net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #ifdef TIZEN_BT
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #include <net/bluetooth/sco.h>
  38 #endif
  39
  40 #include "hci_request.h"
  41 #include "smp.h"
  42 #include "mgmt_util.h"
  43 #include "mgmt_config.h"
  44 #include "msft.h"
  45
  46 #define MGMT_VERSION    1
  47 #define MGMT_REVISION   21
  48
  49 static const u16 mgmt_commands[] = {
  50         MGMT_OP_READ_INDEX_LIST,
  51         MGMT_OP_READ_INFO,
  52         MGMT_OP_SET_POWERED,
  53         MGMT_OP_SET_DISCOVERABLE,
  54         MGMT_OP_SET_CONNECTABLE,
  55         MGMT_OP_SET_FAST_CONNECTABLE,
  56         MGMT_OP_SET_BONDABLE,
  57         MGMT_OP_SET_LINK_SECURITY,
  58         MGMT_OP_SET_SSP,
  59         MGMT_OP_SET_HS,
  60         MGMT_OP_SET_LE,
  61         MGMT_OP_SET_DEV_CLASS,
  62         MGMT_OP_SET_LOCAL_NAME,
  63         MGMT_OP_ADD_UUID,
  64         MGMT_OP_REMOVE_UUID,
  65         MGMT_OP_LOAD_LINK_KEYS,
  66         MGMT_OP_LOAD_LONG_TERM_KEYS,
  67         MGMT_OP_DISCONNECT,
  68         MGMT_OP_GET_CONNECTIONS,
  69         MGMT_OP_PIN_CODE_REPLY,
  70         MGMT_OP_PIN_CODE_NEG_REPLY,
  71         MGMT_OP_SET_IO_CAPABILITY,
  72         MGMT_OP_PAIR_DEVICE,
  73         MGMT_OP_CANCEL_PAIR_DEVICE,
  74         MGMT_OP_UNPAIR_DEVICE,
  75         MGMT_OP_USER_CONFIRM_REPLY,
  76         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  77         MGMT_OP_USER_PASSKEY_REPLY,
  78         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  79         MGMT_OP_READ_LOCAL_OOB_DATA,
  80         MGMT_OP_ADD_REMOTE_OOB_DATA,
  81         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  82         MGMT_OP_START_DISCOVERY,
  83         MGMT_OP_STOP_DISCOVERY,
  84         MGMT_OP_CONFIRM_NAME,
  85         MGMT_OP_BLOCK_DEVICE,
  86         MGMT_OP_UNBLOCK_DEVICE,
  87         MGMT_OP_SET_DEVICE_ID,
  88         MGMT_OP_SET_ADVERTISING,
  89         MGMT_OP_SET_BREDR,
  90         MGMT_OP_SET_STATIC_ADDRESS,
  91         MGMT_OP_SET_SCAN_PARAMS,
  92         MGMT_OP_SET_SECURE_CONN,
  93         MGMT_OP_SET_DEBUG_KEYS,
  94         MGMT_OP_SET_PRIVACY,
  95         MGMT_OP_LOAD_IRKS,
  96         MGMT_OP_GET_CONN_INFO,
  97         MGMT_OP_GET_CLOCK_INFO,
  98         MGMT_OP_ADD_DEVICE,
  99         MGMT_OP_REMOVE_DEVICE,
 100         MGMT_OP_LOAD_CONN_PARAM,
 101         MGMT_OP_READ_UNCONF_INDEX_LIST,
 102         MGMT_OP_READ_CONFIG_INFO,
 103         MGMT_OP_SET_EXTERNAL_CONFIG,
 104         MGMT_OP_SET_PUBLIC_ADDRESS,
 105         MGMT_OP_START_SERVICE_DISCOVERY,
 106         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 107         MGMT_OP_READ_EXT_INDEX_LIST,
 108         MGMT_OP_READ_ADV_FEATURES,
 109         MGMT_OP_ADD_ADVERTISING,
 110         MGMT_OP_REMOVE_ADVERTISING,
 111         MGMT_OP_GET_ADV_SIZE_INFO,
 112         MGMT_OP_START_LIMITED_DISCOVERY,
 113         MGMT_OP_READ_EXT_INFO,
 114         MGMT_OP_SET_APPEARANCE,
 115         MGMT_OP_GET_PHY_CONFIGURATION,
 116         MGMT_OP_SET_PHY_CONFIGURATION,
 117         MGMT_OP_SET_BLOCKED_KEYS,
 118         MGMT_OP_SET_WIDEBAND_SPEECH,
 119         MGMT_OP_READ_CONTROLLER_CAP,
 120         MGMT_OP_READ_EXP_FEATURES_INFO,
 121         MGMT_OP_SET_EXP_FEATURE,
 122         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 123         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 124         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 125         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 126         MGMT_OP_GET_DEVICE_FLAGS,
 127         MGMT_OP_SET_DEVICE_FLAGS,
 128         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 129         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 130         MGMT_OP_REMOVE_ADV_MONITOR,
 131         MGMT_OP_ADD_EXT_ADV_PARAMS,
 132         MGMT_OP_ADD_EXT_ADV_DATA,
 133         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 134 };
 135
 136 static const u16 mgmt_events[] = {
 137         MGMT_EV_CONTROLLER_ERROR,
 138         MGMT_EV_INDEX_ADDED,
 139         MGMT_EV_INDEX_REMOVED,
 140         MGMT_EV_NEW_SETTINGS,
 141         MGMT_EV_CLASS_OF_DEV_CHANGED,
 142         MGMT_EV_LOCAL_NAME_CHANGED,
 143         MGMT_EV_NEW_LINK_KEY,
 144         MGMT_EV_NEW_LONG_TERM_KEY,
 145         MGMT_EV_DEVICE_CONNECTED,
 146         MGMT_EV_DEVICE_DISCONNECTED,
 147         MGMT_EV_CONNECT_FAILED,
 148         MGMT_EV_PIN_CODE_REQUEST,
 149         MGMT_EV_USER_CONFIRM_REQUEST,
 150         MGMT_EV_USER_PASSKEY_REQUEST,
 151         MGMT_EV_AUTH_FAILED,
 152         MGMT_EV_DEVICE_FOUND,
 153         MGMT_EV_DISCOVERING,
 154         MGMT_EV_DEVICE_BLOCKED,
 155         MGMT_EV_DEVICE_UNBLOCKED,
 156         MGMT_EV_DEVICE_UNPAIRED,
 157         MGMT_EV_PASSKEY_NOTIFY,
 158         MGMT_EV_NEW_IRK,
 159         MGMT_EV_NEW_CSRK,
 160         MGMT_EV_DEVICE_ADDED,
 161         MGMT_EV_DEVICE_REMOVED,
 162         MGMT_EV_NEW_CONN_PARAM,
 163         MGMT_EV_UNCONF_INDEX_ADDED,
 164         MGMT_EV_UNCONF_INDEX_REMOVED,
 165         MGMT_EV_NEW_CONFIG_OPTIONS,
 166         MGMT_EV_EXT_INDEX_ADDED,
 167         MGMT_EV_EXT_INDEX_REMOVED,
 168         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 169         MGMT_EV_ADVERTISING_ADDED,
 170         MGMT_EV_ADVERTISING_REMOVED,
 171         MGMT_EV_EXT_INFO_CHANGED,
 172         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 173         MGMT_EV_EXP_FEATURE_CHANGED,
 174         MGMT_EV_DEVICE_FLAGS_CHANGED,
 175         MGMT_EV_ADV_MONITOR_ADDED,
 176         MGMT_EV_ADV_MONITOR_REMOVED,
 177         MGMT_EV_CONTROLLER_SUSPEND,
 178         MGMT_EV_CONTROLLER_RESUME,
 179 };
 180
 181 static const u16 mgmt_untrusted_commands[] = {
 182         MGMT_OP_READ_INDEX_LIST,
 183         MGMT_OP_READ_INFO,
 184         MGMT_OP_READ_UNCONF_INDEX_LIST,
 185         MGMT_OP_READ_CONFIG_INFO,
 186         MGMT_OP_READ_EXT_INDEX_LIST,
 187         MGMT_OP_READ_EXT_INFO,
 188         MGMT_OP_READ_CONTROLLER_CAP,
 189         MGMT_OP_READ_EXP_FEATURES_INFO,
 190         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 191         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 192 };
 193
 194 static const u16 mgmt_untrusted_events[] = {
 195         MGMT_EV_INDEX_ADDED,
 196         MGMT_EV_INDEX_REMOVED,
 197         MGMT_EV_NEW_SETTINGS,
 198         MGMT_EV_CLASS_OF_DEV_CHANGED,
 199         MGMT_EV_LOCAL_NAME_CHANGED,
 200         MGMT_EV_UNCONF_INDEX_ADDED,
 201         MGMT_EV_UNCONF_INDEX_REMOVED,
 202         MGMT_EV_NEW_CONFIG_OPTIONS,
 203         MGMT_EV_EXT_INDEX_ADDED,
 204         MGMT_EV_EXT_INDEX_REMOVED,
 205         MGMT_EV_EXT_INFO_CHANGED,
 206         MGMT_EV_EXP_FEATURE_CHANGED,
 207 };
 208
 209 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 210
 211 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 212                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 213
 214 /* HCI to MGMT error code conversion table */
 215 static const u8 mgmt_status_table[] = {
 216         MGMT_STATUS_SUCCESS,
 217         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 218         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 219         MGMT_STATUS_FAILED,             /* Hardware Failure */
 220         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 221         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 222         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 223         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 224         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 225         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 226         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 227         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 228         MGMT_STATUS_BUSY,               /* Command Disallowed */
 229         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 230         MGMT_STATUS_REJECTED,           /* Rejected Security */
 231         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 232         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 233         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 234         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 235         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 236         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 237         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 238         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 239         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 240         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 241         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 242         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 243         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 244         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 245         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 246         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 247         MGMT_STATUS_FAILED,             /* Unspecified Error */
 248         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 249         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 250         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 251         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 252         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 253         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 254         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 255         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 256         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 257         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 258         MGMT_STATUS_FAILED,             /* Transaction Collision */
 259         MGMT_STATUS_FAILED,             /* Reserved for future use */
 260         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 261         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 262         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 263         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 264         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 265         MGMT_STATUS_FAILED,             /* Reserved for future use */
 266         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 267         MGMT_STATUS_FAILED,             /* Reserved for future use */
 268         MGMT_STATUS_FAILED,             /* Slot Violation */
 269         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 270         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 271         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 272         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 273         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 274         MGMT_STATUS_BUSY,               /* Controller Busy */
 275         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 276         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 277         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 278         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 279         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 280 };
 281
 282 static u8 mgmt_status(u8 hci_status)
 283 {
 284         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 285                 return mgmt_status_table[hci_status];
 286
 287         return MGMT_STATUS_FAILED;
 288 }
 289
 290 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 291                             u16 len, int flag)
 292 {
 293         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 294                                flag, NULL);
 295 }
 296
 297 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 298                               u16 len, int flag, struct sock *skip_sk)
 299 {
 300         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 301                                flag, skip_sk);
 302 }
 303
 304 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 305                       struct sock *skip_sk)
 306 {
 307         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 308                                HCI_SOCK_TRUSTED, skip_sk);
 309 }
 310
 311 static u8 le_addr_type(u8 mgmt_addr_type)
 312 {
 313         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 314                 return ADDR_LE_DEV_PUBLIC;
 315         else
 316                 return ADDR_LE_DEV_RANDOM;
 317 }
 318
 319 void mgmt_fill_version_info(void *ver)
 320 {
 321         struct mgmt_rp_read_version *rp = ver;
 322
 323         rp->version = MGMT_VERSION;
 324         rp->revision = cpu_to_le16(MGMT_REVISION);
 325 }
 326
 327 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 328                         u16 data_len)
 329 {
 330         struct mgmt_rp_read_version rp;
 331
 332         bt_dev_dbg(hdev, "sock %p", sk);
 333
 334         mgmt_fill_version_info(&rp);
 335
 336         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 337                                  &rp, sizeof(rp));
 338 }
 339
 340 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 341                          u16 data_len)
 342 {
 343         struct mgmt_rp_read_commands *rp;
 344         u16 num_commands, num_events;
 345         size_t rp_size;
 346         int i, err;
 347
 348         bt_dev_dbg(hdev, "sock %p", sk);
 349
 350         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 351                 num_commands = ARRAY_SIZE(mgmt_commands);
 352                 num_events = ARRAY_SIZE(mgmt_events);
 353         } else {
 354                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 355                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 356         }
 357
 358         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 359
 360         rp = kmalloc(rp_size, GFP_KERNEL);
 361         if (!rp)
 362                 return -ENOMEM;
 363
 364         rp->num_commands = cpu_to_le16(num_commands);
 365         rp->num_events = cpu_to_le16(num_events);
 366
 367         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 368                 __le16 *opcode = rp->opcodes;
 369
 370                 for (i = 0; i < num_commands; i++, opcode++)
 371                         put_unaligned_le16(mgmt_commands[i], opcode);
 372
 373                 for (i = 0; i < num_events; i++, opcode++)
 374                         put_unaligned_le16(mgmt_events[i], opcode);
 375         } else {
 376                 __le16 *opcode = rp->opcodes;
 377
 378                 for (i = 0; i < num_commands; i++, opcode++)
 379                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 380
 381                 for (i = 0; i < num_events; i++, opcode++)
 382                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 383         }
 384
 385         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 386                                 rp, rp_size);
 387         kfree(rp);
 388
 389         return err;
 390 }
 391
 392 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 393                            u16 data_len)
 394 {
 395         struct mgmt_rp_read_index_list *rp;
 396         struct hci_dev *d;
 397         size_t rp_len;
 398         u16 count;
 399         int err;
 400
 401         bt_dev_dbg(hdev, "sock %p", sk);
 402
 403         read_lock(&hci_dev_list_lock);
 404
 405         count = 0;
 406         list_for_each_entry(d, &hci_dev_list, list) {
 407                 if (d->dev_type == HCI_PRIMARY &&
 408                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 409                         count++;
 410         }
 411
 412         rp_len = sizeof(*rp) + (2 * count);
 413         rp = kmalloc(rp_len, GFP_ATOMIC);
 414         if (!rp) {
 415                 read_unlock(&hci_dev_list_lock);
 416                 return -ENOMEM;
 417         }
 418
 419         count = 0;
 420         list_for_each_entry(d, &hci_dev_list, list) {
 421                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 422                     hci_dev_test_flag(d, HCI_CONFIG) ||
 423                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 424                         continue;
 425
 426                 /* Devices marked as raw-only are neither configured
 427                  * nor unconfigured controllers.
 428                  */
 429                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 430                         continue;
 431
 432                 if (d->dev_type == HCI_PRIMARY &&
 433                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 434                         rp->index[count++] = cpu_to_le16(d->id);
 435                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 436                 }
 437         }
 438
 439         rp->num_controllers = cpu_to_le16(count);
 440         rp_len = sizeof(*rp) + (2 * count);
 441
 442         read_unlock(&hci_dev_list_lock);
 443
 444         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 445                                 0, rp, rp_len);
 446
 447         kfree(rp);
 448
 449         return err;
 450 }
 451
 452 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 453                                   void *data, u16 data_len)
 454 {
 455         struct mgmt_rp_read_unconf_index_list *rp;
 456         struct hci_dev *d;
 457         size_t rp_len;
 458         u16 count;
 459         int err;
 460
 461         bt_dev_dbg(hdev, "sock %p", sk);
 462
 463         read_lock(&hci_dev_list_lock);
 464
 465         count = 0;
 466         list_for_each_entry(d, &hci_dev_list, list) {
 467                 if (d->dev_type == HCI_PRIMARY &&
 468                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 469                         count++;
 470         }
 471
 472         rp_len = sizeof(*rp) + (2 * count);
 473         rp = kmalloc(rp_len, GFP_ATOMIC);
 474         if (!rp) {
 475                 read_unlock(&hci_dev_list_lock);
 476                 return -ENOMEM;
 477         }
 478
 479         count = 0;
 480         list_for_each_entry(d, &hci_dev_list, list) {
 481                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 482                     hci_dev_test_flag(d, HCI_CONFIG) ||
 483                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 484                         continue;
 485
 486                 /* Devices marked as raw-only are neither configured
 487                  * nor unconfigured controllers.
