net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33
  34 #include "smp.h"
  35
  36 #define MGMT_VERSION    1
  37 #define MGMT_REVISION   4
  38
  39 static const u16 mgmt_commands[] = {
  40         MGMT_OP_READ_INDEX_LIST,
  41         MGMT_OP_READ_INFO,
  42         MGMT_OP_SET_POWERED,
  43         MGMT_OP_SET_DISCOVERABLE,
  44         MGMT_OP_SET_CONNECTABLE,
  45         MGMT_OP_SET_FAST_CONNECTABLE,
  46         MGMT_OP_SET_PAIRABLE,
  47         MGMT_OP_SET_LINK_SECURITY,
  48         MGMT_OP_SET_SSP,
  49         MGMT_OP_SET_HS,
  50         MGMT_OP_SET_LE,
  51         MGMT_OP_SET_DEV_CLASS,
  52         MGMT_OP_SET_LOCAL_NAME,
  53         MGMT_OP_ADD_UUID,
  54         MGMT_OP_REMOVE_UUID,
  55         MGMT_OP_LOAD_LINK_KEYS,
  56         MGMT_OP_LOAD_LONG_TERM_KEYS,
  57         MGMT_OP_DISCONNECT,
  58         MGMT_OP_GET_CONNECTIONS,
  59         MGMT_OP_PIN_CODE_REPLY,
  60         MGMT_OP_PIN_CODE_NEG_REPLY,
  61         MGMT_OP_SET_IO_CAPABILITY,
  62         MGMT_OP_PAIR_DEVICE,
  63         MGMT_OP_CANCEL_PAIR_DEVICE,
  64         MGMT_OP_UNPAIR_DEVICE,
  65         MGMT_OP_USER_CONFIRM_REPLY,
  66         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  67         MGMT_OP_USER_PASSKEY_REPLY,
  68         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  69         MGMT_OP_READ_LOCAL_OOB_DATA,
  70         MGMT_OP_ADD_REMOTE_OOB_DATA,
  71         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  72         MGMT_OP_START_DISCOVERY,
  73         MGMT_OP_STOP_DISCOVERY,
  74         MGMT_OP_CONFIRM_NAME,
  75         MGMT_OP_BLOCK_DEVICE,
  76         MGMT_OP_UNBLOCK_DEVICE,
  77         MGMT_OP_SET_DEVICE_ID,
  78         MGMT_OP_SET_ADVERTISING,
  79         MGMT_OP_SET_BREDR,
  80         MGMT_OP_SET_STATIC_ADDRESS,
  81         MGMT_OP_SET_SCAN_PARAMS,
  82 };
  83
  84 static const u16 mgmt_events[] = {
  85         MGMT_EV_CONTROLLER_ERROR,
  86         MGMT_EV_INDEX_ADDED,
  87         MGMT_EV_INDEX_REMOVED,
  88         MGMT_EV_NEW_SETTINGS,
  89         MGMT_EV_CLASS_OF_DEV_CHANGED,
  90         MGMT_EV_LOCAL_NAME_CHANGED,
  91         MGMT_EV_NEW_LINK_KEY,
  92         MGMT_EV_NEW_LONG_TERM_KEY,
  93         MGMT_EV_DEVICE_CONNECTED,
  94         MGMT_EV_DEVICE_DISCONNECTED,
  95         MGMT_EV_CONNECT_FAILED,
  96         MGMT_EV_PIN_CODE_REQUEST,
  97         MGMT_EV_USER_CONFIRM_REQUEST,
  98         MGMT_EV_USER_PASSKEY_REQUEST,
  99         MGMT_EV_AUTH_FAILED,
 100         MGMT_EV_DEVICE_FOUND,
 101         MGMT_EV_DISCOVERING,
 102         MGMT_EV_DEVICE_BLOCKED,
 103         MGMT_EV_DEVICE_UNBLOCKED,
 104         MGMT_EV_DEVICE_UNPAIRED,
 105         MGMT_EV_PASSKEY_NOTIFY,
 106 };
 107
 108 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 109
 110 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 111                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 112
 113 struct pending_cmd {
 114         struct list_head list;
 115         u16 opcode;
 116         int index;
 117         void *param;
 118         struct sock *sk;
 119         void *user_data;
 120 };
 121
 122 /* HCI to MGMT error code conversion table */
 123 static u8 mgmt_status_table[] = {
 124         MGMT_STATUS_SUCCESS,
 125         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 126         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 127         MGMT_STATUS_FAILED,             /* Hardware Failure */
 128         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 129         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 130         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 131         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 132         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 133         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 134         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 135         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 136         MGMT_STATUS_BUSY,               /* Command Disallowed */
 137         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 138         MGMT_STATUS_REJECTED,           /* Rejected Security */
 139         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 140         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 141         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 142         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 143         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 144         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 145         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 146         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 147         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 148         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 149         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 150         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 151         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 152         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 153         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 154         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 155         MGMT_STATUS_FAILED,             /* Unspecified Error */
 156         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 157         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 158         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 159         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 160         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 161         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 162         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 164         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 165         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 166         MGMT_STATUS_FAILED,             /* Transaction Collision */
 167         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 168         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 169         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 170         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 171         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 172         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 173         MGMT_STATUS_FAILED,             /* Slot Violation */
 174         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 175         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 176         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 177         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 178         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 179         MGMT_STATUS_BUSY,               /* Controller Busy */
 180         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 181         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 182         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 183         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 184         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 185 };
 186
 187 static u8 mgmt_status(u8 hci_status)
 188 {
 189         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 190                 return mgmt_status_table[hci_status];
 191
 192         return MGMT_STATUS_FAILED;
 193 }
 194
 195 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 196 {
 197         struct sk_buff *skb;
 198         struct mgmt_hdr *hdr;
 199         struct mgmt_ev_cmd_status *ev;
 200         int err;
 201
 202         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 203
 204         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 205         if (!skb)
 206                 return -ENOMEM;
 207
 208         hdr = (void *) skb_put(skb, sizeof(*hdr));
 209
 210         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 211         hdr->index = cpu_to_le16(index);
 212         hdr->len = cpu_to_le16(sizeof(*ev));
 213
 214         ev = (void *) skb_put(skb, sizeof(*ev));
 215         ev->status = status;
 216         ev->opcode = cpu_to_le16(cmd);
 217
 218         err = sock_queue_rcv_skb(sk, skb);
 219         if (err < 0)
 220                 kfree_skb(skb);
 221
 222         return err;
 223 }
 224
 225 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 226                         void *rp, size_t rp_len)
 227 {
 228         struct sk_buff *skb;
 229         struct mgmt_hdr *hdr;
 230         struct mgmt_ev_cmd_complete *ev;
 231         int err;
 232
 233         BT_DBG("sock %p", sk);
 234
 235         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 236         if (!skb)
 237                 return -ENOMEM;
 238
 239         hdr = (void *) skb_put(skb, sizeof(*hdr));
 240
 241         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 242         hdr->index = cpu_to_le16(index);
 243         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 244
 245         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 246         ev->opcode = cpu_to_le16(cmd);
 247         ev->status = status;
 248
 249         if (rp)
 250                 memcpy(ev->data, rp, rp_len);
 251
 252         err = sock_queue_rcv_skb(sk, skb);
 253         if (err < 0)
 254                 kfree_skb(skb);
 255
 256         return err;
 257 }
 258
 259 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 260                         u16 data_len)
 261 {
 262         struct mgmt_rp_read_version rp;
 263
 264         BT_DBG("sock %p", sk);
 265
 266         rp.version = MGMT_VERSION;
 267         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 268
 269         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 270                             sizeof(rp));
 271 }
 272
 273 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 274                          u16 data_len)
 275 {
 276         struct mgmt_rp_read_commands *rp;
 277         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 278         const u16 num_events = ARRAY_SIZE(mgmt_events);
 279         __le16 *opcode;
 280         size_t rp_size;
 281         int i, err;
 282
 283         BT_DBG("sock %p", sk);
 284
 285         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 286
 287         rp = kmalloc(rp_size, GFP_KERNEL);
 288         if (!rp)
 289                 return -ENOMEM;
 290
 291         rp->num_commands = __constant_cpu_to_le16(num_commands);
 292         rp->num_events = __constant_cpu_to_le16(num_events);
 293
 294         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 295                 put_unaligned_le16(mgmt_commands[i], opcode);
 296
 297         for (i = 0; i < num_events; i++, opcode++)
 298                 put_unaligned_le16(mgmt_events[i], opcode);
 299
 300         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 301                            rp_size);
 302         kfree(rp);
 303
 304         return err;
 305 }
 306
 307 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 308                            u16 data_len)
 309 {
 310         struct mgmt_rp_read_index_list *rp;
 311         struct hci_dev *d;
 312         size_t rp_len;
 313         u16 count;
 314         int err;
 315
 316         BT_DBG("sock %p", sk);
 317
 318         read_lock(&hci_dev_list_lock);
 319
 320         count = 0;
 321         list_for_each_entry(d, &hci_dev_list, list) {
 322                 if (d->dev_type == HCI_BREDR)
 323                         count++;
 324         }
 325
 326         rp_len = sizeof(*rp) + (2 * count);
 327         rp = kmalloc(rp_len, GFP_ATOMIC);
 328         if (!rp) {
 329                 read_unlock(&hci_dev_list_lock);
 330                 return -ENOMEM;
 331         }
 332
 333         count = 0;
 334         list_for_each_entry(d, &hci_dev_list, list) {
 335                 if (test_bit(HCI_SETUP, &d->dev_flags))
 336                         continue;
 337
 338                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 339                         continue;
 340
 341                 if (d->dev_type == HCI_BREDR) {
 342                         rp->index[count++] = cpu_to_le16(d->id);
 343                         BT_DBG("Added hci%u", d->id);
 344                 }
 345         }
 346
 347         rp->num_controllers = cpu_to_le16(count);
 348         rp_len = sizeof(*rp) + (2 * count);
 349
 350         read_unlock(&hci_dev_list_lock);
 351
 352         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 353                            rp_len);
 354
 355         kfree(rp);
 356
 357         return err;
 358 }
 359
 360 static u32 get_supported_settings(struct hci_dev *hdev)
 361 {
 362         u32 settings = 0;
 363
 364         settings |= MGMT_SETTING_POWERED;
 365         settings |= MGMT_SETTING_PAIRABLE;
 366
 367         if (lmp_bredr_capable(hdev)) {
 368                 settings |= MGMT_SETTING_CONNECTABLE;
 369                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 370                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 371                 settings |= MGMT_SETTING_DISCOVERABLE;
 372                 settings |= MGMT_SETTING_BREDR;
 373                 settings |= MGMT_SETTING_LINK_SECURITY;
 374
 375                 if (lmp_ssp_capable(hdev)) {
 376                         settings |= MGMT_SETTING_SSP;
 377                         settings |= MGMT_SETTING_HS;
 378                 }
 379         }
 380
 381         if (lmp_le_capable(hdev)) {
 382                 settings |= MGMT_SETTING_LE;
 383                 settings |= MGMT_SETTING_ADVERTISING;
 384         }
 385
 386         return settings;
 387 }
 388
 389 static u32 get_current_settings(struct hci_dev *hdev)
 390 {
 391         u32 settings = 0;
 392
 393         if (hdev_is_powered(hdev))
 394                 settings |= MGMT_SETTING_POWERED;
 395
 396         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 397                 settings |= MGMT_SETTING_CONNECTABLE;
 398
 399         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 400                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 401
 402         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 403                 settings |= MGMT_SETTING_DISCOVERABLE;
 404
 405         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 406                 settings |= MGMT_SETTING_PAIRABLE;
 407
 408         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 409                 settings |= MGMT_SETTING_BREDR;
 410
 411         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 412                 settings |= MGMT_SETTING_LE;
 413
 414         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 415                 settings |= MGMT_SETTING_LINK_SECURITY;
 416
 417         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 418                 settings |= MGMT_SETTING_SSP;
 419
 420         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 421                 settings |= MGMT_SETTING_HS;
 422
 423         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 424                 settings |= MGMT_SETTING_ADVERTISING;
 425
 426         return settings;
 427 }
 428
 429 #define PNP_INFO_SVCLASS_ID             0x1200
 430
 431 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 432 {
 433         u8 *ptr = data, *uuids_start = NULL;
 434         struct bt_uuid *uuid;
 435
 436         if (len < 4)
 437                 return ptr;
 438
 439         list_for_each_entry(uuid, &hdev->uuids, list) {
 440                 u16 uuid16;
 441
 442                 if (uuid->size != 16)
 443                         continue;
 444
 445                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 446                 if (uuid16 < 0x1100)
 447                         continue;
 448
 449                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 450                         continue;
 451
 452                 if (!uuids_start) {
 453                         uuids_start = ptr;
 454                         uuids_start[0] = 1;
 455                         uuids_start[1] = EIR_UUID16_ALL;
 456                         ptr += 2;
 457                 }
 458
 459                 /* Stop if not enough space to put next UUID */
 460                 if ((ptr - data) + sizeof(u16) > len) {
 461                         uuids_start[1] = EIR_UUID16_SOME;
 462                         break;
 463                 }
 464
 465                 *ptr++ = (uuid16 & 0x00ff);
 466                 *ptr++ = (uuid16 & 0xff00) >> 8;
 467                 uuids_start[0] += sizeof(uuid16);
 468         }
 469
 470         return ptr;
 471 }
 472
 473 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 474 {
 475         u8 *ptr = data, *uuids_start = NULL;
 476         struct bt_uuid *uuid;
 477
 478         if (len < 6)
 479                 return ptr;
 480
 481         list_for_each_entry(uuid, &hdev->uuids, list) {
 482                 if (uuid->size != 32)
 483                         continue;
 484
 485                 if (!uuids_start) {
 486                         uuids_start = ptr;
 487                         uuids_start[0] = 1;
 488                         uuids_start[1] = EIR_UUID32_ALL;
 489                         ptr += 2;
 490                 }
 491
 492                 /* Stop if not enough space to put next UUID */
 493                 if ((ptr - data) + sizeof(u32) > len) {
 494                         uuids_start[1] = EIR_UUID32_SOME;
 495                         break;
 496                 }
 497
 498                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 499                 ptr += sizeof(u32);
 500                 uuids_start[0] += sizeof(u32);
 501         }
 502
 503         return ptr;
 504 }
 505
 506 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 507 {
 508         u8 *ptr = data, *uuids_start = NULL;
 509         struct bt_uuid *uuid;
 510
 511         if (len < 18)
 512                 return ptr;
 513
 514         list_for_each_entry(uuid, &hdev->uuids, list) {
 515                 if (uuid->size != 128)
 516                         continue;
 517
 518                 if (!uuids_start) {
 519                         uuids_start = ptr;
 520                         uuids_start[0] = 1;
 521                         uuids_start[1] = EIR_UUID128_ALL;
 522                         ptr += 2;
 523                 }
 524
 525                 /* Stop if not enough space to put next UUID */
 526                 if ((ptr - data) + 16 > len) {
 527                         uuids_start[1] = EIR_UUID128_SOME;
 528                         break;
 529                 }
 530
 531                 memcpy(ptr, uuid->uuid, 16);
 532                 ptr += 16;
 533                 uuids_start[0] += 16;
 534         }
 535
 536         return ptr;
 537 }
 538
 539 static u8 create_ad(struct hci_dev *hdev, u8 *ptr)
 540 {
 541         u8 ad_len = 0, flags = 0;
 542         size_t name_len;
 543
 544         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 545                 flags |= LE_AD_GENERAL;
 546
 547         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
 548                 if (lmp_le_br_capable(hdev))
 549                         flags |= LE_AD_SIM_LE_BREDR_CTRL;
 550                 if (lmp_host_le_br_capable(hdev))
 551                         flags |= LE_AD_SIM_LE_BREDR_HOST;
 552         } else {
 553                 flags |= LE_AD_NO_BREDR;
 554         }
 555
 556         if (flags) {
 557                 BT_DBG("adv flags 0x%02x", flags);
 558
 559                 ptr[0] = 2;
 560                 ptr[1] = EIR_FLAGS;
 561                 ptr[2] = flags;
 562
 563                 ad_len += 3;
 564                 ptr += 3;
 565         }
 566
 567         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 568                 ptr[0] = 2;
 569                 ptr[1] = EIR_TX_POWER;
 570                 ptr[2] = (u8) hdev->adv_tx_power;
 571
 572                 ad_len += 3;
 573                 ptr += 3;
 574         }
 575
 576         name_len = strlen(hdev->dev_name);
 577         if (name_len > 0) {
 578                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 579
 580                 if (name_len > max_len) {
