                 u8 mgmt_err = mgmt_status(status);
1278                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1279                 goto remove_cmd;
1280         }
1281
1282         cp = cmd->param;
1283         if (cp->val)
1284                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1285         else
1286                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1287
1288         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1289
1290         if (changed)
1291                 new_settings(hdev, cmd->sk);
1292
1293 remove_cmd:
1294         mgmt_pending_remove(cmd);
1295
1296 unlock:
1297         hci_dev_unlock(hdev);
1298 }
1299
1300 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1301                            u16 len)
1302 {
1303         struct mgmt_mode *cp = data;
1304         struct pending_cmd *cmd;
1305         struct hci_request req;
1306         u8 scan;
1307         int err;
1308
1309         BT_DBG("request for %s", hdev->name);
1310
1311         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1312             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1313                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1314                                   MGMT_STATUS_REJECTED);
1315
1316         if (cp->val != 0x00 && cp->val != 0x01)
1317                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1318                                   MGMT_STATUS_INVALID_PARAMS);
1319
1320         hci_dev_lock(hdev);
1321
1322         if (!hdev_is_powered(hdev)) {
1323                 bool changed = false;
1324
1325                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1326                         changed = true;
1327
1328                 if (cp->val) {
1329                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1330                 } else {
1331                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1332                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1333                 }
1334
1335                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1336                 if (err < 0)
1337                         goto failed;
1338
1339                 if (changed)
1340                         err = new_settings(hdev, sk);
1341
1342                 goto failed;
1343         }
1344
1345         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1346             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1347                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1348                                  MGMT_STATUS_BUSY);
1349                 goto failed;
1350         }
1351
1352         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1353         if (!cmd) {
1354                 err = -ENOMEM;
1355                 goto failed;
1356         }
1357
1358         hci_req_init(&req, hdev);
1359
1360         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
1361             cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1362                 if (cp->val) {
1363                         scan = SCAN_PAGE;
1364                 } else {
1365                         scan = 0;
1366
1367                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1368                             hdev->discov_timeout > 0)
1369                                 cancel_delayed_work(&hdev->discov_off);
1370                 }
1371
1372                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1373         }
1374
1375         /* If we're going from non-connectable to connectable or
1376          * vice-versa when fast connectable is enabled ensure that fast
1377          * connectable gets disabled. write_fast_connectable won't do
1378          * anything if the page scan parameters are already what they
1379          * should be.
1380          */
1381         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1382                 write_fast_connectable(&req, false);
1383
1384         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) &&
1385             hci_conn_num(hdev, LE_LINK) == 0) {
1386                 disable_advertising(&req);
1387                 enable_advertising(&req);
1388         }
1389
1390         err = hci_req_run(&req, set_connectable_complete);
1391         if (err < 0) {
1392                 mgmt_pending_remove(cmd);
1393                 if (err == -ENODATA)
1394                         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE,
1395                                                 hdev);
1396                 goto failed;
1397         }
1398
1399 failed:
1400         hci_dev_unlock(hdev);
1401         return err;
1402 }
1403
1404 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1405                         u16 len)
1406 {
1407         struct mgmt_mode *cp = data;
1408         bool changed;
1409         int err;
1410
1411         BT_DBG("request for %s", hdev->name);
1412
1413         if (cp->val != 0x00 && cp->val != 0x01)
1414                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1415                                   MGMT_STATUS_INVALID_PARAMS);
1416
1417         hci_dev_lock(hdev);
1418
1419         if (cp->val)
1420                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1421         else
1422                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1423
1424         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1425         if (err < 0)
1426                 goto unlock;
1427
1428         if (changed)
1429                 err = new_settings(hdev, sk);
1430
1431 unlock:
1432         hci_dev_unlock(hdev);
1433         return err;
1434 }
1435
1436 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1437                              u16 len)
1438 {
1439         struct mgmt_mode *cp = data;
1440         struct pending_cmd *cmd;
1441         u8 val, status;
1442         int err;
1443
1444         BT_DBG("request for %s", hdev->name);
1445
1446         status = mgmt_bredr_support(hdev);
1447         if (status)
1448                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1449                                   status);
1450
1451         if (cp->val != 0x00 && cp->val != 0x01)
1452                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1453                                   MGMT_STATUS_INVALID_PARAMS);
1454
1455         hci_dev_lock(hdev);
1456
1457         if (!hdev_is_powered(hdev)) {
1458                 bool changed = false;
1459
1460                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1461                                           &hdev->dev_flags)) {
1462                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1463                         changed = true;
1464                 }
1465
1466                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1467                 if (err < 0)
1468                         goto failed;
1469
1470                 if (changed)
1471                         err = new_settings(hdev, sk);
1472
1473                 goto failed;
1474         }
1475
1476         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1477                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1478                                  MGMT_STATUS_BUSY);
1479                 goto failed;
1480         }
1481
1482         val = !!cp->val;
1483
1484         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1485                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1486                 goto failed;
1487         }
1488
1489         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1490         if (!cmd) {
1491                 err = -ENOMEM;
1492                 goto failed;
1493         }
1494
1495         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1496         if (err < 0) {
1497                 mgmt_pending_remove(cmd);
1498                 goto failed;
1499         }
1500
1501 failed:
1502         hci_dev_unlock(hdev);
1503         return err;
1504 }
1505
1506 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1507 {
1508         struct mgmt_mode *cp = data;
1509         struct pending_cmd *cmd;
1510         u8 status;
1511         int err;
1512
1513         BT_DBG("request for %s", hdev->name);
1514
1515         status = mgmt_bredr_support(hdev);
1516         if (status)
1517                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1518
1519         if (!lmp_ssp_capable(hdev))
1520                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1521                                   MGMT_STATUS_NOT_SUPPORTED);
1522
1523         if (cp->val != 0x00 && cp->val != 0x01)
1524                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1525                                   MGMT_STATUS_INVALID_PARAMS);
1526
1527         hci_dev_lock(hdev);
1528
1529         if (!hdev_is_powered(hdev)) {
1530                 bool changed;
1531
1532                 if (cp->val) {
1533                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
1534                                                     &hdev->dev_flags);
1535                 } else {
1536                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
1537                                                      &hdev->dev_flags);
1538                         if (!changed)
1539                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
1540                                                              &hdev->dev_flags);
1541                         else
1542                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1543                 }
1544
1545                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1546                 if (err < 0)
1547                         goto failed;
1548
1549                 if (changed)
1550                         err = new_settings(hdev, sk);
1551
1552                 goto failed;
1553         }
1554
1555         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
1556             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
1557                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1558                                  MGMT_STATUS_BUSY);
1559                 goto failed;
1560         }
1561
1562         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1563                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1564                 goto failed;
1565         }
1566
1567         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1568         if (!cmd) {
1569                 err = -ENOMEM;
1570                 goto failed;
1571         }
1572
1573         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1574         if (err < 0) {
1575                 mgmt_pending_remove(cmd);
1576                 goto failed;
1577         }
1578
1579 failed:
1580         hci_dev_unlock(hdev);
1581         return err;
1582 }
1583
1584 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1585 {
1586         struct mgmt_mode *cp = data;
1587         bool changed;
1588         u8 status;
1589         int err;
1590
1591         BT_DBG("request for %s", hdev->name);
1592
1593         status = mgmt_bredr_support(hdev);
1594         if (status)
1595                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1596
1597         if (!lmp_ssp_capable(hdev))
1598                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1599                                   MGMT_STATUS_NOT_SUPPORTED);
1600
1601         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
1602                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1603                                   MGMT_STATUS_REJECTED);
1604
1605         if (cp->val != 0x00 && cp->val != 0x01)
1606                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1607                                   MGMT_STATUS_INVALID_PARAMS);
1608
1609         hci_dev_lock(hdev);
1610
1611         if (cp->val) {
1612                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1613         } else {
1614                 if (hdev_is_powered(hdev)) {
1615                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1616                                          MGMT_STATUS_REJECTED);
1617                         goto unlock;
1618                 }
1619
1620                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1621         }
1622
1623         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1624         if (err < 0)
1625                 goto unlock;
1626
1627         if (changed)
1628                 err = new_settings(hdev, sk);
1629
1630 unlock:
1631         hci_dev_unlock(hdev);
1632         return err;
1633 }
1634
1635 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1636 {
1637         struct cmd_lookup match = { NULL, hdev };
1638
1639         if (status) {
1640                 u8 mgmt_err = mgmt_status(status);
1641
1642                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1643                                      &mgmt_err);
1644                 return;
1645         }
1646
1647         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1648
1649         new_settings(hdev, match.sk);
1650
1651         if (match.sk)
1652                 sock_put(match.sk);
1653
1654         /* Make sure the controller has a good default for
1655          * advertising data. Restrict the update to when LE
1656          * has actually been enabled. During power on, the
1657          * update in powered_update_hci will take care of it.
1658          */
1659         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1660                 struct hci_request req;
1661
1662                 hci_dev_lock(hdev);
1663
1664                 hci_req_init(&req, hdev);
1665                 update_ad(&req);
1666                 hci_req_run(&req, NULL);
1667
1668                 hci_dev_unlock(hdev);
1669         }
1670 }
1671
1672 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1673 {
1674         struct mgmt_mode *cp = data;
1675         struct hci_cp_write_le_host_supported hci_cp;
1676         struct pending_cmd *cmd;
1677         struct hci_request req;
1678         int err;
1679         u8 val, enabled;
1680
1681         BT_DBG("request for %s", hdev->name);
1682
1683         if (!lmp_le_capable(hdev))
1684                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1685                                   MGMT_STATUS_NOT_SUPPORTED);
1686
1687         if (cp->val != 0x00 && cp->val != 0x01)
1688                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1689                                   MGMT_STATUS_INVALID_PARAMS);
1690
1691         /* LE-only devices do not allow toggling LE on/off */
1692         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1693                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1694                                   MGMT_STATUS_REJECTED);
1695
1696         hci_dev_lock(hdev);
1697
1698         val = !!cp->val;
1699         enabled = lmp_host_le_capable(hdev);
1700
1701         if (!hdev_is_powered(hdev) || val == enabled) {
1702                 bool changed = false;
1703
1704                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1705                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1706                         changed = true;
1707                 }
1708
1709                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
1710                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1711                         changed = true;
1712                 }
1713
1714                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1715                 if (err < 0)
1716                         goto unlock;
1717
1718                 if (changed)
1719                         err = new_settings(hdev, sk);
1720
1721                 goto unlock;
1722         }
1723
1724         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1725             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1726                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1727                                  MGMT_STATUS_BUSY);
1728                 goto unlock;
1729         }
1730
1731         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1732         if (!cmd) {
1733                 err = -ENOMEM;
1734                 goto unlock;
1735         }
1736
1737         hci_req_init(&req, hdev);
1738
1739         memset(&hci_cp, 0, sizeof(hci_cp));
1740
1741         if (val) {
1742                 hci_cp.le = val;
1743                 hci_cp.simul = lmp_le_br_capable(hdev);
1744         } else {
1745                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1746                         disable_advertising(&req);
1747         }
1748
1749         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1750                     &hci_cp);
1751
1752         err = hci_req_run(&req, le_enable_complete);
1753         if (err < 0)
1754                 mgmt_pending_remove(cmd);
1755
1756 unlock:
1757         hci_dev_unlock(hdev);
1758         return err;
1759 }
1760
1761 /* This is a helper function to test for pending mgmt commands that can
1762  * cause CoD or EIR HCI commands. We can only allow one such pending
1763  * mgmt command at a time since otherwise we cannot easily track what
1764  * the current values are, will be, and based on that calculate if a new
1765  * HCI command needs to be sent and if yes with what value.