 488                  */
 489                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 490                         continue;
 491
 492                 if (d->dev_type == HCI_PRIMARY &&
 493                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 494                         rp->index[count++] = cpu_to_le16(d->id);
 495                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 496                 }
 497         }
 498
 499         rp->num_controllers = cpu_to_le16(count);
 500         rp_len = sizeof(*rp) + (2 * count);
 501
 502         read_unlock(&hci_dev_list_lock);
 503
 504         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 505                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 506
 507         kfree(rp);
 508
 509         return err;
 510 }
 511
 512 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 513                                void *data, u16 data_len)
 514 {
 515         struct mgmt_rp_read_ext_index_list *rp;
 516         struct hci_dev *d;
 517         u16 count;
 518         int err;
 519
 520         bt_dev_dbg(hdev, "sock %p", sk);
 521
 522         read_lock(&hci_dev_list_lock);
 523
 524         count = 0;
 525         list_for_each_entry(d, &hci_dev_list, list) {
 526                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 527                         count++;
 528         }
 529
 530         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 531         if (!rp) {
 532                 read_unlock(&hci_dev_list_lock);
 533                 return -ENOMEM;
 534         }
 535
 536         count = 0;
 537         list_for_each_entry(d, &hci_dev_list, list) {
 538                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 539                     hci_dev_test_flag(d, HCI_CONFIG) ||
 540                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 541                         continue;
 542
 543                 /* Devices marked as raw-only are neither configured
 544                  * nor unconfigured controllers.
 545                  */
 546                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 547                         continue;
 548
 549                 if (d->dev_type == HCI_PRIMARY) {
 550                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 551                                 rp->entry[count].type = 0x01;
 552                         else
 553                                 rp->entry[count].type = 0x00;
 554                 } else if (d->dev_type == HCI_AMP) {
 555                         rp->entry[count].type = 0x02;
 556                 } else {
 557                         continue;
 558                 }
 559
 560                 rp->entry[count].bus = d->bus;
 561                 rp->entry[count++].index = cpu_to_le16(d->id);
 562                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 563         }
 564
 565         rp->num_controllers = cpu_to_le16(count);
 566
 567         read_unlock(&hci_dev_list_lock);
 568
 569         /* If this command is called at least once, then all the
 570          * default index and unconfigured index events are disabled
 571          * and from now on only extended index events are used.
 572          */
 573         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 574         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 575         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 576
 577         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 578                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 579                                 struct_size(rp, entry, count));
 580
 581         kfree(rp);
 582
 583         return err;
 584 }
 585
 586 static bool is_configured(struct hci_dev *hdev)
 587 {
 588         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 589             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 590                 return false;
 591
 592         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 593              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 594             !bacmp(&hdev->public_addr, BDADDR_ANY))
 595                 return false;
 596
 597         return true;
 598 }
 599
 600 static __le32 get_missing_options(struct hci_dev *hdev)
 601 {
 602         u32 options = 0;
 603
 604         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 605             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 606                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 607
 608         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 609              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 610             !bacmp(&hdev->public_addr, BDADDR_ANY))
 611                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 612
 613         return cpu_to_le32(options);
 614 }
 615
 616 static int new_options(struct hci_dev *hdev, struct sock *skip)
 617 {
 618         __le32 options = get_missing_options(hdev);
 619
 620         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 621                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 622 }
 623
 624 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 625 {
 626         __le32 options = get_missing_options(hdev);
 627
 628         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 629                                  sizeof(options));
 630 }
 631
 632 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 633                             void *data, u16 data_len)
 634 {
 635         struct mgmt_rp_read_config_info rp;
 636         u32 options = 0;
 637
 638         bt_dev_dbg(hdev, "sock %p", sk);
 639
 640         hci_dev_lock(hdev);
 641
 642         memset(&rp, 0, sizeof(rp));
 643         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 644
 645         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 646                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 647
 648         if (hdev->set_bdaddr)
 649                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 650
 651         rp.supported_options = cpu_to_le32(options);
 652         rp.missing_options = get_missing_options(hdev);
 653
 654         hci_dev_unlock(hdev);
 655
 656         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 657                                  &rp, sizeof(rp));
 658 }
 659
 660 static u32 get_supported_phys(struct hci_dev *hdev)
 661 {
 662         u32 supported_phys = 0;
 663
 664         if (lmp_bredr_capable(hdev)) {
 665                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 666
 667                 if (hdev->features[0][0] & LMP_3SLOT)
 668                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 669
 670                 if (hdev->features[0][0] & LMP_5SLOT)
 671                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 672
 673                 if (lmp_edr_2m_capable(hdev)) {
 674                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 675
 676                         if (lmp_edr_3slot_capable(hdev))
 677                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 678
 679                         if (lmp_edr_5slot_capable(hdev))
 680                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 681
 682                         if (lmp_edr_3m_capable(hdev)) {
 683                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 684
 685                                 if (lmp_edr_3slot_capable(hdev))
 686                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 687
 688                                 if (lmp_edr_5slot_capable(hdev))
 689                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 690                         }
 691                 }
 692         }
 693
 694         if (lmp_le_capable(hdev)) {
 695                 supported_phys |= MGMT_PHY_LE_1M_TX;
 696                 supported_phys |= MGMT_PHY_LE_1M_RX;
 697
 698                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 699                         supported_phys |= MGMT_PHY_LE_2M_TX;
 700                         supported_phys |= MGMT_PHY_LE_2M_RX;
 701                 }
 702
 703                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 704                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 705                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 706                 }
 707         }
 708
 709         return supported_phys;
 710 }
 711
 712 static u32 get_selected_phys(struct hci_dev *hdev)
 713 {
 714         u32 selected_phys = 0;
 715
 716         if (lmp_bredr_capable(hdev)) {
 717                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 718
 719                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 720                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 721
 722                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 723                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 724
 725                 if (lmp_edr_2m_capable(hdev)) {
 726                         if (!(hdev->pkt_type & HCI_2DH1))
 727                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 728
 729                         if (lmp_edr_3slot_capable(hdev) &&
 730                             !(hdev->pkt_type & HCI_2DH3))
 731                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 732
 733                         if (lmp_edr_5slot_capable(hdev) &&
 734                             !(hdev->pkt_type & HCI_2DH5))
 735                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 736
 737                         if (lmp_edr_3m_capable(hdev)) {
 738                                 if (!(hdev->pkt_type & HCI_3DH1))
 739                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 740
 741                                 if (lmp_edr_3slot_capable(hdev) &&
 742                                     !(hdev->pkt_type & HCI_3DH3))
 743                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 744
 745                                 if (lmp_edr_5slot_capable(hdev) &&
 746                                     !(hdev->pkt_type & HCI_3DH5))
 747                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 748                         }
 749                 }
 750         }
 751
 752         if (lmp_le_capable(hdev)) {
 753                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 754                         selected_phys |= MGMT_PHY_LE_1M_TX;
 755
 756                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 757                         selected_phys |= MGMT_PHY_LE_1M_RX;
 758
 759                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 760                         selected_phys |= MGMT_PHY_LE_2M_TX;
 761
 762                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 763                         selected_phys |= MGMT_PHY_LE_2M_RX;
 764
 765                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 766                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 767
 768                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 769                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 770         }
 771
 772         return selected_phys;
 773 }
 774
 775 static u32 get_configurable_phys(struct hci_dev *hdev)
 776 {
 777         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 778                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 779 }
 780
 781 static u32 get_supported_settings(struct hci_dev *hdev)
 782 {
 783         u32 settings = 0;
 784
 785         settings |= MGMT_SETTING_POWERED;
 786         settings |= MGMT_SETTING_BONDABLE;
 787         settings |= MGMT_SETTING_DEBUG_KEYS;
 788         settings |= MGMT_SETTING_CONNECTABLE;
 789         settings |= MGMT_SETTING_DISCOVERABLE;
 790
 791         if (lmp_bredr_capable(hdev)) {
 792                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 793                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 794                 settings |= MGMT_SETTING_BREDR;
 795                 settings |= MGMT_SETTING_LINK_SECURITY;
 796
 797                 if (lmp_ssp_capable(hdev)) {
 798                         settings |= MGMT_SETTING_SSP;
 799                         if (IS_ENABLED(CONFIG_BT_HS))
 800                                 settings |= MGMT_SETTING_HS;
 801                 }
 802
 803                 if (lmp_sc_capable(hdev))
 804                         settings |= MGMT_SETTING_SECURE_CONN;
 805
 806                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 807                              &hdev->quirks))
 808                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 809         }
 810
 811         if (lmp_le_capable(hdev)) {
 812                 settings |= MGMT_SETTING_LE;
 813                 settings |= MGMT_SETTING_SECURE_CONN;
 814                 settings |= MGMT_SETTING_PRIVACY;
 815                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 816
 817                 /* When the experimental feature for LL Privacy support is
 818                  * enabled, then advertising is no longer supported.
 819                  */
 820                 if (!hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
 821                         settings |= MGMT_SETTING_ADVERTISING;
 822         }
 823
 824         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 825             hdev->set_bdaddr)
 826                 settings |= MGMT_SETTING_CONFIGURATION;
 827
 828         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 829
 830         return settings;
 831 }
 832
 833 static u32 get_current_settings(struct hci_dev *hdev)
 834 {
 835         u32 settings = 0;
 836
 837         if (hdev_is_powered(hdev))
 838                 settings |= MGMT_SETTING_POWERED;
 839
 840         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 841                 settings |= MGMT_SETTING_CONNECTABLE;
 842
 843         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 844                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 845
 846         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 847                 settings |= MGMT_SETTING_DISCOVERABLE;
 848
 849         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 850                 settings |= MGMT_SETTING_BONDABLE;
 851
 852         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 853                 settings |= MGMT_SETTING_BREDR;
 854
 855         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 856                 settings |= MGMT_SETTING_LE;
 857
 858         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 859                 settings |= MGMT_SETTING_LINK_SECURITY;
 860
 861         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 862                 settings |= MGMT_SETTING_SSP;
 863
 864         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 865                 settings |= MGMT_SETTING_HS;
 866
 867         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 868                 settings |= MGMT_SETTING_ADVERTISING;
 869
 870         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 871                 settings |= MGMT_SETTING_SECURE_CONN;
 872
 873         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 874                 settings |= MGMT_SETTING_DEBUG_KEYS;
 875
 876         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 877                 settings |= MGMT_SETTING_PRIVACY;
 878
 879         /* The current setting for static address has two purposes. The
 880          * first is to indicate if the static address will be used and
 881          * the second is to indicate if it is actually set.
 882          *
 883          * This means if the static address is not configured, this flag
 884          * will never be set. If the address is configured, then if the
 885          * address is actually used decides if the flag is set or not.
 886          *
 887          * For single mode LE only controllers and dual-mode controllers
 888          * with BR/EDR disabled, the existence of the static address will
 889          * be evaluated.
 890          */
 891         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 892             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 893             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 894                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 895                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 896         }
 897
 898         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 899                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 900
 901         return settings;
 902 }
 903
 904 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 905 {
 906         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 907 }
 908
 909 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 910                                                   struct hci_dev *hdev,
 911                                                   const void *data)
 912 {
 913         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 914 }
 915
 916 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 917 {
 918         struct mgmt_pending_cmd *cmd;
 919
 920         /* If there's a pending mgmt command the flags will not yet have
 921          * their final values, so check for this first.
 922          */
 923         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 924         if (cmd) {
 925                 struct mgmt_mode *cp = cmd->param;
 926                 if (cp->val == 0x01)
 927                         return LE_AD_GENERAL;
 928                 else if (cp->val == 0x02)
 929                         return LE_AD_LIMITED;
 930         } else {
 931                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 932                         return LE_AD_LIMITED;
 933                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 934                         return LE_AD_GENERAL;
 935         }
 936
 937         return 0;
 938 }
 939
 940 bool mgmt_get_connectable(struct hci_dev *hdev)
 941 {
 942         struct mgmt_pending_cmd *cmd;
 943
 944         /* If there's a pending mgmt command the flag will not yet have
 945          * it's final value, so check for this first.
 946          */
 947         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 948         if (cmd) {
 949                 struct mgmt_mode *cp = cmd->param;
 950
 951                 return cp->val;
 952         }
 953
 954         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 955 }
 956
 957 static void service_cache_off(struct work_struct *work)
 958 {
 959         struct hci_dev *hdev = container_of(work, struct hci_dev,
 960                                             service_cache.work);
 961         struct hci_request req;
 962
 963         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 964                 return;
 965
 966         hci_req_init(&req, hdev);
 967
 968         hci_dev_lock(hdev);
 969
 970         __hci_req_update_eir(&req);
 971         __hci_req_update_class(&req);
 972
 973         hci_dev_unlock(hdev);
 974
 975         hci_req_run(&req, NULL);
 976 }
 977
 978 static void rpa_expired(struct work_struct *work)
 979 {
 980         struct hci_dev *hdev = container_of(work, struct hci_dev,
 981                                             rpa_expired.work);
 982         struct hci_request req;
 983
 984         bt_dev_dbg(hdev, "");
 985
 986         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 987
 988         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 989                 return;
 990
 991         /* The generation of a new RPA and programming it into the
 992          * controller happens in the hci_req_enable_advertising()
 993          * function.
 994          */
 995         hci_req_init(&req, hdev);
 996         if (ext_adv_capable(hdev))
 997                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 998         else
 999                 __hci_req_enable_advertising(&req);
1000         hci_req_run(&req, NULL);
1001 }
1002
1003 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1004 {
1005         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1006                 return;
1007
1008         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1009         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1010
1011         /* Non-mgmt controlled devices get this bit set
1012          * implicitly so that pairing works for them, however
1013          * for mgmt we require user-space to explicitly enable
1014          * it
1015          */
1016         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1017 }
1018
1019 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1020                                 void *data, u16 data_len)
1021 {
1022         struct mgmt_rp_read_info rp;
1023
1024         bt_dev_dbg(hdev, "sock %p", sk);
1025
1026         hci_dev_lock(hdev);
1027
1028         memset(&rp, 0, sizeof(rp));
1029
1030         bacpy(&rp.bdaddr, &hdev->bdaddr);
1031
1032         rp.version = hdev->hci_ver;
1033         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1034
1035         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1036         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1037
1038         memcpy(rp.dev_class, hdev->dev_class, 3);
1039
1040         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1041         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1042
1043         hci_dev_unlock(hdev);
1044
1045         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1046                                  sizeof(rp));
1047 }
1048
1049 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1050 {
1051         u16 eir_len = 0;
1052         size_t name_len;
1053
1054         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1055                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1056                                           hdev->dev_class, 3);
1057
1058         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1059                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1060                                           hdev->appearance);
1061
1062         name_len = strlen(hdev->dev_name);
1063         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1064                                   hdev->dev_name, name_len);
1065
1066         name_len = strlen(hdev->short_name);
1067         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1068                                   hdev->short_name, name_len);
1069
1070         return eir_len;
1071 }
1072
1073 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1074                                     void *data, u16 data_len)
1075 {
1076         char buf[512];
1077         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1078         u16 eir_len;
1079
1080         bt_dev_dbg(hdev, "sock %p", sk);
1081
1082         memset(&buf, 0, sizeof(buf));
1083
1084         hci_dev_lock(hdev);
1085
1086         bacpy(&rp->bdaddr, &hdev->bdaddr);
1087
1088         rp->version = hdev->hci_ver;
1089         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1090
1091         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1092         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1093
1094
1095         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1096         rp->eir_len = cpu_to_le16(eir_len);
1097
1098         hci_dev_unlock(hdev);
1099
1100         /* If this command is called at least once, then the events
1101          * for class of device and local name changes are disabled
1102          * and only the new extended controller information event
1103          * is used.