 581                         name_len = max_len;
 582                         ptr[1] = EIR_NAME_SHORT;
 583                 } else
 584                         ptr[1] = EIR_NAME_COMPLETE;
 585
 586                 ptr[0] = name_len + 1;
 587
 588                 memcpy(ptr + 2, hdev->dev_name, name_len);
 589
 590                 ad_len += (name_len + 2);
 591                 ptr += (name_len + 2);
 592         }
 593
 594         return ad_len;
 595 }
 596
 597 static void update_ad(struct hci_request *req)
 598 {
 599         struct hci_dev *hdev = req->hdev;
 600         struct hci_cp_le_set_adv_data cp;
 601         u8 len;
 602
 603         if (!lmp_le_capable(hdev))
 604                 return;
 605
 606         memset(&cp, 0, sizeof(cp));
 607
 608         len = create_ad(hdev, cp.data);
 609
 610         if (hdev->adv_data_len == len &&
 611             memcmp(cp.data, hdev->adv_data, len) == 0)
 612                 return;
 613
 614         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 615         hdev->adv_data_len = len;
 616
 617         cp.length = len;
 618
 619         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 620 }
 621
 622 static void create_eir(struct hci_dev *hdev, u8 *data)
 623 {
 624         u8 *ptr = data;
 625         size_t name_len;
 626
 627         name_len = strlen(hdev->dev_name);
 628
 629         if (name_len > 0) {
 630                 /* EIR Data type */
 631                 if (name_len > 48) {
 632                         name_len = 48;
 633                         ptr[1] = EIR_NAME_SHORT;
 634                 } else
 635                         ptr[1] = EIR_NAME_COMPLETE;
 636
 637                 /* EIR Data length */
 638                 ptr[0] = name_len + 1;
 639
 640                 memcpy(ptr + 2, hdev->dev_name, name_len);
 641
 642                 ptr += (name_len + 2);
 643         }
 644
 645         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 646                 ptr[0] = 2;
 647                 ptr[1] = EIR_TX_POWER;
 648                 ptr[2] = (u8) hdev->inq_tx_power;
 649
 650                 ptr += 3;
 651         }
 652
 653         if (hdev->devid_source > 0) {
 654                 ptr[0] = 9;
 655                 ptr[1] = EIR_DEVICE_ID;
 656
 657                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 658                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 659                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 660                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 661
 662                 ptr += 10;
 663         }
 664
 665         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 666         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 667         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 668 }
 669
 670 static void update_eir(struct hci_request *req)
 671 {
 672         struct hci_dev *hdev = req->hdev;
 673         struct hci_cp_write_eir cp;
 674
 675         if (!hdev_is_powered(hdev))
 676                 return;
 677
 678         if (!lmp_ext_inq_capable(hdev))
 679                 return;
 680
 681         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 682                 return;
 683
 684         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 685                 return;
 686
 687         memset(&cp, 0, sizeof(cp));
 688
 689         create_eir(hdev, cp.data);
 690
 691         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 692                 return;
 693
 694         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 695
 696         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 697 }
 698
 699 static u8 get_service_classes(struct hci_dev *hdev)
 700 {
 701         struct bt_uuid *uuid;
 702         u8 val = 0;
 703
 704         list_for_each_entry(uuid, &hdev->uuids, list)
 705                 val |= uuid->svc_hint;
 706
 707         return val;
 708 }
 709
 710 static void update_class(struct hci_request *req)
 711 {
 712         struct hci_dev *hdev = req->hdev;
 713         u8 cod[3];
 714
 715         BT_DBG("%s", hdev->name);
 716
 717         if (!hdev_is_powered(hdev))
 718                 return;
 719
 720         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 721                 return;
 722
 723         cod[0] = hdev->minor_class;
 724         cod[1] = hdev->major_class;
 725         cod[2] = get_service_classes(hdev);
 726
 727         if (memcmp(cod, hdev->dev_class, 3) == 0)
 728                 return;
 729
 730         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 731 }
 732
 733 static void service_cache_off(struct work_struct *work)
 734 {
 735         struct hci_dev *hdev = container_of(work, struct hci_dev,
 736                                             service_cache.work);
 737         struct hci_request req;
 738
 739         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 740                 return;
 741
 742         hci_req_init(&req, hdev);
 743
 744         hci_dev_lock(hdev);
 745
 746         update_eir(&req);
 747         update_class(&req);
 748
 749         hci_dev_unlock(hdev);
 750
 751         hci_req_run(&req, NULL);
 752 }
 753
 754 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 755 {
 756         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 757                 return;
 758
 759         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 760
 761         /* Non-mgmt controlled devices get this bit set
 762          * implicitly so that pairing works for them, however
 763          * for mgmt we require user-space to explicitly enable
 764          * it
 765          */
 766         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 767 }
 768
 769 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 770                                 void *data, u16 data_len)
 771 {
 772         struct mgmt_rp_read_info rp;
 773
 774         BT_DBG("sock %p %s", sk, hdev->name);
 775
 776         hci_dev_lock(hdev);
 777
 778         memset(&rp, 0, sizeof(rp));
 779
 780         bacpy(&rp.bdaddr, &hdev->bdaddr);
 781
 782         rp.version = hdev->hci_ver;
 783         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 784
 785         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 786         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 787
 788         memcpy(rp.dev_class, hdev->dev_class, 3);
 789
 790         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 791         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 792
 793         hci_dev_unlock(hdev);
 794
 795         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 796                             sizeof(rp));
 797 }
 798
 799 static void mgmt_pending_free(struct pending_cmd *cmd)
 800 {
 801         sock_put(cmd->sk);
 802         kfree(cmd->param);
 803         kfree(cmd);
 804 }
 805
 806 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 807                                             struct hci_dev *hdev, void *data,
 808                                             u16 len)
 809 {
 810         struct pending_cmd *cmd;
 811
 812         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 813         if (!cmd)
 814                 return NULL;
 815
 816         cmd->opcode = opcode;
 817         cmd->index = hdev->id;
 818
 819         cmd->param = kmalloc(len, GFP_KERNEL);
 820         if (!cmd->param) {
 821                 kfree(cmd);
 822                 return NULL;
 823         }
 824
 825         if (data)
 826                 memcpy(cmd->param, data, len);
 827
 828         cmd->sk = sk;
 829         sock_hold(sk);
 830
 831         list_add(&cmd->list, &hdev->mgmt_pending);
 832
 833         return cmd;
 834 }
 835
 836 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 837                                  void (*cb)(struct pending_cmd *cmd,
 838                                             void *data),
 839                                  void *data)
 840 {
 841         struct pending_cmd *cmd, *tmp;
 842
 843         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 844                 if (opcode > 0 && cmd->opcode != opcode)
 845                         continue;
 846
 847                 cb(cmd, data);
 848         }
 849 }
 850
 851 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 852 {
 853         struct pending_cmd *cmd;
 854
 855         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 856                 if (cmd->opcode == opcode)
 857                         return cmd;
 858         }
 859
 860         return NULL;
 861 }
 862
 863 static void mgmt_pending_remove(struct pending_cmd *cmd)
 864 {
 865         list_del(&cmd->list);
 866         mgmt_pending_free(cmd);
 867 }
 868
 869 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 870 {
 871         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 872
 873         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 874                             sizeof(settings));
 875 }
 876
 877 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 878                        u16 len)
 879 {
 880         struct mgmt_mode *cp = data;
 881         struct pending_cmd *cmd;
 882         int err;
 883
 884         BT_DBG("request for %s", hdev->name);
 885
 886         if (cp->val != 0x00 && cp->val != 0x01)
 887                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 888                                   MGMT_STATUS_INVALID_PARAMS);
 889
 890         hci_dev_lock(hdev);
 891
 892         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 893                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 894                                  MGMT_STATUS_BUSY);
 895                 goto failed;
 896         }
 897
 898         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 899                 cancel_delayed_work(&hdev->power_off);
 900
 901                 if (cp->val) {
 902                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 903                                          data, len);
 904                         err = mgmt_powered(hdev, 1);
 905                         goto failed;
 906                 }
 907         }
 908
 909         if (!!cp->val == hdev_is_powered(hdev)) {
 910                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 911                 goto failed;
 912         }
 913
 914         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 915         if (!cmd) {
 916                 err = -ENOMEM;
 917                 goto failed;
 918         }
 919
 920         if (cp->val)
 921                 queue_work(hdev->req_workqueue, &hdev->power_on);
 922         else
 923                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 924
 925         err = 0;
 926
 927 failed:
 928         hci_dev_unlock(hdev);
 929         return err;
 930 }
 931
 932 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 933                       struct sock *skip_sk)
 934 {
 935         struct sk_buff *skb;
 936         struct mgmt_hdr *hdr;
 937
 938         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 939         if (!skb)
 940                 return -ENOMEM;
 941
 942         hdr = (void *) skb_put(skb, sizeof(*hdr));
 943         hdr->opcode = cpu_to_le16(event);
 944         if (hdev)
 945                 hdr->index = cpu_to_le16(hdev->id);
 946         else
 947                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 948         hdr->len = cpu_to_le16(data_len);
 949
 950         if (data)
 951                 memcpy(skb_put(skb, data_len), data, data_len);
 952
 953         /* Time stamp */
 954         __net_timestamp(skb);
 955
 956         hci_send_to_control(skb, skip_sk);
 957         kfree_skb(skb);
 958
 959         return 0;
 960 }
 961
 962 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 963 {
 964         __le32 ev;
 965
 966         ev = cpu_to_le32(get_current_settings(hdev));
 967
 968         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 969 }
 970
 971 struct cmd_lookup {
 972         struct sock *sk;
 973         struct hci_dev *hdev;
 974         u8 mgmt_status;
 975 };
 976
 977 static void settings_rsp(struct pending_cmd *cmd, void *data)
 978 {
 979         struct cmd_lookup *match = data;
 980
 981         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
 982
 983         list_del(&cmd->list);
 984
 985         if (match->sk == NULL) {
 986                 match->sk = cmd->sk;
 987                 sock_hold(match->sk);
 988         }
 989
 990         mgmt_pending_free(cmd);
 991 }
 992
 993 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
 994 {
 995         u8 *status = data;
 996
 997         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
 998         mgmt_pending_remove(cmd);
 999 }
1000
1001 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1002 {
1003         if (!lmp_bredr_capable(hdev))
1004                 return MGMT_STATUS_NOT_SUPPORTED;
1005         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1006                 return MGMT_STATUS_REJECTED;
1007         else
1008                 return MGMT_STATUS_SUCCESS;
1009 }
1010
1011 static u8 mgmt_le_support(struct hci_dev *hdev)
1012 {
1013         if (!lmp_le_capable(hdev))
1014                 return MGMT_STATUS_NOT_SUPPORTED;
1015         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1016                 return MGMT_STATUS_REJECTED;
1017         else
1018                 return MGMT_STATUS_SUCCESS;
1019 }
1020
1021 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1022 {
1023         struct pending_cmd *cmd;
1024         struct mgmt_mode *cp;
1025         bool changed;
1026
1027         BT_DBG("status 0x%02x", status);
1028
1029         hci_dev_lock(hdev);
1030
1031         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1032         if (!cmd)
1033                 goto unlock;
1034
1035         if (status) {
1036                 u8 mgmt_err = mgmt_status(status);
1037                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1038                 goto remove_cmd;
1039         }
1040
1041         cp = cmd->param;
1042         if (cp->val)
1043                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1044                                             &hdev->dev_flags);
1045         else
1046                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1047                                              &hdev->dev_flags);
1048
1049         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1050
1051         if (changed)
1052                 new_settings(hdev, cmd->sk);
1053
1054 remove_cmd:
1055         mgmt_pending_remove(cmd);
1056
1057 unlock:
1058         hci_dev_unlock(hdev);
1059 }
1060
1061 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1062                             u16 len)
1063 {
1064         struct mgmt_cp_set_discoverable *cp = data;
1065         struct pending_cmd *cmd;
1066         struct hci_request req;
1067         u16 timeout;
1068         u8 scan, status;
1069         int err;
1070
1071         BT_DBG("request for %s", hdev->name);
1072
1073         status = mgmt_bredr_support(hdev);
1074         if (status)
1075                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1076                                   status);
1077
1078         if (cp->val != 0x00 && cp->val != 0x01)
1079                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1080                                   MGMT_STATUS_INVALID_PARAMS);
1081
1082         timeout = __le16_to_cpu(cp->timeout);
1083         if (!cp->val && timeout > 0)
1084                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1085                                   MGMT_STATUS_INVALID_PARAMS);
1086
1087         hci_dev_lock(hdev);
1088
1089         if (!hdev_is_powered(hdev) && timeout > 0) {
1090                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1091                                  MGMT_STATUS_NOT_POWERED);
1092                 goto failed;
1093         }
1094
1095         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1096             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1097                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1098                                  MGMT_STATUS_BUSY);
1099                 goto failed;
1100         }
1101
1102         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1103                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1104                                  MGMT_STATUS_REJECTED);
1105                 goto failed;
1106         }
1107
1108         if (!hdev_is_powered(hdev)) {
1109                 bool changed = false;
1110
1111                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1112                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1113                         changed = true;
1114                 }
1115
1116                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1117                 if (err < 0)
1118                         goto failed;
1119
1120                 if (changed)
1121                         err = new_settings(hdev, sk);
1122
1123                 goto failed;
1124         }
1125
1126         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1127                 if (hdev->discov_timeout > 0) {
1128                         cancel_delayed_work(&hdev->discov_off);
1129                         hdev->discov_timeout = 0;
1130                 }
1131
1132                 if (cp->val && timeout > 0) {
1133                         hdev->discov_timeout = timeout;
1134                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1135                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
1136                 }
1137
1138                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1139                 goto failed;
1140         }
1141
1142         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1143         if (!cmd) {
1144                 err = -ENOMEM;
1145                 goto failed;
1146         }
1147
1148         hci_req_init(&req, hdev);
1149
1150         scan = SCAN_PAGE;
1151
1152         if (cp->val)
1153                 scan |= SCAN_INQUIRY;
1154         else
1155                 cancel_delayed_work(&hdev->discov_off);
1156
1157         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1158
1159         err = hci_req_run(&req, set_discoverable_complete);
1160         if (err < 0)
1161                 mgmt_pending_remove(cmd);
1162
1163         if (cp->val)
1164                 hdev->discov_timeout = timeout;
1165
1166 failed:
1167         hci_dev_unlock(hdev);
1168         return err;
1169 }
1170
1171 static void write_fast_connectable(struct hci_request *req, bool enable)
1172 {
1173         struct hci_dev *hdev = req->hdev;
1174         struct hci_cp_write_page_scan_activity acp;
1175         u8 type;
1176
1177         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1178                 return;
1179
1180         if (enable) {
1181                 type = PAGE_SCAN_TYPE_INTERLACED;
1182
1183                 /* 160 msec page scan interval */
1184                 acp.interval = __constant_cpu_to_le16(0x0100);
1185         } else {
1186                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1187
1188                 /* default 1.28 sec page scan */
1189                 acp.interval = __constant_cpu_to_le16(0x0800);
1190         }
1191
1192         acp.window = __constant_cpu_to_le16(0x0012);
1193
1194         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1195             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1196                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1197                             sizeof(acp), &acp);
1198
1199         if (hdev->page_scan_type != type)
1200                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1201 }
1202
1203 static u8 get_adv_type(struct hci_dev *hdev)
1204 {
1205         struct pending_cmd *cmd;
1206         bool connectable;
1207
1208         /* If there's a pending mgmt command the flag will not yet have
1209          * it's final value, so check for this first.