1766  */
1767 static bool pending_eir_or_class(struct hci_dev *hdev)
1768 {
1769         struct pending_cmd *cmd;
1770
1771         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1772                 switch (cmd->opcode) {
1773                 case MGMT_OP_ADD_UUID:
1774                 case MGMT_OP_REMOVE_UUID:
1775                 case MGMT_OP_SET_DEV_CLASS:
1776                 case MGMT_OP_SET_POWERED:
1777                         return true;
1778                 }
1779         }
1780
1781         return false;
1782 }
1783
1784 static const u8 bluetooth_base_uuid[] = {
1785                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1786                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1787 };
1788
1789 static u8 get_uuid_size(const u8 *uuid)
1790 {
1791         u32 val;
1792
1793         if (memcmp(uuid, bluetooth_base_uuid, 12))
1794                 return 128;
1795
1796         val = get_unaligned_le32(&uuid[12]);
1797         if (val > 0xffff)
1798                 return 32;
1799
1800         return 16;
1801 }
1802
1803 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1804 {
1805         struct pending_cmd *cmd;
1806
1807         hci_dev_lock(hdev);
1808
1809         cmd = mgmt_pending_find(mgmt_op, hdev);
1810         if (!cmd)
1811                 goto unlock;
1812
1813         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1814                      hdev->dev_class, 3);
1815
1816         mgmt_pending_remove(cmd);
1817
1818 unlock:
1819         hci_dev_unlock(hdev);
1820 }
1821
1822 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1823 {
1824         BT_DBG("status 0x%02x", status);
1825
1826         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1827 }
1828
1829 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1830 {
1831         struct mgmt_cp_add_uuid *cp = data;
1832         struct pending_cmd *cmd;
1833         struct hci_request req;
1834         struct bt_uuid *uuid;
1835         int err;
1836
1837         BT_DBG("request for %s", hdev->name);
1838
1839         hci_dev_lock(hdev);
1840
1841         if (pending_eir_or_class(hdev)) {
1842                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1843                                  MGMT_STATUS_BUSY);
1844                 goto failed;
1845         }
1846
1847         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1848         if (!uuid) {
1849                 err = -ENOMEM;
1850                 goto failed;
1851         }
1852
1853         memcpy(uuid->uuid, cp->uuid, 16);
1854         uuid->svc_hint = cp->svc_hint;
1855         uuid->size = get_uuid_size(cp->uuid);
1856
1857         list_add_tail(&uuid->list, &hdev->uuids);
1858
1859         hci_req_init(&req, hdev);
1860
1861         update_class(&req);
1862         update_eir(&req);
1863
1864         err = hci_req_run(&req, add_uuid_complete);
1865         if (err < 0) {
1866                 if (err != -ENODATA)
1867                         goto failed;
1868
1869                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1870                                    hdev->dev_class, 3);
1871                 goto failed;
1872         }
1873
1874         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1875         if (!cmd) {
1876                 err = -ENOMEM;
1877                 goto failed;
1878         }
1879
1880         err = 0;
1881
1882 failed:
1883         hci_dev_unlock(hdev);
1884         return err;
1885 }
1886
1887 static bool enable_service_cache(struct hci_dev *hdev)
1888 {
1889         if (!hdev_is_powered(hdev))
1890                 return false;
1891
1892         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1893                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1894                                    CACHE_TIMEOUT);
1895                 return true;
1896         }
1897
1898         return false;
1899 }
1900
1901 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1902 {
1903         BT_DBG("status 0x%02x", status);
1904
1905         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1906 }
1907
1908 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1909                        u16 len)
1910 {
1911         struct mgmt_cp_remove_uuid *cp = data;
1912         struct pending_cmd *cmd;
1913         struct bt_uuid *match, *tmp;
1914         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1915         struct hci_request req;
1916         int err, found;
1917
1918         BT_DBG("request for %s", hdev->name);
1919
1920         hci_dev_lock(hdev);
1921
1922         if (pending_eir_or_class(hdev)) {
1923                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1924                                  MGMT_STATUS_BUSY);
1925                 goto unlock;
1926         }
1927
1928         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1929                 err = hci_uuids_clear(hdev);
1930
1931                 if (enable_service_cache(hdev)) {
1932                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1933                                            0, hdev->dev_class, 3);
1934                         goto unlock;
1935                 }
1936
1937                 goto update_class;
1938         }
1939
1940         found = 0;
1941
1942         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1943                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1944                         continue;
1945
1946                 list_del(&match->list);
1947                 kfree(match);
1948                 found++;
1949         }
1950
1951         if (found == 0) {
1952                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1953                                  MGMT_STATUS_INVALID_PARAMS);
1954                 goto unlock;
1955         }
1956
1957 update_class:
1958         hci_req_init(&req, hdev);
1959
1960         update_class(&req);
1961         update_eir(&req);
1962
1963         err = hci_req_run(&req, remove_uuid_complete);
1964         if (err < 0) {
1965                 if (err != -ENODATA)
1966                         goto unlock;
1967
1968                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1969                                    hdev->dev_class, 3);
1970                 goto unlock;
1971         }
1972
1973         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1974         if (!cmd) {
1975                 err = -ENOMEM;
1976                 goto unlock;
1977         }
1978
1979         err = 0;
1980
1981 unlock:
1982         hci_dev_unlock(hdev);
1983         return err;
1984 }
1985
1986 static void set_class_complete(struct hci_dev *hdev, u8 status)
1987 {
1988         BT_DBG("status 0x%02x", status);
1989
1990         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1991 }
1992
1993 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1994                          u16 len)
1995 {
1996         struct mgmt_cp_set_dev_class *cp = data;
1997         struct pending_cmd *cmd;
1998         struct hci_request req;
1999         int err;
2000
2001         BT_DBG("request for %s", hdev->name);
2002
2003         if (!lmp_bredr_capable(hdev))
2004                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2005                                   MGMT_STATUS_NOT_SUPPORTED);
2006
2007         hci_dev_lock(hdev);
2008
2009         if (pending_eir_or_class(hdev)) {
2010                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2011                                  MGMT_STATUS_BUSY);
2012                 goto unlock;
2013         }
2014
2015         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2016                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2017                                  MGMT_STATUS_INVALID_PARAMS);
2018                 goto unlock;
2019         }
2020
2021         hdev->major_class = cp->major;
2022         hdev->minor_class = cp->minor;
2023
2024         if (!hdev_is_powered(hdev)) {
2025                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2026                                    hdev->dev_class, 3);
2027                 goto unlock;
2028         }
2029
2030         hci_req_init(&req, hdev);
2031
2032         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2033                 hci_dev_unlock(hdev);
2034                 cancel_delayed_work_sync(&hdev->service_cache);
2035                 hci_dev_lock(hdev);
2036                 update_eir(&req);
2037         }
2038
2039         update_class(&req);
2040
2041         err = hci_req_run(&req, set_class_complete);
2042         if (err < 0) {
2043                 if (err != -ENODATA)
2044                         goto unlock;
2045
2046                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2047                                    hdev->dev_class, 3);
2048                 goto unlock;
2049         }
2050
2051         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2052         if (!cmd) {
2053                 err = -ENOMEM;
2054                 goto unlock;
2055         }
2056
2057         err = 0;
2058
2059 unlock:
2060         hci_dev_unlock(hdev);
2061         return err;
2062 }
2063
2064 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2065                           u16 len)
2066 {
2067         struct mgmt_cp_load_link_keys *cp = data;
2068         u16 key_count, expected_len;
2069         int i;
2070
2071         BT_DBG("request for %s", hdev->name);
2072
2073         if (!lmp_bredr_capable(hdev))
2074                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2075                                   MGMT_STATUS_NOT_SUPPORTED);
2076
2077         key_count = __le16_to_cpu(cp->key_count);
2078
2079         expected_len = sizeof(*cp) + key_count *
2080                                         sizeof(struct mgmt_link_key_info);
2081         if (expected_len != len) {
2082                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2083                        len, expected_len);
2084                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2085                                   MGMT_STATUS_INVALID_PARAMS);
2086         }
2087
2088         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2089                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2090                                   MGMT_STATUS_INVALID_PARAMS);
2091
2092         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2093                key_count);
2094
2095         for (i = 0; i < key_count; i++) {
2096                 struct mgmt_link_key_info *key = &cp->keys[i];
2097
2098                 if (key->addr.type != BDADDR_BREDR)
2099                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2100                                           MGMT_STATUS_INVALID_PARAMS);
2101         }
2102
2103         hci_dev_lock(hdev);
2104
2105         hci_link_keys_clear(hdev);
2106
2107         if (cp->debug_keys)
2108                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2109         else
2110                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2111
2112         for (i = 0; i < key_count; i++) {
2113                 struct mgmt_link_key_info *key = &cp->keys[i];
2114
2115                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
2116                                  key->type, key->pin_len);
2117         }
2118
2119         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2120
2121         hci_dev_unlock(hdev);
2122
2123         return 0;
2124 }
2125
2126 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2127                            u8 addr_type, struct sock *skip_sk)
2128 {
2129         struct mgmt_ev_device_unpaired ev;
2130
2131         bacpy(&ev.addr.bdaddr, bdaddr);
2132         ev.addr.type = addr_type;
2133
2134         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2135                           skip_sk);
2136 }
2137
2138 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2139                          u16 len)
2140 {
2141         struct mgmt_cp_unpair_device *cp = data;
2142         struct mgmt_rp_unpair_device rp;
2143         struct hci_cp_disconnect dc;
2144         struct pending_cmd *cmd;
2145         struct hci_conn *conn;
2146         int err;
2147
2148         memset(&rp, 0, sizeof(rp));
2149         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2150         rp.addr.type = cp->addr.type;
2151
2152         if (!bdaddr_type_is_valid(cp->addr.type))
2153                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2154                                     MGMT_STATUS_INVALID_PARAMS,
2155                                     &rp, sizeof(rp));
2156
2157         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2158                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2159                                     MGMT_STATUS_INVALID_PARAMS,
2160                                     &rp, sizeof(rp));
2161
2162         hci_dev_lock(hdev);
2163
2164         if (!hdev_is_powered(hdev)) {
2165                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2166                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2167                 goto unlock;
2168         }
2169
2170         if (cp->addr.type == BDADDR_BREDR)
2171                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2172         else
2173                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
2174
2175         if (err < 0) {
2176                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2177                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2178                 goto unlock;
2179         }
2180
2181         if (cp->disconnect) {
2182                 if (cp->addr.type == BDADDR_BREDR)
2183                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2184                                                        &cp->addr.bdaddr);
2185                 else
2186                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2187                                                        &cp->addr.bdaddr);
2188         } else {
2189                 conn = NULL;
2190         }
2191
2192         if (!conn) {
2193                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2194                                    &rp, sizeof(rp));
2195                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2196                 goto unlock;
2197         }
2198
2199         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2200                                sizeof(*cp));
2201         if (!cmd) {
2202                 err = -ENOMEM;
2203                 goto unlock;
2204         }
2205
2206         dc.handle = cpu_to_le16(conn->handle);
2207         dc.reason = 0x13; /* Remote User Terminated Connection */
2208         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2209         if (err < 0)