1104          */
1105         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1106         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1107         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1108
1109         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1110                                  sizeof(*rp) + eir_len);
1111 }
1112
1113 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1114 {
1115         char buf[512];
1116         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1117         u16 eir_len;
1118
1119         memset(buf, 0, sizeof(buf));
1120
1121         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1122         ev->eir_len = cpu_to_le16(eir_len);
1123
1124         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1125                                   sizeof(*ev) + eir_len,
1126                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1127 }
1128
1129 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1130 {
1131         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1132
1133         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1134                                  sizeof(settings));
1135 }
1136
1137 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1138 {
1139         bt_dev_dbg(hdev, "status 0x%02x", status);
1140
1141         if (hci_conn_count(hdev) == 0) {
1142                 cancel_delayed_work(&hdev->power_off);
1143                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1144         }
1145 }
1146
1147 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1148 {
1149         struct mgmt_ev_advertising_added ev;
1150
1151         ev.instance = instance;
1152
1153         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1154 }
1155
1156 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1157                               u8 instance)
1158 {
1159         struct mgmt_ev_advertising_removed ev;
1160
1161         ev.instance = instance;
1162
1163         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1164 }
1165
1166 static void cancel_adv_timeout(struct hci_dev *hdev)
1167 {
1168         if (hdev->adv_instance_timeout) {
1169                 hdev->adv_instance_timeout = 0;
1170                 cancel_delayed_work(&hdev->adv_instance_expire);
1171         }
1172 }
1173
1174 static int clean_up_hci_state(struct hci_dev *hdev)
1175 {
1176         struct hci_request req;
1177         struct hci_conn *conn;
1178         bool discov_stopped;
1179         int err;
1180
1181         hci_req_init(&req, hdev);
1182
1183         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1184             test_bit(HCI_PSCAN, &hdev->flags)) {
1185                 u8 scan = 0x00;
1186                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1187         }
1188
1189         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1190
1191         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1192                 __hci_req_disable_advertising(&req);
1193
1194         discov_stopped = hci_req_stop_discovery(&req);
1195
1196         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1197                 /* 0x15 == Terminated due to Power Off */
1198                 __hci_abort_conn(&req, conn, 0x15);
1199         }
1200
1201         err = hci_req_run(&req, clean_up_hci_complete);
1202         if (!err && discov_stopped)
1203                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1204
1205         return err;
1206 }
1207
1208 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1209                        u16 len)
1210 {
1211         struct mgmt_mode *cp = data;
1212         struct mgmt_pending_cmd *cmd;
1213         int err;
1214
1215         bt_dev_dbg(hdev, "sock %p", sk);
1216
1217         if (cp->val != 0x00 && cp->val != 0x01)
1218                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1219                                        MGMT_STATUS_INVALID_PARAMS);
1220
1221         hci_dev_lock(hdev);
1222
1223         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1224                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1225                                       MGMT_STATUS_BUSY);
1226                 goto failed;
1227         }
1228
1229         if (!!cp->val == hdev_is_powered(hdev)) {
1230                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1231                 goto failed;
1232         }
1233
1234         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1235         if (!cmd) {
1236                 err = -ENOMEM;
1237                 goto failed;
1238         }
1239
1240         if (cp->val) {
1241                 queue_work(hdev->req_workqueue, &hdev->power_on);
1242                 err = 0;
1243         } else {
1244                 /* Disconnect connections, stop scans, etc */
1245                 err = clean_up_hci_state(hdev);
1246                 if (!err)
1247                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1248                                            HCI_POWER_OFF_TIMEOUT);
1249
1250                 /* ENODATA means there were no HCI commands queued */
1251                 if (err == -ENODATA) {
1252                         cancel_delayed_work(&hdev->power_off);
1253                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1254                         err = 0;
1255                 }
1256         }
1257
1258 failed:
1259         hci_dev_unlock(hdev);
1260         return err;
1261 }
1262
1263 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1264 {
1265         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1266
1267         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1268                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1269 }
1270
1271 int mgmt_new_settings(struct hci_dev *hdev)
1272 {
1273         return new_settings(hdev, NULL);
1274 }
1275
1276 struct cmd_lookup {
1277         struct sock *sk;
1278         struct hci_dev *hdev;
1279         u8 mgmt_status;
1280 };
1281
1282 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1283 {
1284         struct cmd_lookup *match = data;
1285
1286         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1287
1288         list_del(&cmd->list);
1289
1290         if (match->sk == NULL) {
1291                 match->sk = cmd->sk;
1292                 sock_hold(match->sk);
1293         }
1294
1295         mgmt_pending_free(cmd);
1296 }
1297
1298 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1299 {
1300         u8 *status = data;
1301
1302         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1303         mgmt_pending_remove(cmd);
1304 }
1305
1306 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1307 {
1308         if (cmd->cmd_complete) {
1309                 u8 *status = data;
1310
1311                 cmd->cmd_complete(cmd, *status);
1312                 mgmt_pending_remove(cmd);
1313
1314                 return;
1315         }
1316
1317         cmd_status_rsp(cmd, data);
1318 }
1319
1320 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1321 {
1322         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1323                                  cmd->param, cmd->param_len);
1324 }
1325
1326 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1327 {
1328         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1329                                  cmd->param, sizeof(struct mgmt_addr_info));
1330 }
1331
1332 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1333 {
1334         if (!lmp_bredr_capable(hdev))
1335                 return MGMT_STATUS_NOT_SUPPORTED;
1336         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1337                 return MGMT_STATUS_REJECTED;
1338         else
1339                 return MGMT_STATUS_SUCCESS;
1340 }
1341
1342 static u8 mgmt_le_support(struct hci_dev *hdev)
1343 {
1344         if (!lmp_le_capable(hdev))
1345                 return MGMT_STATUS_NOT_SUPPORTED;
1346         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1347                 return MGMT_STATUS_REJECTED;
1348         else
1349                 return MGMT_STATUS_SUCCESS;
1350 }
1351
1352 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1353 {
1354         struct mgmt_pending_cmd *cmd;
1355
1356         bt_dev_dbg(hdev, "status 0x%02x", status);
1357
1358         hci_dev_lock(hdev);
1359
1360         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1361         if (!cmd)
1362                 goto unlock;
1363
1364         if (status) {
1365                 u8 mgmt_err = mgmt_status(status);
1366                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1367                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1368                 goto remove_cmd;
1369         }
1370
1371         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1372             hdev->discov_timeout > 0) {
1373                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1374                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1375         }
1376
1377         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1378         new_settings(hdev, cmd->sk);
1379
1380 remove_cmd:
1381         mgmt_pending_remove(cmd);
1382
1383 unlock:
1384         hci_dev_unlock(hdev);
1385 }
1386
1387 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1388                             u16 len)
1389 {
1390         struct mgmt_cp_set_discoverable *cp = data;
1391         struct mgmt_pending_cmd *cmd;
1392         u16 timeout;
1393         int err;
1394
1395         bt_dev_dbg(hdev, "sock %p", sk);
1396
1397         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1398             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1399                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1400                                        MGMT_STATUS_REJECTED);
1401
1402         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1403                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1404                                        MGMT_STATUS_INVALID_PARAMS);
1405
1406         timeout = __le16_to_cpu(cp->timeout);
1407
1408         /* Disabling discoverable requires that no timeout is set,
1409          * and enabling limited discoverable requires a timeout.
1410          */
1411         if ((cp->val == 0x00 && timeout > 0) ||
1412             (cp->val == 0x02 && timeout == 0))
1413                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1414                                        MGMT_STATUS_INVALID_PARAMS);
1415
1416         hci_dev_lock(hdev);
1417
1418         if (!hdev_is_powered(hdev) && timeout > 0) {
1419                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1420                                       MGMT_STATUS_NOT_POWERED);
1421                 goto failed;
1422         }
1423
1424         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1425             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1426                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1427                                       MGMT_STATUS_BUSY);
1428                 goto failed;
1429         }
1430
1431         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1432                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1433                                       MGMT_STATUS_REJECTED);
1434                 goto failed;
1435         }
1436
1437         if (hdev->advertising_paused) {
1438                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1439                                       MGMT_STATUS_BUSY);
1440                 goto failed;
1441         }
1442
1443         if (!hdev_is_powered(hdev)) {
1444                 bool changed = false;
1445
1446                 /* Setting limited discoverable when powered off is
1447                  * not a valid operation since it requires a timeout
1448                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1449                  */
1450                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1451                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1452                         changed = true;
1453                 }
1454
1455                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1456                 if (err < 0)
1457                         goto failed;
1458
1459                 if (changed)
1460                         err = new_settings(hdev, sk);
1461
1462                 goto failed;
1463         }
1464
1465         /* If the current mode is the same, then just update the timeout
1466          * value with the new value. And if only the timeout gets updated,
1467          * then no need for any HCI transactions.
1468          */
1469         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1470             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1471                                                    HCI_LIMITED_DISCOVERABLE)) {
1472                 cancel_delayed_work(&hdev->discov_off);
1473                 hdev->discov_timeout = timeout;
1474
1475                 if (cp->val && hdev->discov_timeout > 0) {
1476                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1477                         queue_delayed_work(hdev->req_workqueue,
1478                                            &hdev->discov_off, to);
1479                 }
1480
1481                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1482                 goto failed;
1483         }
1484
1485         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1486         if (!cmd) {
1487                 err = -ENOMEM;
1488                 goto failed;
1489         }
1490
1491         /* Cancel any potential discoverable timeout that might be
1492          * still active and store new timeout value. The arming of
1493          * the timeout happens in the complete handler.
1494          */
1495         cancel_delayed_work(&hdev->discov_off);
1496         hdev->discov_timeout = timeout;
1497
1498         if (cp->val)
1499                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1500         else
1501                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1502
1503         /* Limited discoverable mode */
1504         if (cp->val == 0x02)
1505                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1506         else
1507                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1508
1509         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1510         err = 0;
1511
1512 failed:
1513         hci_dev_unlock(hdev);
1514         return err;
1515 }
1516
1517 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1518 {
1519         struct mgmt_pending_cmd *cmd;
1520
1521         bt_dev_dbg(hdev, "status 0x%02x", status);
1522
1523         hci_dev_lock(hdev);
1524
1525         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1526         if (!cmd)
1527                 goto unlock;
1528
1529         if (status) {
1530                 u8 mgmt_err = mgmt_status(status);
1531                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1532                 goto remove_cmd;
1533         }
1534
1535         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1536         new_settings(hdev, cmd->sk);
1537
1538 remove_cmd:
1539         mgmt_pending_remove(cmd);
1540
1541 unlock:
1542         hci_dev_unlock(hdev);
1543 }
1544
1545 static int set_connectable_update_settings(struct hci_dev *hdev,
1546                                            struct sock *sk, u8 val)
1547 {
1548         bool changed = false;
1549         int err;
1550
1551         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1552                 changed = true;
1553
1554         if (val) {
1555                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1556         } else {
1557                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1558                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1559         }
1560
1561         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1562         if (err < 0)
1563                 return err;
1564
1565         if (changed) {
1566                 hci_req_update_scan(hdev);
1567                 hci_update_background_scan(hdev);
1568                 return new_settings(hdev, sk);
1569         }
1570
1571         return 0;
1572 }
1573
1574 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1575                            u16 len)
1576 {
1577         struct mgmt_mode *cp = data;
1578         struct mgmt_pending_cmd *cmd;
1579         int err;
1580
1581         bt_dev_dbg(hdev, "sock %p", sk);
1582
1583         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1584             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1585                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1586                                        MGMT_STATUS_REJECTED);
1587
1588         if (cp->val != 0x00 && cp->val != 0x01)
1589                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1590                                        MGMT_STATUS_INVALID_PARAMS);
1591
1592         hci_dev_lock(hdev);
1593
1594         if (!hdev_is_powered(hdev)) {
1595                 err = set_connectable_update_settings(hdev, sk, cp->val);
1596                 goto failed;
1597         }
1598
1599         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1600             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1601                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1602                                       MGMT_STATUS_BUSY);
1603                 goto failed;
1604         }
1605
1606         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1607         if (!cmd) {
1608                 err = -ENOMEM;
1609                 goto failed;
1610         }
1611
1612         if (cp->val) {
1613                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1614         } else {
1615                 if (hdev->discov_timeout > 0)
1616                         cancel_delayed_work(&hdev->discov_off);
1617
1618                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1619                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1620                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1621         }
1622
1623         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1624         err = 0;
1625
1626 failed:
1627         hci_dev_unlock(hdev);
1628         return err;
1629 }
1630
1631 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1632                         u16 len)
1633 {
1634         struct mgmt_mode *cp = data;
1635         bool changed;
1636         int err;
1637
1638         bt_dev_dbg(hdev, "sock %p", sk);
1639
1640         if (cp->val != 0x00 && cp->val != 0x01)
1641                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1642                                        MGMT_STATUS_INVALID_PARAMS);
1643
1644         hci_dev_lock(hdev);
1645
1646         if (cp->val)
1647                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1648         else
1649                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1650
1651         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1652         if (err < 0)
1653                 goto unlock;
1654
1655         if (changed) {
1656                 /* In limited privacy mode the change of bondable mode
1657                  * may affect the local advertising address.
1658                  */
1659                 if (hdev_is_powered(hdev) &&
1660                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1661                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1662                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1663                         queue_work(hdev->req_workqueue,
1664                                    &hdev->discoverable_update);
1665
1666                 err = new_settings(hdev, sk);
1667         }
1668
1669 unlock:
1670         hci_dev_unlock(hdev);
1671         return err;
1672 }
1673
1674 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1675                              u16 len)
1676 {
1677         struct mgmt_mode *cp = data;
1678         struct mgmt_pending_cmd *cmd;
1679         u8 val, status;
1680         int err;
1681
1682         bt_dev_dbg(hdev, "sock %p", sk);
1683
1684         status = mgmt_bredr_support(hdev);
1685         if (status)
1686                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1687                                        status);
1688
1689         if (cp->val != 0x00 && cp->val != 0x01)
1690                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1691                                        MGMT_STATUS_INVALID_PARAMS);
1692
1693         hci_dev_lock(hdev);
1694
1695         if (!hdev_is_powered(hdev)) {
1696                 bool changed = false;
1697
1698                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1699                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1700                         changed = true;
1701                 }
1702
1703                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1704                 if (err < 0)
1705                         goto failed;
1706
1707                 if (changed)
1708                         err = new_settings(hdev, sk);
1709
1710                 goto failed;
1711         }
1712
1713         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1714                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1715                                       MGMT_STATUS_BUSY);
1716                 goto failed;
1717         }
1718
1719         val = !!cp->val;
1720
1721         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1722                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1723                 goto failed;
1724         }
1725
1726         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1727         if (!cmd) {
1728                 err = -ENOMEM;
1729                 goto failed;
1730         }
1731
1732         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1733         if (err < 0) {
1734                 mgmt_pending_remove(cmd);
1735                 goto failed;
1736         }
1737
1738 failed:
1739         hci_dev_unlock(hdev);
1740         return err;
1741 }
1742
1743 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1744 {
1745         struct mgmt_mode *cp = data;
1746         struct mgmt_pending_cmd *cmd;
1747         u8 status;
1748         int err;
1749
1750         bt_dev_dbg(hdev, "sock %p", sk);
1751
1752         status = mgmt_bredr_support(hdev);
1753         if (status)
1754                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1755
1756         if (!lmp_ssp_capable(hdev))
1757                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1758                                        MGMT_STATUS_NOT_SUPPORTED);
1759
1760         if (cp->val != 0x00 && cp->val != 0x01)
1761                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1762                                        MGMT_STATUS_INVALID_PARAMS);
1763
1764         hci_dev_lock(hdev);
1765
1766         if (!hdev_is_powered(hdev)) {
1767                 bool changed;
1768
1769                 if (cp->val) {
1770                         changed = !hci_dev_test_and_set_flag(hdev,
1771                                                              HCI_SSP_ENABLED);
1772                 } else {
1773                         changed = hci_dev_test_and_clear_flag(hdev,
1774                                                               HCI_SSP_ENABLED);
1775                         if (!changed)
1776                                 changed = hci_dev_test_and_clear_flag(hdev,
1777                                                                       HCI_HS_ENABLED);
1778                         else
1779                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1780                 }
1781
1782                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1783                 if (err < 0)
1784                         goto failed;
1785
1786                 if (changed)
1787                         err = new_settings(hdev, sk);
1788
1789                 goto failed;
1790         }
1791
1792         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1793                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1794                                       MGMT_STATUS_BUSY);
1795                 goto failed;
1796         }
1797
1798         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1799                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1800                 goto failed;
1801         }
1802
1803         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1804         if (!cmd) {
1805                 err = -ENOMEM;
1806                 goto failed;
1807         }
1808
1809         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1810                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1811                              sizeof(cp->val), &cp->val);
1812
1813         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1814         if (err < 0) {
1815                 mgmt_pending_remove(cmd);
1816                 goto failed;
1817         }
1818
1819 failed:
1820         hci_dev_unlock(hdev);
1821         return err;
1822 }
1823
1824 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1825 {
1826         struct mgmt_mode *cp = data;
1827         bool changed;
1828         u8 status;
1829         int err;
1830
1831         bt_dev_dbg(hdev, "sock %p", sk);
1832
1833         if (!IS_ENABLED(CONFIG_BT_HS))
1834                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1835                                        MGMT_STATUS_NOT_SUPPORTED);
1836
1837         status = mgmt_bredr_support(hdev);
1838         if (status)
1839                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1840
1841         if (!lmp_ssp_capable(hdev))
1842                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1843                                        MGMT_STATUS_NOT_SUPPORTED);
1844
1845         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1846                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1847                                        MGMT_STATUS_REJECTED);
1848
1849         if (cp->val != 0x00 && cp->val != 0x01)
1850                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1851                                        MGMT_STATUS_INVALID_PARAMS);
1852
1853         hci_dev_lock(hdev);
1854
1855         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1856                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1857                                       MGMT_STATUS_BUSY);
1858                 goto unlock;
1859         }
1860
1861         if (cp->val) {
1862                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1863         } else {
1864                 if (hdev_is_powered(hdev)) {
1865                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1866                                               MGMT_STATUS_REJECTED);
1867                         goto unlock;
1868                 }
1869
1870                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1871         }
1872
1873         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1874         if (err < 0)
1875                 goto unlock;
1876
1877         if (changed)
1878                 err = new_settings(hdev, sk);
1879
1880 unlock:
1881         hci_dev_unlock(hdev);
1882         return err;
1883 }
1884
1885 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1886 {
1887         struct cmd_lookup match = { NULL, hdev };
1888
1889         hci_dev_lock(hdev);
1890
1891         if (status) {
1892                 u8 mgmt_err = mgmt_status(status);
1893
1894                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1895                                      &mgmt_err);
1896                 goto unlock;
1897         }
1898
1899         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1900
1901         new_settings(hdev, match.sk);
1902
1903         if (match.sk)
1904                 sock_put(match.sk);
1905
1906         /* Make sure the controller has a good default for
1907          * advertising data. Restrict the update to when LE
1908          * has actually been enabled. During power on, the
1909          * update in powered_update_hci will take care of it.