1210          */
1211         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1212         if (cmd) {
1213                 struct mgmt_mode *cp = cmd->param;
1214                 connectable = !!cp->val;
1215         } else {
1216                 connectable = test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1217         }
1218
1219         return connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1220 }
1221
1222 static void enable_advertising(struct hci_request *req)
1223 {
1224         struct hci_dev *hdev = req->hdev;
1225         struct hci_cp_le_set_adv_param cp;
1226         u8 enable = 0x01;
1227
1228         memset(&cp, 0, sizeof(cp));
1229         cp.min_interval = __constant_cpu_to_le16(0x0800);
1230         cp.max_interval = __constant_cpu_to_le16(0x0800);
1231         cp.type = get_adv_type(hdev);
1232         if (bacmp(&hdev->bdaddr, BDADDR_ANY))
1233                 cp.own_address_type = ADDR_LE_DEV_PUBLIC;
1234         else
1235                 cp.own_address_type = ADDR_LE_DEV_RANDOM;
1236         cp.channel_map = 0x07;
1237
1238         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1239
1240         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1241 }
1242
1243 static void disable_advertising(struct hci_request *req)
1244 {
1245         u8 enable = 0x00;
1246
1247         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1248 }
1249
1250 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1251 {
1252         struct pending_cmd *cmd;
1253         struct mgmt_mode *cp;
1254         bool changed;
1255
1256         BT_DBG("status 0x%02x", status);
1257
1258         hci_dev_lock(hdev);
1259
1260         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1261         if (!cmd)
1262                 goto unlock;
1263
1264         if (status) {
1265                 u8 mgmt_err = mgmt_status(status);
1266                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1267                 goto remove_cmd;
1268         }
1269
1270         cp = cmd->param;
1271         if (cp->val)
1272                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1273         else
1274                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1275
1276         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1277
1278         if (changed)
1279                 new_settings(hdev, cmd->sk);
1280
1281 remove_cmd:
1282         mgmt_pending_remove(cmd);
1283
1284 unlock:
1285         hci_dev_unlock(hdev);
1286 }
1287
1288 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1289                            u16 len)
1290 {
1291         struct mgmt_mode *cp = data;
1292         struct pending_cmd *cmd;
1293         struct hci_request req;
1294         u8 scan;
1295         int err;
1296
1297         BT_DBG("request for %s", hdev->name);
1298
1299         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1300             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1301                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1302                                   MGMT_STATUS_REJECTED);
1303
1304         if (cp->val != 0x00 && cp->val != 0x01)
1305                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1306                                   MGMT_STATUS_INVALID_PARAMS);
1307
1308         hci_dev_lock(hdev);
1309
1310         if (!hdev_is_powered(hdev)) {
1311                 bool changed = false;
1312
1313                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1314                         changed = true;
1315
1316                 if (cp->val) {
1317                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1318                 } else {
1319                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1320                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1321                 }
1322
1323                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1324                 if (err < 0)
1325                         goto failed;
1326
1327                 if (changed)
1328                         err = new_settings(hdev, sk);
1329
1330                 goto failed;
1331         }
1332
1333         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1334             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1335                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1336                                  MGMT_STATUS_BUSY);
1337                 goto failed;
1338         }
1339
1340         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1341         if (!cmd) {
1342                 err = -ENOMEM;
1343                 goto failed;
1344         }
1345
1346         hci_req_init(&req, hdev);
1347
1348         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
1349             cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1350                 if (cp->val) {
1351                         scan = SCAN_PAGE;
1352                 } else {
1353                         scan = 0;
1354
1355                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1356                             hdev->discov_timeout > 0)
1357                                 cancel_delayed_work(&hdev->discov_off);
1358                 }
1359
1360                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1361         }
1362
1363         /* If we're going from non-connectable to connectable or
1364          * vice-versa when fast connectable is enabled ensure that fast
1365          * connectable gets disabled. write_fast_connectable won't do
1366          * anything if the page scan parameters are already what they
1367          * should be.
1368          */
1369         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1370                 write_fast_connectable(&req, false);
1371
1372         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) &&
1373             hci_conn_num(hdev, LE_LINK) == 0) {
1374                 disable_advertising(&req);
1375                 enable_advertising(&req);
1376         }
1377
1378         err = hci_req_run(&req, set_connectable_complete);
1379         if (err < 0) {
1380                 mgmt_pending_remove(cmd);
1381                 if (err == -ENODATA)
1382                         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE,
1383                                                 hdev);
1384                 goto failed;
1385         }
1386
1387 failed:
1388         hci_dev_unlock(hdev);
1389         return err;
1390 }
1391
1392 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1393                         u16 len)
1394 {
1395         struct mgmt_mode *cp = data;
1396         bool changed;
1397         int err;
1398
1399         BT_DBG("request for %s", hdev->name);
1400
1401         if (cp->val != 0x00 && cp->val != 0x01)
1402                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1403                                   MGMT_STATUS_INVALID_PARAMS);
1404
1405         hci_dev_lock(hdev);
1406
1407         if (cp->val)
1408                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1409         else
1410                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1411
1412         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1413         if (err < 0)
1414                 goto unlock;
1415
1416         if (changed)
1417                 err = new_settings(hdev, sk);
1418
1419 unlock:
1420         hci_dev_unlock(hdev);
1421         return err;
1422 }
1423
1424 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1425                              u16 len)
1426 {
1427         struct mgmt_mode *cp = data;
1428         struct pending_cmd *cmd;
1429         u8 val, status;
1430         int err;
1431
1432         BT_DBG("request for %s", hdev->name);
1433
1434         status = mgmt_bredr_support(hdev);
1435         if (status)
1436                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1437                                   status);
1438
1439         if (cp->val != 0x00 && cp->val != 0x01)
1440                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1441                                   MGMT_STATUS_INVALID_PARAMS);
1442
1443         hci_dev_lock(hdev);
1444
1445         if (!hdev_is_powered(hdev)) {
1446                 bool changed = false;
1447
1448                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1449                                           &hdev->dev_flags)) {
1450                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1451                         changed = true;
1452                 }
1453
1454                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1455                 if (err < 0)
1456                         goto failed;
1457
1458                 if (changed)
1459                         err = new_settings(hdev, sk);
1460
1461                 goto failed;
1462         }
1463
1464         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1465                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1466                                  MGMT_STATUS_BUSY);
1467                 goto failed;
1468         }
1469
1470         val = !!cp->val;
1471
1472         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1473                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1474                 goto failed;
1475         }
1476
1477         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1478         if (!cmd) {
1479                 err = -ENOMEM;
1480                 goto failed;
1481         }
1482
1483         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1484         if (err < 0) {
1485                 mgmt_pending_remove(cmd);
1486                 goto failed;
1487         }
1488
1489 failed:
1490         hci_dev_unlock(hdev);
1491         return err;
1492 }
1493
1494 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1495 {
1496         struct mgmt_mode *cp = data;
1497         struct pending_cmd *cmd;
1498         u8 status;
1499         int err;
1500
1501         BT_DBG("request for %s", hdev->name);
1502
1503         status = mgmt_bredr_support(hdev);
1504         if (status)
1505                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1506
1507         if (!lmp_ssp_capable(hdev))
1508                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1509                                   MGMT_STATUS_NOT_SUPPORTED);
1510
1511         if (cp->val != 0x00 && cp->val != 0x01)
1512                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1513                                   MGMT_STATUS_INVALID_PARAMS);
1514
1515         hci_dev_lock(hdev);
1516
1517         if (!hdev_is_powered(hdev)) {
1518                 bool changed;
1519
1520                 if (cp->val) {
1521                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
1522                                                     &hdev->dev_flags);
1523                 } else {
1524                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
1525                                                      &hdev->dev_flags);
1526                         if (!changed)
1527                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
1528                                                              &hdev->dev_flags);
1529                         else
1530                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1531                 }
1532
1533                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1534                 if (err < 0)
1535                         goto failed;
1536
1537                 if (changed)
1538                         err = new_settings(hdev, sk);
1539
1540                 goto failed;
1541         }
1542
1543         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
1544             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
1545                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1546                                  MGMT_STATUS_BUSY);
1547                 goto failed;
1548         }
1549
1550         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1551                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1552                 goto failed;
1553         }
1554
1555         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1556         if (!cmd) {
1557                 err = -ENOMEM;
1558                 goto failed;
1559         }
1560
1561         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1562         if (err < 0) {
1563                 mgmt_pending_remove(cmd);
1564                 goto failed;
1565         }
1566
1567 failed:
1568         hci_dev_unlock(hdev);
1569         return err;
1570 }
1571
1572 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1573 {
1574         struct mgmt_mode *cp = data;
1575         bool changed;
1576         u8 status;
1577         int err;
1578
1579         BT_DBG("request for %s", hdev->name);
1580
1581         status = mgmt_bredr_support(hdev);
1582         if (status)
1583                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1584
1585         if (!lmp_ssp_capable(hdev))
1586                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1587                                   MGMT_STATUS_NOT_SUPPORTED);
1588
1589         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
1590                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1591                                   MGMT_STATUS_REJECTED);
1592
1593         if (cp->val != 0x00 && cp->val != 0x01)
1594                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1595                                   MGMT_STATUS_INVALID_PARAMS);
1596
1597         hci_dev_lock(hdev);
1598
1599         if (cp->val) {
1600                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1601         } else {
1602                 if (hdev_is_powered(hdev)) {
1603                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1604                                          MGMT_STATUS_REJECTED);
1605                         goto unlock;
1606                 }
1607
1608                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1609         }
1610
1611         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1612         if (err < 0)
1613                 goto unlock;
1614
1615         if (changed)
1616                 err = new_settings(hdev, sk);
1617
1618 unlock:
1619         hci_dev_unlock(hdev);
1620         return err;
1621 }
1622
1623 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1624 {
1625         struct cmd_lookup match = { NULL, hdev };
1626
1627         if (status) {
1628                 u8 mgmt_err = mgmt_status(status);
1629
1630                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1631                                      &mgmt_err);
1632                 return;
1633         }
1634
1635         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1636
1637         new_settings(hdev, match.sk);
1638
1639         if (match.sk)
1640                 sock_put(match.sk);
1641
1642         /* Make sure the controller has a good default for
1643          * advertising data. Restrict the update to when LE
1644          * has actually been enabled. During power on, the
1645          * update in powered_update_hci will take care of it.
1646          */
1647         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1648                 struct hci_request req;
1649
1650                 hci_dev_lock(hdev);
1651
1652                 hci_req_init(&req, hdev);
1653                 update_ad(&req);
1654                 hci_req_run(&req, NULL);
1655
1656                 hci_dev_unlock(hdev);
1657         }
1658 }
1659
1660 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1661 {
1662         struct mgmt_mode *cp = data;
1663         struct hci_cp_write_le_host_supported hci_cp;
1664         struct pending_cmd *cmd;
1665         struct hci_request req;
1666         int err;
1667         u8 val, enabled;
1668
1669         BT_DBG("request for %s", hdev->name);
1670
1671         if (!lmp_le_capable(hdev))
1672                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1673                                   MGMT_STATUS_NOT_SUPPORTED);
1674
1675         if (cp->val != 0x00 && cp->val != 0x01)
1676                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1677                                   MGMT_STATUS_INVALID_PARAMS);
1678
1679         /* LE-only devices do not allow toggling LE on/off */
1680         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1681                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1682                                   MGMT_STATUS_REJECTED);
1683
1684         hci_dev_lock(hdev);
1685
1686         val = !!cp->val;
1687         enabled = lmp_host_le_capable(hdev);
1688
1689         if (!hdev_is_powered(hdev) || val == enabled) {
1690                 bool changed = false;
1691
1692                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1693                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1694                         changed = true;
1695                 }
1696
1697                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
1698                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1699                         changed = true;
1700                 }
1701
1702                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1703                 if (err < 0)
1704                         goto unlock;
1705
1706                 if (changed)
1707                         err = new_settings(hdev, sk);
1708
1709                 goto unlock;
1710         }
1711
1712         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1713             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1714                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1715                                  MGMT_STATUS_BUSY);
1716                 goto unlock;
1717         }
1718
1719         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1720         if (!cmd) {
1721                 err = -ENOMEM;
1722                 goto unlock;
1723         }
1724
1725         hci_req_init(&req, hdev);
1726
1727         memset(&hci_cp, 0, sizeof(hci_cp));
1728
1729         if (val) {
1730                 hci_cp.le = val;
1731                 hci_cp.simul = lmp_le_br_capable(hdev);
1732         } else {
1733                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1734                         disable_advertising(&req);
1735         }
1736
1737         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1738                     &hci_cp);
1739
1740         err = hci_req_run(&req, le_enable_complete);
1741         if (err < 0)
1742                 mgmt_pending_remove(cmd);
1743
1744 unlock:
1745         hci_dev_unlock(hdev);
1746         return err;
1747 }
1748
1749 /* This is a helper function to test for pending mgmt commands that can
1750  * cause CoD or EIR HCI commands. We can only allow one such pending
1751  * mgmt command at a time since otherwise we cannot easily track what
1752  * the current values are, will be, and based on that calculate if a new
1753  * HCI command needs to be sent and if yes with what value.