2210                 mgmt_pending_remove(cmd);
2211
2212 unlock:
2213         hci_dev_unlock(hdev);
2214         return err;
2215 }
2216
2217 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2218                       u16 len)
2219 {
2220         struct mgmt_cp_disconnect *cp = data;
2221         struct mgmt_rp_disconnect rp;
2222         struct hci_cp_disconnect dc;
2223         struct pending_cmd *cmd;
2224         struct hci_conn *conn;
2225         int err;
2226
2227         BT_DBG("");
2228
2229         memset(&rp, 0, sizeof(rp));
2230         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2231         rp.addr.type = cp->addr.type;
2232
2233         if (!bdaddr_type_is_valid(cp->addr.type))
2234                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2235                                     MGMT_STATUS_INVALID_PARAMS,
2236                                     &rp, sizeof(rp));
2237
2238         hci_dev_lock(hdev);
2239
2240         if (!test_bit(HCI_UP, &hdev->flags)) {
2241                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2242                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2243                 goto failed;
2244         }
2245
2246         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2247                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2248                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2249                 goto failed;
2250         }
2251
2252         if (cp->addr.type == BDADDR_BREDR)
2253                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2254                                                &cp->addr.bdaddr);
2255         else
2256                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2257
2258         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2259                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2260                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2261                 goto failed;
2262         }
2263
2264         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2265         if (!cmd) {
2266                 err = -ENOMEM;
2267                 goto failed;
2268         }
2269
2270         dc.handle = cpu_to_le16(conn->handle);
2271         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2272
2273         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2274         if (err < 0)
2275                 mgmt_pending_remove(cmd);
2276
2277 failed:
2278         hci_dev_unlock(hdev);
2279         return err;
2280 }
2281
2282 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2283 {
2284         switch (link_type) {
2285         case LE_LINK:
2286                 switch (addr_type) {
2287                 case ADDR_LE_DEV_PUBLIC:
2288                         return BDADDR_LE_PUBLIC;
2289
2290                 default:
2291                         /* Fallback to LE Random address type */
2292                         return BDADDR_LE_RANDOM;
2293                 }
2294
2295         default:
2296                 /* Fallback to BR/EDR type */
2297                 return BDADDR_BREDR;
2298         }
2299 }
2300
2301 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2302                            u16 data_len)
2303 {
2304         struct mgmt_rp_get_connections *rp;
2305         struct hci_conn *c;
2306         size_t rp_len;
2307         int err;
2308         u16 i;
2309
2310         BT_DBG("");
2311
2312         hci_dev_lock(hdev);
2313
2314         if (!hdev_is_powered(hdev)) {
2315                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2316                                  MGMT_STATUS_NOT_POWERED);
2317                 goto unlock;
2318         }
2319
2320         i = 0;
2321         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2322                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2323                         i++;
2324         }
2325
2326         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2327         rp = kmalloc(rp_len, GFP_KERNEL);
2328         if (!rp) {
2329                 err = -ENOMEM;
2330                 goto unlock;
2331         }
2332
2333         i = 0;
2334         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2335                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2336                         continue;
2337                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2338                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2339                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2340                         continue;
2341                 i++;
2342         }
2343
2344         rp->conn_count = cpu_to_le16(i);
2345
2346         /* Recalculate length in case of filtered SCO connections, etc */
2347         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2348
2349         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2350                            rp_len);
2351
2352         kfree(rp);
2353
2354 unlock:
2355         hci_dev_unlock(hdev);
2356         return err;
2357 }
2358
2359 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2360                                    struct mgmt_cp_pin_code_neg_reply *cp)
2361 {
2362         struct pending_cmd *cmd;
2363         int err;
2364
2365         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2366                                sizeof(*cp));
2367         if (!cmd)
2368                 return -ENOMEM;
2369
2370         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2371                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2372         if (err < 0)
2373                 mgmt_pending_remove(cmd);
2374
2375         return err;
2376 }
2377
2378 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2379                           u16 len)
2380 {
2381         struct hci_conn *conn;
2382         struct mgmt_cp_pin_code_reply *cp = data;
2383         struct hci_cp_pin_code_reply reply;
2384         struct pending_cmd *cmd;
2385         int err;
2386
2387         BT_DBG("");
2388
2389         hci_dev_lock(hdev);
2390
2391         if (!hdev_is_powered(hdev)) {
2392                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2393                                  MGMT_STATUS_NOT_POWERED);
2394                 goto failed;
2395         }
2396
2397         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2398         if (!conn) {
2399                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2400                                  MGMT_STATUS_NOT_CONNECTED);
2401                 goto failed;
2402         }
2403
2404         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2405                 struct mgmt_cp_pin_code_neg_reply ncp;
2406
2407                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2408
2409                 BT_ERR("PIN code is not 16 bytes long");
2410
2411                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2412                 if (err >= 0)
2413                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2414                                          MGMT_STATUS_INVALID_PARAMS);
2415
2416                 goto failed;
2417         }
2418
2419         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2420         if (!cmd) {
2421                 err = -ENOMEM;
2422                 goto failed;
2423         }
2424
2425         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2426         reply.pin_len = cp->pin_len;
2427         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2428
2429         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2430         if (err < 0)
2431                 mgmt_pending_remove(cmd);
2432
2433 failed:
2434         hci_dev_unlock(hdev);
2435         return err;
2436 }
2437
2438 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2439                              u16 len)
2440 {
2441         struct mgmt_cp_set_io_capability *cp = data;
2442
2443         BT_DBG("");
2444
2445         hci_dev_lock(hdev);
2446
2447         hdev->io_capability = cp->io_capability;
2448
2449         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2450                hdev->io_capability);
2451
2452         hci_dev_unlock(hdev);
2453
2454         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2455                             0);
2456 }
2457
2458 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2459 {
2460         struct hci_dev *hdev = conn->hdev;
2461         struct pending_cmd *cmd;
2462
2463         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2464                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2465                         continue;
2466
2467                 if (cmd->user_data != conn)
2468                         continue;
2469
2470                 return cmd;
2471         }
2472
2473         return NULL;
2474 }
2475
2476 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2477 {
2478         struct mgmt_rp_pair_device rp;
2479         struct hci_conn *conn = cmd->user_data;
2480
2481         bacpy(&rp.addr.bdaddr, &conn->dst);
2482         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2483
2484         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2485                      &rp, sizeof(rp));
2486
2487         /* So we don't get further callbacks for this connection */
2488         conn->connect_cfm_cb = NULL;
2489         conn->security_cfm_cb = NULL;
2490         conn->disconn_cfm_cb = NULL;
2491
2492         hci_conn_drop(conn);
2493
2494         mgmt_pending_remove(cmd);
2495 }
2496
2497 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2498 {
2499         struct pending_cmd *cmd;
2500
2501         BT_DBG("status %u", status);
2502
2503         cmd = find_pairing(conn);
2504         if (!cmd)
2505                 BT_DBG("Unable to find a pending command");
2506         else
2507                 pairing_complete(cmd, mgmt_status(status));
2508 }
2509
2510 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2511 {
2512         struct pending_cmd *cmd;
2513
2514         BT_DBG("status %u", status);
2515
2516         if (!status)
2517                 return;
2518
2519         cmd = find_pairing(conn);
2520         if (!cmd)
2521                 BT_DBG("Unable to find a pending command");
2522         else
2523                 pairing_complete(cmd, mgmt_status(status));
2524 }
2525
2526 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2527                        u16 len)
2528 {
2529         struct mgmt_cp_pair_device *cp = data;
2530         struct mgmt_rp_pair_device rp;
2531         struct pending_cmd *cmd;
2532         u8 sec_level, auth_type;
2533         struct hci_conn *conn;
2534         int err;
2535
2536         BT_DBG("");
2537
2538         memset(&rp, 0, sizeof(rp));
2539         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2540         rp.addr.type = cp->addr.type;
2541
2542         if (!bdaddr_type_is_valid(cp->addr.type))
2543                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2544                                     MGMT_STATUS_INVALID_PARAMS,
2545                                     &rp, sizeof(rp));
2546
2547         hci_dev_lock(hdev);
2548
2549         if (!hdev_is_powered(hdev)) {
2550                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2551                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2552                 goto unlock;
2553         }
2554
2555         sec_level = BT_SECURITY_MEDIUM;
2556         if (cp->io_cap == 0x03)
2557                 auth_type = HCI_AT_DEDICATED_BONDING;
2558         else
2559                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2560
2561         if (cp->addr.type == BDADDR_BREDR)
2562                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2563                                    cp->addr.type, sec_level, auth_type);
2564         else
2565                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2566                                    cp->addr.type, sec_level, auth_type);
2567
2568         if (IS_ERR(conn)) {
2569                 int status;
2570
2571                 if (PTR_ERR(conn) == -EBUSY)
2572                         status = MGMT_STATUS_BUSY;
2573                 else
2574                         status = MGMT_STATUS_CONNECT_FAILED;
2575
2576                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2577                                    status, &rp,
2578                                    sizeof(rp));
2579                 goto unlock;
2580         }
2581
2582         if (conn->connect_cfm_cb) {
2583                 hci_conn_drop(conn);
2584                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2585                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2586                 goto unlock;
2587         }
2588
2589         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2590         if (!cmd) {
2591                 err = -ENOMEM;
2592                 hci_conn_drop(conn);
2593                 goto unlock;
2594         }
2595
2596         /* For LE, just connecting isn't a proof that the pairing finished */
2597         if (cp->addr.type == BDADDR_BREDR)
2598                 conn->connect_cfm_cb = pairing_complete_cb;
2599         else
2600                 conn->connect_cfm_cb = le_connect_complete_cb;
2601
2602         conn->security_cfm_cb = pairing_complete_cb;
2603         conn->disconn_cfm_cb = pairing_complete_cb;
2604         conn->io_capability = cp->io_cap;
2605         cmd->user_data = conn;
2606
2607         if (conn->state == BT_CONNECTED &&
2608             hci_conn_security(conn, sec_level, auth_type))
2609                 pairing_complete(cmd, 0);
2610
2611         err = 0;
2612
2613 unlock:
2614         hci_dev_unlock(hdev);
2615         return err;
2616 }
2617
2618 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2619                               u16 len)
2620 {
2621         struct mgmt_addr_info *addr = data;
2622         struct pending_cmd *cmd;
2623         struct hci_conn *conn;
2624         int err;
2625
2626         BT_DBG("");
2627
2628         hci_dev_lock(hdev);
2629
2630         if (!hdev_is_powered(hdev)) {
2631                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2632                                  MGMT_STATUS_NOT_POWERED);
2633                 goto unlock;
2634         }
2635
2636         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2637         if (!cmd) {
2638                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2639                                  MGMT_STATUS_INVALID_PARAMS);
2640                 goto unlock;
2641         }
2642
2643         conn = cmd->user_data;
2644
2645         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2646                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2647                                  MGMT_STATUS_INVALID_PARAMS);