1910          */
1911         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1912                 struct hci_request req;
1913                 hci_req_init(&req, hdev);
1914                 if (ext_adv_capable(hdev)) {
1915                         int err;
1916
1917                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1918                         if (!err)
1919                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1920                 } else {
1921                         __hci_req_update_adv_data(&req, 0x00);
1922                         __hci_req_update_scan_rsp_data(&req, 0x00);
1923                 }
1924                 hci_req_run(&req, NULL);
1925                 hci_update_background_scan(hdev);
1926         }
1927
1928 unlock:
1929         hci_dev_unlock(hdev);
1930 }
1931
1932 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1933 {
1934         struct mgmt_mode *cp = data;
1935         struct hci_cp_write_le_host_supported hci_cp;
1936         struct mgmt_pending_cmd *cmd;
1937         struct hci_request req;
1938         int err;
1939         u8 val, enabled;
1940
1941         bt_dev_dbg(hdev, "sock %p", sk);
1942
1943         if (!lmp_le_capable(hdev))
1944                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1945                                        MGMT_STATUS_NOT_SUPPORTED);
1946
1947         if (cp->val != 0x00 && cp->val != 0x01)
1948                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1949                                        MGMT_STATUS_INVALID_PARAMS);
1950
1951         /* Bluetooth single mode LE only controllers or dual-mode
1952          * controllers configured as LE only devices, do not allow
1953          * switching LE off. These have either LE enabled explicitly
1954          * or BR/EDR has been previously switched off.
1955          *
1956          * When trying to enable an already enabled LE, then gracefully
1957          * send a positive response. Trying to disable it however will
1958          * result into rejection.
1959          */
1960         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1961                 if (cp->val == 0x01)
1962                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1963
1964                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1965                                        MGMT_STATUS_REJECTED);
1966         }
1967
1968         hci_dev_lock(hdev);
1969
1970         val = !!cp->val;
1971         enabled = lmp_host_le_capable(hdev);
1972
1973         if (!val)
1974                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1975
1976         if (!hdev_is_powered(hdev) || val == enabled) {
1977                 bool changed = false;
1978
1979                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1980                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1981                         changed = true;
1982                 }
1983
1984                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1985                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1986                         changed = true;
1987                 }
1988
1989                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1990                 if (err < 0)
1991                         goto unlock;
1992
1993                 if (changed)
1994                         err = new_settings(hdev, sk);
1995
1996                 goto unlock;
1997         }
1998
1999         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2000             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2001                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2002                                       MGMT_STATUS_BUSY);
2003                 goto unlock;
2004         }
2005
2006         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2007         if (!cmd) {
2008                 err = -ENOMEM;
2009                 goto unlock;
2010         }
2011
2012         hci_req_init(&req, hdev);
2013
2014         memset(&hci_cp, 0, sizeof(hci_cp));
2015
2016         if (val) {
2017                 hci_cp.le = val;
2018                 hci_cp.simul = 0x00;
2019         } else {
2020                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2021                         __hci_req_disable_advertising(&req);
2022
2023                 if (ext_adv_capable(hdev))
2024                         __hci_req_clear_ext_adv_sets(&req);
2025         }
2026
2027         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2028                     &hci_cp);
2029
2030         err = hci_req_run(&req, le_enable_complete);
2031         if (err < 0)
2032                 mgmt_pending_remove(cmd);
2033
2034 unlock:
2035         hci_dev_unlock(hdev);
2036         return err;
2037 }
2038
2039 /* This is a helper function to test for pending mgmt commands that can
2040  * cause CoD or EIR HCI commands. We can only allow one such pending
2041  * mgmt command at a time since otherwise we cannot easily track what
2042  * the current values are, will be, and based on that calculate if a new
2043  * HCI command needs to be sent and if yes with what value.
2044  */
2045 static bool pending_eir_or_class(struct hci_dev *hdev)
2046 {
2047         struct mgmt_pending_cmd *cmd;
2048
2049         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2050                 switch (cmd->opcode) {
2051                 case MGMT_OP_ADD_UUID:
2052                 case MGMT_OP_REMOVE_UUID:
2053                 case MGMT_OP_SET_DEV_CLASS:
2054                 case MGMT_OP_SET_POWERED:
2055                         return true;
2056                 }
2057         }
2058
2059         return false;
2060 }
2061
2062 static const u8 bluetooth_base_uuid[] = {
2063                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2064                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2065 };
2066
2067 static u8 get_uuid_size(const u8 *uuid)
2068 {
2069         u32 val;
2070
2071         if (memcmp(uuid, bluetooth_base_uuid, 12))
2072                 return 128;
2073
2074         val = get_unaligned_le32(&uuid[12]);
2075         if (val > 0xffff)
2076                 return 32;
2077
2078         return 16;
2079 }
2080
2081 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2082 {
2083         struct mgmt_pending_cmd *cmd;
2084
2085         hci_dev_lock(hdev);
2086
2087         cmd = pending_find(mgmt_op, hdev);
2088         if (!cmd)
2089                 goto unlock;
2090
2091         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2092                           mgmt_status(status), hdev->dev_class, 3);
2093
2094         mgmt_pending_remove(cmd);
2095
2096 unlock:
2097         hci_dev_unlock(hdev);
2098 }
2099
2100 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2101 {
2102         bt_dev_dbg(hdev, "status 0x%02x", status);
2103
2104         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2105 }
2106
2107 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2108 {
2109         struct mgmt_cp_add_uuid *cp = data;
2110         struct mgmt_pending_cmd *cmd;
2111         struct hci_request req;
2112         struct bt_uuid *uuid;
2113         int err;
2114
2115         bt_dev_dbg(hdev, "sock %p", sk);
2116
2117         hci_dev_lock(hdev);
2118
2119         if (pending_eir_or_class(hdev)) {
2120                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2121                                       MGMT_STATUS_BUSY);
2122                 goto failed;
2123         }
2124
2125         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2126         if (!uuid) {
2127                 err = -ENOMEM;
2128                 goto failed;
2129         }
2130
2131         memcpy(uuid->uuid, cp->uuid, 16);
2132         uuid->svc_hint = cp->svc_hint;
2133         uuid->size = get_uuid_size(cp->uuid);
2134
2135         list_add_tail(&uuid->list, &hdev->uuids);
2136
2137         hci_req_init(&req, hdev);
2138
2139         __hci_req_update_class(&req);
2140         __hci_req_update_eir(&req);
2141
2142         err = hci_req_run(&req, add_uuid_complete);
2143         if (err < 0) {
2144                 if (err != -ENODATA)
2145                         goto failed;
2146
2147                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2148                                         hdev->dev_class, 3);
2149                 goto failed;
2150         }
2151
2152         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2153         if (!cmd) {
2154                 err = -ENOMEM;
2155                 goto failed;
2156         }
2157
2158         err = 0;
2159
2160 failed:
2161         hci_dev_unlock(hdev);
2162         return err;
2163 }
2164
2165 static bool enable_service_cache(struct hci_dev *hdev)
2166 {
2167         if (!hdev_is_powered(hdev))
2168                 return false;
2169
2170         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2171                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2172                                    CACHE_TIMEOUT);
2173                 return true;
2174         }
2175
2176         return false;
2177 }
2178
2179 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2180 {
2181         bt_dev_dbg(hdev, "status 0x%02x", status);
2182
2183         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2184 }
2185
2186 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2187                        u16 len)
2188 {
2189         struct mgmt_cp_remove_uuid *cp = data;
2190         struct mgmt_pending_cmd *cmd;
2191         struct bt_uuid *match, *tmp;
2192         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2193         struct hci_request req;
2194         int err, found;
2195
2196         bt_dev_dbg(hdev, "sock %p", sk);
2197
2198         hci_dev_lock(hdev);
2199
2200         if (pending_eir_or_class(hdev)) {
2201                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2202                                       MGMT_STATUS_BUSY);
2203                 goto unlock;
2204         }
2205
2206         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2207                 hci_uuids_clear(hdev);
2208
2209                 if (enable_service_cache(hdev)) {
2210                         err = mgmt_cmd_complete(sk, hdev->id,
2211                                                 MGMT_OP_REMOVE_UUID,
2212                                                 0, hdev->dev_class, 3);
2213                         goto unlock;
2214                 }
2215
2216                 goto update_class;
2217         }
2218
2219         found = 0;
2220
2221         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2222                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2223                         continue;
2224
2225                 list_del(&match->list);
2226                 kfree(match);
2227                 found++;
2228         }
2229
2230         if (found == 0) {
2231                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2232                                       MGMT_STATUS_INVALID_PARAMS);
2233                 goto unlock;
2234         }
2235
2236 update_class:
2237         hci_req_init(&req, hdev);
2238
2239         __hci_req_update_class(&req);
2240         __hci_req_update_eir(&req);
2241
2242         err = hci_req_run(&req, remove_uuid_complete);
2243         if (err < 0) {
2244                 if (err != -ENODATA)
2245                         goto unlock;
2246
2247                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2248                                         hdev->dev_class, 3);
2249                 goto unlock;
2250         }
2251
2252         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2253         if (!cmd) {
2254                 err = -ENOMEM;
2255                 goto unlock;
2256         }
2257
2258         err = 0;
2259
2260 unlock:
2261         hci_dev_unlock(hdev);
2262         return err;
2263 }
2264
2265 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2266 {
2267         bt_dev_dbg(hdev, "status 0x%02x", status);
2268
2269         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2270 }
2271
2272 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2273                          u16 len)
2274 {
2275         struct mgmt_cp_set_dev_class *cp = data;
2276         struct mgmt_pending_cmd *cmd;
2277         struct hci_request req;
2278         int err;
2279
2280         bt_dev_dbg(hdev, "sock %p", sk);
2281
2282         if (!lmp_bredr_capable(hdev))
2283                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2284                                        MGMT_STATUS_NOT_SUPPORTED);
2285
2286         hci_dev_lock(hdev);
2287
2288         if (pending_eir_or_class(hdev)) {
2289                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2290                                       MGMT_STATUS_BUSY);
2291                 goto unlock;
2292         }
2293
2294         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2295                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2296                                       MGMT_STATUS_INVALID_PARAMS);
2297                 goto unlock;
2298         }
2299
2300         hdev->major_class = cp->major;
2301         hdev->minor_class = cp->minor;
2302
2303         if (!hdev_is_powered(hdev)) {
2304                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2305                                         hdev->dev_class, 3);
2306                 goto unlock;
2307         }
2308
2309         hci_req_init(&req, hdev);
2310
2311         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2312                 hci_dev_unlock(hdev);
2313                 cancel_delayed_work_sync(&hdev->service_cache);
2314                 hci_dev_lock(hdev);
2315                 __hci_req_update_eir(&req);
2316         }
2317
2318         __hci_req_update_class(&req);
2319
2320         err = hci_req_run(&req, set_class_complete);
2321         if (err < 0) {
2322                 if (err != -ENODATA)
2323                         goto unlock;
2324
2325                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2326                                         hdev->dev_class, 3);
2327                 goto unlock;
2328         }
2329
2330         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2331         if (!cmd) {
2332                 err = -ENOMEM;
2333                 goto unlock;
2334         }
2335
2336         err = 0;
2337
2338 unlock:
2339         hci_dev_unlock(hdev);
2340         return err;
2341 }
2342
2343 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2344                           u16 len)
2345 {
2346         struct mgmt_cp_load_link_keys *cp = data;
2347         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2348                                    sizeof(struct mgmt_link_key_info));
2349         u16 key_count, expected_len;
2350         bool changed;
2351         int i;
2352
2353         bt_dev_dbg(hdev, "sock %p", sk);
2354
2355         if (!lmp_bredr_capable(hdev))
2356                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2357                                        MGMT_STATUS_NOT_SUPPORTED);
2358
2359         key_count = __le16_to_cpu(cp->key_count);
2360         if (key_count > max_key_count) {
2361                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2362                            key_count);
2363                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2364                                        MGMT_STATUS_INVALID_PARAMS);
2365         }
2366
2367         expected_len = struct_size(cp, keys, key_count);
2368         if (expected_len != len) {
2369                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2370                            expected_len, len);
2371                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2372                                        MGMT_STATUS_INVALID_PARAMS);
2373         }
2374
2375         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2376                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2377                                        MGMT_STATUS_INVALID_PARAMS);
2378
2379         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2380                    key_count);
2381
2382         for (i = 0; i < key_count; i++) {
2383                 struct mgmt_link_key_info *key = &cp->keys[i];
2384
2385                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2386                         return mgmt_cmd_status(sk, hdev->id,
2387                                                MGMT_OP_LOAD_LINK_KEYS,
2388                                                MGMT_STATUS_INVALID_PARAMS);
2389         }
2390
2391         hci_dev_lock(hdev);
2392
2393         hci_link_keys_clear(hdev);
2394
2395         if (cp->debug_keys)
2396                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2397         else
2398                 changed = hci_dev_test_and_clear_flag(hdev,
2399                                                       HCI_KEEP_DEBUG_KEYS);
2400
2401         if (changed)
2402                 new_settings(hdev, NULL);
2403
2404         for (i = 0; i < key_count; i++) {
2405                 struct mgmt_link_key_info *key = &cp->keys[i];
2406
2407                 if (hci_is_blocked_key(hdev,
2408                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2409                                        key->val)) {
2410                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2411                                     &key->addr.bdaddr);
2412                         continue;
2413                 }
2414
2415                 /* Always ignore debug keys and require a new pairing if
2416                  * the user wants to use them.
2417                  */
2418                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2419                         continue;
2420
2421                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2422                                  key->type, key->pin_len, NULL);
2423         }
2424
2425         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2426
2427         hci_dev_unlock(hdev);
2428
2429         return 0;
2430 }
2431
2432 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2433                            u8 addr_type, struct sock *skip_sk)
2434 {
2435         struct mgmt_ev_device_unpaired ev;
2436
2437         bacpy(&ev.addr.bdaddr, bdaddr);
2438         ev.addr.type = addr_type;
2439
2440         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2441                           skip_sk);
2442 }
2443
2444 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2445                          u16 len)
2446 {
2447         struct mgmt_cp_unpair_device *cp = data;
2448         struct mgmt_rp_unpair_device rp;
2449         struct hci_conn_params *params;
2450         struct mgmt_pending_cmd *cmd;
2451         struct hci_conn *conn;
2452         u8 addr_type;
2453         int err;
2454
2455         memset(&rp, 0, sizeof(rp));
2456         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2457         rp.addr.type = cp->addr.type;
2458
2459         if (!bdaddr_type_is_valid(cp->addr.type))
2460                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2461                                          MGMT_STATUS_INVALID_PARAMS,
2462                                          &rp, sizeof(rp));
2463
2464         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2465                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2466                                          MGMT_STATUS_INVALID_PARAMS,
2467                                          &rp, sizeof(rp));
2468
2469         hci_dev_lock(hdev);
2470
2471         if (!hdev_is_powered(hdev)) {
2472                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2473                                         MGMT_STATUS_NOT_POWERED, &rp,
2474                                         sizeof(rp));
2475                 goto unlock;
2476         }
2477
2478         if (cp->addr.type == BDADDR_BREDR) {
2479                 /* If disconnection is requested, then look up the
2480                  * connection. If the remote device is connected, it
2481                  * will be later used to terminate the link.
2482                  *
2483                  * Setting it to NULL explicitly will cause no
2484                  * termination of the link.
2485                  */
2486                 if (cp->disconnect)
2487                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2488                                                        &cp->addr.bdaddr);
2489                 else
2490                         conn = NULL;
2491
2492                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2493                 if (err < 0) {
2494                         err = mgmt_cmd_complete(sk, hdev->id,
2495                                                 MGMT_OP_UNPAIR_DEVICE,
2496                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2497                                                 sizeof(rp));
2498                         goto unlock;
2499                 }
2500
2501                 goto done;
2502         }
2503
2504         /* LE address type */
2505         addr_type = le_addr_type(cp->addr.type);
2506
2507         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2508         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2509         if (err < 0) {
2510                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2511                                         MGMT_STATUS_NOT_PAIRED, &rp,
2512                                         sizeof(rp));
2513                 goto unlock;
2514         }
2515
2516         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2517         if (!conn) {
2518                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2519                 goto done;
2520         }
2521
2522
2523         /* Defer clearing up the connection parameters until closing to
2524          * give a chance of keeping them if a repairing happens.
2525          */
2526         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2527
2528         /* Disable auto-connection parameters if present */
2529         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2530         if (params) {
2531                 if (params->explicit_connect)
2532                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2533                 else
2534                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2535         }
2536
2537         /* If disconnection is not requested, then clear the connection
2538          * variable so that the link is not terminated.
2539          */
2540         if (!cp->disconnect)
2541                 conn = NULL;
2542
2543 done:
2544         /* If the connection variable is set, then termination of the
2545          * link is requested.