1754  */
1755 static bool pending_eir_or_class(struct hci_dev *hdev)
1756 {
1757         struct pending_cmd *cmd;
1758
1759         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1760                 switch (cmd->opcode) {
1761                 case MGMT_OP_ADD_UUID:
1762                 case MGMT_OP_REMOVE_UUID:
1763                 case MGMT_OP_SET_DEV_CLASS:
1764                 case MGMT_OP_SET_POWERED:
1765                         return true;
1766                 }
1767         }
1768
1769         return false;
1770 }
1771
1772 static const u8 bluetooth_base_uuid[] = {
1773                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1774                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1775 };
1776
1777 static u8 get_uuid_size(const u8 *uuid)
1778 {
1779         u32 val;
1780
1781         if (memcmp(uuid, bluetooth_base_uuid, 12))
1782                 return 128;
1783
1784         val = get_unaligned_le32(&uuid[12]);
1785         if (val > 0xffff)
1786                 return 32;
1787
1788         return 16;
1789 }
1790
1791 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1792 {
1793         struct pending_cmd *cmd;
1794
1795         hci_dev_lock(hdev);
1796
1797         cmd = mgmt_pending_find(mgmt_op, hdev);
1798         if (!cmd)
1799                 goto unlock;
1800
1801         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1802                      hdev->dev_class, 3);
1803
1804         mgmt_pending_remove(cmd);
1805
1806 unlock:
1807         hci_dev_unlock(hdev);
1808 }
1809
1810 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1811 {
1812         BT_DBG("status 0x%02x", status);
1813
1814         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1815 }
1816
1817 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1818 {
1819         struct mgmt_cp_add_uuid *cp = data;
1820         struct pending_cmd *cmd;
1821         struct hci_request req;
1822         struct bt_uuid *uuid;
1823         int err;
1824
1825         BT_DBG("request for %s", hdev->name);
1826
1827         hci_dev_lock(hdev);
1828
1829         if (pending_eir_or_class(hdev)) {
1830                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1831                                  MGMT_STATUS_BUSY);
1832                 goto failed;
1833         }
1834
1835         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1836         if (!uuid) {
1837                 err = -ENOMEM;
1838                 goto failed;
1839         }
1840
1841         memcpy(uuid->uuid, cp->uuid, 16);
1842         uuid->svc_hint = cp->svc_hint;
1843         uuid->size = get_uuid_size(cp->uuid);
1844
1845         list_add_tail(&uuid->list, &hdev->uuids);
1846
1847         hci_req_init(&req, hdev);
1848
1849         update_class(&req);
1850         update_eir(&req);
1851
1852         err = hci_req_run(&req, add_uuid_complete);
1853         if (err < 0) {
1854                 if (err != -ENODATA)
1855                         goto failed;
1856
1857                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1858                                    hdev->dev_class, 3);
1859                 goto failed;
1860         }
1861
1862         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1863         if (!cmd) {
1864                 err = -ENOMEM;
1865                 goto failed;
1866         }
1867
1868         err = 0;
1869
1870 failed:
1871         hci_dev_unlock(hdev);
1872         return err;
1873 }
1874
1875 static bool enable_service_cache(struct hci_dev *hdev)
1876 {
1877         if (!hdev_is_powered(hdev))
1878                 return false;
1879
1880         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1881                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1882                                    CACHE_TIMEOUT);
1883                 return true;
1884         }
1885
1886         return false;
1887 }
1888
1889 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1890 {
1891         BT_DBG("status 0x%02x", status);
1892
1893         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1894 }
1895
1896 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1897                        u16 len)
1898 {
1899         struct mgmt_cp_remove_uuid *cp = data;
1900         struct pending_cmd *cmd;
1901         struct bt_uuid *match, *tmp;
1902         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1903         struct hci_request req;
1904         int err, found;
1905
1906         BT_DBG("request for %s", hdev->name);
1907
1908         hci_dev_lock(hdev);
1909
1910         if (pending_eir_or_class(hdev)) {
1911                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1912                                  MGMT_STATUS_BUSY);
1913                 goto unlock;
1914         }
1915
1916         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1917                 err = hci_uuids_clear(hdev);
1918
1919                 if (enable_service_cache(hdev)) {
1920                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1921                                            0, hdev->dev_class, 3);
1922                         goto unlock;
1923                 }
1924
1925                 goto update_class;
1926         }
1927
1928         found = 0;
1929
1930         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1931                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1932                         continue;
1933
1934                 list_del(&match->list);
1935                 kfree(match);
1936                 found++;
1937         }
1938
1939         if (found == 0) {
1940                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1941                                  MGMT_STATUS_INVALID_PARAMS);
1942                 goto unlock;
1943         }
1944
1945 update_class:
1946         hci_req_init(&req, hdev);
1947
1948         update_class(&req);
1949         update_eir(&req);
1950
1951         err = hci_req_run(&req, remove_uuid_complete);
1952         if (err < 0) {
1953                 if (err != -ENODATA)
1954                         goto unlock;
1955
1956                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1957                                    hdev->dev_class, 3);
1958                 goto unlock;
1959         }
1960
1961         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1962         if (!cmd) {
1963                 err = -ENOMEM;
1964                 goto unlock;
1965         }
1966
1967         err = 0;
1968
1969 unlock:
1970         hci_dev_unlock(hdev);
1971         return err;
1972 }
1973
1974 static void set_class_complete(struct hci_dev *hdev, u8 status)
1975 {
1976         BT_DBG("status 0x%02x", status);
1977
1978         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1979 }
1980
1981 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1982                          u16 len)
1983 {
1984         struct mgmt_cp_set_dev_class *cp = data;
1985         struct pending_cmd *cmd;
1986         struct hci_request req;
1987         int err;
1988
1989         BT_DBG("request for %s", hdev->name);
1990
1991         if (!lmp_bredr_capable(hdev))
1992                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1993                                   MGMT_STATUS_NOT_SUPPORTED);
1994
1995         hci_dev_lock(hdev);
1996
1997         if (pending_eir_or_class(hdev)) {
1998                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1999                                  MGMT_STATUS_BUSY);
2000                 goto unlock;
2001         }
2002
2003         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2004                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2005                                  MGMT_STATUS_INVALID_PARAMS);
2006                 goto unlock;
2007         }
2008
2009         hdev->major_class = cp->major;
2010         hdev->minor_class = cp->minor;
2011
2012         if (!hdev_is_powered(hdev)) {
2013                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2014                                    hdev->dev_class, 3);
2015                 goto unlock;
2016         }
2017
2018         hci_req_init(&req, hdev);
2019
2020         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2021                 hci_dev_unlock(hdev);
2022                 cancel_delayed_work_sync(&hdev->service_cache);
2023                 hci_dev_lock(hdev);
2024                 update_eir(&req);
2025         }
2026
2027         update_class(&req);
2028
2029         err = hci_req_run(&req, set_class_complete);
2030         if (err < 0) {
2031                 if (err != -ENODATA)
2032                         goto unlock;
2033
2034                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2035                                    hdev->dev_class, 3);
2036                 goto unlock;
2037         }
2038
2039         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2040         if (!cmd) {
2041                 err = -ENOMEM;
2042                 goto unlock;
2043         }
2044
2045         err = 0;
2046
2047 unlock:
2048         hci_dev_unlock(hdev);
2049         return err;
2050 }
2051
2052 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2053                           u16 len)
2054 {
2055         struct mgmt_cp_load_link_keys *cp = data;
2056         u16 key_count, expected_len;
2057         int i;
2058
2059         BT_DBG("request for %s", hdev->name);
2060
2061         if (!lmp_bredr_capable(hdev))
2062                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2063                                   MGMT_STATUS_NOT_SUPPORTED);
2064
2065         key_count = __le16_to_cpu(cp->key_count);
2066
2067         expected_len = sizeof(*cp) + key_count *
2068                                         sizeof(struct mgmt_link_key_info);
2069         if (expected_len != len) {
2070                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2071                        len, expected_len);
2072                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2073                                   MGMT_STATUS_INVALID_PARAMS);
2074         }
2075
2076         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2077                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2078                                   MGMT_STATUS_INVALID_PARAMS);
2079
2080         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2081                key_count);
2082
2083         for (i = 0; i < key_count; i++) {
2084                 struct mgmt_link_key_info *key = &cp->keys[i];
2085
2086                 if (key->addr.type != BDADDR_BREDR)
2087                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2088                                           MGMT_STATUS_INVALID_PARAMS);
2089         }
2090
2091         hci_dev_lock(hdev);
2092
2093         hci_link_keys_clear(hdev);
2094
2095         if (cp->debug_keys)
2096                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2097         else
2098                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2099
2100         for (i = 0; i < key_count; i++) {
2101                 struct mgmt_link_key_info *key = &cp->keys[i];
2102
2103                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
2104                                  key->type, key->pin_len);
2105         }
2106
2107         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2108
2109         hci_dev_unlock(hdev);
2110
2111         return 0;
2112 }
2113
2114 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2115                            u8 addr_type, struct sock *skip_sk)
2116 {
2117         struct mgmt_ev_device_unpaired ev;
2118
2119         bacpy(&ev.addr.bdaddr, bdaddr);
2120         ev.addr.type = addr_type;
2121
2122         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2123                           skip_sk);
2124 }
2125
2126 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2127                          u16 len)
2128 {
2129         struct mgmt_cp_unpair_device *cp = data;
2130         struct mgmt_rp_unpair_device rp;
2131         struct hci_cp_disconnect dc;
2132         struct pending_cmd *cmd;
2133         struct hci_conn *conn;
2134         int err;
2135
2136         memset(&rp, 0, sizeof(rp));
2137         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2138         rp.addr.type = cp->addr.type;
2139
2140         if (!bdaddr_type_is_valid(cp->addr.type))
2141                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2142                                     MGMT_STATUS_INVALID_PARAMS,
2143                                     &rp, sizeof(rp));
2144
2145         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2146                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2147                                     MGMT_STATUS_INVALID_PARAMS,
2148                                     &rp, sizeof(rp));
2149
2150         hci_dev_lock(hdev);
2151
2152         if (!hdev_is_powered(hdev)) {
2153                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2154                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2155                 goto unlock;
2156         }
2157
2158         if (cp->addr.type == BDADDR_BREDR)
2159                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2160         else
2161                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
2162
2163         if (err < 0) {
2164                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2165                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2166                 goto unlock;
2167         }
2168
2169         if (cp->disconnect) {
2170                 if (cp->addr.type == BDADDR_BREDR)
2171                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2172                                                        &cp->addr.bdaddr);
2173                 else
2174                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2175                                                        &cp->addr.bdaddr);
2176         } else {
2177                 conn = NULL;
2178         }
2179
2180         if (!conn) {
2181                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2182                                    &rp, sizeof(rp));
2183                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2184                 goto unlock;
2185         }
2186
2187         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2188                                sizeof(*cp));
2189         if (!cmd) {
2190                 err = -ENOMEM;
2191                 goto unlock;
2192         }
2193
2194         dc.handle = cpu_to_le16(conn->handle);
2195         dc.reason = 0x13; /* Remote User Terminated Connection */
2196         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2197         if (err < 0)
2198                 mgmt_pending_remove(cmd);
2199
2200 unlock:
2201         hci_dev_unlock(hdev);
2202         return err;
2203 }
2204
2205 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2206                       u16 len)
2207 {
2208         struct mgmt_cp_disconnect *cp = data;
2209         struct mgmt_rp_disconnect rp;
2210         struct hci_cp_disconnect dc;
2211         struct pending_cmd *cmd;
2212         struct hci_conn *conn;
2213         int err;
2214
2215         BT_DBG("");
2216
2217         memset(&rp, 0, sizeof(rp));
2218         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2219         rp.addr.type = cp->addr.type;
2220
2221         if (!bdaddr_type_is_valid(cp->addr.type))
2222                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2223                                     MGMT_STATUS_INVALID_PARAMS,
2224                                     &rp, sizeof(rp));
2225
2226         hci_dev_lock(hdev);
2227
2228         if (!test_bit(HCI_UP, &hdev->flags)) {
2229                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2230                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2231                 goto failed;
2232         }
2233
2234         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2235                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2236                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2237                 goto failed;
2238         }
2239
2240         if (cp->addr.type == BDADDR_BREDR)
2241                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2242                                                &cp->addr.bdaddr);
2243         else
2244                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2245
2246         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2247                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2248                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2249                 goto failed;
2250         }
2251
2252         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2253         if (!cmd) {
2254                 err = -ENOMEM;
2255                 goto failed;
2256         }
2257
2258         dc.handle = cpu_to_le16(conn->handle);
2259         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2260
2261         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2262         if (err < 0)
2263                 mgmt_pending_remove(cmd);
2264
2265 failed:
2266         hci_dev_unlock(hdev);
2267         return err;
2268 }
2269
2270 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2271 {
2272         switch (link_type) {
2273         case LE_LINK:
2274                 switch (addr_type) {
2275                 case ADDR_LE_DEV_PUBLIC:
2276                         return BDADDR_LE_PUBLIC;
2277
2278                 default:
2279                         /* Fallback to LE Random address type */
2280                         return BDADDR_LE_RANDOM;
2281                 }
2282
2283         default:
2284                 /* Fallback to BR/EDR type */
2285                 return BDADDR_BREDR;
2286         }
2287 }
2288
2289 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2290                            u16 data_len)
2291 {
2292         struct mgmt_rp_get_connections *rp;
2293         struct hci_conn *c;
2294         size_t rp_len;
2295         int err;
2296         u16 i;
2297
2298         BT_DBG("");
2299
2300         hci_dev_lock(hdev);
2301
2302         if (!hdev_is_powered(hdev)) {
2303                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2304                                  MGMT_STATUS_NOT_POWERED);
2305                 goto unlock;
2306         }
2307
2308         i = 0;
2309         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2310                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2311                         i++;
2312         }
2313
2314         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2315         rp = kmalloc(rp_len, GFP_KERNEL);
2316         if (!rp) {
2317                 err = -ENOMEM;
2318                 goto unlock;
2319         }
2320
2321         i = 0;
2322         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2323                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2324                         continue;
2325                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2326                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2327                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2328                         continue;
2329                 i++;
2330         }
2331
2332         rp->conn_count = cpu_to_le16(i);
2333
2334         /* Recalculate length in case of filtered SCO connections, etc */
2335         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2336
2337         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2338                            rp_len);
2339
2340         kfree(rp);
2341
2342 unlock:
2343         hci_dev_unlock(hdev);
2344         return err;
2345 }
2346
2347 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2348                                    struct mgmt_cp_pin_code_neg_reply *cp)
2349 {
2350         struct pending_cmd *cmd;
2351         int err;
2352
2353         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2354                                sizeof(*cp));
2355         if (!cmd)
2356                 return -ENOMEM;
2357
2358         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2359                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2360         if (err < 0)
2361                 mgmt_pending_remove(cmd);
2362
2363         return err;
2364 }
2365
2366 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2367                           u16 len)
2368 {
2369         struct hci_conn *conn;
2370         struct mgmt_cp_pin_code_reply *cp = data;
2371         struct hci_cp_pin_code_reply reply;
2372         struct pending_cmd *cmd;
2373         int err;
2374
2375         BT_DBG("");
2376
2377         hci_dev_lock(hdev);
2378
2379         if (!hdev_is_powered(hdev)) {
2380                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2381                                  MGMT_STATUS_NOT_POWERED);
2382                 goto failed;
2383         }
2384
2385         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2386         if (!conn) {
2387                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2388                                  MGMT_STATUS_NOT_CONNECTED);
2389                 goto failed;
2390         }
2391
2392         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2393                 struct mgmt_cp_pin_code_neg_reply ncp;
2394
2395                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2396
2397                 BT_ERR("PIN code is not 16 bytes long");
2398
2399                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2400                 if (err >= 0)
2401                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2402                                          MGMT_STATUS_INVALID_PARAMS);
2403
2404                 goto failed;
2405         }
2406
2407         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2408         if (!cmd) {
2409                 err = -ENOMEM;
2410                 goto failed;
2411         }
2412
2413         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2414         reply.pin_len = cp->pin_len;
2415         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2416
2417         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2418         if (err < 0)
2419                 mgmt_pending_remove(cmd);
2420
2421 failed:
2422         hci_dev_unlock(hdev);