2648                 goto unlock;
2649         }
2650
2651         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2652
2653         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2654                            addr, sizeof(*addr));
2655 unlock:
2656         hci_dev_unlock(hdev);
2657         return err;
2658 }
2659
2660 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2661                              struct mgmt_addr_info *addr, u16 mgmt_op,
2662                              u16 hci_op, __le32 passkey)
2663 {
2664         struct pending_cmd *cmd;
2665         struct hci_conn *conn;
2666         int err;
2667
2668         hci_dev_lock(hdev);
2669
2670         if (!hdev_is_powered(hdev)) {
2671                 err = cmd_complete(sk, hdev->id, mgmt_op,
2672                                    MGMT_STATUS_NOT_POWERED, addr,
2673                                    sizeof(*addr));
2674                 goto done;
2675         }
2676
2677         if (addr->type == BDADDR_BREDR)
2678                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2679         else
2680                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2681
2682         if (!conn) {
2683                 err = cmd_complete(sk, hdev->id, mgmt_op,
2684                                    MGMT_STATUS_NOT_CONNECTED, addr,
2685                                    sizeof(*addr));
2686                 goto done;
2687         }
2688
2689         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2690                 /* Continue with pairing via SMP */
2691                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2692
2693                 if (!err)
2694                         err = cmd_complete(sk, hdev->id, mgmt_op,
2695                                            MGMT_STATUS_SUCCESS, addr,
2696                                            sizeof(*addr));
2697                 else
2698                         err = cmd_complete(sk, hdev->id, mgmt_op,
2699                                            MGMT_STATUS_FAILED, addr,
2700                                            sizeof(*addr));
2701
2702                 goto done;
2703         }
2704
2705         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2706         if (!cmd) {
2707                 err = -ENOMEM;
2708                 goto done;
2709         }
2710
2711         /* Continue with pairing via HCI */
2712         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2713                 struct hci_cp_user_passkey_reply cp;
2714
2715                 bacpy(&cp.bdaddr, &addr->bdaddr);
2716                 cp.passkey = passkey;
2717                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2718         } else
2719                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2720                                    &addr->bdaddr);
2721
2722         if (err < 0)
2723                 mgmt_pending_remove(cmd);
2724
2725 done:
2726         hci_dev_unlock(hdev);
2727         return err;
2728 }
2729
2730 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2731                               void *data, u16 len)
2732 {
2733         struct mgmt_cp_pin_code_neg_reply *cp = data;
2734
2735         BT_DBG("");
2736
2737         return user_pairing_resp(sk, hdev, &cp->addr,
2738                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2739                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2740 }
2741
2742 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2743                               u16 len)
2744 {
2745         struct mgmt_cp_user_confirm_reply *cp = data;
2746
2747         BT_DBG("");
2748
2749         if (len != sizeof(*cp))
2750                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2751                                   MGMT_STATUS_INVALID_PARAMS);
2752
2753         return user_pairing_resp(sk, hdev, &cp->addr,
2754                                  MGMT_OP_USER_CONFIRM_REPLY,
2755                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2756 }
2757
2758 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2759                                   void *data, u16 len)
2760 {
2761         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2762
2763         BT_DBG("");
2764
2765         return user_pairing_resp(sk, hdev, &cp->addr,
2766                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2767                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2768 }
2769
2770 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2771                               u16 len)
2772 {
2773         struct mgmt_cp_user_passkey_reply *cp = data;
2774
2775         BT_DBG("");
2776
2777         return user_pairing_resp(sk, hdev, &cp->addr,
2778                                  MGMT_OP_USER_PASSKEY_REPLY,
2779                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2780 }
2781
2782 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2783                                   void *data, u16 len)
2784 {
2785         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2786
2787         BT_DBG("");
2788
2789         return user_pairing_resp(sk, hdev, &cp->addr,
2790                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2791                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2792 }
2793
2794 static void update_name(struct hci_request *req)
2795 {
2796         struct hci_dev *hdev = req->hdev;
2797         struct hci_cp_write_local_name cp;
2798
2799         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2800
2801         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2802 }
2803
2804 static void set_name_complete(struct hci_dev *hdev, u8 status)
2805 {
2806         struct mgmt_cp_set_local_name *cp;
2807         struct pending_cmd *cmd;
2808
2809         BT_DBG("status 0x%02x", status);
2810
2811         hci_dev_lock(hdev);
2812
2813         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2814         if (!cmd)
2815                 goto unlock;
2816
2817         cp = cmd->param;
2818
2819         if (status)
2820                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2821                            mgmt_status(status));
2822         else
2823                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2824                              cp, sizeof(*cp));
2825
2826         mgmt_pending_remove(cmd);
2827
2828 unlock:
2829         hci_dev_unlock(hdev);
2830 }
2831
2832 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2833                           u16 len)
2834 {
2835         struct mgmt_cp_set_local_name *cp = data;
2836         struct pending_cmd *cmd;
2837         struct hci_request req;
2838         int err;
2839
2840         BT_DBG("");
2841
2842         hci_dev_lock(hdev);
2843
2844         /* If the old values are the same as the new ones just return a
2845          * direct command complete event.
2846          */
2847         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2848             !memcmp(hdev->short_name, cp->short_name,
2849                     sizeof(hdev->short_name))) {
2850                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2851                                    data, len);
2852                 goto failed;
2853         }
2854
2855         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2856
2857         if (!hdev_is_powered(hdev)) {
2858                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2859
2860                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2861                                    data, len);
2862                 if (err < 0)
2863                         goto failed;
2864
2865                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2866                                  sk);
2867
2868                 goto failed;
2869         }
2870
2871         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2872         if (!cmd) {
2873                 err = -ENOMEM;
2874                 goto failed;
2875         }
2876
2877         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2878
2879         hci_req_init(&req, hdev);
2880
2881         if (lmp_bredr_capable(hdev)) {
2882                 update_name(&req);
2883                 update_eir(&req);
2884         }
2885
2886         if (lmp_le_capable(hdev))
2887                 update_ad(&req);
2888
2889         err = hci_req_run(&req, set_name_complete);
2890         if (err < 0)
2891                 mgmt_pending_remove(cmd);
2892
2893 failed:
2894         hci_dev_unlock(hdev);
2895         return err;
2896 }
2897
2898 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2899                                void *data, u16 data_len)
2900 {
2901         struct pending_cmd *cmd;
2902         int err;
2903
2904         BT_DBG("%s", hdev->name);
2905
2906         hci_dev_lock(hdev);
2907
2908         if (!hdev_is_powered(hdev)) {
2909                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2910                                  MGMT_STATUS_NOT_POWERED);
2911                 goto unlock;
2912         }
2913
2914         if (!lmp_ssp_capable(hdev)) {
2915                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2916                                  MGMT_STATUS_NOT_SUPPORTED);
2917                 goto unlock;
2918         }
2919
2920         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2921                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2922                                  MGMT_STATUS_BUSY);
2923                 goto unlock;
2924         }
2925
2926         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2927         if (!cmd) {
2928                 err = -ENOMEM;
2929                 goto unlock;
2930         }
2931
2932         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2933         if (err < 0)
2934                 mgmt_pending_remove(cmd);
2935
2936 unlock:
2937         hci_dev_unlock(hdev);
2938         return err;
2939 }
2940
2941 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2942                                void *data, u16 len)
2943 {
2944         struct mgmt_cp_add_remote_oob_data *cp = data;
2945         u8 status;
2946         int err;
2947
2948         BT_DBG("%s ", hdev->name);
2949
2950         hci_dev_lock(hdev);
2951
2952         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2953                                       cp->randomizer);
2954         if (err < 0)
2955                 status = MGMT_STATUS_FAILED;
2956         else
2957                 status = MGMT_STATUS_SUCCESS;
2958
2959         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2960                            &cp->addr, sizeof(cp->addr));
2961
2962         hci_dev_unlock(hdev);
2963         return err;
2964 }
2965
2966 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2967                                   void *data, u16 len)
2968 {
2969         struct mgmt_cp_remove_remote_oob_data *cp = data;
2970         u8 status;
2971         int err;
2972
2973         BT_DBG("%s", hdev->name);
2974
2975         hci_dev_lock(hdev);
2976
2977         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2978         if (err < 0)
2979                 status = MGMT_STATUS_INVALID_PARAMS;
2980         else
2981                 status = MGMT_STATUS_SUCCESS;
2982
2983         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2984                            status, &cp->addr, sizeof(cp->addr));
2985
2986         hci_dev_unlock(hdev);
2987         return err;
2988 }
2989
2990 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2991 {
2992         struct pending_cmd *cmd;
2993         u8 type;
2994         int err;
2995
2996         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2997
2998         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2999         if (!cmd)
3000                 return -ENOENT;
3001
3002         type = hdev->discovery.type;
3003
3004         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3005                            &type, sizeof(type));
3006         mgmt_pending_remove(cmd);
3007
3008         return err;
3009 }
3010
3011 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3012 {
3013         BT_DBG("status %d", status);
3014
3015         if (status) {
3016                 hci_dev_lock(hdev);
3017                 mgmt_start_discovery_failed(hdev, status);
3018                 hci_dev_unlock(hdev);
3019                 return;
3020         }
3021
3022         hci_dev_lock(hdev);
3023         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3024         hci_dev_unlock(hdev);
3025
3026         switch (hdev->discovery.type) {
3027         case DISCOV_TYPE_LE:
3028                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
3029                                    DISCOV_LE_TIMEOUT);
3030                 break;
3031
3032         case DISCOV_TYPE_INTERLEAVED:
3033                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
3034                                    DISCOV_INTERLEAVED_TIMEOUT);
3035                 break;
3036
3037         case DISCOV_TYPE_BREDR:
3038                 break;
3039
3040         default:
3041                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3042         }
3043 }
3044
3045 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3046                            void *data, u16 len)
3047 {
3048         struct mgmt_cp_start_discovery *cp = data;
3049         struct pending_cmd *cmd;
3050         struct hci_cp_le_set_scan_param param_cp;
3051         struct hci_cp_le_set_scan_enable enable_cp;
3052         struct hci_cp_inquiry inq_cp;
3053         struct hci_request req;
3054         /* General inquiry access code (GIAC) */
3055         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3056         u8 status;
3057         int err;
3058
3059         BT_DBG("%s", hdev->name);
3060
3061         hci_dev_lock(hdev);
3062
3063         if (!hdev_is_powered(hdev)) {
3064                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3065                                  MGMT_STATUS_NOT_POWERED);
3066                 goto failed;
3067         }
3068
3069         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3070                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3071                                  MGMT_STATUS_BUSY);
3072                 goto failed;
3073         }
3074
3075         if (hdev->discovery.state != DISCOVERY_STOPPED) {
3076                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3077                                  MGMT_STATUS_BUSY);
3078                 goto failed;
3079         }
3080
3081         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3082         if (!cmd) {
3083                 err = -ENOMEM;
3084                 goto failed;
3085         }
3086
3087         hdev->discovery.type = cp->type;