2546          */
2547         if (!conn) {
2548                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2549                                         &rp, sizeof(rp));
2550                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2551                 goto unlock;
2552         }
2553
2554         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2555                                sizeof(*cp));
2556         if (!cmd) {
2557                 err = -ENOMEM;
2558                 goto unlock;
2559         }
2560
2561         cmd->cmd_complete = addr_cmd_complete;
2562
2563         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2564         if (err < 0)
2565                 mgmt_pending_remove(cmd);
2566
2567 unlock:
2568         hci_dev_unlock(hdev);
2569         return err;
2570 }
2571
2572 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2573                       u16 len)
2574 {
2575         struct mgmt_cp_disconnect *cp = data;
2576         struct mgmt_rp_disconnect rp;
2577         struct mgmt_pending_cmd *cmd;
2578         struct hci_conn *conn;
2579         int err;
2580
2581         bt_dev_dbg(hdev, "sock %p", sk);
2582
2583         memset(&rp, 0, sizeof(rp));
2584         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2585         rp.addr.type = cp->addr.type;
2586
2587         if (!bdaddr_type_is_valid(cp->addr.type))
2588                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2589                                          MGMT_STATUS_INVALID_PARAMS,
2590                                          &rp, sizeof(rp));
2591
2592         hci_dev_lock(hdev);
2593
2594         if (!test_bit(HCI_UP, &hdev->flags)) {
2595                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2596                                         MGMT_STATUS_NOT_POWERED, &rp,
2597                                         sizeof(rp));
2598                 goto failed;
2599         }
2600
2601         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2602                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2603                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2604                 goto failed;
2605         }
2606
2607         if (cp->addr.type == BDADDR_BREDR)
2608                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2609                                                &cp->addr.bdaddr);
2610         else
2611                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2612                                                le_addr_type(cp->addr.type));
2613
2614         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2615                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2616                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2617                                         sizeof(rp));
2618                 goto failed;
2619         }
2620
2621         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2622         if (!cmd) {
2623                 err = -ENOMEM;
2624                 goto failed;
2625         }
2626
2627         cmd->cmd_complete = generic_cmd_complete;
2628
2629         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2630         if (err < 0)
2631                 mgmt_pending_remove(cmd);
2632
2633 failed:
2634         hci_dev_unlock(hdev);
2635         return err;
2636 }
2637
2638 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2639 {
2640         switch (link_type) {
2641         case LE_LINK:
2642                 switch (addr_type) {
2643                 case ADDR_LE_DEV_PUBLIC:
2644                         return BDADDR_LE_PUBLIC;
2645
2646                 default:
2647                         /* Fallback to LE Random address type */
2648                         return BDADDR_LE_RANDOM;
2649                 }
2650
2651         default:
2652                 /* Fallback to BR/EDR type */
2653                 return BDADDR_BREDR;
2654         }
2655 }
2656
2657 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2658                            u16 data_len)
2659 {
2660         struct mgmt_rp_get_connections *rp;
2661         struct hci_conn *c;
2662         int err;
2663         u16 i;
2664
2665         bt_dev_dbg(hdev, "sock %p", sk);
2666
2667         hci_dev_lock(hdev);
2668
2669         if (!hdev_is_powered(hdev)) {
2670                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2671                                       MGMT_STATUS_NOT_POWERED);
2672                 goto unlock;
2673         }
2674
2675         i = 0;
2676         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2677                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2678                         i++;
2679         }
2680
2681         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2682         if (!rp) {
2683                 err = -ENOMEM;
2684                 goto unlock;
2685         }
2686
2687         i = 0;
2688         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2689                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2690                         continue;
2691                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2692                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2693                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2694                         continue;
2695                 i++;
2696         }
2697
2698         rp->conn_count = cpu_to_le16(i);
2699
2700         /* Recalculate length in case of filtered SCO connections, etc */
2701         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2702                                 struct_size(rp, addr, i));
2703
2704         kfree(rp);
2705
2706 unlock:
2707         hci_dev_unlock(hdev);
2708         return err;
2709 }
2710
2711 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2712                                    struct mgmt_cp_pin_code_neg_reply *cp)
2713 {
2714         struct mgmt_pending_cmd *cmd;
2715         int err;
2716
2717         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2718                                sizeof(*cp));
2719         if (!cmd)
2720                 return -ENOMEM;
2721
2722         cmd->cmd_complete = addr_cmd_complete;
2723
2724         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2725                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2726         if (err < 0)
2727                 mgmt_pending_remove(cmd);
2728
2729         return err;
2730 }
2731
2732 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2733                           u16 len)
2734 {
2735         struct hci_conn *conn;
2736         struct mgmt_cp_pin_code_reply *cp = data;
2737         struct hci_cp_pin_code_reply reply;
2738         struct mgmt_pending_cmd *cmd;
2739         int err;
2740
2741         bt_dev_dbg(hdev, "sock %p", sk);
2742
2743         hci_dev_lock(hdev);
2744
2745         if (!hdev_is_powered(hdev)) {
2746                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2747                                       MGMT_STATUS_NOT_POWERED);
2748                 goto failed;
2749         }
2750
2751         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2752         if (!conn) {
2753                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2754                                       MGMT_STATUS_NOT_CONNECTED);
2755                 goto failed;
2756         }
2757
2758         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2759                 struct mgmt_cp_pin_code_neg_reply ncp;
2760
2761                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2762
2763                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2764
2765                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2766                 if (err >= 0)
2767                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2768                                               MGMT_STATUS_INVALID_PARAMS);
2769
2770                 goto failed;
2771         }
2772
2773         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2774         if (!cmd) {
2775                 err = -ENOMEM;
2776                 goto failed;
2777         }
2778
2779         cmd->cmd_complete = addr_cmd_complete;
2780
2781         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2782         reply.pin_len = cp->pin_len;
2783         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2784
2785         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2786         if (err < 0)
2787                 mgmt_pending_remove(cmd);
2788
2789 failed:
2790         hci_dev_unlock(hdev);
2791         return err;
2792 }
2793
2794 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2795                              u16 len)
2796 {
2797         struct mgmt_cp_set_io_capability *cp = data;
2798
2799         bt_dev_dbg(hdev, "sock %p", sk);
2800
2801         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2802                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2803                                        MGMT_STATUS_INVALID_PARAMS);
2804
2805         hci_dev_lock(hdev);
2806
2807         hdev->io_capability = cp->io_capability;
2808
2809         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
2810
2811         hci_dev_unlock(hdev);
2812
2813         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2814                                  NULL, 0);
2815 }
2816
2817 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2818 {
2819         struct hci_dev *hdev = conn->hdev;
2820         struct mgmt_pending_cmd *cmd;
2821
2822         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2823                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2824                         continue;
2825
2826                 if (cmd->user_data != conn)
2827                         continue;
2828
2829                 return cmd;
2830         }
2831
2832         return NULL;
2833 }
2834
2835 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2836 {
2837         struct mgmt_rp_pair_device rp;
2838         struct hci_conn *conn = cmd->user_data;
2839         int err;
2840
2841         bacpy(&rp.addr.bdaddr, &conn->dst);
2842         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2843
2844         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2845                                 status, &rp, sizeof(rp));
2846
2847         /* So we don't get further callbacks for this connection */
2848         conn->connect_cfm_cb = NULL;
2849         conn->security_cfm_cb = NULL;
2850         conn->disconn_cfm_cb = NULL;
2851
2852         hci_conn_drop(conn);
2853
2854         /* The device is paired so there is no need to remove
2855          * its connection parameters anymore.
2856          */
2857         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2858
2859         hci_conn_put(conn);
2860
2861         return err;
2862 }
2863
2864 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2865 {
2866         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2867         struct mgmt_pending_cmd *cmd;
2868
2869         cmd = find_pairing(conn);
2870         if (cmd) {
2871                 cmd->cmd_complete(cmd, status);
2872                 mgmt_pending_remove(cmd);
2873         }
2874 }
2875
2876 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2877 {
2878         struct mgmt_pending_cmd *cmd;
2879
2880         BT_DBG("status %u", status);
2881
2882         cmd = find_pairing(conn);
2883         if (!cmd) {
2884                 BT_DBG("Unable to find a pending command");
2885                 return;
2886         }
2887
2888         cmd->cmd_complete(cmd, mgmt_status(status));
2889         mgmt_pending_remove(cmd);
2890 }
2891
2892 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2893 {
2894         struct mgmt_pending_cmd *cmd;
2895
2896         BT_DBG("status %u", status);
2897
2898         if (!status)
2899                 return;
2900
2901         cmd = find_pairing(conn);
2902         if (!cmd) {
2903                 BT_DBG("Unable to find a pending command");
2904                 return;
2905         }
2906
2907         cmd->cmd_complete(cmd, mgmt_status(status));
2908         mgmt_pending_remove(cmd);
2909 }
2910
2911 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2912                        u16 len)
2913 {
2914         struct mgmt_cp_pair_device *cp = data;
2915         struct mgmt_rp_pair_device rp;
2916         struct mgmt_pending_cmd *cmd;
2917         u8 sec_level, auth_type;
2918         struct hci_conn *conn;
2919         int err;
2920
2921         bt_dev_dbg(hdev, "sock %p", sk);
2922
2923         memset(&rp, 0, sizeof(rp));
2924         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2925         rp.addr.type = cp->addr.type;
2926
2927         if (!bdaddr_type_is_valid(cp->addr.type))
2928                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2929                                          MGMT_STATUS_INVALID_PARAMS,
2930                                          &rp, sizeof(rp));
2931
2932         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2933                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2934                                          MGMT_STATUS_INVALID_PARAMS,
2935                                          &rp, sizeof(rp));
2936
2937         hci_dev_lock(hdev);
2938
2939         if (!hdev_is_powered(hdev)) {
2940                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2941                                         MGMT_STATUS_NOT_POWERED, &rp,
2942                                         sizeof(rp));
2943                 goto unlock;
2944         }
2945
2946         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2947                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2948                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2949                                         sizeof(rp));
2950                 goto unlock;
2951         }
2952
2953         sec_level = BT_SECURITY_MEDIUM;
2954         auth_type = HCI_AT_DEDICATED_BONDING;
2955
2956         if (cp->addr.type == BDADDR_BREDR) {
2957                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2958                                        auth_type, CONN_REASON_PAIR_DEVICE);
2959         } else {
2960                 u8 addr_type = le_addr_type(cp->addr.type);
2961                 struct hci_conn_params *p;
2962
2963                 /* When pairing a new device, it is expected to remember
2964                  * this device for future connections. Adding the connection
2965                  * parameter information ahead of time allows tracking
2966                  * of the peripheral preferred values and will speed up any
2967                  * further connection establishment.
2968                  *
2969                  * If connection parameters already exist, then they
2970                  * will be kept and this function does nothing.
2971                  */
2972                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2973
2974                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2975                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2976
2977                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
2978                                            sec_level, HCI_LE_CONN_TIMEOUT,
2979                                            CONN_REASON_PAIR_DEVICE);
2980         }
2981
2982         if (IS_ERR(conn)) {
2983                 int status;
2984
2985                 if (PTR_ERR(conn) == -EBUSY)
2986                         status = MGMT_STATUS_BUSY;
2987                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2988                         status = MGMT_STATUS_NOT_SUPPORTED;
2989                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2990                         status = MGMT_STATUS_REJECTED;
2991                 else
2992                         status = MGMT_STATUS_CONNECT_FAILED;
2993
2994                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2995                                         status, &rp, sizeof(rp));
2996                 goto unlock;
2997         }
2998
2999         if (conn->connect_cfm_cb) {
3000                 hci_conn_drop(conn);
3001                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3002                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3003                 goto unlock;
3004         }
3005
3006         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3007         if (!cmd) {
3008                 err = -ENOMEM;
3009                 hci_conn_drop(conn);
3010                 goto unlock;
3011         }
3012
3013         cmd->cmd_complete = pairing_complete;
3014
3015         /* For LE, just connecting isn't a proof that the pairing finished */
3016         if (cp->addr.type == BDADDR_BREDR) {
3017                 conn->connect_cfm_cb = pairing_complete_cb;
3018                 conn->security_cfm_cb = pairing_complete_cb;
3019                 conn->disconn_cfm_cb = pairing_complete_cb;
3020         } else {
3021                 conn->connect_cfm_cb = le_pairing_complete_cb;
3022                 conn->security_cfm_cb = le_pairing_complete_cb;
3023                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3024         }
3025
3026         conn->io_capability = cp->io_cap;
3027         cmd->user_data = hci_conn_get(conn);
3028
3029         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3030             hci_conn_security(conn, sec_level, auth_type, true)) {
3031                 cmd->cmd_complete(cmd, 0);
3032                 mgmt_pending_remove(cmd);
3033         }
3034
3035         err = 0;
3036
3037 unlock:
3038         hci_dev_unlock(hdev);
3039         return err;
3040 }
3041
3042 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3043                               u16 len)
3044 {
3045         struct mgmt_addr_info *addr = data;
3046         struct mgmt_pending_cmd *cmd;
3047         struct hci_conn *conn;
3048         int err;
3049
3050         bt_dev_dbg(hdev, "sock %p", sk);
3051
3052         hci_dev_lock(hdev);
3053
3054         if (!hdev_is_powered(hdev)) {
3055                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3056                                       MGMT_STATUS_NOT_POWERED);
3057                 goto unlock;
3058         }
3059
3060         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3061         if (!cmd) {
3062                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3063                                       MGMT_STATUS_INVALID_PARAMS);
3064                 goto unlock;
3065         }
3066
3067         conn = cmd->user_data;
3068
3069         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3070                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3071                                       MGMT_STATUS_INVALID_PARAMS);
3072                 goto unlock;
3073         }
3074
3075         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3076         mgmt_pending_remove(cmd);
3077
3078         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3079                                 addr, sizeof(*addr));
3080
3081         /* Since user doesn't want to proceed with the connection, abort any
3082          * ongoing pairing and then terminate the link if it was created
3083          * because of the pair device action.
3084          */
3085         if (addr->type == BDADDR_BREDR)
3086                 hci_remove_link_key(hdev, &addr->bdaddr);
3087         else
3088                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3089                                               le_addr_type(addr->type));
3090
3091         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3092                 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3093
3094 unlock:
3095         hci_dev_unlock(hdev);
3096         return err;
3097 }
3098
3099 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3100                              struct mgmt_addr_info *addr, u16 mgmt_op,
3101                              u16 hci_op, __le32 passkey)
3102 {
3103         struct mgmt_pending_cmd *cmd;
3104         struct hci_conn *conn;
3105         int err;
3106
3107         hci_dev_lock(hdev);
3108
3109         if (!hdev_is_powered(hdev)) {
3110                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3111                                         MGMT_STATUS_NOT_POWERED, addr,
3112                                         sizeof(*addr));
3113                 goto done;
3114         }
3115
3116         if (addr->type == BDADDR_BREDR)
3117                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3118         else
3119                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3120                                                le_addr_type(addr->type));
3121
3122         if (!conn) {
3123                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3124                                         MGMT_STATUS_NOT_CONNECTED, addr,
3125                                         sizeof(*addr));
3126                 goto done;
3127         }
3128
3129         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3130                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3131                 if (!err)
3132                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3133                                                 MGMT_STATUS_SUCCESS, addr,
3134                                                 sizeof(*addr));
3135                 else
3136                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3137                                                 MGMT_STATUS_FAILED, addr,
3138                                                 sizeof(*addr));
3139
3140                 goto done;
3141         }
3142
3143         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3144         if (!cmd) {
3145                 err = -ENOMEM;
3146                 goto done;
3147         }
3148
3149         cmd->cmd_complete = addr_cmd_complete;
3150
3151         /* Continue with pairing via HCI */
3152         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3153                 struct hci_cp_user_passkey_reply cp;
3154
3155                 bacpy(&cp.bdaddr, &addr->bdaddr);
3156                 cp.passkey = passkey;
3157                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3158         } else
3159                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3160                                    &addr->bdaddr);
3161
3162         if (err < 0)
3163                 mgmt_pending_remove(cmd);
3164
3165 done:
3166         hci_dev_unlock(hdev);
3167         return err;
3168 }
3169
3170 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3171                               void *data, u16 len)
3172 {
3173         struct mgmt_cp_pin_code_neg_reply *cp = data;
3174
3175         bt_dev_dbg(hdev, "sock %p", sk);
3176
3177         return user_pairing_resp(sk, hdev, &cp->addr,
3178                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3179                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3180 }
3181
3182 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3183                               u16 len)
3184 {
3185         struct mgmt_cp_user_confirm_reply *cp = data;
3186
3187         bt_dev_dbg(hdev, "sock %p", sk);
3188
3189         if (len != sizeof(*cp))
3190                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3191                                        MGMT_STATUS_INVALID_PARAMS);
3192
3193         return user_pairing_resp(sk, hdev, &cp->addr,
3194                                  MGMT_OP_USER_CONFIRM_REPLY,
3195                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3196 }
3197
3198 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3199                                   void *data, u16 len)
3200 {
3201         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3202
3203         bt_dev_dbg(hdev, "sock %p", sk);
3204
3205         return user_pairing_resp(sk, hdev, &cp->addr,
3206                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3207                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3208 }
3209
3210 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3211                               u16 len)
3212 {
3213         struct mgmt_cp_user_passkey_reply *cp = data;
3214
3215         bt_dev_dbg(hdev, "sock %p", sk);
3216
3217         return user_pairing_resp(sk, hdev, &cp->addr,
3218                                  MGMT_OP_USER_PASSKEY_REPLY,
3219                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3220 }
3221
3222 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3223                                   void *data, u16 len)
3224 {
3225         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3226
3227         bt_dev_dbg(hdev, "sock %p", sk);
3228
3229         return user_pairing_resp(sk, hdev, &cp->addr,
3230                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3231                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3232 }
3233
3234 static void adv_expire(struct hci_dev *hdev, u32 flags)
3235 {
3236         struct adv_info *adv_instance;
3237         struct hci_request req;
3238         int err;
3239
3240         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3241         if (!adv_instance)
3242                 return;
3243
3244         /* stop if current instance doesn't need to be changed */
3245         if (!(adv_instance->flags & flags))
3246                 return;
3247
3248         cancel_adv_timeout(hdev);
3249
3250         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3251         if (!adv_instance)
3252                 return;
3253
3254         hci_req_init(&req, hdev);
3255         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3256                                               true);
3257         if (err)
3258                 return;
3259
3260         hci_req_run(&req, NULL);
3261 }
3262
3263 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3264 {
3265         struct mgmt_cp_set_local_name *cp;
3266         struct mgmt_pending_cmd *cmd;
3267
3268         bt_dev_dbg(hdev, "status 0x%02x", status);
3269
3270         hci_dev_lock(hdev);
3271
3272         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3273         if (!cmd)
3274                 goto unlock;
3275
3276         cp = cmd->param;
3277
3278         if (status) {
3279                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3280                                 mgmt_status(status));
3281         } else {
3282                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3283                                   cp, sizeof(*cp));
3284
3285                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3286                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3287         }
3288
3289         mgmt_pending_remove(cmd);
3290
3291 unlock:
3292         hci_dev_unlock(hdev);
3293 }
3294
3295 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3296                           u16 len)
3297 {
3298         struct mgmt_cp_set_local_name *cp = data;
3299         struct mgmt_pending_cmd *cmd;
3300         struct hci_request req;
3301         int err;
3302
3303         bt_dev_dbg(hdev, "sock %p", sk);
3304
3305         hci_dev_lock(hdev);
3306
3307         /* If the old values are the same as the new ones just return a
3308          * direct command complete event.