2423         return err;
2424 }
2425
2426 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2427                              u16 len)
2428 {
2429         struct mgmt_cp_set_io_capability *cp = data;
2430
2431         BT_DBG("");
2432
2433         hci_dev_lock(hdev);
2434
2435         hdev->io_capability = cp->io_capability;
2436
2437         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2438                hdev->io_capability);
2439
2440         hci_dev_unlock(hdev);
2441
2442         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2443                             0);
2444 }
2445
2446 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2447 {
2448         struct hci_dev *hdev = conn->hdev;
2449         struct pending_cmd *cmd;
2450
2451         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2452                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2453                         continue;
2454
2455                 if (cmd->user_data != conn)
2456                         continue;
2457
2458                 return cmd;
2459         }
2460
2461         return NULL;
2462 }
2463
2464 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2465 {
2466         struct mgmt_rp_pair_device rp;
2467         struct hci_conn *conn = cmd->user_data;
2468
2469         bacpy(&rp.addr.bdaddr, &conn->dst);
2470         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2471
2472         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2473                      &rp, sizeof(rp));
2474
2475         /* So we don't get further callbacks for this connection */
2476         conn->connect_cfm_cb = NULL;
2477         conn->security_cfm_cb = NULL;
2478         conn->disconn_cfm_cb = NULL;
2479
2480         hci_conn_drop(conn);
2481
2482         mgmt_pending_remove(cmd);
2483 }
2484
2485 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2486 {
2487         struct pending_cmd *cmd;
2488
2489         BT_DBG("status %u", status);
2490
2491         cmd = find_pairing(conn);
2492         if (!cmd)
2493                 BT_DBG("Unable to find a pending command");
2494         else
2495                 pairing_complete(cmd, mgmt_status(status));
2496 }
2497
2498 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2499 {
2500         struct pending_cmd *cmd;
2501
2502         BT_DBG("status %u", status);
2503
2504         if (!status)
2505                 return;
2506
2507         cmd = find_pairing(conn);
2508         if (!cmd)
2509                 BT_DBG("Unable to find a pending command");
2510         else
2511                 pairing_complete(cmd, mgmt_status(status));
2512 }
2513
2514 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2515                        u16 len)
2516 {
2517         struct mgmt_cp_pair_device *cp = data;
2518         struct mgmt_rp_pair_device rp;
2519         struct pending_cmd *cmd;
2520         u8 sec_level, auth_type;
2521         struct hci_conn *conn;
2522         int err;
2523
2524         BT_DBG("");
2525
2526         memset(&rp, 0, sizeof(rp));
2527         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2528         rp.addr.type = cp->addr.type;
2529
2530         if (!bdaddr_type_is_valid(cp->addr.type))
2531                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2532                                     MGMT_STATUS_INVALID_PARAMS,
2533                                     &rp, sizeof(rp));
2534
2535         hci_dev_lock(hdev);
2536
2537         if (!hdev_is_powered(hdev)) {
2538                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2539                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2540                 goto unlock;
2541         }
2542
2543         sec_level = BT_SECURITY_MEDIUM;
2544         if (cp->io_cap == 0x03)
2545                 auth_type = HCI_AT_DEDICATED_BONDING;
2546         else
2547                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2548
2549         if (cp->addr.type == BDADDR_BREDR)
2550                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2551                                    cp->addr.type, sec_level, auth_type);
2552         else
2553                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2554                                    cp->addr.type, sec_level, auth_type);
2555
2556         if (IS_ERR(conn)) {
2557                 int status;
2558
2559                 if (PTR_ERR(conn) == -EBUSY)
2560                         status = MGMT_STATUS_BUSY;
2561                 else
2562                         status = MGMT_STATUS_CONNECT_FAILED;
2563
2564                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2565                                    status, &rp,
2566                                    sizeof(rp));
2567                 goto unlock;
2568         }
2569
2570         if (conn->connect_cfm_cb) {
2571                 hci_conn_drop(conn);
2572                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2573                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2574                 goto unlock;
2575         }
2576
2577         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2578         if (!cmd) {
2579                 err = -ENOMEM;
2580                 hci_conn_drop(conn);
2581                 goto unlock;
2582         }
2583
2584         /* For LE, just connecting isn't a proof that the pairing finished */
2585         if (cp->addr.type == BDADDR_BREDR)
2586                 conn->connect_cfm_cb = pairing_complete_cb;
2587         else
2588                 conn->connect_cfm_cb = le_connect_complete_cb;
2589
2590         conn->security_cfm_cb = pairing_complete_cb;
2591         conn->disconn_cfm_cb = pairing_complete_cb;
2592         conn->io_capability = cp->io_cap;
2593         cmd->user_data = conn;
2594
2595         if (conn->state == BT_CONNECTED &&
2596             hci_conn_security(conn, sec_level, auth_type))
2597                 pairing_complete(cmd, 0);
2598
2599         err = 0;
2600
2601 unlock:
2602         hci_dev_unlock(hdev);
2603         return err;
2604 }
2605
2606 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2607                               u16 len)
2608 {
2609         struct mgmt_addr_info *addr = data;
2610         struct pending_cmd *cmd;
2611         struct hci_conn *conn;
2612         int err;
2613
2614         BT_DBG("");
2615
2616         hci_dev_lock(hdev);
2617
2618         if (!hdev_is_powered(hdev)) {
2619                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2620                                  MGMT_STATUS_NOT_POWERED);
2621                 goto unlock;
2622         }
2623
2624         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2625         if (!cmd) {
2626                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2627                                  MGMT_STATUS_INVALID_PARAMS);
2628                 goto unlock;
2629         }
2630
2631         conn = cmd->user_data;
2632
2633         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2634                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2635                                  MGMT_STATUS_INVALID_PARAMS);
2636                 goto unlock;
2637         }
2638
2639         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2640
2641         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2642                            addr, sizeof(*addr));
2643 unlock:
2644         hci_dev_unlock(hdev);
2645         return err;
2646 }
2647
2648 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2649                              struct mgmt_addr_info *addr, u16 mgmt_op,
2650                              u16 hci_op, __le32 passkey)
2651 {
2652         struct pending_cmd *cmd;
2653         struct hci_conn *conn;
2654         int err;
2655
2656         hci_dev_lock(hdev);
2657
2658         if (!hdev_is_powered(hdev)) {
2659                 err = cmd_complete(sk, hdev->id, mgmt_op,
2660                                    MGMT_STATUS_NOT_POWERED, addr,
2661                                    sizeof(*addr));
2662                 goto done;
2663         }
2664
2665         if (addr->type == BDADDR_BREDR)
2666                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2667         else
2668                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2669
2670         if (!conn) {
2671                 err = cmd_complete(sk, hdev->id, mgmt_op,
2672                                    MGMT_STATUS_NOT_CONNECTED, addr,
2673                                    sizeof(*addr));
2674                 goto done;
2675         }
2676
2677         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2678                 /* Continue with pairing via SMP */
2679                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2680
2681                 if (!err)
2682                         err = cmd_complete(sk, hdev->id, mgmt_op,
2683                                            MGMT_STATUS_SUCCESS, addr,
2684                                            sizeof(*addr));
2685                 else
2686                         err = cmd_complete(sk, hdev->id, mgmt_op,
2687                                            MGMT_STATUS_FAILED, addr,
2688                                            sizeof(*addr));
2689
2690                 goto done;
2691         }
2692
2693         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2694         if (!cmd) {
2695                 err = -ENOMEM;
2696                 goto done;
2697         }
2698
2699         /* Continue with pairing via HCI */
2700         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2701                 struct hci_cp_user_passkey_reply cp;
2702
2703                 bacpy(&cp.bdaddr, &addr->bdaddr);
2704                 cp.passkey = passkey;
2705                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2706         } else
2707                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2708                                    &addr->bdaddr);
2709
2710         if (err < 0)
2711                 mgmt_pending_remove(cmd);
2712
2713 done:
2714         hci_dev_unlock(hdev);
2715         return err;
2716 }
2717
2718 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2719                               void *data, u16 len)
2720 {
2721         struct mgmt_cp_pin_code_neg_reply *cp = data;
2722
2723         BT_DBG("");
2724
2725         return user_pairing_resp(sk, hdev, &cp->addr,
2726                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2727                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2728 }
2729
2730 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2731                               u16 len)
2732 {
2733         struct mgmt_cp_user_confirm_reply *cp = data;
2734
2735         BT_DBG("");
2736
2737         if (len != sizeof(*cp))
2738                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2739                                   MGMT_STATUS_INVALID_PARAMS);
2740
2741         return user_pairing_resp(sk, hdev, &cp->addr,
2742                                  MGMT_OP_USER_CONFIRM_REPLY,
2743                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2744 }
2745
2746 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2747                                   void *data, u16 len)
2748 {
2749         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2750
2751         BT_DBG("");
2752
2753         return user_pairing_resp(sk, hdev, &cp->addr,
2754                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2755                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2756 }
2757
2758 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2759                               u16 len)
2760 {
2761         struct mgmt_cp_user_passkey_reply *cp = data;
2762
2763         BT_DBG("");
2764
2765         return user_pairing_resp(sk, hdev, &cp->addr,
2766                                  MGMT_OP_USER_PASSKEY_REPLY,
2767                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2768 }
2769
2770 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2771                                   void *data, u16 len)
2772 {
2773         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2774
2775         BT_DBG("");
2776
2777         return user_pairing_resp(sk, hdev, &cp->addr,
2778                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2779                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2780 }
2781
2782 static void update_name(struct hci_request *req)
2783 {
2784         struct hci_dev *hdev = req->hdev;
2785         struct hci_cp_write_local_name cp;
2786
2787         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2788
2789         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2790 }
2791
2792 static void set_name_complete(struct hci_dev *hdev, u8 status)
2793 {
2794         struct mgmt_cp_set_local_name *cp;
2795         struct pending_cmd *cmd;
2796
2797         BT_DBG("status 0x%02x", status);
2798
2799         hci_dev_lock(hdev);
2800
2801         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2802         if (!cmd)
2803                 goto unlock;
2804
2805         cp = cmd->param;
2806
2807         if (status)
2808                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2809                            mgmt_status(status));
2810         else
2811                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2812                              cp, sizeof(*cp));
2813
2814         mgmt_pending_remove(cmd);
2815
2816 unlock:
2817         hci_dev_unlock(hdev);
2818 }
2819
2820 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2821                           u16 len)
2822 {
2823         struct mgmt_cp_set_local_name *cp = data;
2824         struct pending_cmd *cmd;
2825         struct hci_request req;
2826         int err;
2827
2828         BT_DBG("");
2829
2830         hci_dev_lock(hdev);
2831
2832         /* If the old values are the same as the new ones just return a
2833          * direct command complete event.
2834          */
2835         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2836             !memcmp(hdev->short_name, cp->short_name,
2837                     sizeof(hdev->short_name))) {
2838                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2839                                    data, len);
2840                 goto failed;
2841         }
2842
2843         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2844
2845         if (!hdev_is_powered(hdev)) {
2846                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2847
2848                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2849                                    data, len);
2850                 if (err < 0)
2851                         goto failed;
2852
2853                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2854                                  sk);
2855
2856                 goto failed;
2857         }
2858
2859         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2860         if (!cmd) {
2861                 err = -ENOMEM;
2862                 goto failed;
2863         }
2864
2865         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2866
2867         hci_req_init(&req, hdev);
2868
2869         if (lmp_bredr_capable(hdev)) {
2870                 update_name(&req);
2871                 update_eir(&req);
2872         }
2873
2874         if (lmp_le_capable(hdev))
2875                 update_ad(&req);
2876
2877         err = hci_req_run(&req, set_name_complete);
2878         if (err < 0)
2879                 mgmt_pending_remove(cmd);
2880
2881 failed:
2882         hci_dev_unlock(hdev);
2883         return err;
2884 }
2885
2886 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2887                                void *data, u16 data_len)
2888 {
2889         struct pending_cmd *cmd;
2890         int err;
2891
2892         BT_DBG("%s", hdev->name);
2893
2894         hci_dev_lock(hdev);
2895
2896         if (!hdev_is_powered(hdev)) {
2897                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2898                                  MGMT_STATUS_NOT_POWERED);
2899                 goto unlock;
2900         }
2901
2902         if (!lmp_ssp_capable(hdev)) {
2903                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2904                                  MGMT_STATUS_NOT_SUPPORTED);
2905                 goto unlock;
2906         }
2907
2908         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2909                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2910                                  MGMT_STATUS_BUSY);
2911                 goto unlock;
2912         }
2913
2914         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2915         if (!cmd) {
2916                 err = -ENOMEM;
2917                 goto unlock;
2918         }
2919
2920         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2921         if (err < 0)
2922                 mgmt_pending_remove(cmd);
2923
2924 unlock:
2925         hci_dev_unlock(hdev);
2926         return err;
2927 }
2928
2929 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2930                                void *data, u16 len)
2931 {
2932         struct mgmt_cp_add_remote_oob_data *cp = data;
2933         u8 status;
2934         int err;
2935
2936         BT_DBG("%s ", hdev->name);
2937
2938         hci_dev_lock(hdev);
2939
2940         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2941                                       cp->randomizer);
2942         if (err < 0)
2943                 status = MGMT_STATUS_FAILED;
2944         else
2945                 status = MGMT_STATUS_SUCCESS;
2946
2947         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2948                            &cp->addr, sizeof(cp->addr));
2949
2950         hci_dev_unlock(hdev);
2951         return err;
2952 }
2953
2954 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2955                                   void *data, u16 len)
2956 {
2957         struct mgmt_cp_remove_remote_oob_data *cp = data;
2958         u8 status;
2959         int err;
2960
2961         BT_DBG("%s", hdev->name);
2962
2963         hci_dev_lock(hdev);
2964
2965         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2966         if (err < 0)
2967                 status = MGMT_STATUS_INVALID_PARAMS;
2968         else
2969                 status = MGMT_STATUS_SUCCESS;
2970
2971         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2972                            status, &cp->addr, sizeof(cp->addr));
2973
2974         hci_dev_unlock(hdev);
2975         return err;
2976 }
2977
2978 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2979 {
2980         struct pending_cmd *cmd;
2981         u8 type;
2982         int err;
2983
2984         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2985
2986         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2987         if (!cmd)
2988                 return -ENOENT;
2989
2990         type = hdev->discovery.type;
2991
2992         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2993                            &type, sizeof(type));
2994         mgmt_pending_remove(cmd);
2995
2996         return err;
2997 }
2998
2999 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3000 {
3001         BT_DBG("status %d", status);
3002
3003         if (status) {
3004                 hci_dev_lock(hdev);
3005                 mgmt_start_discovery_failed(hdev, status);
3006                 hci_dev_unlock(hdev);
3007                 return;
3008         }
3009
3010         hci_dev_lock(hdev);
3011         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3012         hci_dev_unlock(hdev);
3013
3014         switch (hdev->discovery.type) {
3015         case DISCOV_TYPE_LE:
3016                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
3017                                    DISCOV_LE_TIMEOUT);
3018                 break;
3019
3020         case DISCOV_TYPE_INTERLEAVED:
3021                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
3022                                    DISCOV_INTERLEAVED_TIMEOUT);
3023                 break;
3024
3025         case DISCOV_TYPE_BREDR:
3026                 break;
3027
3028         default:
3029                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3030         }
3031 }
3032
3033 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3034                            void *data, u16 len)
3035 {
3036         struct mgmt_cp_start_discovery *cp = data;
3037         struct pending_cmd *cmd;
3038         struct hci_cp_le_set_scan_param param_cp;
3039         struct hci_cp_le_set_scan_enable enable_cp;
3040         struct hci_cp_inquiry inq_cp;
3041         struct hci_request req;
3042         /* General inquiry access code (GIAC) */
3043         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3044         u8 status;
3045         int err;
3046
3047         BT_DBG("%s", hdev->name);
3048
3049         hci_dev_lock(hdev);
3050
3051         if (!hdev_is_powered(hdev)) {
3052                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3053                                  MGMT_STATUS_NOT_POWERED);
3054                 goto failed;
3055         }
3056
3057         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3058                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3059                                  MGMT_STATUS_BUSY);
3060                 goto failed;
3061         }
3062
3063         if (hdev->discovery.state != DISCOVERY_STOPPED) {
3064                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3065                                  MGMT_STATUS_BUSY);
3066                 goto failed;
3067         }
3068
3069         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3070         if (!cmd) {
3071                 err = -ENOMEM;
3072                 goto failed;
3073         }
3074
3075         hdev->discovery.type = cp->type;
3076
3077         hci_req_init(&req, hdev);
3078
3079         switch (hdev->discovery.type) {
3080         case DISCOV_TYPE_BREDR:
3081                 status = mgmt_bredr_support(hdev);
3082                 if (status) {
3083                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3084                                          status);
3085                         mgmt_pending_remove(cmd);
3086                         goto failed;
3087                 }
3088
3089                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3090                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3091                                          MGMT_STATUS_BUSY);