3088
3089         hci_req_init(&req, hdev);
3090
3091         switch (hdev->discovery.type) {
3092         case DISCOV_TYPE_BREDR:
3093                 status = mgmt_bredr_support(hdev);
3094                 if (status) {
3095                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3096                                          status);
3097                         mgmt_pending_remove(cmd);
3098                         goto failed;
3099                 }
3100
3101                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3102                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3103                                          MGMT_STATUS_BUSY);
3104                         mgmt_pending_remove(cmd);
3105                         goto failed;
3106                 }
3107
3108                 hci_inquiry_cache_flush(hdev);
3109
3110                 memset(&inq_cp, 0, sizeof(inq_cp));
3111                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3112                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3113                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3114                 break;
3115
3116         case DISCOV_TYPE_LE:
3117         case DISCOV_TYPE_INTERLEAVED:
3118                 status = mgmt_le_support(hdev);
3119                 if (status) {
3120                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3121                                          status);
3122                         mgmt_pending_remove(cmd);
3123                         goto failed;
3124                 }
3125
3126                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3127                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3128                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3129                                          MGMT_STATUS_NOT_SUPPORTED);
3130                         mgmt_pending_remove(cmd);
3131                         goto failed;
3132                 }
3133
3134                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3135                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3136                                          MGMT_STATUS_REJECTED);
3137                         mgmt_pending_remove(cmd);
3138                         goto failed;
3139                 }
3140
3141                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
3142                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3143                                          MGMT_STATUS_BUSY);
3144                         mgmt_pending_remove(cmd);
3145                         goto failed;
3146                 }
3147
3148                 memset(&param_cp, 0, sizeof(param_cp));
3149                 param_cp.type = LE_SCAN_ACTIVE;
3150                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3151                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3152                 if (bacmp(&hdev->bdaddr, BDADDR_ANY))
3153                         param_cp.own_address_type = ADDR_LE_DEV_PUBLIC;
3154                 else
3155                         param_cp.own_address_type = ADDR_LE_DEV_RANDOM;
3156                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3157                             &param_cp);
3158
3159                 memset(&enable_cp, 0, sizeof(enable_cp));
3160                 enable_cp.enable = LE_SCAN_ENABLE;
3161                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3162                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3163                             &enable_cp);
3164                 break;
3165
3166         default:
3167                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3168                                  MGMT_STATUS_INVALID_PARAMS);
3169                 mgmt_pending_remove(cmd);
3170                 goto failed;
3171         }
3172
3173         err = hci_req_run(&req, start_discovery_complete);
3174         if (err < 0)
3175                 mgmt_pending_remove(cmd);
3176         else
3177                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3178
3179 failed:
3180         hci_dev_unlock(hdev);
3181         return err;
3182 }
3183
3184 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3185 {
3186         struct pending_cmd *cmd;
3187         int err;
3188
3189         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3190         if (!cmd)
3191                 return -ENOENT;
3192
3193         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3194                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3195         mgmt_pending_remove(cmd);
3196
3197         return err;
3198 }
3199
3200 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3201 {
3202         BT_DBG("status %d", status);
3203
3204         hci_dev_lock(hdev);
3205
3206         if (status) {
3207                 mgmt_stop_discovery_failed(hdev, status);
3208                 goto unlock;
3209         }
3210
3211         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3212
3213 unlock:
3214         hci_dev_unlock(hdev);
3215 }
3216
3217 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3218                           u16 len)
3219 {
3220         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3221         struct pending_cmd *cmd;
3222         struct hci_cp_remote_name_req_cancel cp;
3223         struct inquiry_entry *e;
3224         struct hci_request req;
3225         struct hci_cp_le_set_scan_enable enable_cp;
3226         int err;
3227
3228         BT_DBG("%s", hdev->name);
3229
3230         hci_dev_lock(hdev);
3231
3232         if (!hci_discovery_active(hdev)) {
3233                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3234                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3235                                    sizeof(mgmt_cp->type));
3236                 goto unlock;
3237         }
3238
3239         if (hdev->discovery.type != mgmt_cp->type) {
3240                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3241                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3242                                    sizeof(mgmt_cp->type));
3243                 goto unlock;
3244         }
3245
3246         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3247         if (!cmd) {
3248                 err = -ENOMEM;
3249                 goto unlock;
3250         }
3251
3252         hci_req_init(&req, hdev);
3253
3254         switch (hdev->discovery.state) {
3255         case DISCOVERY_FINDING:
3256                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3257                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3258                 } else {
3259                         cancel_delayed_work(&hdev->le_scan_disable);
3260
3261                         memset(&enable_cp, 0, sizeof(enable_cp));
3262                         enable_cp.enable = LE_SCAN_DISABLE;
3263                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
3264                                     sizeof(enable_cp), &enable_cp);
3265                 }
3266
3267                 break;
3268
3269         case DISCOVERY_RESOLVING:
3270                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3271                                                      NAME_PENDING);
3272                 if (!e) {
3273                         mgmt_pending_remove(cmd);
3274                         err = cmd_complete(sk, hdev->id,
3275                                            MGMT_OP_STOP_DISCOVERY, 0,
3276                                            &mgmt_cp->type,
3277                                            sizeof(mgmt_cp->type));
3278                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3279                         goto unlock;
3280                 }
3281
3282                 bacpy(&cp.bdaddr, &e->data.bdaddr);
3283                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3284                             &cp);
3285
3286                 break;
3287
3288         default:
3289                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
3290
3291                 mgmt_pending_remove(cmd);
3292                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3293                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
3294                                    sizeof(mgmt_cp->type));
3295                 goto unlock;
3296         }
3297
3298         err = hci_req_run(&req, stop_discovery_complete);
3299         if (err < 0)
3300                 mgmt_pending_remove(cmd);
3301         else
3302                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3303
3304 unlock:
3305         hci_dev_unlock(hdev);
3306         return err;
3307 }
3308
3309 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3310                         u16 len)
3311 {
3312         struct mgmt_cp_confirm_name *cp = data;
3313         struct inquiry_entry *e;
3314         int err;
3315
3316         BT_DBG("%s", hdev->name);
3317
3318         hci_dev_lock(hdev);
3319
3320         if (!hci_discovery_active(hdev)) {
3321                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3322                                  MGMT_STATUS_FAILED);
3323                 goto failed;
3324         }
3325
3326         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3327         if (!e) {
3328                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3329                                  MGMT_STATUS_INVALID_PARAMS);
3330                 goto failed;
3331         }
3332
3333         if (cp->name_known) {
3334                 e->name_state = NAME_KNOWN;
3335                 list_del(&e->list);
3336         } else {
3337                 e->name_state = NAME_NEEDED;
3338                 hci_inquiry_cache_update_resolve(hdev, e);
3339         }
3340
3341         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3342                            sizeof(cp->addr));
3343
3344 failed:
3345         hci_dev_unlock(hdev);
3346         return err;
3347 }
3348
3349 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3350                         u16 len)
3351 {
3352         struct mgmt_cp_block_device *cp = data;
3353         u8 status;
3354         int err;
3355
3356         BT_DBG("%s", hdev->name);
3357
3358         if (!bdaddr_type_is_valid(cp->addr.type))
3359                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3360                                     MGMT_STATUS_INVALID_PARAMS,
3361                                     &cp->addr, sizeof(cp->addr));
3362
3363         hci_dev_lock(hdev);
3364
3365         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3366         if (err < 0)
3367                 status = MGMT_STATUS_FAILED;
3368         else
3369                 status = MGMT_STATUS_SUCCESS;
3370
3371         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3372                            &cp->addr, sizeof(cp->addr));
3373
3374         hci_dev_unlock(hdev);
3375
3376         return err;
3377 }
3378
3379 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3380                           u16 len)
3381 {
3382         struct mgmt_cp_unblock_device *cp = data;
3383         u8 status;
3384         int err;
3385
3386         BT_DBG("%s", hdev->name);
3387
3388         if (!bdaddr_type_is_valid(cp->addr.type))
3389                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3390                                     MGMT_STATUS_INVALID_PARAMS,
3391                                     &cp->addr, sizeof(cp->addr));
3392
3393         hci_dev_lock(hdev);
3394
3395         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3396         if (err < 0)
3397                 status = MGMT_STATUS_INVALID_PARAMS;
3398         else
3399                 status = MGMT_STATUS_SUCCESS;
3400
3401         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3402                            &cp->addr, sizeof(cp->addr));
3403
3404         hci_dev_unlock(hdev);
3405
3406         return err;
3407 }
3408
3409 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3410                          u16 len)
3411 {
3412         struct mgmt_cp_set_device_id *cp = data;
3413         struct hci_request req;
3414         int err;
3415         __u16 source;
3416
3417         BT_DBG("%s", hdev->name);
3418
3419         source = __le16_to_cpu(cp->source);
3420
3421         if (source > 0x0002)
3422                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3423                                   MGMT_STATUS_INVALID_PARAMS);
3424
3425         hci_dev_lock(hdev);
3426
3427         hdev->devid_source = source;
3428         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3429         hdev->devid_product = __le16_to_cpu(cp->product);
3430         hdev->devid_version = __le16_to_cpu(cp->version);
3431
3432         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3433
3434         hci_req_init(&req, hdev);
3435         update_eir(&req);
3436         hci_req_run(&req, NULL);
3437
3438         hci_dev_unlock(hdev);
3439
3440         return err;
3441 }
3442
3443 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3444 {
3445         struct cmd_lookup match = { NULL, hdev };
3446
3447         if (status) {
3448                 u8 mgmt_err = mgmt_status(status);
3449
3450                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3451                                      cmd_status_rsp, &mgmt_err);
3452                 return;
3453         }
3454
3455         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3456                              &match);
3457
3458         new_settings(hdev, match.sk);
3459
3460         if (match.sk)
3461                 sock_put(match.sk);
3462 }
3463
3464 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3465                            u16 len)
3466 {
3467         struct mgmt_mode *cp = data;
3468         struct pending_cmd *cmd;
3469         struct hci_request req;
3470         u8 val, enabled, status;
3471         int err;
3472
3473         BT_DBG("request for %s", hdev->name);
3474
3475         status = mgmt_le_support(hdev);
3476         if (status)
3477                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3478                                   status);
3479
3480         if (cp->val != 0x00 && cp->val != 0x01)
3481                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3482                                   MGMT_STATUS_INVALID_PARAMS);
3483
3484         hci_dev_lock(hdev);
3485
3486         val = !!cp->val;
3487         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3488
3489         /* The following conditions are ones which mean that we should
3490          * not do any HCI communication but directly send a mgmt
3491          * response to user space (after toggling the flag if
3492          * necessary).