3309          */
3310         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3311             !memcmp(hdev->short_name, cp->short_name,
3312                     sizeof(hdev->short_name))) {
3313                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3314                                         data, len);
3315                 goto failed;
3316         }
3317
3318         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3319
3320         if (!hdev_is_powered(hdev)) {
3321                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3322
3323                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3324                                         data, len);
3325                 if (err < 0)
3326                         goto failed;
3327
3328                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3329                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3330                 ext_info_changed(hdev, sk);
3331
3332                 goto failed;
3333         }
3334
3335         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3336         if (!cmd) {
3337                 err = -ENOMEM;
3338                 goto failed;
3339         }
3340
3341         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3342
3343         hci_req_init(&req, hdev);
3344
3345         if (lmp_bredr_capable(hdev)) {
3346                 __hci_req_update_name(&req);
3347                 __hci_req_update_eir(&req);
3348         }
3349
3350         /* The name is stored in the scan response data and so
3351          * no need to update the advertising data here.
3352          */
3353         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3354                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3355
3356         err = hci_req_run(&req, set_name_complete);
3357         if (err < 0)
3358                 mgmt_pending_remove(cmd);
3359
3360 failed:
3361         hci_dev_unlock(hdev);
3362         return err;
3363 }
3364
3365 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3366                           u16 len)
3367 {
3368         struct mgmt_cp_set_appearance *cp = data;
3369         u16 appearance;
3370         int err;
3371
3372         bt_dev_dbg(hdev, "sock %p", sk);
3373
3374         if (!lmp_le_capable(hdev))
3375                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3376                                        MGMT_STATUS_NOT_SUPPORTED);
3377
3378         appearance = le16_to_cpu(cp->appearance);
3379
3380         hci_dev_lock(hdev);
3381
3382         if (hdev->appearance != appearance) {
3383                 hdev->appearance = appearance;
3384
3385                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3386                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3387
3388                 ext_info_changed(hdev, sk);
3389         }
3390
3391         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3392                                 0);
3393
3394         hci_dev_unlock(hdev);
3395
3396         return err;
3397 }
3398
3399 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3400                                  void *data, u16 len)
3401 {
3402         struct mgmt_rp_get_phy_configuration rp;
3403
3404         bt_dev_dbg(hdev, "sock %p", sk);
3405
3406         hci_dev_lock(hdev);
3407
3408         memset(&rp, 0, sizeof(rp));
3409
3410         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3411         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3412         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3413
3414         hci_dev_unlock(hdev);
3415
3416         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3417                                  &rp, sizeof(rp));
3418 }
3419
3420 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3421 {
3422         struct mgmt_ev_phy_configuration_changed ev;
3423
3424         memset(&ev, 0, sizeof(ev));
3425
3426         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3427
3428         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3429                           sizeof(ev), skip);
3430 }
3431
3432 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3433                                      u16 opcode, struct sk_buff *skb)
3434 {
3435         struct mgmt_pending_cmd *cmd;
3436
3437         bt_dev_dbg(hdev, "status 0x%02x", status);
3438
3439         hci_dev_lock(hdev);
3440
3441         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3442         if (!cmd)
3443                 goto unlock;
3444
3445         if (status) {
3446                 mgmt_cmd_status(cmd->sk, hdev->id,
3447                                 MGMT_OP_SET_PHY_CONFIGURATION,
3448                                 mgmt_status(status));
3449         } else {
3450                 mgmt_cmd_complete(cmd->sk, hdev->id,
3451                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3452                                   NULL, 0);
3453
3454                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3455         }
3456
3457         mgmt_pending_remove(cmd);
3458
3459 unlock:
3460         hci_dev_unlock(hdev);
3461 }
3462
3463 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3464                                  void *data, u16 len)
3465 {
3466         struct mgmt_cp_set_phy_configuration *cp = data;
3467         struct hci_cp_le_set_default_phy cp_phy;
3468         struct mgmt_pending_cmd *cmd;
3469         struct hci_request req;
3470         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3471         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3472         bool changed = false;
3473         int err;
3474
3475         bt_dev_dbg(hdev, "sock %p", sk);
3476
3477         configurable_phys = get_configurable_phys(hdev);
3478         supported_phys = get_supported_phys(hdev);
3479         selected_phys = __le32_to_cpu(cp->selected_phys);
3480
3481         if (selected_phys & ~supported_phys)
3482                 return mgmt_cmd_status(sk, hdev->id,
3483                                        MGMT_OP_SET_PHY_CONFIGURATION,
3484                                        MGMT_STATUS_INVALID_PARAMS);
3485
3486         unconfigure_phys = supported_phys & ~configurable_phys;
3487
3488         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3489                 return mgmt_cmd_status(sk, hdev->id,
3490                                        MGMT_OP_SET_PHY_CONFIGURATION,
3491                                        MGMT_STATUS_INVALID_PARAMS);
3492
3493         if (selected_phys == get_selected_phys(hdev))
3494                 return mgmt_cmd_complete(sk, hdev->id,
3495                                          MGMT_OP_SET_PHY_CONFIGURATION,
3496                                          0, NULL, 0);
3497
3498         hci_dev_lock(hdev);
3499
3500         if (!hdev_is_powered(hdev)) {
3501                 err = mgmt_cmd_status(sk, hdev->id,
3502                                       MGMT_OP_SET_PHY_CONFIGURATION,
3503                                       MGMT_STATUS_REJECTED);
3504                 goto unlock;
3505         }
3506
3507         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3508                 err = mgmt_cmd_status(sk, hdev->id,
3509                                       MGMT_OP_SET_PHY_CONFIGURATION,
3510                                       MGMT_STATUS_BUSY);
3511                 goto unlock;
3512         }
3513
3514         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3515                 pkt_type |= (HCI_DH3 | HCI_DM3);
3516         else
3517                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3518
3519         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3520                 pkt_type |= (HCI_DH5 | HCI_DM5);
3521         else
3522                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3523
3524         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3525                 pkt_type &= ~HCI_2DH1;
3526         else
3527                 pkt_type |= HCI_2DH1;
3528
3529         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3530                 pkt_type &= ~HCI_2DH3;
3531         else
3532                 pkt_type |= HCI_2DH3;
3533
3534         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3535                 pkt_type &= ~HCI_2DH5;
3536         else
3537                 pkt_type |= HCI_2DH5;
3538
3539         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3540                 pkt_type &= ~HCI_3DH1;
3541         else
3542                 pkt_type |= HCI_3DH1;
3543
3544         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3545                 pkt_type &= ~HCI_3DH3;
3546         else
3547                 pkt_type |= HCI_3DH3;
3548
3549         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3550                 pkt_type &= ~HCI_3DH5;
3551         else
3552                 pkt_type |= HCI_3DH5;
3553
3554         if (pkt_type != hdev->pkt_type) {
3555                 hdev->pkt_type = pkt_type;
3556                 changed = true;
3557         }
3558
3559         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3560             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3561                 if (changed)
3562                         mgmt_phy_configuration_changed(hdev, sk);
3563
3564                 err = mgmt_cmd_complete(sk, hdev->id,
3565                                         MGMT_OP_SET_PHY_CONFIGURATION,
3566                                         0, NULL, 0);
3567
3568                 goto unlock;
3569         }
3570
3571         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3572                                len);
3573         if (!cmd) {
3574                 err = -ENOMEM;
3575                 goto unlock;
3576         }
3577
3578         hci_req_init(&req, hdev);
3579
3580         memset(&cp_phy, 0, sizeof(cp_phy));
3581
3582         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3583                 cp_phy.all_phys |= 0x01;
3584
3585         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3586                 cp_phy.all_phys |= 0x02;
3587
3588         if (selected_phys & MGMT_PHY_LE_1M_TX)
3589                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3590
3591         if (selected_phys & MGMT_PHY_LE_2M_TX)
3592                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3593
3594         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3595                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3596
3597         if (selected_phys & MGMT_PHY_LE_1M_RX)
3598                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3599
3600         if (selected_phys & MGMT_PHY_LE_2M_RX)
3601                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3602
3603         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3604                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3605
3606         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3607
3608         err = hci_req_run_skb(&req, set_default_phy_complete);
3609         if (err < 0)
3610                 mgmt_pending_remove(cmd);
3611
3612 unlock:
3613         hci_dev_unlock(hdev);
3614
3615         return err;
3616 }
3617
3618 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3619                             u16 len)
3620 {
3621         int err = MGMT_STATUS_SUCCESS;
3622         struct mgmt_cp_set_blocked_keys *keys = data;
3623         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
3624                                    sizeof(struct mgmt_blocked_key_info));
3625         u16 key_count, expected_len;
3626         int i;
3627
3628         bt_dev_dbg(hdev, "sock %p", sk);
3629
3630         key_count = __le16_to_cpu(keys->key_count);
3631         if (key_count > max_key_count) {
3632                 bt_dev_err(hdev, "too big key_count value %u", key_count);
3633                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3634                                        MGMT_STATUS_INVALID_PARAMS);
3635         }
3636
3637         expected_len = struct_size(keys, keys, key_count);
3638         if (expected_len != len) {
3639                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
3640                            expected_len, len);
3641                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3642                                        MGMT_STATUS_INVALID_PARAMS);
3643         }
3644
3645         hci_dev_lock(hdev);
3646
3647         hci_blocked_keys_clear(hdev);
3648
3649         for (i = 0; i < keys->key_count; ++i) {
3650                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
3651
3652                 if (!b) {
3653                         err = MGMT_STATUS_NO_RESOURCES;
3654                         break;
3655                 }
3656
3657                 b->type = keys->keys[i].type;
3658                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
3659                 list_add_rcu(&b->list, &hdev->blocked_keys);
3660         }
3661         hci_dev_unlock(hdev);
3662
3663         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3664                                 err, NULL, 0);
3665 }
3666
3667 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
3668                                void *data, u16 len)
3669 {
3670         struct mgmt_mode *cp = data;
3671         int err;
3672         bool changed = false;
3673
3674         bt_dev_dbg(hdev, "sock %p", sk);
3675
3676         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
3677                 return mgmt_cmd_status(sk, hdev->id,
3678                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3679                                        MGMT_STATUS_NOT_SUPPORTED);
3680
3681         if (cp->val != 0x00 && cp->val != 0x01)
3682                 return mgmt_cmd_status(sk, hdev->id,
3683                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3684                                        MGMT_STATUS_INVALID_PARAMS);
3685
3686         hci_dev_lock(hdev);
3687
3688         if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) {
3689                 err = mgmt_cmd_status(sk, hdev->id,
3690                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3691                                       MGMT_STATUS_BUSY);
3692                 goto unlock;
3693         }
3694
3695         if (hdev_is_powered(hdev) &&
3696             !!cp->val != hci_dev_test_flag(hdev,
3697                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
3698                 err = mgmt_cmd_status(sk, hdev->id,
3699                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3700                                       MGMT_STATUS_REJECTED);
3701                 goto unlock;
3702         }
3703
3704         if (cp->val)
3705                 changed = !hci_dev_test_and_set_flag(hdev,
3706                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3707         else
3708                 changed = hci_dev_test_and_clear_flag(hdev,
3709                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3710
3711         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
3712         if (err < 0)
3713                 goto unlock;
3714
3715         if (changed)
3716                 err = new_settings(hdev, sk);
3717
3718 unlock:
3719         hci_dev_unlock(hdev);
3720         return err;
3721 }
3722
3723 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
3724                                void *data, u16 data_len)
3725 {
3726         char buf[20];
3727         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
3728         u16 cap_len = 0;
3729         u8 flags = 0;
3730         u8 tx_power_range[2];
3731
3732         bt_dev_dbg(hdev, "sock %p", sk);
3733
3734         memset(&buf, 0, sizeof(buf));
3735
3736         hci_dev_lock(hdev);
3737
3738         /* When the Read Simple Pairing Options command is supported, then
3739          * the remote public key validation is supported.
3740          *
3741          * Alternatively, when Microsoft extensions are available, they can
3742          * indicate support for public key validation as well.
3743          */
3744         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
3745                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
3746
3747         flags |= 0x02;          /* Remote public key validation (LE) */
3748
3749         /* When the Read Encryption Key Size command is supported, then the
3750          * encryption key size is enforced.
3751          */
3752         if (hdev->commands[20] & 0x10)
3753                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
3754
3755         flags |= 0x08;          /* Encryption key size enforcement (LE) */
3756
3757         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
3758                                   &flags, 1);
3759
3760         /* When the Read Simple Pairing Options command is supported, then
3761          * also max encryption key size information is provided.
3762          */
3763         if (hdev->commands[41] & 0x08)
3764                 cap_len = eir_append_le16(rp->cap, cap_len,
3765                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
3766                                           hdev->max_enc_key_size);
3767
3768         cap_len = eir_append_le16(rp->cap, cap_len,
3769                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
3770                                   SMP_MAX_ENC_KEY_SIZE);
3771
3772         /* Append the min/max LE tx power parameters if we were able to fetch
3773          * it from the controller
3774          */
3775         if (hdev->commands[38] & 0x80) {
3776                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
3777                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
3778                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
3779                                           tx_power_range, 2);
3780         }
3781
3782         rp->cap_len = cpu_to_le16(cap_len);
3783
3784         hci_dev_unlock(hdev);
3785
3786         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
3787                                  rp, sizeof(*rp) + cap_len);
3788 }
3789
3790 #ifdef CONFIG_BT_FEATURE_DEBUG
3791 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
3792 static const u8 debug_uuid[16] = {
3793         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
3794         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
3795 };
3796 #endif
3797
3798 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
3799 static const u8 simult_central_periph_uuid[16] = {
3800         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
3801         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
3802 };
3803
3804 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
3805 static const u8 rpa_resolution_uuid[16] = {
3806         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
3807         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
3808 };
3809
3810 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
3811                                   void *data, u16 data_len)
3812 {
3813         char buf[62];   /* Enough space for 3 features */
3814         struct mgmt_rp_read_exp_features_info *rp = (void *)buf;
3815         u16 idx = 0;
3816         u32 flags;
3817
3818         bt_dev_dbg(hdev, "sock %p", sk);
3819
3820         memset(&buf, 0, sizeof(buf));
3821
3822 #ifdef CONFIG_BT_FEATURE_DEBUG
3823         if (!hdev) {
3824                 flags = bt_dbg_get() ? BIT(0) : 0;
3825
3826                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
3827                 rp->features[idx].flags = cpu_to_le32(flags);
3828                 idx++;
3829         }
3830 #endif
3831
3832         if (hdev) {
3833                 if (test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) &&
3834                     (hdev->le_states[4] & 0x08) &&      /* Central */
3835                     (hdev->le_states[4] & 0x40) &&      /* Peripheral */
3836                     (hdev->le_states[3] & 0x10))        /* Simultaneous */
3837                         flags = BIT(0);
3838                 else
3839                         flags = 0;
3840
3841                 memcpy(rp->features[idx].uuid, simult_central_periph_uuid, 16);
3842                 rp->features[idx].flags = cpu_to_le32(flags);
3843                 idx++;
3844         }
3845
3846         if (hdev && use_ll_privacy(hdev)) {
3847                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
3848                         flags = BIT(0) | BIT(1);
3849                 else
3850                         flags = BIT(1);
3851
3852                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
3853                 rp->features[idx].flags = cpu_to_le32(flags);
3854                 idx++;
3855         }
3856
3857         rp->feature_count = cpu_to_le16(idx);
3858
3859         /* After reading the experimental features information, enable
3860          * the events to update client on any future change.