3092                         mgmt_pending_remove(cmd);
3093                         goto failed;
3094                 }
3095
3096                 hci_inquiry_cache_flush(hdev);
3097
3098                 memset(&inq_cp, 0, sizeof(inq_cp));
3099                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3100                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3101                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3102                 break;
3103
3104         case DISCOV_TYPE_LE:
3105         case DISCOV_TYPE_INTERLEAVED:
3106                 status = mgmt_le_support(hdev);
3107                 if (status) {
3108                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3109                                          status);
3110                         mgmt_pending_remove(cmd);
3111                         goto failed;
3112                 }
3113
3114                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3115                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3116                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3117                                          MGMT_STATUS_NOT_SUPPORTED);
3118                         mgmt_pending_remove(cmd);
3119                         goto failed;
3120                 }
3121
3122                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3123                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3124                                          MGMT_STATUS_REJECTED);
3125                         mgmt_pending_remove(cmd);
3126                         goto failed;
3127                 }
3128
3129                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
3130                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3131                                          MGMT_STATUS_BUSY);
3132                         mgmt_pending_remove(cmd);
3133                         goto failed;
3134                 }
3135
3136                 memset(&param_cp, 0, sizeof(param_cp));
3137                 param_cp.type = LE_SCAN_ACTIVE;
3138                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3139                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3140                 if (bacmp(&hdev->bdaddr, BDADDR_ANY))
3141                         param_cp.own_address_type = ADDR_LE_DEV_PUBLIC;
3142                 else
3143                         param_cp.own_address_type = ADDR_LE_DEV_RANDOM;
3144                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3145                             &param_cp);
3146
3147                 memset(&enable_cp, 0, sizeof(enable_cp));
3148                 enable_cp.enable = LE_SCAN_ENABLE;
3149                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3150                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3151                             &enable_cp);
3152                 break;
3153
3154         default:
3155                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3156                                  MGMT_STATUS_INVALID_PARAMS);
3157                 mgmt_pending_remove(cmd);
3158                 goto failed;
3159         }
3160
3161         err = hci_req_run(&req, start_discovery_complete);
3162         if (err < 0)
3163                 mgmt_pending_remove(cmd);
3164         else
3165                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3166
3167 failed:
3168         hci_dev_unlock(hdev);
3169         return err;
3170 }
3171
3172 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3173 {
3174         struct pending_cmd *cmd;
3175         int err;
3176
3177         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3178         if (!cmd)
3179                 return -ENOENT;
3180
3181         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3182                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3183         mgmt_pending_remove(cmd);
3184
3185         return err;
3186 }
3187
3188 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3189 {
3190         BT_DBG("status %d", status);
3191
3192         hci_dev_lock(hdev);
3193
3194         if (status) {
3195                 mgmt_stop_discovery_failed(hdev, status);
3196                 goto unlock;
3197         }
3198
3199         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3200
3201 unlock:
3202         hci_dev_unlock(hdev);
3203 }
3204
3205 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3206                           u16 len)
3207 {
3208         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3209         struct pending_cmd *cmd;
3210         struct hci_cp_remote_name_req_cancel cp;
3211         struct inquiry_entry *e;
3212         struct hci_request req;
3213         struct hci_cp_le_set_scan_enable enable_cp;
3214         int err;
3215
3216         BT_DBG("%s", hdev->name);
3217
3218         hci_dev_lock(hdev);
3219
3220         if (!hci_discovery_active(hdev)) {
3221                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3222                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3223                                    sizeof(mgmt_cp->type));
3224                 goto unlock;
3225         }
3226
3227         if (hdev->discovery.type != mgmt_cp->type) {
3228                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3229                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3230                                    sizeof(mgmt_cp->type));
3231                 goto unlock;
3232         }
3233
3234         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3235         if (!cmd) {
3236                 err = -ENOMEM;
3237                 goto unlock;
3238         }
3239
3240         hci_req_init(&req, hdev);
3241
3242         switch (hdev->discovery.state) {
3243         case DISCOVERY_FINDING:
3244                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3245                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3246                 } else {
3247                         cancel_delayed_work(&hdev->le_scan_disable);
3248
3249                         memset(&enable_cp, 0, sizeof(enable_cp));
3250                         enable_cp.enable = LE_SCAN_DISABLE;
3251                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
3252                                     sizeof(enable_cp), &enable_cp);
3253                 }
3254
3255                 break;
3256
3257         case DISCOVERY_RESOLVING:
3258                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3259                                                      NAME_PENDING);
3260                 if (!e) {
3261                         mgmt_pending_remove(cmd);
3262                         err = cmd_complete(sk, hdev->id,
3263                                            MGMT_OP_STOP_DISCOVERY, 0,
3264                                            &mgmt_cp->type,
3265                                            sizeof(mgmt_cp->type));
3266                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3267                         goto unlock;
3268                 }
3269
3270                 bacpy(&cp.bdaddr, &e->data.bdaddr);
3271                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3272                             &cp);
3273
3274                 break;
3275
3276         default:
3277                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
3278
3279                 mgmt_pending_remove(cmd);
3280                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3281                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
3282                                    sizeof(mgmt_cp->type));
3283                 goto unlock;
3284         }
3285
3286         err = hci_req_run(&req, stop_discovery_complete);
3287         if (err < 0)
3288                 mgmt_pending_remove(cmd);
3289         else
3290                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3291
3292 unlock:
3293         hci_dev_unlock(hdev);
3294         return err;
3295 }
3296
3297 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3298                         u16 len)
3299 {
3300         struct mgmt_cp_confirm_name *cp = data;
3301         struct inquiry_entry *e;
3302         int err;
3303
3304         BT_DBG("%s", hdev->name);
3305
3306         hci_dev_lock(hdev);
3307
3308         if (!hci_discovery_active(hdev)) {
3309                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3310                                  MGMT_STATUS_FAILED);
3311                 goto failed;
3312         }
3313
3314         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3315         if (!e) {
3316                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3317                                  MGMT_STATUS_INVALID_PARAMS);
3318                 goto failed;
3319         }
3320
3321         if (cp->name_known) {
3322                 e->name_state = NAME_KNOWN;
3323                 list_del(&e->list);
3324         } else {
3325                 e->name_state = NAME_NEEDED;
3326                 hci_inquiry_cache_update_resolve(hdev, e);
3327         }
3328
3329         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3330                            sizeof(cp->addr));
3331
3332 failed:
3333         hci_dev_unlock(hdev);
3334         return err;
3335 }
3336
3337 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3338                         u16 len)
3339 {
3340         struct mgmt_cp_block_device *cp = data;
3341         u8 status;
3342         int err;
3343
3344         BT_DBG("%s", hdev->name);
3345
3346         if (!bdaddr_type_is_valid(cp->addr.type))
3347                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3348                                     MGMT_STATUS_INVALID_PARAMS,
3349                                     &cp->addr, sizeof(cp->addr));
3350
3351         hci_dev_lock(hdev);
3352
3353         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3354         if (err < 0)
3355                 status = MGMT_STATUS_FAILED;
3356         else
3357                 status = MGMT_STATUS_SUCCESS;
3358
3359         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3360                            &cp->addr, sizeof(cp->addr));
3361
3362         hci_dev_unlock(hdev);
3363
3364         return err;
3365 }
3366
3367 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3368                           u16 len)
3369 {
3370         struct mgmt_cp_unblock_device *cp = data;
3371         u8 status;
3372         int err;
3373
3374         BT_DBG("%s", hdev->name);
3375
3376         if (!bdaddr_type_is_valid(cp->addr.type))
3377                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3378                                     MGMT_STATUS_INVALID_PARAMS,
3379                                     &cp->addr, sizeof(cp->addr));
3380
3381         hci_dev_lock(hdev);
3382
3383         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3384         if (err < 0)
3385                 status = MGMT_STATUS_INVALID_PARAMS;
3386         else
3387                 status = MGMT_STATUS_SUCCESS;
3388
3389         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3390                            &cp->addr, sizeof(cp->addr));
3391
3392         hci_dev_unlock(hdev);
3393
3394         return err;
3395 }
3396
3397 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3398                          u16 len)
3399 {
3400         struct mgmt_cp_set_device_id *cp = data;
3401         struct hci_request req;
3402         int err;
3403         __u16 source;
3404
3405         BT_DBG("%s", hdev->name);
3406
3407         source = __le16_to_cpu(cp->source);
3408
3409         if (source > 0x0002)
3410                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3411                                   MGMT_STATUS_INVALID_PARAMS);
3412
3413         hci_dev_lock(hdev);
3414
3415         hdev->devid_source = source;
3416         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3417         hdev->devid_product = __le16_to_cpu(cp->product);
3418         hdev->devid_version = __le16_to_cpu(cp->version);
3419
3420         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3421
3422         hci_req_init(&req, hdev);
3423         update_eir(&req);
3424         hci_req_run(&req, NULL);
3425
3426         hci_dev_unlock(hdev);
3427
3428         return err;
3429 }
3430
3431 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3432 {
3433         struct cmd_lookup match = { NULL, hdev };
3434
3435         if (status) {
3436                 u8 mgmt_err = mgmt_status(status);
3437
3438                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3439                                      cmd_status_rsp, &mgmt_err);
3440                 return;
3441         }
3442
3443         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3444                              &match);
3445
3446         new_settings(hdev, match.sk);
3447
3448         if (match.sk)
3449                 sock_put(match.sk);
3450 }
3451
3452 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3453                            u16 len)
3454 {
3455         struct mgmt_mode *cp = data;
3456         struct pending_cmd *cmd;
3457         struct hci_request req;
3458         u8 val, enabled, status;
3459         int err;
3460
3461         BT_DBG("request for %s", hdev->name);
3462
3463         status = mgmt_le_support(hdev);
3464         if (status)
3465                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3466                                   status);
3467
3468         if (cp->val != 0x00 && cp->val != 0x01)
3469                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3470                                   MGMT_STATUS_INVALID_PARAMS);
3471
3472         hci_dev_lock(hdev);
3473
3474         val = !!cp->val;
3475         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3476
3477         /* The following conditions are ones which mean that we should
3478          * not do any HCI communication but directly send a mgmt
3479          * response to user space (after toggling the flag if
3480          * necessary).
3481          */
3482         if (!hdev_is_powered(hdev) || val == enabled ||
3483             hci_conn_num(hdev, LE_LINK) > 0) {
3484                 bool changed = false;
3485
3486                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3487                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3488                         changed = true;
3489                 }
3490
3491                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3492                 if (err < 0)
3493                         goto unlock;
3494
3495                 if (changed)
3496                         err = new_settings(hdev, sk);
3497
3498                 goto unlock;
3499         }
3500
3501         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3502             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3503                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3504                                  MGMT_STATUS_BUSY);
3505                 goto unlock;
3506         }
3507
3508         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3509         if (!cmd) {
3510                 err = -ENOMEM;
3511                 goto unlock;
3512         }
3513
3514         hci_req_init(&req, hdev);
3515
3516         if (val)
3517                 enable_advertising(&req);
3518         else
3519                 disable_advertising(&req);
3520
3521         err = hci_req_run(&req, set_advertising_complete);
3522         if (err < 0)
3523                 mgmt_pending_remove(cmd);
3524
3525 unlock:
3526         hci_dev_unlock(hdev);
3527         return err;
3528 }
3529
3530 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3531                               void *data, u16 len)
3532 {
3533         struct mgmt_cp_set_static_address *cp = data;
3534         int err;
3535
3536         BT_DBG("%s", hdev->name);
3537
3538         if (!lmp_le_capable(hdev))
3539                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3540                                   MGMT_STATUS_NOT_SUPPORTED);
3541
3542         if (hdev_is_powered(hdev))
3543                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3544                                   MGMT_STATUS_REJECTED);
3545
3546         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3547                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3548                         return cmd_status(sk, hdev->id,
3549                                           MGMT_OP_SET_STATIC_ADDRESS,
3550                                           MGMT_STATUS_INVALID_PARAMS);
3551
3552                 /* Two most significant bits shall be set */
3553                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3554                         return cmd_status(sk, hdev->id,
3555                                           MGMT_OP_SET_STATIC_ADDRESS,
3556                                           MGMT_STATUS_INVALID_PARAMS);
3557         }
3558
3559         hci_dev_lock(hdev);
3560
3561         bacpy(&hdev->static_addr, &cp->bdaddr);
3562
3563         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3564
3565         hci_dev_unlock(hdev);
3566
3567         return err;
3568 }
3569
3570 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
3571                            void *data, u16 len)
3572 {
3573         struct mgmt_cp_set_scan_params *cp = data;
3574         __u16 interval, window;
3575         int err;
3576
3577         BT_DBG("%s", hdev->name);
3578
3579         if (!lmp_le_capable(hdev))
3580                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3581                                   MGMT_STATUS_NOT_SUPPORTED);
3582
3583         interval = __le16_to_cpu(cp->interval);
3584
3585         if (interval < 0x0004 || interval > 0x4000)
3586                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3587                                   MGMT_STATUS_INVALID_PARAMS);
3588
3589         window = __le16_to_cpu(cp->window);
3590
3591         if (window < 0x0004 || window > 0x4000)
3592                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3593                                   MGMT_STATUS_INVALID_PARAMS);
3594
3595         if (window > interval)
3596                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3597                                   MGMT_STATUS_INVALID_PARAMS);
3598
3599         hci_dev_lock(hdev);
3600
3601         hdev->le_scan_interval = interval;
3602         hdev->le_scan_window = window;
3603
3604         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
3605
3606         hci_dev_unlock(hdev);
3607
3608         return err;
3609 }
3610
3611 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3612 {
3613         struct pending_cmd *cmd;
3614
3615         BT_DBG("status 0x%02x", status);
3616
3617         hci_dev_lock(hdev);
3618
3619         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3620         if (!cmd)
3621                 goto unlock;
3622
3623         if (status) {
3624                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3625                            mgmt_status(status));
3626         } else {
3627                 struct mgmt_mode *cp = cmd->param;
3628
3629                 if (cp->val)
3630                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3631                 else
3632                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3633
3634                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3635                 new_settings(hdev, cmd->sk);
3636         }
3637
3638         mgmt_pending_remove(cmd);
3639
3640 unlock:
3641         hci_dev_unlock(hdev);
3642 }
3643
3644 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3645                                 void *data, u16 len)
3646 {
3647         struct mgmt_mode *cp = data;
3648         struct pending_cmd *cmd;
3649         struct hci_request req;
3650         int err;
3651
3652         BT_DBG("%s", hdev->name);
3653
3654         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
3655             hdev->hci_ver < BLUETOOTH_VER_1_2)
3656                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3657                                   MGMT_STATUS_NOT_SUPPORTED);
3658
3659         if (cp->val != 0x00 && cp->val != 0x01)
3660                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3661                                   MGMT_STATUS_INVALID_PARAMS);
3662
3663         if (!hdev_is_powered(hdev))
3664                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3665                                   MGMT_STATUS_NOT_POWERED);
3666
3667         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3668                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3669                                   MGMT_STATUS_REJECTED);
3670
3671         hci_dev_lock(hdev);
3672
3673         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3674                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3675                                  MGMT_STATUS_BUSY);
3676                 goto unlock;
3677         }
3678
3679         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3680                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3681                                         hdev);
3682                 goto unlock;
3683         }
3684
3685         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3686                                data, len);
3687         if (!cmd) {
3688                 err = -ENOMEM;
3689                 goto unlock;
3690         }
3691
3692         hci_req_init(&req, hdev);
3693
3694         write_fast_connectable(&req, cp->val);
3695
3696         err = hci_req_run(&req, fast_connectable_complete);
3697         if (err < 0) {
3698                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3699                                  MGMT_STATUS_FAILED);
3700                 mgmt_pending_remove(cmd);
3701         }
3702
3703 unlock:
3704         hci_dev_unlock(hdev);
3705
3706         return err;
3707 }
3708
3709 static void set_bredr_scan(struct hci_request *req)
3710 {
3711         struct hci_dev *hdev = req->hdev;
3712         u8 scan = 0;
3713
3714         /* Ensure that fast connectable is disabled. This function will
3715          * not do anything if the page scan parameters are already what
3716          * they should be.