3493          */
3494         if (!hdev_is_powered(hdev) || val == enabled ||
3495             hci_conn_num(hdev, LE_LINK) > 0) {
3496                 bool changed = false;
3497
3498                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3499                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3500                         changed = true;
3501                 }
3502
3503                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3504                 if (err < 0)
3505                         goto unlock;
3506
3507                 if (changed)
3508                         err = new_settings(hdev, sk);
3509
3510                 goto unlock;
3511         }
3512
3513         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3514             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3515                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3516                                  MGMT_STATUS_BUSY);
3517                 goto unlock;
3518         }
3519
3520         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3521         if (!cmd) {
3522                 err = -ENOMEM;
3523                 goto unlock;
3524         }
3525
3526         hci_req_init(&req, hdev);
3527
3528         if (val)
3529                 enable_advertising(&req);
3530         else
3531                 disable_advertising(&req);
3532
3533         err = hci_req_run(&req, set_advertising_complete);
3534         if (err < 0)
3535                 mgmt_pending_remove(cmd);
3536
3537 unlock:
3538         hci_dev_unlock(hdev);
3539         return err;
3540 }
3541
3542 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3543                               void *data, u16 len)
3544 {
3545         struct mgmt_cp_set_static_address *cp = data;
3546         int err;
3547
3548         BT_DBG("%s", hdev->name);
3549
3550         if (!lmp_le_capable(hdev))
3551                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3552                                   MGMT_STATUS_NOT_SUPPORTED);
3553
3554         if (hdev_is_powered(hdev))
3555                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3556                                   MGMT_STATUS_REJECTED);
3557
3558         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3559                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3560                         return cmd_status(sk, hdev->id,
3561                                           MGMT_OP_SET_STATIC_ADDRESS,
3562                                           MGMT_STATUS_INVALID_PARAMS);
3563
3564                 /* Two most significant bits shall be set */
3565                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3566                         return cmd_status(sk, hdev->id,
3567                                           MGMT_OP_SET_STATIC_ADDRESS,
3568                                           MGMT_STATUS_INVALID_PARAMS);
3569         }
3570
3571         hci_dev_lock(hdev);
3572
3573         bacpy(&hdev->static_addr, &cp->bdaddr);
3574
3575         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3576
3577         hci_dev_unlock(hdev);
3578
3579         return err;
3580 }
3581
3582 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
3583                            void *data, u16 len)
3584 {
3585         struct mgmt_cp_set_scan_params *cp = data;
3586         __u16 interval, window;
3587         int err;
3588
3589         BT_DBG("%s", hdev->name);
3590
3591         if (!lmp_le_capable(hdev))
3592                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3593                                   MGMT_STATUS_NOT_SUPPORTED);
3594
3595         interval = __le16_to_cpu(cp->interval);
3596
3597         if (interval < 0x0004 || interval > 0x4000)
3598                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3599                                   MGMT_STATUS_INVALID_PARAMS);
3600
3601         window = __le16_to_cpu(cp->window);
3602
3603         if (window < 0x0004 || window > 0x4000)
3604                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3605                                   MGMT_STATUS_INVALID_PARAMS);
3606
3607         if (window > interval)
3608                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3609                                   MGMT_STATUS_INVALID_PARAMS);
3610
3611         hci_dev_lock(hdev);
3612
3613         hdev->le_scan_interval = interval;
3614         hdev->le_scan_window = window;
3615
3616         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
3617
3618         hci_dev_unlock(hdev);
3619
3620         return err;
3621 }
3622
3623 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3624 {
3625         struct pending_cmd *cmd;
3626
3627         BT_DBG("status 0x%02x", status);
3628
3629         hci_dev_lock(hdev);
3630
3631         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3632         if (!cmd)
3633                 goto unlock;
3634
3635         if (status) {
3636                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3637                            mgmt_status(status));
3638         } else {
3639                 struct mgmt_mode *cp = cmd->param;
3640
3641                 if (cp->val)
3642                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3643                 else
3644                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3645
3646                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3647                 new_settings(hdev, cmd->sk);
3648         }
3649
3650         mgmt_pending_remove(cmd);
3651
3652 unlock:
3653         hci_dev_unlock(hdev);
3654 }
3655
3656 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3657                                 void *data, u16 len)
3658 {
3659         struct mgmt_mode *cp = data;
3660         struct pending_cmd *cmd;
3661         struct hci_request req;
3662         int err;
3663
3664         BT_DBG("%s", hdev->name);
3665
3666         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
3667             hdev->hci_ver < BLUETOOTH_VER_1_2)
3668                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3669                                   MGMT_STATUS_NOT_SUPPORTED);
3670
3671         if (cp->val != 0x00 && cp->val != 0x01)
3672                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3673                                   MGMT_STATUS_INVALID_PARAMS);
3674
3675         if (!hdev_is_powered(hdev))
3676                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3677                                   MGMT_STATUS_NOT_POWERED);
3678
3679         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3680                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3681                                   MGMT_STATUS_REJECTED);
3682
3683         hci_dev_lock(hdev);
3684
3685         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3686                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3687                                  MGMT_STATUS_BUSY);
3688                 goto unlock;
3689         }
3690
3691         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3692                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3693                                         hdev);
3694                 goto unlock;
3695         }
3696
3697         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3698                                data, len);
3699         if (!cmd) {
3700                 err = -ENOMEM;
3701                 goto unlock;
3702         }
3703
3704         hci_req_init(&req, hdev);
3705
3706         write_fast_connectable(&req, cp->val);
3707
3708         err = hci_req_run(&req, fast_connectable_complete);
3709         if (err < 0) {
3710                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3711                                  MGMT_STATUS_FAILED);
3712                 mgmt_pending_remove(cmd);
3713         }
3714
3715 unlock:
3716         hci_dev_unlock(hdev);
3717
3718         return err;
3719 }
3720
3721 static void set_bredr_scan(struct hci_request *req)
3722 {
3723         struct hci_dev *hdev = req->hdev;
3724         u8 scan = 0;
3725
3726         /* Ensure that fast connectable is disabled. This function will
3727          * not do anything if the page scan parameters are already what
3728          * they should be.
3729          */
3730         write_fast_connectable(req, false);
3731
3732         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3733                 scan |= SCAN_PAGE;
3734         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3735                 scan |= SCAN_INQUIRY;
3736
3737         if (scan)
3738                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3739 }
3740
3741 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
3742 {
3743         struct pending_cmd *cmd;
3744
3745         BT_DBG("status 0x%02x", status);
3746
3747         hci_dev_lock(hdev);
3748
3749         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
3750         if (!cmd)
3751                 goto unlock;
3752
3753         if (status) {
3754                 u8 mgmt_err = mgmt_status(status);
3755
3756                 /* We need to restore the flag if related HCI commands
3757                  * failed.
3758                  */
3759                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3760
3761                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
3762         } else {
3763                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
3764                 new_settings(hdev, cmd->sk);
3765         }
3766
3767         mgmt_pending_remove(cmd);
3768
3769 unlock:
3770         hci_dev_unlock(hdev);
3771 }
3772
3773 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3774 {
3775         struct mgmt_mode *cp = data;
3776         struct pending_cmd *cmd;
3777         struct hci_request req;
3778         int err;
3779
3780         BT_DBG("request for %s", hdev->name);
3781
3782         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
3783                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3784                                   MGMT_STATUS_NOT_SUPPORTED);
3785
3786         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3787                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3788                                   MGMT_STATUS_REJECTED);
3789
3790         if (cp->val != 0x00 && cp->val != 0x01)
3791                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3792                                   MGMT_STATUS_INVALID_PARAMS);
3793
3794         hci_dev_lock(hdev);
3795
3796         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3797                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3798                 goto unlock;
3799         }
3800
3801         if (!hdev_is_powered(hdev)) {
3802                 if (!cp->val) {
3803                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
3804                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
3805                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3806                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3807                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3808                 }
3809
3810                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3811
3812                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3813                 if (err < 0)
3814                         goto unlock;
3815
3816                 err = new_settings(hdev, sk);
3817                 goto unlock;
3818         }
3819
3820         /* Reject disabling when powered on */
3821         if (!cp->val) {
3822                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3823                                  MGMT_STATUS_REJECTED);
3824                 goto unlock;
3825         }
3826
3827         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
3828                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3829                                  MGMT_STATUS_BUSY);
3830                 goto unlock;
3831         }
3832
3833         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
3834         if (!cmd) {
3835                 err = -ENOMEM;
3836                 goto unlock;
3837         }
3838
3839         /* We need to flip the bit already here so that update_ad
3840          * generates the correct flags.
3841          */
3842         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3843
3844         hci_req_init(&req, hdev);
3845
3846         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3847                 set_bredr_scan(&req);
3848
3849         update_ad(&req);
3850
3851         err = hci_req_run(&req, set_bredr_complete);
3852         if (err < 0)
3853                 mgmt_pending_remove(cmd);
3854
3855 unlock:
3856         hci_dev_unlock(hdev);
3857         return err;
3858 }
3859
3860 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3861 {
3862         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3863                 return false;
3864         if (key->master != 0x00 && key->master != 0x01)
3865                 return false;
3866         if (!bdaddr_type_is_le(key->addr.type))
3867                 return false;
3868         return true;
3869 }
3870
3871 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3872                                void *cp_data, u16 len)
3873 {
3874         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3875         u16 key_count, expected_len;
3876         int i, err;
3877
3878         BT_DBG("request for %s", hdev->name);
3879
3880         if (!lmp_le_capable(hdev))
3881                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3882                                   MGMT_STATUS_NOT_SUPPORTED);
3883
3884         key_count = __le16_to_cpu(cp->key_count);
3885
3886         expected_len = sizeof(*cp) + key_count *
3887                                         sizeof(struct mgmt_ltk_info);
3888         if (expected_len != len) {
3889                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3890                        len, expected_len);
3891                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3892                                   MGMT_STATUS_INVALID_PARAMS);
3893         }
3894
3895         BT_DBG("%s key_count %u", hdev->name, key_count);
3896
3897         for (i = 0; i < key_count; i++) {
3898                 struct mgmt_ltk_info *key = &cp->keys[i];
3899
3900                 if (!ltk_is_valid(key))
3901                         return cmd_status(sk, hdev->id,
3902                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3903                                           MGMT_STATUS_INVALID_PARAMS);
3904         }
3905
3906         hci_dev_lock(hdev);
3907
3908         hci_smp_ltks_clear(hdev);
3909
3910         for (i = 0; i < key_count; i++) {
3911                 struct mgmt_ltk_info *key = &cp->keys[i];
3912                 u8 type, addr_type;
3913
3914                 if (key->addr.type == BDADDR_LE_PUBLIC)
3915                         addr_type = ADDR_LE_DEV_PUBLIC;
3916                 else
3917                         addr_type = ADDR_LE_DEV_RANDOM;
3918
3919                 if (key->master)
3920                         type = HCI_SMP_LTK;
3921                 else
3922                         type = HCI_SMP_LTK_SLAVE;
3923
3924                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type,
3925                             type, 0, key->authenticated, key->val,
3926                             key->enc_size, key->ediv, key->rand);
3927         }
3928
3929         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3930                            NULL, 0);
3931
3932         hci_dev_unlock(hdev);
3933
3934         return err;
3935 }
3936
3937 static const struct mgmt_handler {
3938         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3939                      u16 data_len);
3940         bool var_len;
3941         size_t data_len;
3942 } mgmt_handlers[] = {
3943         { NULL }, /* 0x0000 (no command) */
3944         { read_version,           false, MGMT_READ_VERSION_SIZE },
3945         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3946         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3947         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3948         { set_powered,            false, MGMT_SETTING_SIZE },
3949         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3950         { set_connectable,        false, MGMT_SETTING_SIZE },
3951         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3952         { set_pairable,           false, MGMT_SETTING_SIZE },
3953         { set_link_security,      false, MGMT_SETTING_SIZE },
3954         { set_ssp,                false, MGMT_SETTING_SIZE },
3955         { set_hs,                 false, MGMT_SETTING_SIZE },
3956         { set_le,                 false, MGMT_SETTING_SIZE },