3861          */
3862         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3863
3864         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3865                                  MGMT_OP_READ_EXP_FEATURES_INFO,
3866                                  0, rp, sizeof(*rp) + (20 * idx));
3867 }
3868
3869 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
3870                                           struct sock *skip)
3871 {
3872         struct mgmt_ev_exp_feature_changed ev;
3873
3874         memset(&ev, 0, sizeof(ev));
3875         memcpy(ev.uuid, rpa_resolution_uuid, 16);
3876         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
3877
3878         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
3879                                   &ev, sizeof(ev),
3880                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3881
3882 }
3883
3884 #ifdef CONFIG_BT_FEATURE_DEBUG
3885 static int exp_debug_feature_changed(bool enabled, struct sock *skip)
3886 {
3887         struct mgmt_ev_exp_feature_changed ev;
3888
3889         memset(&ev, 0, sizeof(ev));
3890         memcpy(ev.uuid, debug_uuid, 16);
3891         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
3892
3893         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL,
3894                                   &ev, sizeof(ev),
3895                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3896 }
3897 #endif
3898
3899 #define EXP_FEAT(_uuid, _set_func)      \
3900 {                                       \
3901         .uuid = _uuid,                  \
3902         .set_func = _set_func,          \
3903 }
3904
3905 /* The zero key uuid is special. Multiple exp features are set through it. */
3906 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
3907                              struct mgmt_cp_set_exp_feature *cp, u16 data_len)
3908 {
3909         struct mgmt_rp_set_exp_feature rp;
3910
3911         memset(rp.uuid, 0, 16);
3912         rp.flags = cpu_to_le32(0);
3913
3914 #ifdef CONFIG_BT_FEATURE_DEBUG
3915         if (!hdev) {
3916                 bool changed = bt_dbg_get();
3917
3918                 bt_dbg_set(false);
3919
3920                 if (changed)
3921                         exp_debug_feature_changed(false, sk);
3922         }
3923 #endif
3924
3925         if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
3926                 bool changed;
3927
3928                 changed = hci_dev_test_and_clear_flag(hdev,
3929                                                       HCI_ENABLE_LL_PRIVACY);
3930                 if (changed)
3931                         exp_ll_privacy_feature_changed(false, hdev, sk);
3932         }
3933
3934         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3935
3936         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3937                                  MGMT_OP_SET_EXP_FEATURE, 0,
3938                                  &rp, sizeof(rp));
3939 }
3940
3941 #ifdef CONFIG_BT_FEATURE_DEBUG
3942 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
3943                           struct mgmt_cp_set_exp_feature *cp, u16 data_len)
3944 {
3945         struct mgmt_rp_set_exp_feature rp;
3946
3947         bool val, changed;
3948         int err;
3949
3950         /* Command requires to use the non-controller index */
3951         if (hdev)
3952                 return mgmt_cmd_status(sk, hdev->id,
3953                                        MGMT_OP_SET_EXP_FEATURE,
3954                                        MGMT_STATUS_INVALID_INDEX);
3955
3956         /* Parameters are limited to a single octet */
3957         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3958                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3959                                        MGMT_OP_SET_EXP_FEATURE,
3960                                        MGMT_STATUS_INVALID_PARAMS);
3961
3962         /* Only boolean on/off is supported */
3963         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3964                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3965                                        MGMT_OP_SET_EXP_FEATURE,
3966                                        MGMT_STATUS_INVALID_PARAMS);
3967
3968         val = !!cp->param[0];
3969         changed = val ? !bt_dbg_get() : bt_dbg_get();
3970         bt_dbg_set(val);
3971
3972         memcpy(rp.uuid, debug_uuid, 16);
3973         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
3974
3975         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3976
3977         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
3978                                 MGMT_OP_SET_EXP_FEATURE, 0,
3979                                 &rp, sizeof(rp));
3980
3981         if (changed)
3982                 exp_debug_feature_changed(val, sk);
3983
3984         return err;
3985 }
3986 #endif
3987
3988 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev,
3989                                    struct mgmt_cp_set_exp_feature *cp,
3990                                    u16 data_len)
3991 {
3992         struct mgmt_rp_set_exp_feature rp;
3993         bool val, changed;
3994         int err;
3995         u32 flags;
3996
3997         /* Command requires to use the controller index */
3998         if (!hdev)
3999                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4000                                        MGMT_OP_SET_EXP_FEATURE,
4001                                        MGMT_STATUS_INVALID_INDEX);
4002
4003         /* Changes can only be made when controller is powered down */
4004         if (hdev_is_powered(hdev))
4005                 return mgmt_cmd_status(sk, hdev->id,
4006                                        MGMT_OP_SET_EXP_FEATURE,
4007                                        MGMT_STATUS_REJECTED);
4008
4009         /* Parameters are limited to a single octet */
4010         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4011                 return mgmt_cmd_status(sk, hdev->id,
4012                                        MGMT_OP_SET_EXP_FEATURE,
4013                                        MGMT_STATUS_INVALID_PARAMS);
4014
4015         /* Only boolean on/off is supported */
4016         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4017                 return mgmt_cmd_status(sk, hdev->id,
4018                                        MGMT_OP_SET_EXP_FEATURE,
4019                                        MGMT_STATUS_INVALID_PARAMS);
4020
4021         val = !!cp->param[0];
4022
4023         if (val) {
4024                 changed = !hci_dev_test_and_set_flag(hdev,
4025                                                      HCI_ENABLE_LL_PRIVACY);
4026                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4027
4028                 /* Enable LL privacy + supported settings changed */
4029                 flags = BIT(0) | BIT(1);
4030         } else {
4031                 changed = hci_dev_test_and_clear_flag(hdev,
4032                                                       HCI_ENABLE_LL_PRIVACY);
4033
4034                 /* Disable LL privacy + supported settings changed */
4035                 flags = BIT(1);
4036         }
4037
4038         memcpy(rp.uuid, rpa_resolution_uuid, 16);
4039         rp.flags = cpu_to_le32(flags);
4040
4041         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4042
4043         err = mgmt_cmd_complete(sk, hdev->id,
4044                                 MGMT_OP_SET_EXP_FEATURE, 0,
4045                                 &rp, sizeof(rp));
4046
4047         if (changed)
4048                 exp_ll_privacy_feature_changed(val, hdev, sk);
4049
4050         return err;
4051 }
4052
4053 static const struct mgmt_exp_feature {
4054         const u8 *uuid;
4055         int (*set_func)(struct sock *sk, struct hci_dev *hdev,
4056                         struct mgmt_cp_set_exp_feature *cp, u16 data_len);
4057 } exp_features[] = {
4058         EXP_FEAT(ZERO_KEY, set_zero_key_func),
4059 #ifdef CONFIG_BT_FEATURE_DEBUG
4060         EXP_FEAT(debug_uuid, set_debug_func),
4061 #endif
4062         EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func),
4063
4064         /* end with a null feature */
4065         EXP_FEAT(NULL, NULL)
4066 };
4067
4068 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
4069                            void *data, u16 data_len)
4070 {
4071         struct mgmt_cp_set_exp_feature *cp = data;
4072         size_t i = 0;
4073
4074         bt_dev_dbg(hdev, "sock %p", sk);
4075
4076         for (i = 0; exp_features[i].uuid; i++) {
4077                 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
4078                         return exp_features[i].set_func(sk, hdev, cp, data_len);
4079         }
4080
4081         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4082                                MGMT_OP_SET_EXP_FEATURE,
4083                                MGMT_STATUS_NOT_SUPPORTED);
4084 }
4085
4086 #define SUPPORTED_DEVICE_FLAGS() ((1U << HCI_CONN_FLAG_MAX) - 1)
4087
4088 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4089                             u16 data_len)
4090 {
4091         struct mgmt_cp_get_device_flags *cp = data;
4092         struct mgmt_rp_get_device_flags rp;
4093         struct bdaddr_list_with_flags *br_params;
4094         struct hci_conn_params *params;
4095         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4096         u32 current_flags = 0;
4097         u8 status = MGMT_STATUS_INVALID_PARAMS;
4098
4099         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
4100                    &cp->addr.bdaddr, cp->addr.type);
4101
4102         hci_dev_lock(hdev);
4103
4104         memset(&rp, 0, sizeof(rp));
4105
4106         if (cp->addr.type == BDADDR_BREDR) {
4107                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4108                                                               &cp->addr.bdaddr,
4109                                                               cp->addr.type);
4110                 if (!br_params)
4111                         goto done;
4112
4113                 current_flags = br_params->current_flags;
4114         } else {
4115                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4116                                                 le_addr_type(cp->addr.type));
4117
4118                 if (!params)
4119                         goto done;
4120
4121                 current_flags = params->current_flags;
4122         }
4123
4124         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4125         rp.addr.type = cp->addr.type;
4126         rp.supported_flags = cpu_to_le32(supported_flags);
4127         rp.current_flags = cpu_to_le32(current_flags);
4128
4129         status = MGMT_STATUS_SUCCESS;
4130
4131 done:
4132         hci_dev_unlock(hdev);
4133
4134         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
4135                                 &rp, sizeof(rp));
4136 }
4137
4138 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
4139                                  bdaddr_t *bdaddr, u8 bdaddr_type,
4140                                  u32 supported_flags, u32 current_flags)
4141 {
4142         struct mgmt_ev_device_flags_changed ev;
4143
4144         bacpy(&ev.addr.bdaddr, bdaddr);
4145         ev.addr.type = bdaddr_type;
4146         ev.supported_flags = cpu_to_le32(supported_flags);
4147         ev.current_flags = cpu_to_le32(current_flags);
4148
4149         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
4150 }
4151
4152 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4153                             u16 len)
4154 {
4155         struct mgmt_cp_set_device_flags *cp = data;
4156         struct bdaddr_list_with_flags *br_params;
4157         struct hci_conn_params *params;
4158         u8 status = MGMT_STATUS_INVALID_PARAMS;
4159         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4160         u32 current_flags = __le32_to_cpu(cp->current_flags);
4161
4162         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
4163                    &cp->addr.bdaddr, cp->addr.type,
4164                    __le32_to_cpu(current_flags));
4165
4166         if ((supported_flags | current_flags) != supported_flags) {
4167                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
4168                             current_flags, supported_flags);
4169                 goto done;
4170         }
4171
4172         hci_dev_lock(hdev);
4173
4174         if (cp->addr.type == BDADDR_BREDR) {
4175                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4176                                                               &cp->addr.bdaddr,
4177                                                               cp->addr.type);
4178
4179                 if (br_params) {
4180                         br_params->current_flags = current_flags;
4181                         status = MGMT_STATUS_SUCCESS;
4182                 } else {
4183                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
4184                                     &cp->addr.bdaddr, cp->addr.type);
4185                 }
4186         } else {
4187                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4188                                                 le_addr_type(cp->addr.type));
4189                 if (params) {
4190                         params->current_flags = current_flags;
4191                         status = MGMT_STATUS_SUCCESS;
4192                 } else {
4193                         bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
4194                                     &cp->addr.bdaddr,
4195                                     le_addr_type(cp->addr.type));
4196                 }
4197         }
4198
4199 done:
4200         hci_dev_unlock(hdev);
4201
4202         if (status == MGMT_STATUS_SUCCESS)
4203                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
4204                                      supported_flags, current_flags);
4205
4206         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
4207                                  &cp->addr, sizeof(cp->addr));
4208 }
4209
4210 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
4211                                    u16 handle)
4212 {
4213         struct mgmt_ev_adv_monitor_added ev;
4214
4215         ev.monitor_handle = cpu_to_le16(handle);
4216
4217         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
4218 }
4219
4220 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
4221 {
4222         struct mgmt_ev_adv_monitor_removed ev;
4223         struct mgmt_pending_cmd *cmd;
4224         struct sock *sk_skip = NULL;
4225         struct mgmt_cp_remove_adv_monitor *cp;
4226
4227         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4228         if (cmd) {
4229                 cp = cmd->param;
4230
4231                 if (cp->monitor_handle)
4232                         sk_skip = cmd->sk;
4233         }
4234
4235         ev.monitor_handle = cpu_to_le16(handle);
4236
4237         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
4238 }
4239
4240 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
4241                                  void *data, u16 len)
4242 {
4243         struct adv_monitor *monitor = NULL;
4244         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
4245         int handle, err;
4246         size_t rp_size = 0;
4247         __u32 supported = 0;
4248         __u32 enabled = 0;
4249         __u16 num_handles = 0;
4250         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
4251
4252         BT_DBG("request for %s", hdev->name);
4253
4254         hci_dev_lock(hdev);
4255
4256         if (msft_monitor_supported(hdev))
4257                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
4258
4259         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
4260                 handles[num_handles++] = monitor->handle;
4261
4262         hci_dev_unlock(hdev);
4263
4264         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
4265         rp = kmalloc(rp_size, GFP_KERNEL);
4266         if (!rp)
4267                 return -ENOMEM;
4268
4269         /* All supported features are currently enabled */
4270         enabled = supported;
4271
4272         rp->supported_features = cpu_to_le32(supported);
4273         rp->enabled_features = cpu_to_le32(enabled);
4274         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
4275         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
4276         rp->num_handles = cpu_to_le16(num_handles);
4277         if (num_handles)
4278                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
4279
4280         err = mgmt_cmd_complete(sk, hdev->id,
4281                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
4282                                 MGMT_STATUS_SUCCESS, rp, rp_size);
4283
4284         kfree(rp);
4285
4286         return err;
4287 }
4288
4289 int mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status)
4290 {
4291         struct mgmt_rp_add_adv_patterns_monitor rp;
4292         struct mgmt_pending_cmd *cmd;
4293         struct adv_monitor *monitor;
4294         int err = 0;
4295
4296         hci_dev_lock(hdev);
4297
4298         cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev);
4299         if (!cmd) {
4300                 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev);
4301                 if (!cmd)
4302                         goto done;
4303         }
4304
4305         monitor = cmd->user_data;
4306         rp.monitor_handle = cpu_to_le16(monitor->handle);
4307
4308         if (!status) {
4309                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
4310                 hdev->adv_monitors_cnt++;
4311                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
4312                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
4313                 hci_update_background_scan(hdev);
4314         }
4315
4316         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4317                                 mgmt_status(status), &rp, sizeof(rp));
4318         mgmt_pending_remove(cmd);
4319
4320 done:
4321         hci_dev_unlock(hdev);
4322         bt_dev_dbg(hdev, "add monitor %d complete, status %u",
4323                    rp.monitor_handle, status);
4324
4325         return err;
4326 }
4327
4328 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4329                                       struct adv_monitor *m, u8 status,
4330                                       void *data, u16 len, u16 op)
4331 {
4332         struct mgmt_rp_add_adv_patterns_monitor rp;
4333         struct mgmt_pending_cmd *cmd;
4334         int err;
4335         bool pending;
4336
4337         hci_dev_lock(hdev);
4338
4339         if (status)
4340                 goto unlock;
4341
4342         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4343             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4344             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
4345             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
4346                 status = MGMT_STATUS_BUSY;
4347                 goto unlock;
4348         }
4349
4350         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4351         if (!cmd) {
4352                 status = MGMT_STATUS_NO_RESOURCES;
4353                 goto unlock;
4354         }
4355
4356         cmd->user_data = m;
4357         pending = hci_add_adv_monitor(hdev, m, &err);
4358         if (err) {
4359                 if (err == -ENOSPC || err == -ENOMEM)
4360                         status = MGMT_STATUS_NO_RESOURCES;
4361                 else if (err == -EINVAL)
4362                         status = MGMT_STATUS_INVALID_PARAMS;
4363                 else
4364                         status = MGMT_STATUS_FAILED;
4365
4366                 mgmt_pending_remove(cmd);
4367                 goto unlock;
4368         }
4369
4370         if (!pending) {
4371                 mgmt_pending_remove(cmd);
4372                 rp.monitor_handle = cpu_to_le16(m->handle);
4373                 mgmt_adv_monitor_added(sk, hdev, m->handle);
4374                 m->state = ADV_MONITOR_STATE_REGISTERED;
4375                 hdev->adv_monitors_cnt++;
4376
4377                 hci_dev_unlock(hdev);
4378                 return mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_SUCCESS,
4379                                          &rp, sizeof(rp));
4380         }
4381
4382         hci_dev_unlock(hdev);
4383
4384         return 0;
4385
4386 unlock:
4387         hci_free_adv_monitor(hdev, m);
4388         hci_dev_unlock(hdev);
4389         return mgmt_cmd_status(sk, hdev->id, op, status);
4390 }
4391
4392 static void parse_adv_monitor_rssi(struct adv_monitor *m,
4393                                    struct mgmt_adv_rssi_thresholds *rssi)
4394 {
4395         if (rssi) {
4396                 m->rssi.low_threshold = rssi->low_threshold;
4397                 m->rssi.low_threshold_timeout =
4398                     __le16_to_cpu(rssi->low_threshold_timeout);
4399                 m->rssi.high_threshold = rssi->high_threshold;
4400                 m->rssi.high_threshold_timeout =
4401                     __le16_to_cpu(rssi->high_threshold_timeout);
4402                 m->rssi.sampling_period = rssi->sampling_period;
4403         } else {
4404                 /* Default values. These numbers are the least constricting
4405                  * parameters for MSFT API to work, so it behaves as if there
4406                  * are no rssi parameter to consider. May need to be changed
4407                  * if other API are to be supported.