3717          */
3718         write_fast_connectable(req, false);
3719
3720         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3721                 scan |= SCAN_PAGE;
3722         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3723                 scan |= SCAN_INQUIRY;
3724
3725         if (scan)
3726                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3727 }
3728
3729 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
3730 {
3731         struct pending_cmd *cmd;
3732
3733         BT_DBG("status 0x%02x", status);
3734
3735         hci_dev_lock(hdev);
3736
3737         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
3738         if (!cmd)
3739                 goto unlock;
3740
3741         if (status) {
3742                 u8 mgmt_err = mgmt_status(status);
3743
3744                 /* We need to restore the flag if related HCI commands
3745                  * failed.
3746                  */
3747                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3748
3749                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
3750         } else {
3751                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
3752                 new_settings(hdev, cmd->sk);
3753         }
3754
3755         mgmt_pending_remove(cmd);
3756
3757 unlock:
3758         hci_dev_unlock(hdev);
3759 }
3760
3761 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3762 {
3763         struct mgmt_mode *cp = data;
3764         struct pending_cmd *cmd;
3765         struct hci_request req;
3766         int err;
3767
3768         BT_DBG("request for %s", hdev->name);
3769
3770         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
3771                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3772                                   MGMT_STATUS_NOT_SUPPORTED);
3773
3774         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3775                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3776                                   MGMT_STATUS_REJECTED);
3777
3778         if (cp->val != 0x00 && cp->val != 0x01)
3779                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3780                                   MGMT_STATUS_INVALID_PARAMS);
3781
3782         hci_dev_lock(hdev);
3783
3784         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3785                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3786                 goto unlock;
3787         }
3788
3789         if (!hdev_is_powered(hdev)) {
3790                 if (!cp->val) {
3791                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
3792                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
3793                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3794                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3795                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3796                 }
3797
3798                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3799
3800                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3801                 if (err < 0)
3802                         goto unlock;
3803
3804                 err = new_settings(hdev, sk);
3805                 goto unlock;
3806         }
3807
3808         /* Reject disabling when powered on */
3809         if (!cp->val) {
3810                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3811                                  MGMT_STATUS_REJECTED);
3812                 goto unlock;
3813         }
3814
3815         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
3816                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3817                                  MGMT_STATUS_BUSY);
3818                 goto unlock;
3819         }
3820
3821         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
3822         if (!cmd) {
3823                 err = -ENOMEM;
3824                 goto unlock;
3825         }
3826
3827         /* We need to flip the bit already here so that update_ad
3828          * generates the correct flags.
3829          */
3830         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3831
3832         hci_req_init(&req, hdev);
3833
3834         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3835                 set_bredr_scan(&req);
3836
3837         update_ad(&req);
3838
3839         err = hci_req_run(&req, set_bredr_complete);
3840         if (err < 0)
3841                 mgmt_pending_remove(cmd);
3842
3843 unlock:
3844         hci_dev_unlock(hdev);
3845         return err;
3846 }
3847
3848 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3849 {
3850         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3851                 return false;
3852         if (key->master != 0x00 && key->master != 0x01)
3853                 return false;
3854         if (!bdaddr_type_is_le(key->addr.type))
3855                 return false;
3856         return true;
3857 }
3858
3859 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3860                                void *cp_data, u16 len)
3861 {
3862         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3863         u16 key_count, expected_len;
3864         int i, err;
3865
3866         BT_DBG("request for %s", hdev->name);
3867
3868         if (!lmp_le_capable(hdev))
3869                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3870                                   MGMT_STATUS_NOT_SUPPORTED);
3871
3872         key_count = __le16_to_cpu(cp->key_count);
3873
3874         expected_len = sizeof(*cp) + key_count *
3875                                         sizeof(struct mgmt_ltk_info);
3876         if (expected_len != len) {
3877                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3878                        len, expected_len);
3879                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3880                                   MGMT_STATUS_INVALID_PARAMS);
3881         }
3882
3883         BT_DBG("%s key_count %u", hdev->name, key_count);
3884
3885         for (i = 0; i < key_count; i++) {
3886                 struct mgmt_ltk_info *key = &cp->keys[i];
3887
3888                 if (!ltk_is_valid(key))
3889                         return cmd_status(sk, hdev->id,
3890                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3891                                           MGMT_STATUS_INVALID_PARAMS);
3892         }
3893
3894         hci_dev_lock(hdev);
3895
3896         hci_smp_ltks_clear(hdev);
3897
3898         for (i = 0; i < key_count; i++) {
3899                 struct mgmt_ltk_info *key = &cp->keys[i];
3900                 u8 type, addr_type;
3901
3902                 if (key->addr.type == BDADDR_LE_PUBLIC)
3903                         addr_type = ADDR_LE_DEV_PUBLIC;
3904                 else
3905                         addr_type = ADDR_LE_DEV_RANDOM;
3906
3907                 if (key->master)
3908                         type = HCI_SMP_LTK;
3909                 else
3910                         type = HCI_SMP_LTK_SLAVE;
3911
3912                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type,
3913                             type, 0, key->authenticated, key->val,
3914                             key->enc_size, key->ediv, key->rand);
3915         }
3916
3917         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3918                            NULL, 0);
3919
3920         hci_dev_unlock(hdev);
3921
3922         return err;
3923 }
3924
3925 static const struct mgmt_handler {
3926         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3927                      u16 data_len);
3928         bool var_len;
3929         size_t data_len;
3930 } mgmt_handlers[] = {
3931         { NULL }, /* 0x0000 (no command) */
3932         { read_version,           false, MGMT_READ_VERSION_SIZE },
3933         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3934         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3935         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3936         { set_powered,            false, MGMT_SETTING_SIZE },
3937         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3938         { set_connectable,        false, MGMT_SETTING_SIZE },
3939         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3940         { set_pairable,           false, MGMT_SETTING_SIZE },
3941         { set_link_security,      false, MGMT_SETTING_SIZE },
3942         { set_ssp,                false, MGMT_SETTING_SIZE },
3943         { set_hs,                 false, MGMT_SETTING_SIZE },
3944         { set_le,                 false, MGMT_SETTING_SIZE },
3945         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3946         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3947         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3948         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3949         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3950         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3951         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3952         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3953         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3954         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3955         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3956         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3957         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3958         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3959         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3960         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3961         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3962         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3963         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3964         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3965         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3966         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3967         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3968         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3969         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3970         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3971         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3972         { set_advertising,        false, MGMT_SETTING_SIZE },
3973         { set_bredr,              false, MGMT_SETTING_SIZE },
3974         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
3975         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
3976 };
3977
3978
3979 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3980 {
3981         void *buf;
3982         u8 *cp;
3983         struct mgmt_hdr *hdr;
3984         u16 opcode, index, len;
3985         struct hci_dev *hdev = NULL;
3986         const struct mgmt_handler *handler;
3987         int err;
3988
3989         BT_DBG("got %zu bytes", msglen);
3990
3991         if (msglen < sizeof(*hdr))
3992                 return -EINVAL;
3993
3994         buf = kmalloc(msglen, GFP_KERNEL);
3995         if (!buf)
3996                 return -ENOMEM;
3997
3998         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3999                 err = -EFAULT;
4000                 goto done;
4001         }
4002
4003         hdr = buf;
4004         opcode = __le16_to_cpu(hdr->opcode);
4005         index = __le16_to_cpu(hdr->index);
4006         len = __le16_to_cpu(hdr->len);
4007
4008         if (len != msglen - sizeof(*hdr)) {
4009                 err = -EINVAL;
4010                 goto done;
4011         }
4012
4013         if (index != MGMT_INDEX_NONE) {
4014                 hdev = hci_dev_get(index);
4015                 if (!hdev) {
4016                         err = cmd_status(sk, index, opcode,
4017                                          MGMT_STATUS_INVALID_INDEX);
4018                         goto done;
4019                 }
4020
4021                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
4022                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
4023                         err = cmd_status(sk, index, opcode,
4024                                          MGMT_STATUS_INVALID_INDEX);
4025                         goto done;
4026                 }
4027         }
4028
4029         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
4030             mgmt_handlers[opcode].func == NULL) {
4031                 BT_DBG("Unknown op %u", opcode);
4032                 err = cmd_status(sk, index, opcode,
4033                                  MGMT_STATUS_UNKNOWN_COMMAND);
4034                 goto done;
4035         }
4036
4037         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
4038             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
4039                 err = cmd_status(sk, index, opcode,
4040                                  MGMT_STATUS_INVALID_INDEX);
4041                 goto done;
4042         }
4043
4044         handler = &mgmt_handlers[opcode];
4045
4046         if ((handler->var_len && len < handler->data_len) ||
4047             (!handler->var_len && len != handler->data_len)) {
4048                 err = cmd_status(sk, index, opcode,
4049                                  MGMT_STATUS_INVALID_PARAMS);
4050                 goto done;
4051         }
4052
4053         if (hdev)
4054                 mgmt_init_hdev(sk, hdev);
4055
4056         cp = buf + sizeof(*hdr);
4057
4058         err = handler->func(sk, hdev, cp, len);
4059         if (err < 0)
4060                 goto done;
4061
4062         err = msglen;
4063
4064 done:
4065         if (hdev)
4066                 hci_dev_put(hdev);
4067
4068         kfree(buf);
4069         return err;
4070 }
4071
4072 void mgmt_index_added(struct hci_dev *hdev)
4073 {
4074         if (hdev->dev_type != HCI_BREDR)
4075                 return;
4076
4077         mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
4078 }
4079
4080 void mgmt_index_removed(struct hci_dev *hdev)
4081 {
4082         u8 status = MGMT_STATUS_INVALID_INDEX;
4083
4084         if (hdev->dev_type != HCI_BREDR)
4085                 return;
4086
4087         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
4088
4089         mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
4090 }
4091
4092 static void powered_complete(struct hci_dev *hdev, u8 status)
4093 {
4094         struct cmd_lookup match = { NULL, hdev };
4095
4096         BT_DBG("status 0x%02x", status);
4097
4098         hci_dev_lock(hdev);
4099
4100         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
4101
4102         new_settings(hdev, match.sk);
4103
4104         hci_dev_unlock(hdev);
4105
4106         if (match.sk)
4107                 sock_put(match.sk);
4108 }
4109
4110 static int powered_update_hci(struct hci_dev *hdev)
4111 {
4112         struct hci_request req;
4113         u8 link_sec;
4114
4115         hci_req_init(&req, hdev);
4116
4117         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
4118             !lmp_host_ssp_capable(hdev)) {
4119                 u8 ssp = 1;
4120
4121                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
4122         }
4123
4124         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
4125             lmp_bredr_capable(hdev)) {
4126                 struct hci_cp_write_le_host_supported cp;
4127
4128                 cp.le = 1;
4129                 cp.simul = lmp_le_br_capable(hdev);
4130
4131                 /* Check first if we already have the right
4132                  * host state (host features set)
4133                  */
4134                 if (cp.le != lmp_host_le_capable(hdev) ||
4135                     cp.simul != lmp_host_le_br_capable(hdev))
4136                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
4137                                     sizeof(cp), &cp);
4138         }
4139
4140         if (lmp_le_capable(hdev)) {
4141                 /* Set random address to static address if configured */
4142                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
4143                         hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
4144                                     &hdev->static_addr);
4145
4146                 /* Make sure the controller has a good default for
4147                  * advertising data. This also applies to the case
4148                  * where BR/EDR was toggled during the AUTO_OFF phase.
4149                  */
4150                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4151                         update_ad(&req);
4152
4153                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
4154                         enable_advertising(&req);
4155         }
4156
4157         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4158         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
4159                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
4160                             sizeof(link_sec), &link_sec);
4161
4162         if (lmp_bredr_capable(hdev)) {
4163                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
4164                         set_bredr_scan(&req);
4165                 update_class(&req);
4166                 update_name(&req);
4167                 update_eir(&req);
4168         }
4169
4170         return hci_req_run(&req, powered_complete);
4171 }
4172
4173 int mgmt_powered(struct hci_dev *hdev, u8 powered)
4174 {
4175         struct cmd_lookup match = { NULL, hdev };
4176         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
4177         u8 zero_cod[] = { 0, 0, 0 };
4178         int err;
4179
4180         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
4181                 return 0;
4182
4183         if (powered) {
4184                 if (powered_update_hci(hdev) == 0)
4185                         return 0;
4186
4187                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
4188                                      &match);
4189                 goto new_settings;
4190         }
4191
4192         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
4193         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
4194
4195         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
4196                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
4197                            zero_cod, sizeof(zero_cod), NULL);
4198
4199 new_settings:
4200         err = new_settings(hdev, match.sk);
4201
4202         if (match.sk)
4203                 sock_put(match.sk);
4204
4205         return err;
4206 }
4207
4208 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
4209 {
4210         struct pending_cmd *cmd;
4211         u8 status;
4212
4213         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
4214         if (!cmd)
4215                 return;
4216
4217         if (err == -ERFKILL)
4218                 status = MGMT_STATUS_RFKILLED;
4219         else
4220                 status = MGMT_STATUS_FAILED;
4221
4222         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
4223
4224         mgmt_pending_remove(cmd);
4225 }
4226
4227 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
4228 {
4229         bool changed = false;
4230         int err = 0;
4231
4232         /* Nothing needed here if there's a pending command since that
4233          * commands request completion callback takes care of everything
4234          * necessary.
4235          */
4236         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
4237                 return 0;
4238
4239         if (discoverable) {
4240                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
4241                         changed = true;
4242         } else {
4243                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
4244                         changed = true;
4245         }
4246
4247         if (changed)
4248                 err = new_settings(hdev, NULL);
4249
4250         return err;
4251 }
4252
4253 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
4254 {
4255         bool changed = false;
4256         int err = 0;
4257
4258         /* Nothing needed here if there's a pending command since that
4259          * commands request completion callback takes care of everything
4260          * necessary.