3957         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3958         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3959         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3960         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3961         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3962         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3963         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3964         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3965         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3966         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3967         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3968         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3969         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3970         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3971         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3972         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3973         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3974         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3975         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3976         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3977         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3978         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3979         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3980         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3981         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3982         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3983         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3984         { set_advertising,        false, MGMT_SETTING_SIZE },
3985         { set_bredr,              false, MGMT_SETTING_SIZE },
3986         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
3987         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
3988 };
3989
3990
3991 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3992 {
3993         void *buf;
3994         u8 *cp;
3995         struct mgmt_hdr *hdr;
3996         u16 opcode, index, len;
3997         struct hci_dev *hdev = NULL;
3998         const struct mgmt_handler *handler;
3999         int err;
4000
4001         BT_DBG("got %zu bytes", msglen);
4002
4003         if (msglen < sizeof(*hdr))
4004                 return -EINVAL;
4005
4006         buf = kmalloc(msglen, GFP_KERNEL);
4007         if (!buf)
4008                 return -ENOMEM;
4009
4010         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
4011                 err = -EFAULT;
4012                 goto done;
4013         }
4014
4015         hdr = buf;
4016         opcode = __le16_to_cpu(hdr->opcode);
4017         index = __le16_to_cpu(hdr->index);
4018         len = __le16_to_cpu(hdr->len);
4019
4020         if (len != msglen - sizeof(*hdr)) {
4021                 err = -EINVAL;
4022                 goto done;
4023         }
4024
4025         if (index != MGMT_INDEX_NONE) {
4026                 hdev = hci_dev_get(index);
4027                 if (!hdev) {
4028                         err = cmd_status(sk, index, opcode,
4029                                          MGMT_STATUS_INVALID_INDEX);
4030                         goto done;
4031                 }
4032
4033                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
4034                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
4035                         err = cmd_status(sk, index, opcode,
4036                                          MGMT_STATUS_INVALID_INDEX);
4037                         goto done;
4038                 }
4039         }
4040
4041         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
4042             mgmt_handlers[opcode].func == NULL) {
4043                 BT_DBG("Unknown op %u", opcode);
4044                 err = cmd_status(sk, index, opcode,
4045                                  MGMT_STATUS_UNKNOWN_COMMAND);
4046                 goto done;
4047         }
4048
4049         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
4050             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
4051                 err = cmd_status(sk, index, opcode,
4052                                  MGMT_STATUS_INVALID_INDEX);
4053                 goto done;
4054         }
4055
4056         handler = &mgmt_handlers[opcode];
4057
4058         if ((handler->var_len && len < handler->data_len) ||
4059             (!handler->var_len && len != handler->data_len)) {
4060                 err = cmd_status(sk, index, opcode,
4061                                  MGMT_STATUS_INVALID_PARAMS);
4062                 goto done;
4063         }
4064
4065         if (hdev)
4066                 mgmt_init_hdev(sk, hdev);
4067
4068         cp = buf + sizeof(*hdr);
4069
4070         err = handler->func(sk, hdev, cp, len);
4071         if (err < 0)
4072                 goto done;
4073
4074         err = msglen;
4075
4076 done:
4077         if (hdev)
4078                 hci_dev_put(hdev);
4079
4080         kfree(buf);
4081         return err;
4082 }
4083
4084 void mgmt_index_added(struct hci_dev *hdev)
4085 {
4086         if (hdev->dev_type != HCI_BREDR)
4087                 return;
4088
4089         mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
4090 }
4091
4092 void mgmt_index_removed(struct hci_dev *hdev)
4093 {
4094         u8 status = MGMT_STATUS_INVALID_INDEX;
4095
4096         if (hdev->dev_type != HCI_BREDR)
4097                 return;
4098
4099         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
4100
4101         mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
4102 }
4103
4104 static void powered_complete(struct hci_dev *hdev, u8 status)
4105 {
4106         struct cmd_lookup match = { NULL, hdev };
4107
4108         BT_DBG("status 0x%02x", status);
4109
4110         hci_dev_lock(hdev);
4111
4112         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
4113
4114         new_settings(hdev, match.sk);
4115
4116         hci_dev_unlock(hdev);
4117
4118         if (match.sk)
4119                 sock_put(match.sk);
4120 }
4121
4122 static int powered_update_hci(struct hci_dev *hdev)
4123 {
4124         struct hci_request req;
4125         u8 link_sec;
4126
4127         hci_req_init(&req, hdev);
4128
4129         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
4130             !lmp_host_ssp_capable(hdev)) {
4131                 u8 ssp = 1;
4132
4133                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
4134         }
4135
4136         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
4137             lmp_bredr_capable(hdev)) {
4138                 struct hci_cp_write_le_host_supported cp;
4139
4140                 cp.le = 1;
4141                 cp.simul = lmp_le_br_capable(hdev);
4142
4143                 /* Check first if we already have the right
4144                  * host state (host features set)
4145                  */
4146                 if (cp.le != lmp_host_le_capable(hdev) ||
4147                     cp.simul != lmp_host_le_br_capable(hdev))
4148                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
4149                                     sizeof(cp), &cp);
4150         }
4151
4152         if (lmp_le_capable(hdev)) {
4153                 /* Set random address to static address if configured */
4154                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
4155                         hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
4156                                     &hdev->static_addr);
4157
4158                 /* Make sure the controller has a good default for
4159                  * advertising data. This also applies to the case
4160                  * where BR/EDR was toggled during the AUTO_OFF phase.
4161                  */
4162                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4163                         update_ad(&req);
4164
4165                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
4166                         enable_advertising(&req);
4167         }
4168
4169         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4170         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
4171                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
4172                             sizeof(link_sec), &link_sec);
4173
4174         if (lmp_bredr_capable(hdev)) {
4175                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
4176                         set_bredr_scan(&req);
4177                 update_class(&req);
4178                 update_name(&req);
4179                 update_eir(&req);
4180         }
4181
4182         return hci_req_run(&req, powered_complete);
4183 }
4184
4185 int mgmt_powered(struct hci_dev *hdev, u8 powered)
4186 {
4187         struct cmd_lookup match = { NULL, hdev };
4188         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
4189         u8 zero_cod[] = { 0, 0, 0 };
4190         int err;
4191
4192         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
4193                 return 0;
4194
4195         if (powered) {
4196                 if (powered_update_hci(hdev) == 0)
4197                         return 0;
4198
4199                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
4200                                      &match);
4201                 goto new_settings;
4202         }
4203
4204         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
4205         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
4206
4207         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
4208                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
4209                            zero_cod, sizeof(zero_cod), NULL);
4210
4211 new_settings:
4212         err = new_settings(hdev, match.sk);
4213
4214         if (match.sk)
4215                 sock_put(match.sk);
4216
4217         return err;
4218 }
4219
4220 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
4221 {
4222         struct pending_cmd *cmd;
4223         u8 status;
4224
4225         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
4226         if (!cmd)
4227                 return;
4228
4229         if (err == -ERFKILL)
4230                 status = MGMT_STATUS_RFKILLED;
4231         else
4232                 status = MGMT_STATUS_FAILED;
4233
4234         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
4235
4236         mgmt_pending_remove(cmd);
4237 }
4238
4239 void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
4240 {
4241         bool changed;
4242
4243         /* Nothing needed here if there's a pending command since that
4244          * commands request completion callback takes care of everything
4245          * necessary.
4246          */
4247         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
4248                 return;
4249
4250         if (discoverable)
4251                 changed = !test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4252         else
4253                 changed = test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4254
4255         if (changed)
4256                 new_settings(hdev, NULL);
4257 }
4258
4259 void mgmt_connectable(struct hci_dev *hdev, u8 connectable)
4260 {
4261         bool changed;
4262
4263         /* Nothing needed here if there's a pending command since that
4264          * commands request completion callback takes care of everything
4265          * necessary.
4266          */
4267         if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
4268                 return;
4269
4270         if (connectable)
4271                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
4272         else
4273                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
4274
4275         if (changed)
4276                 new_settings(hdev, NULL);
4277 }
4278
4279 void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
4280 {
4281         u8 mgmt_err = mgmt_status(status);
4282
4283         if (scan & SCAN_PAGE)
4284                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
4285                                      cmd_status_rsp, &mgmt_err);
4286
4287         if (scan & SCAN_INQUIRY)
4288                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
4289                                      cmd_status_rsp, &mgmt_err);
4290 }
4291
4292 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
4293                       bool persistent)
4294 {
4295         struct mgmt_ev_new_link_key ev;
4296
4297         memset(&ev, 0, sizeof(ev));
4298
4299         ev.store_hint = persistent;
4300         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4301         ev.key.addr.type = BDADDR_BREDR;
4302         ev.key.type = key->type;
4303         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
4304         ev.key.pin_len = key->pin_len;
4305
4306         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
4307 }
4308
4309 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
4310 {
4311         struct mgmt_ev_new_long_term_key ev;
4312
4313         memset(&ev, 0, sizeof(ev));
4314
4315         ev.store_hint = persistent;
4316         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4317         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
4318         ev.key.authenticated = key->authenticated;
4319         ev.key.enc_size = key->enc_size;
4320         ev.key.ediv = key->ediv;
4321
4322         if (key->type == HCI_SMP_LTK)
4323                 ev.key.master = 1;
4324
4325         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
4326         memcpy(ev.key.val, key->val, sizeof(key->val));
4327
4328         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
4329                           NULL);
4330 }
4331
4332 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4333                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
4334                            u8 *dev_class)
4335 {
4336         char buf[512];
4337         struct mgmt_ev_device_connected *ev = (void *) buf;
4338         u16 eir_len = 0;
4339
4340         bacpy(&ev->addr.bdaddr, bdaddr);
4341         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4342
4343         ev->flags = __cpu_to_le32(flags);
4344
4345         if (name_len > 0)
4346                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
4347                                           name, name_len);
4348
4349         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
4350                 eir_len = eir_append_data(ev->eir, eir_len,
4351                                           EIR_CLASS_OF_DEV, dev_class, 3);
4352
4353         ev->eir_len = cpu_to_le16(eir_len);
4354
4355         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
4356                     sizeof(*ev) + eir_len, NULL);
4357 }
4358
4359 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
4360 {
4361         struct mgmt_cp_disconnect *cp = cmd->param;
4362         struct sock **sk = data;
4363         struct mgmt_rp_disconnect rp;
4364
4365         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4366         rp.addr.type = cp->addr.type;
4367
4368         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
4369                      sizeof(rp));
4370
4371         *sk = cmd->sk;
4372         sock_hold(*sk);
4373
4374         mgmt_pending_remove(cmd);
4375 }
4376
4377 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
4378 {
4379         struct hci_dev *hdev = data;
4380         struct mgmt_cp_unpair_device *cp = cmd->param;
4381         struct mgmt_rp_unpair_device rp;
4382
4383         memset(&rp, 0, sizeof(rp));
4384         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4385         rp.addr.type = cp->addr.type;
4386
4387         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
4388
4389         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
4390
4391         mgmt_pending_remove(cmd);
4392 }
4393
4394 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
4395                               u8 link_type, u8 addr_type, u8 reason)
4396 {
4397         struct mgmt_ev_device_disconnected ev;
4398         struct sock *sk = NULL;
4399
4400         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
4401
4402         bacpy(&ev.addr.bdaddr, bdaddr);
4403         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4404         ev.reason = reason;
4405
4406         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
4407
4408         if (sk)
4409                 sock_put(sk);
4410
4411         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4412                              hdev);
4413 }
4414
4415 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
4416                             u8 link_type, u8 addr_type, u8 status)
4417 {
4418         struct mgmt_rp_disconnect rp;
4419         struct pending_cmd *cmd;
4420
4421         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4422                              hdev);
4423
4424         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
4425         if (!cmd)
4426                 return;
4427
4428         bacpy(&rp.addr.bdaddr, bdaddr);
4429         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4430
4431         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
4432                      mgmt_status(status), &rp, sizeof(rp));
4433
4434         mgmt_pending_remove(cmd);
4435 }
4436
4437 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4438                          u8 addr_type, u8 status)
4439 {
4440         struct mgmt_ev_connect_failed ev;
4441
4442         bacpy(&ev.addr.bdaddr, bdaddr);
4443         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4444         ev.status = mgmt_status(status);
4445
4446         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
4447 }
4448
4449 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
4450 {
4451         struct mgmt_ev_pin_code_request ev;
4452
4453         bacpy(&ev.addr.bdaddr, bdaddr);
4454         ev.addr.type = BDADDR_BREDR;
4455         ev.secure = secure;
4456
4457         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
4458                           NULL);
4459 }
4460
4461 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4462                                  u8 status)
4463 {
4464         struct pending_cmd *cmd;
4465         struct mgmt_rp_pin_code_reply rp;
4466         int err;
4467
4468         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
4469         if (!cmd)
4470                 return -ENOENT;
4471
4472         bacpy(&rp.addr.bdaddr, bdaddr);
4473         rp.addr.type = BDADDR_BREDR;
4474
4475         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
4476                            mgmt_status(status), &rp, sizeof(rp));
4477
4478         mgmt_pending_remove(cmd);
4479
4480         return err;
4481 }
4482
4483 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4484                                      u8 status)
4485 {
4486         struct pending_cmd *cmd;
4487         struct mgmt_rp_pin_code_reply rp;
4488         int err;
4489
4490         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
4491         if (!cmd)
4492                 return -ENOENT;
4493
4494         bacpy(&rp.addr.bdaddr, bdaddr);
4495         rp.addr.type = BDADDR_BREDR;
4496
4497         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
4498                            mgmt_status(status), &rp, sizeof(rp));
4499
4500         mgmt_pending_remove(cmd);
4501
4502         return err;
4503 }
4504
4505 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4506                               u8 link_type, u8 addr_type, __le32 value,
4507                               u8 confirm_hint)
4508 {
4509         struct mgmt_ev_user_confirm_request ev;
4510
4511         BT_DBG("%s", hdev->name);
4512
4513         bacpy(&ev.addr.bdaddr, bdaddr);
4514         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4515         ev.confirm_hint = confirm_hint;
4516         ev.value = value;
4517
4518         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
4519                           NULL);
4520 }
4521
4522 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4523                               u8 link_type, u8 addr_type)
4524 {
4525         struct mgmt_ev_user_passkey_request ev;
4526
4527         BT_DBG("%s", hdev->name);
4528
4529         bacpy(&ev.addr.bdaddr, bdaddr);
4530         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4531
4532         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
4533                           NULL);
4534 }
4535
4536 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4537                                       u8 link_type, u8 addr_type, u8 status,
4538                                       u8 opcode)
4539 {
4540         struct pending_cmd *cmd;
4541         struct mgmt_rp_user_confirm_reply rp;
4542         int err;
4543
4544         cmd = mgmt_pending_find(opcode, hdev);
4545         if (!cmd)
4546                 return -ENOENT;
4547
4548         bacpy(&rp.addr.bdaddr, bdaddr);
4549         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4550         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
4551                            &rp, sizeof(rp));
4552
4553         mgmt_pending_remove(cmd);
4554
4555         return err;
4556 }
4557
4558 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4559                                      u8 link_type, u8 addr_type, u8 status)
4560 {
4561         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4562                                           status, MGMT_OP_USER_CONFIRM_REPLY);
4563 }
4564
4565 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4566                                          u8 link_type, u8 addr_type, u8 status)
4567 {
4568         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4569                                           status,
4570                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
4571 }
4572
4573 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4574                                      u8 link_type, u8 addr_type, u8 status)
4575 {
4576         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4577                                           status, MGMT_OP_USER_PASSKEY_REPLY);
4578 }
4579
4580 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4581                                          u8 link_type, u8 addr_type, u8 status)
4582 {
4583         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4584                                           status,
4585                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
4586 }
4587
4588 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
4589                              u8 link_type, u8 addr_type, u32 passkey,
4590                              u8 entered)
4591 {
4592         struct mgmt_ev_passkey_notify ev;
4593
4594         BT_DBG("%s", hdev->name);
4595
4596         bacpy(&ev.addr.bdaddr, bdaddr);
4597         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4598         ev.passkey = __cpu_to_le32(passkey);
4599         ev.entered = entered;
4600
4601         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
4602 }
4603
4604 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4605                      u8 addr_type, u8 status)
4606 {
4607         struct mgmt_ev_auth_failed ev;
4608
4609         bacpy(&ev.addr.bdaddr, bdaddr);
4610         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4611         ev.status = mgmt_status(status);
4612
4613         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
4614 }
4615
4616 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
4617 {
4618         struct cmd_lookup match = { NULL, hdev };
4619         bool changed = false;
4620         int err = 0;
4621
4622         if (status) {
4623                 u8 mgmt_err = mgmt_status(status);
4624                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
4625                                      cmd_status_rsp, &mgmt_err);
4626                 return 0;
4627         }
4628
4629         if (test_bit(HCI_AUTH, &hdev->flags)) {
4630                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4631                         changed = true;
4632         } else {
4633                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4634                         changed = true;
4635         }
4636
4637         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
4638                              &match);
4639
4640         if (changed)
4641                 err = new_settings(hdev, match.sk);
4642
4643         if (match.sk)
4644                 sock_put(match.sk);
4645
4646         return err;
4647 }
4648
4649 static void clear_eir(struct hci_request *req)
4650 {
4651         struct hci_dev *hdev = req->hdev;
4652         struct hci_cp_write_eir cp;
4653
4654         if (!lmp_ext_inq_capable(hdev))
4655                 return;
4656
4657         memset(hdev->eir, 0, sizeof(hdev->eir));
4658
4659         memset(&cp, 0, sizeof(cp));
4660
4661         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4662 }
4663
4664 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4665 {
4666         struct cmd_lookup match = { NULL, hdev };
4667         struct hci_request req;
4668         bool changed = false;
4669         int err = 0;
4670
4671         if (status) {
4672                 u8 mgmt_err = mgmt_status(status);
4673
4674                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4675                                                  &hdev->dev_flags)) {
4676                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4677                         err = new_settings(hdev, NULL);
4678                 }
4679
4680                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4681                                      &mgmt_err);
4682
4683                 return err;
4684         }
4685
4686         if (enable) {
4687                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4688         } else {
4689                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4690                 if (!changed)
4691                         changed = test_and_clear_bit(HCI_HS_ENABLED,
4692                                                      &hdev->dev_flags);
4693                 else
4694                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4695         }
4696
4697         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4698
4699         if (changed)
4700                 err = new_settings(hdev, match.sk);
4701
4702         if (match.sk)
4703                 sock_put(match.sk);
4704
4705         hci_req_init(&req, hdev);
4706
4707         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4708                 update_eir(&req);
4709         else
4710                 clear_eir(&req);
4711
4712         hci_req_run(&req, NULL);
4713
4714         return err;
4715 }
4716
4717 static void sk_lookup(struct pending_cmd *cmd, void *data)
4718 {
4719         struct cmd_lookup *match = data;
4720
4721         if (match->sk == NULL) {
4722                 match->sk = cmd->sk;
4723                 sock_hold(match->sk);
4724         }
4725 }
4726
4727 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4728                                    u8 status)
4729 {
4730         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4731         int err = 0;
4732
4733         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4734         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4735         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4736
4737         if (!status)
4738                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4739                                  3, NULL);
4740
4741         if (match.sk)
4742                 sock_put(match.sk);
4743
4744         return err;
4745 }
4746
4747 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4748 {
4749         struct mgmt_cp_set_local_name ev;
4750         struct pending_cmd *cmd;
4751
4752         if (status)
4753                 return 0;
4754
4755         memset(&ev, 0, sizeof(ev));
4756         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4757         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4758
4759         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4760         if (!cmd) {
4761                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4762
4763                 /* If this is a HCI command related to powering on the
4764                  * HCI dev don't send any mgmt signals.
4765                  */
4766                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4767                         return 0;
4768         }
4769
4770         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4771                           cmd ? cmd->sk : NULL);
4772 }
4773
4774 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4775                                             u8 *randomizer, u8 status)
4776 {
4777         struct pending_cmd *cmd;
4778         int err;
4779
4780         BT_DBG("%s status %u", hdev->name, status);
4781
4782         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4783         if (!cmd)
4784                 return -ENOENT;
4785
4786         if (status) {
4787                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4788                                  mgmt_status(status));
4789         } else {
4790                 struct mgmt_rp_read_local_oob_data rp;
4791
4792                 memcpy(rp.hash, hash, sizeof(rp.hash));
4793                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4794
4795                 err = cmd_complete(cmd->sk, hdev->id,
4796                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4797                                    sizeof(rp));
4798         }
4799
4800         mgmt_pending_remove(cmd);
4801
4802         return err;
4803 }
4804
4805 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4806                        u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4807                        ssp, u8 *eir, u16 eir_len)
4808 {
4809         char buf[512];
4810         struct mgmt_ev_device_found *ev = (void *) buf;
4811         size_t ev_size;
4812
4813         if (!hci_discovery_active(hdev))
4814                 return;
4815
4816         /* Leave 5 bytes for a potential CoD field */
4817         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4818                 return;
4819
4820         memset(buf, 0, sizeof(buf));
4821
4822         bacpy(&ev->addr.bdaddr, bdaddr);
4823         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4824         ev->rssi = rssi;
4825         if (cfm_name)
4826                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4827         if (!ssp)
4828                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4829
4830         if (eir_len > 0)
4831                 memcpy(ev->eir, eir, eir_len);
4832
4833         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4834                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4835                                           dev_class, 3);
4836
4837         ev->eir_len = cpu_to_le16(eir_len);
4838         ev_size = sizeof(*ev) + eir_len;
4839
4840         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4841 }
4842
4843 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4844                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4845 {
4846         struct mgmt_ev_device_found *ev;
4847         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4848         u16 eir_len;
4849
4850         ev = (struct mgmt_ev_device_found *) buf;
4851
4852         memset(buf, 0, sizeof(buf));
4853
4854         bacpy(&ev->addr.bdaddr, bdaddr);
4855         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4856         ev->rssi = rssi;
4857
4858         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4859                                   name_len);
4860
4861         ev->eir_len = cpu_to_le16(eir_len);
4862
4863         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
4864 }
4865
4866 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4867 {
4868         struct mgmt_ev_discovering ev;
4869         struct pending_cmd *cmd;
4870
4871         BT_DBG("%s discovering %u", hdev->name, discovering);
4872
4873         if (discovering)
4874                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4875         else
4876                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4877
4878         if (cmd != NULL) {
4879                 u8 type = hdev->discovery.type;
4880
4881                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4882                              sizeof(type));
4883                 mgmt_pending_remove(cmd);
4884         }
4885
4886         memset(&ev, 0, sizeof(ev));
4887         ev.type = hdev->discovery.type;
4888         ev.discovering = discovering;
4889
4890         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4891 }
4892
4893 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4894 {
4895         struct pending_cmd *cmd;
4896         struct mgmt_ev_device_blocked ev;
4897
4898         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4899
4900         bacpy(&ev.addr.bdaddr, bdaddr);
4901         ev.addr.type = type;
4902
4903         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4904                           cmd ? cmd->sk : NULL);
4905 }
4906
4907 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4908 {
4909         struct pending_cmd *cmd;
4910         struct mgmt_ev_device_unblocked ev;
4911
4912         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4913
4914         bacpy(&ev.addr.bdaddr, bdaddr);
4915         ev.addr.type = type;
4916
4917         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4918                           cmd ? cmd->sk : NULL);
4919 }
4920
4921 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
4922 {
4923         BT_DBG("%s status %u", hdev->name, status);
4924
4925         /* Clear the advertising mgmt setting if we failed to re-enable it */
4926         if (status) {
4927                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4928                 new_settings(hdev, NULL);
4929         }
4930 }
4931
4932 void mgmt_reenable_advertising(struct hci_dev *hdev)
4933 {
4934         struct hci_request req;
4935
4936         if (hci_conn_num(hdev, LE_LINK) > 0)
4937                 return;
4938
4939         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
4940                 return;
4941
4942         hci_req_init(&req, hdev);
4943         enable_advertising(&req);
4944
4945         /* If this fails we have no option but to let user space know
4946          * that we've disabled advertising.
4947          */
4948         if (hci_req_run(&req, adv_enable_complete) < 0) {
4949                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4950                 new_settings(hdev, NULL);
4951         }
4952 }