4261          */
4262         if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
4263                 return 0;
4264
4265         if (connectable) {
4266                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4267                         changed = true;
4268         } else {
4269                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4270                         changed = true;
4271         }
4272
4273         if (changed)
4274                 err = new_settings(hdev, NULL);
4275
4276         return err;
4277 }
4278
4279 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
4280 {
4281         u8 mgmt_err = mgmt_status(status);
4282
4283         if (scan & SCAN_PAGE)
4284                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
4285                                      cmd_status_rsp, &mgmt_err);
4286
4287         if (scan & SCAN_INQUIRY)
4288                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
4289                                      cmd_status_rsp, &mgmt_err);
4290
4291         return 0;
4292 }
4293
4294 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
4295                       bool persistent)
4296 {
4297         struct mgmt_ev_new_link_key ev;
4298
4299         memset(&ev, 0, sizeof(ev));
4300
4301         ev.store_hint = persistent;
4302         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4303         ev.key.addr.type = BDADDR_BREDR;
4304         ev.key.type = key->type;
4305         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
4306         ev.key.pin_len = key->pin_len;
4307
4308         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
4309 }
4310
4311 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
4312 {
4313         struct mgmt_ev_new_long_term_key ev;
4314
4315         memset(&ev, 0, sizeof(ev));
4316
4317         ev.store_hint = persistent;
4318         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4319         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
4320         ev.key.authenticated = key->authenticated;
4321         ev.key.enc_size = key->enc_size;
4322         ev.key.ediv = key->ediv;
4323
4324         if (key->type == HCI_SMP_LTK)
4325                 ev.key.master = 1;
4326
4327         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
4328         memcpy(ev.key.val, key->val, sizeof(key->val));
4329
4330         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
4331                           NULL);
4332 }
4333
4334 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4335                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
4336                            u8 *dev_class)
4337 {
4338         char buf[512];
4339         struct mgmt_ev_device_connected *ev = (void *) buf;
4340         u16 eir_len = 0;
4341
4342         bacpy(&ev->addr.bdaddr, bdaddr);
4343         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4344
4345         ev->flags = __cpu_to_le32(flags);
4346
4347         if (name_len > 0)
4348                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
4349                                           name, name_len);
4350
4351         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
4352                 eir_len = eir_append_data(ev->eir, eir_len,
4353                                           EIR_CLASS_OF_DEV, dev_class, 3);
4354
4355         ev->eir_len = cpu_to_le16(eir_len);
4356
4357         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
4358                     sizeof(*ev) + eir_len, NULL);
4359 }
4360
4361 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
4362 {
4363         struct mgmt_cp_disconnect *cp = cmd->param;
4364         struct sock **sk = data;
4365         struct mgmt_rp_disconnect rp;
4366
4367         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4368         rp.addr.type = cp->addr.type;
4369
4370         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
4371                      sizeof(rp));
4372
4373         *sk = cmd->sk;
4374         sock_hold(*sk);
4375
4376         mgmt_pending_remove(cmd);
4377 }
4378
4379 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
4380 {
4381         struct hci_dev *hdev = data;
4382         struct mgmt_cp_unpair_device *cp = cmd->param;
4383         struct mgmt_rp_unpair_device rp;
4384
4385         memset(&rp, 0, sizeof(rp));
4386         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4387         rp.addr.type = cp->addr.type;
4388
4389         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
4390
4391         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
4392
4393         mgmt_pending_remove(cmd);
4394 }
4395
4396 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
4397                               u8 link_type, u8 addr_type, u8 reason)
4398 {
4399         struct mgmt_ev_device_disconnected ev;
4400         struct sock *sk = NULL;
4401
4402         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
4403
4404         bacpy(&ev.addr.bdaddr, bdaddr);
4405         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4406         ev.reason = reason;
4407
4408         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
4409
4410         if (sk)
4411                 sock_put(sk);
4412
4413         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4414                              hdev);
4415 }
4416
4417 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
4418                             u8 link_type, u8 addr_type, u8 status)
4419 {
4420         struct mgmt_rp_disconnect rp;
4421         struct pending_cmd *cmd;
4422
4423         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4424                              hdev);
4425
4426         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
4427         if (!cmd)
4428                 return;
4429
4430         bacpy(&rp.addr.bdaddr, bdaddr);
4431         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4432
4433         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
4434                      mgmt_status(status), &rp, sizeof(rp));
4435
4436         mgmt_pending_remove(cmd);
4437 }
4438
4439 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4440                          u8 addr_type, u8 status)
4441 {
4442         struct mgmt_ev_connect_failed ev;
4443
4444         bacpy(&ev.addr.bdaddr, bdaddr);
4445         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4446         ev.status = mgmt_status(status);
4447
4448         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
4449 }
4450
4451 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
4452 {
4453         struct mgmt_ev_pin_code_request ev;
4454
4455         bacpy(&ev.addr.bdaddr, bdaddr);
4456         ev.addr.type = BDADDR_BREDR;
4457         ev.secure = secure;
4458
4459         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
4460                           NULL);
4461 }
4462
4463 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4464                                  u8 status)
4465 {
4466         struct pending_cmd *cmd;
4467         struct mgmt_rp_pin_code_reply rp;
4468         int err;
4469
4470         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
4471         if (!cmd)
4472                 return -ENOENT;
4473
4474         bacpy(&rp.addr.bdaddr, bdaddr);
4475         rp.addr.type = BDADDR_BREDR;
4476
4477         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
4478                            mgmt_status(status), &rp, sizeof(rp));
4479
4480         mgmt_pending_remove(cmd);
4481
4482         return err;
4483 }
4484
4485 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4486                                      u8 status)
4487 {
4488         struct pending_cmd *cmd;
4489         struct mgmt_rp_pin_code_reply rp;
4490         int err;
4491
4492         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
4493         if (!cmd)
4494                 return -ENOENT;
4495
4496         bacpy(&rp.addr.bdaddr, bdaddr);
4497         rp.addr.type = BDADDR_BREDR;
4498
4499         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
4500                            mgmt_status(status), &rp, sizeof(rp));
4501
4502         mgmt_pending_remove(cmd);
4503
4504         return err;
4505 }
4506
4507 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4508                               u8 link_type, u8 addr_type, __le32 value,
4509                               u8 confirm_hint)
4510 {
4511         struct mgmt_ev_user_confirm_request ev;
4512
4513         BT_DBG("%s", hdev->name);
4514
4515         bacpy(&ev.addr.bdaddr, bdaddr);
4516         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4517         ev.confirm_hint = confirm_hint;
4518         ev.value = value;
4519
4520         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
4521                           NULL);
4522 }
4523
4524 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4525                               u8 link_type, u8 addr_type)
4526 {
4527         struct mgmt_ev_user_passkey_request ev;
4528
4529         BT_DBG("%s", hdev->name);
4530
4531         bacpy(&ev.addr.bdaddr, bdaddr);
4532         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4533
4534         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
4535                           NULL);
4536 }
4537
4538 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4539                                       u8 link_type, u8 addr_type, u8 status,
4540                                       u8 opcode)
4541 {
4542         struct pending_cmd *cmd;
4543         struct mgmt_rp_user_confirm_reply rp;
4544         int err;
4545
4546         cmd = mgmt_pending_find(opcode, hdev);
4547         if (!cmd)
4548                 return -ENOENT;
4549
4550         bacpy(&rp.addr.bdaddr, bdaddr);
4551         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4552         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
4553                            &rp, sizeof(rp));
4554
4555         mgmt_pending_remove(cmd);
4556
4557         return err;
4558 }
4559
4560 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4561                                      u8 link_type, u8 addr_type, u8 status)
4562 {
4563         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4564                                           status, MGMT_OP_USER_CONFIRM_REPLY);
4565 }
4566
4567 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4568                                          u8 link_type, u8 addr_type, u8 status)
4569 {
4570         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4571                                           status,
4572                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
4573 }
4574
4575 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4576                                      u8 link_type, u8 addr_type, u8 status)
4577 {
4578         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4579                                           status, MGMT_OP_USER_PASSKEY_REPLY);
4580 }
4581
4582 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4583                                          u8 link_type, u8 addr_type, u8 status)
4584 {
4585         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4586                                           status,
4587                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
4588 }
4589
4590 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
4591                              u8 link_type, u8 addr_type, u32 passkey,
4592                              u8 entered)
4593 {
4594         struct mgmt_ev_passkey_notify ev;
4595
4596         BT_DBG("%s", hdev->name);
4597
4598         bacpy(&ev.addr.bdaddr, bdaddr);
4599         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4600         ev.passkey = __cpu_to_le32(passkey);
4601         ev.entered = entered;
4602
4603         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
4604 }
4605
4606 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4607                      u8 addr_type, u8 status)
4608 {
4609         struct mgmt_ev_auth_failed ev;
4610
4611         bacpy(&ev.addr.bdaddr, bdaddr);
4612         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4613         ev.status = mgmt_status(status);
4614
4615         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
4616 }
4617
4618 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
4619 {
4620         struct cmd_lookup match = { NULL, hdev };
4621         bool changed = false;
4622         int err = 0;
4623
4624         if (status) {
4625                 u8 mgmt_err = mgmt_status(status);
4626                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
4627                                      cmd_status_rsp, &mgmt_err);
4628                 return 0;
4629         }
4630
4631         if (test_bit(HCI_AUTH, &hdev->flags)) {
4632                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4633                         changed = true;
4634         } else {
4635                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4636                         changed = true;
4637         }
4638
4639         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
4640                              &match);
4641
4642         if (changed)
4643                 err = new_settings(hdev, match.sk);
4644
4645         if (match.sk)
4646                 sock_put(match.sk);
4647
4648         return err;
4649 }
4650
4651 static void clear_eir(struct hci_request *req)
4652 {
4653         struct hci_dev *hdev = req->hdev;
4654         struct hci_cp_write_eir cp;
4655
4656         if (!lmp_ext_inq_capable(hdev))
4657                 return;
4658
4659         memset(hdev->eir, 0, sizeof(hdev->eir));
4660
4661         memset(&cp, 0, sizeof(cp));
4662
4663         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4664 }
4665
4666 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4667 {
4668         struct cmd_lookup match = { NULL, hdev };
4669         struct hci_request req;
4670         bool changed = false;
4671         int err = 0;
4672
4673         if (status) {
4674                 u8 mgmt_err = mgmt_status(status);
4675
4676                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4677                                                  &hdev->dev_flags)) {
4678                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4679                         err = new_settings(hdev, NULL);
4680                 }
4681
4682                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4683                                      &mgmt_err);
4684
4685                 return err;
4686         }
4687
4688         if (enable) {
4689                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4690         } else {
4691                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4692                 if (!changed)
4693                         changed = test_and_clear_bit(HCI_HS_ENABLED,
4694                                                      &hdev->dev_flags);
4695                 else
4696                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4697         }
4698
4699         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4700
4701         if (changed)
4702                 err = new_settings(hdev, match.sk);
4703
4704         if (match.sk)
4705                 sock_put(match.sk);
4706
4707         hci_req_init(&req, hdev);
4708
4709         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4710                 update_eir(&req);
4711         else
4712                 clear_eir(&req);
4713
4714         hci_req_run(&req, NULL);
4715
4716         return err;
4717 }
4718
4719 static void sk_lookup(struct pending_cmd *cmd, void *data)
4720 {
4721         struct cmd_lookup *match = data;
4722
4723         if (match->sk == NULL) {
4724                 match->sk = cmd->sk;
4725                 sock_hold(match->sk);
4726         }
4727 }
4728
4729 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4730                                    u8 status)
4731 {
4732         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4733         int err = 0;
4734
4735         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4736         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4737         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4738
4739         if (!status)
4740                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4741                                  3, NULL);
4742
4743         if (match.sk)
4744                 sock_put(match.sk);
4745
4746         return err;
4747 }
4748
4749 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4750 {
4751         struct mgmt_cp_set_local_name ev;
4752         struct pending_cmd *cmd;
4753
4754         if (status)
4755                 return 0;
4756
4757         memset(&ev, 0, sizeof(ev));
4758         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4759         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4760
4761         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4762         if (!cmd) {
4763                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4764
4765                 /* If this is a HCI command related to powering on the
4766                  * HCI dev don't send any mgmt signals.
4767                  */
4768                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4769                         return 0;
4770         }
4771
4772         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4773                           cmd ? cmd->sk : NULL);
4774 }
4775
4776 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4777                                             u8 *randomizer, u8 status)
4778 {
4779         struct pending_cmd *cmd;
4780         int err;
4781
4782         BT_DBG("%s status %u", hdev->name, status);
4783
4784         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4785         if (!cmd)
4786                 return -ENOENT;
4787
4788         if (status) {
4789                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4790                                  mgmt_status(status));
4791         } else {
4792                 struct mgmt_rp_read_local_oob_data rp;
4793
4794                 memcpy(rp.hash, hash, sizeof(rp.hash));
4795                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4796
4797                 err = cmd_complete(cmd->sk, hdev->id,
4798                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4799                                    sizeof(rp));
4800         }
4801
4802         mgmt_pending_remove(cmd);
4803
4804         return err;
4805 }
4806
4807 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4808                        u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4809                        ssp, u8 *eir, u16 eir_len)
4810 {
4811         char buf[512];
4812         struct mgmt_ev_device_found *ev = (void *) buf;
4813         size_t ev_size;
4814
4815         if (!hci_discovery_active(hdev))
4816                 return;
4817
4818         /* Leave 5 bytes for a potential CoD field */
4819         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4820                 return;
4821
4822         memset(buf, 0, sizeof(buf));
4823
4824         bacpy(&ev->addr.bdaddr, bdaddr);
4825         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4826         ev->rssi = rssi;
4827         if (cfm_name)
4828                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4829         if (!ssp)
4830                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4831
4832         if (eir_len > 0)
4833                 memcpy(ev->eir, eir, eir_len);
4834
4835         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4836                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4837                                           dev_class, 3);
4838
4839         ev->eir_len = cpu_to_le16(eir_len);
4840         ev_size = sizeof(*ev) + eir_len;
4841
4842         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4843 }
4844
4845 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4846                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4847 {
4848         struct mgmt_ev_device_found *ev;
4849         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4850         u16 eir_len;
4851
4852         ev = (struct mgmt_ev_device_found *) buf;
4853
4854         memset(buf, 0, sizeof(buf));
4855
4856         bacpy(&ev->addr.bdaddr, bdaddr);
4857         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4858         ev->rssi = rssi;
4859
4860         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4861                                   name_len);
4862
4863         ev->eir_len = cpu_to_le16(eir_len);
4864
4865         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
4866 }
4867
4868 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4869 {
4870         struct mgmt_ev_discovering ev;
4871         struct pending_cmd *cmd;
4872
4873         BT_DBG("%s discovering %u", hdev->name, discovering);
4874
4875         if (discovering)
4876                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4877         else
4878                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4879
4880         if (cmd != NULL) {
4881                 u8 type = hdev->discovery.type;
4882
4883                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4884                              sizeof(type));
4885                 mgmt_pending_remove(cmd);
4886         }
4887
4888         memset(&ev, 0, sizeof(ev));
4889         ev.type = hdev->discovery.type;
4890         ev.discovering = discovering;
4891
4892         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4893 }
4894
4895 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4896 {
4897         struct pending_cmd *cmd;
4898         struct mgmt_ev_device_blocked ev;
4899
4900         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4901
4902         bacpy(&ev.addr.bdaddr, bdaddr);
4903         ev.addr.type = type;
4904
4905         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4906                           cmd ? cmd->sk : NULL);
4907 }
4908
4909 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4910 {
4911         struct pending_cmd *cmd;
4912         struct mgmt_ev_device_unblocked ev;
4913
4914         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4915
4916         bacpy(&ev.addr.bdaddr, bdaddr);
4917         ev.addr.type = type;
4918
4919         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4920                           cmd ? cmd->sk : NULL);
4921 }
4922
4923 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
4924 {
4925         BT_DBG("%s status %u", hdev->name, status);
4926
4927         /* Clear the advertising mgmt setting if we failed to re-enable it */
4928         if (status) {
4929                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4930                 new_settings(hdev, NULL);
4931         }
4932 }
4933
4934 void mgmt_reenable_advertising(struct hci_dev *hdev)
4935 {
4936         struct hci_request req;
4937
4938         if (hci_conn_num(hdev, LE_LINK) > 0)
4939                 return;
4940
4941         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
4942                 return;
4943
4944         hci_req_init(&req, hdev);
4945         enable_advertising(&req);
4946
4947         /* If this fails we have no option but to let user space know
4948          * that we've disabled advertising.
4949          */
4950         if (hci_req_run(&req, adv_enable_complete) < 0) {
4951                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4952                 new_settings(hdev, NULL);
4953         }
4954 }