4408                  */
4409                 m->rssi.low_threshold = -127;
4410                 m->rssi.low_threshold_timeout = 60;
4411                 m->rssi.high_threshold = -127;
4412                 m->rssi.high_threshold_timeout = 0;
4413                 m->rssi.sampling_period = 0;
4414         }
4415 }
4416
4417 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
4418                                     struct mgmt_adv_pattern *patterns)
4419 {
4420         u8 offset = 0, length = 0;
4421         struct adv_pattern *p = NULL;
4422         int i;
4423
4424         for (i = 0; i < pattern_count; i++) {
4425                 offset = patterns[i].offset;
4426                 length = patterns[i].length;
4427                 if (offset >= HCI_MAX_AD_LENGTH ||
4428                     length > HCI_MAX_AD_LENGTH ||
4429                     (offset + length) > HCI_MAX_AD_LENGTH)
4430                         return MGMT_STATUS_INVALID_PARAMS;
4431
4432                 p = kmalloc(sizeof(*p), GFP_KERNEL);
4433                 if (!p)
4434                         return MGMT_STATUS_NO_RESOURCES;
4435
4436                 p->ad_type = patterns[i].ad_type;
4437                 p->offset = patterns[i].offset;
4438                 p->length = patterns[i].length;
4439                 memcpy(p->value, patterns[i].value, p->length);
4440
4441                 INIT_LIST_HEAD(&p->list);
4442                 list_add(&p->list, &m->patterns);
4443         }
4444
4445         return MGMT_STATUS_SUCCESS;
4446 }
4447
4448 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4449                                     void *data, u16 len)
4450 {
4451         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
4452         struct adv_monitor *m = NULL;
4453         u8 status = MGMT_STATUS_SUCCESS;
4454         size_t expected_size = sizeof(*cp);
4455
4456         BT_DBG("request for %s", hdev->name);
4457
4458         if (len <= sizeof(*cp)) {
4459                 status = MGMT_STATUS_INVALID_PARAMS;
4460                 goto done;
4461         }
4462
4463         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4464         if (len != expected_size) {
4465                 status = MGMT_STATUS_INVALID_PARAMS;
4466                 goto done;
4467         }
4468
4469         m = kzalloc(sizeof(*m), GFP_KERNEL);
4470         if (!m) {
4471                 status = MGMT_STATUS_NO_RESOURCES;
4472                 goto done;
4473         }
4474
4475         INIT_LIST_HEAD(&m->patterns);
4476
4477         parse_adv_monitor_rssi(m, NULL);
4478         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4479
4480 done:
4481         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4482                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
4483 }
4484
4485 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
4486                                          void *data, u16 len)
4487 {
4488         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
4489         struct adv_monitor *m = NULL;
4490         u8 status = MGMT_STATUS_SUCCESS;
4491         size_t expected_size = sizeof(*cp);
4492
4493         BT_DBG("request for %s", hdev->name);
4494
4495         if (len <= sizeof(*cp)) {
4496                 status = MGMT_STATUS_INVALID_PARAMS;
4497                 goto done;
4498         }
4499
4500         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4501         if (len != expected_size) {
4502                 status = MGMT_STATUS_INVALID_PARAMS;
4503                 goto done;
4504         }
4505
4506         m = kzalloc(sizeof(*m), GFP_KERNEL);
4507         if (!m) {
4508                 status = MGMT_STATUS_NO_RESOURCES;
4509                 goto done;
4510         }
4511
4512         INIT_LIST_HEAD(&m->patterns);
4513
4514         parse_adv_monitor_rssi(m, &cp->rssi);
4515         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4516
4517 done:
4518         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4519                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
4520 }
4521
4522 int mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status)
4523 {
4524         struct mgmt_rp_remove_adv_monitor rp;
4525         struct mgmt_cp_remove_adv_monitor *cp;
4526         struct mgmt_pending_cmd *cmd;
4527         int err = 0;
4528
4529         hci_dev_lock(hdev);
4530
4531         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4532         if (!cmd)
4533                 goto done;
4534
4535         cp = cmd->param;
4536         rp.monitor_handle = cp->monitor_handle;
4537
4538         if (!status)
4539                 hci_update_background_scan(hdev);
4540
4541         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4542                                 mgmt_status(status), &rp, sizeof(rp));
4543         mgmt_pending_remove(cmd);
4544
4545 done:
4546         hci_dev_unlock(hdev);
4547         bt_dev_dbg(hdev, "remove monitor %d complete, status %u",
4548                    rp.monitor_handle, status);
4549
4550         return err;
4551 }
4552
4553 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
4554                               void *data, u16 len)
4555 {
4556         struct mgmt_cp_remove_adv_monitor *cp = data;
4557         struct mgmt_rp_remove_adv_monitor rp;
4558         struct mgmt_pending_cmd *cmd;
4559         u16 handle = __le16_to_cpu(cp->monitor_handle);
4560         int err, status;
4561         bool pending;
4562
4563         BT_DBG("request for %s", hdev->name);
4564         rp.monitor_handle = cp->monitor_handle;
4565
4566         hci_dev_lock(hdev);
4567
4568         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4569             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
4570             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4571             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
4572                 status = MGMT_STATUS_BUSY;
4573                 goto unlock;
4574         }
4575
4576         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
4577         if (!cmd) {
4578                 status = MGMT_STATUS_NO_RESOURCES;
4579                 goto unlock;
4580         }
4581
4582         if (handle)
4583                 pending = hci_remove_single_adv_monitor(hdev, handle, &err);
4584         else
4585                 pending = hci_remove_all_adv_monitor(hdev, &err);
4586
4587         if (err) {
4588                 mgmt_pending_remove(cmd);
4589
4590                 if (err == -ENOENT)
4591                         status = MGMT_STATUS_INVALID_INDEX;
4592                 else
4593                         status = MGMT_STATUS_FAILED;
4594
4595                 goto unlock;
4596         }
4597
4598         /* monitor can be removed without forwarding request to controller */
4599         if (!pending) {
4600                 mgmt_pending_remove(cmd);
4601                 hci_dev_unlock(hdev);
4602
4603                 return mgmt_cmd_complete(sk, hdev->id,
4604                                          MGMT_OP_REMOVE_ADV_MONITOR,
4605                                          MGMT_STATUS_SUCCESS,
4606                                          &rp, sizeof(rp));
4607         }
4608
4609         hci_dev_unlock(hdev);
4610         return 0;
4611
4612 unlock:
4613         hci_dev_unlock(hdev);
4614         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4615                                status);
4616 }
4617
4618 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
4619                                          u16 opcode, struct sk_buff *skb)
4620 {
4621         struct mgmt_rp_read_local_oob_data mgmt_rp;
4622         size_t rp_size = sizeof(mgmt_rp);
4623         struct mgmt_pending_cmd *cmd;
4624
4625         bt_dev_dbg(hdev, "status %u", status);
4626
4627         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4628         if (!cmd)
4629                 return;
4630
4631         if (status || !skb) {
4632                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4633                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
4634                 goto remove;
4635         }
4636
4637         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
4638
4639         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
4640                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
4641
4642                 if (skb->len < sizeof(*rp)) {
4643                         mgmt_cmd_status(cmd->sk, hdev->id,
4644                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4645                                         MGMT_STATUS_FAILED);
4646                         goto remove;
4647                 }
4648
4649                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
4650                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
4651
4652                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
4653         } else {
4654                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
4655
4656                 if (skb->len < sizeof(*rp)) {
4657                         mgmt_cmd_status(cmd->sk, hdev->id,
4658                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4659                                         MGMT_STATUS_FAILED);
4660                         goto remove;
4661                 }
4662
4663                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
4664                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
4665
4666                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
4667                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
4668         }
4669
4670         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4671                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
4672
4673 remove:
4674         mgmt_pending_remove(cmd);
4675 }
4676
4677 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
4678                                void *data, u16 data_len)
4679 {
4680         struct mgmt_pending_cmd *cmd;
4681         struct hci_request req;
4682         int err;
4683
4684         bt_dev_dbg(hdev, "sock %p", sk);
4685
4686         hci_dev_lock(hdev);
4687
4688         if (!hdev_is_powered(hdev)) {
4689                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4690                                       MGMT_STATUS_NOT_POWERED);
4691                 goto unlock;
4692         }
4693
4694         if (!lmp_ssp_capable(hdev)) {
4695                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4696                                       MGMT_STATUS_NOT_SUPPORTED);
4697                 goto unlock;
4698         }
4699
4700         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
4701                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4702                                       MGMT_STATUS_BUSY);
4703                 goto unlock;
4704         }
4705
4706         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
4707         if (!cmd) {
4708                 err = -ENOMEM;
4709                 goto unlock;
4710         }
4711
4712         hci_req_init(&req, hdev);
4713
4714         if (bredr_sc_enabled(hdev))
4715                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4716         else
4717                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4718
4719         err = hci_req_run_skb(&req, read_local_oob_data_complete);
4720         if (err < 0)
4721                 mgmt_pending_remove(cmd);
4722
4723 unlock:
4724         hci_dev_unlock(hdev);
4725         return err;
4726 }
4727
4728 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4729                                void *data, u16 len)
4730 {
4731         struct mgmt_addr_info *addr = data;
4732         int err;
4733
4734         bt_dev_dbg(hdev, "sock %p", sk);
4735
4736         if (!bdaddr_type_is_valid(addr->type))
4737                 return mgmt_cmd_complete(sk, hdev->id,
4738                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
4739                                          MGMT_STATUS_INVALID_PARAMS,
4740                                          addr, sizeof(*addr));
4741
4742         hci_dev_lock(hdev);
4743
4744         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4745                 struct mgmt_cp_add_remote_oob_data *cp = data;
4746                 u8 status;
4747
4748                 if (cp->addr.type != BDADDR_BREDR) {
4749                         err = mgmt_cmd_complete(sk, hdev->id,
4750                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
4751                                                 MGMT_STATUS_INVALID_PARAMS,
4752                                                 &cp->addr, sizeof(cp->addr));
4753                         goto unlock;
4754                 }
4755
4756                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4757                                               cp->addr.type, cp->hash,
4758                                               cp->rand, NULL, NULL);
4759                 if (err < 0)
4760                         status = MGMT_STATUS_FAILED;
4761                 else
4762                         status = MGMT_STATUS_SUCCESS;
4763
4764                 err = mgmt_cmd_complete(sk, hdev->id,
4765                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4766                                         &cp->addr, sizeof(cp->addr));
4767         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4768                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
4769                 u8 *rand192, *hash192, *rand256, *hash256;
4770                 u8 status;
4771
4772                 if (bdaddr_type_is_le(cp->addr.type)) {
4773                         /* Enforce zero-valued 192-bit parameters as
4774                          * long as legacy SMP OOB isn't implemented.
4775                          */
4776                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4777                             memcmp(cp->hash192, ZERO_KEY, 16)) {
4778                                 err = mgmt_cmd_complete(sk, hdev->id,
4779                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4780                                                         MGMT_STATUS_INVALID_PARAMS,
4781                                                         addr, sizeof(*addr));
4782                                 goto unlock;
4783                         }
4784
4785                         rand192 = NULL;
4786                         hash192 = NULL;
4787                 } else {
4788                         /* In case one of the P-192 values is set to zero,
4789                          * then just disable OOB data for P-192.
4790                          */
4791                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4792                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
4793                                 rand192 = NULL;
4794                                 hash192 = NULL;
4795                         } else {
4796                                 rand192 = cp->rand192;
4797                                 hash192 = cp->hash192;
4798                         }
4799                 }
4800
4801                 /* In case one of the P-256 values is set to zero, then just
4802                  * disable OOB data for P-256.
4803                  */
4804                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4805                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
4806                         rand256 = NULL;
4807                         hash256 = NULL;
4808                 } else {
4809                         rand256 = cp->rand256;
4810                         hash256 = cp->hash256;
4811                 }
4812
4813                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4814                                               cp->addr.type, hash192, rand192,
4815                                               hash256, rand256);
4816                 if (err < 0)
4817                         status = MGMT_STATUS_FAILED;
4818                 else
4819                         status = MGMT_STATUS_SUCCESS;
4820
4821                 err = mgmt_cmd_complete(sk, hdev->id,
4822                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4823                                         status, &cp->addr, sizeof(cp->addr));
4824         } else {
4825                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
4826                            len);
4827                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4828                                       MGMT_STATUS_INVALID_PARAMS);
4829         }
4830
4831 unlock:
4832         hci_dev_unlock(hdev);
4833         return err;
4834 }
4835
4836 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4837                                   void *data, u16 len)
4838 {
4839         struct mgmt_cp_remove_remote_oob_data *cp = data;
4840         u8 status;
4841         int err;
4842
4843         bt_dev_dbg(hdev, "sock %p", sk);
4844
4845         if (cp->addr.type != BDADDR_BREDR)
4846                 return mgmt_cmd_complete(sk, hdev->id,
4847                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4848                                          MGMT_STATUS_INVALID_PARAMS,
4849                                          &cp->addr, sizeof(cp->addr));
4850
4851         hci_dev_lock(hdev);
4852
4853         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4854                 hci_remote_oob_data_clear(hdev);
4855                 status = MGMT_STATUS_SUCCESS;
4856                 goto done;
4857         }
4858
4859         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
4860         if (err < 0)
4861                 status = MGMT_STATUS_INVALID_PARAMS;
4862         else
4863                 status = MGMT_STATUS_SUCCESS;
4864
4865 done:
4866         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4867                                 status, &cp->addr, sizeof(cp->addr));
4868
4869         hci_dev_unlock(hdev);
4870         return err;
4871 }
4872
4873 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
4874 {
4875         struct mgmt_pending_cmd *cmd;
4876
4877         bt_dev_dbg(hdev, "status %u", status);
4878
4879         hci_dev_lock(hdev);
4880
4881         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4882         if (!cmd)
4883                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4884
4885         if (!cmd)
4886                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
4887
4888         if (cmd) {
4889                 cmd->cmd_complete(cmd, mgmt_status(status));
4890                 mgmt_pending_remove(cmd);
4891         }
4892
4893         hci_dev_unlock(hdev);
4894
4895         /* Handle suspend notifier */
4896         if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY,
4897                                hdev->suspend_tasks)) {
4898                 bt_dev_dbg(hdev, "Unpaused discovery");
4899                 wake_up(&hdev->suspend_wait_q);
4900         }
4901 }
4902
4903 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
4904                                     uint8_t *mgmt_status)
4905 {
4906         switch (type) {
4907         case DISCOV_TYPE_LE:
4908                 *mgmt_status = mgmt_le_support(hdev);
4909                 if (*mgmt_status)
4910                         return false;
4911                 break;
4912         case DISCOV_TYPE_INTERLEAVED:
4913                 *mgmt_status = mgmt_le_support(hdev);
4914                 if (*mgmt_status)
4915                         return false;
4916                 fallthrough;
4917         case DISCOV_TYPE_BREDR:
4918                 *mgmt_status = mgmt_bredr_support(hdev);
4919                 if (*mgmt_status)
4920                         return false;
4921                 break;
4922         default:
4923                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
4924                 return false;
4925         }
4926
4927         return true;
4928 }
4929
4930 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
4931                                     u16 op, void *data, u16 len)
4932 {
4933         struct mgmt_cp_start_discovery *cp = data;
4934         struct mgmt_pending_cmd *cmd;
4935         u8 status;
4936         int err;
4937
4938         bt_dev_dbg(hdev, "sock %p", sk);
4939
4940         hci_dev_lock(hdev);
4941
4942         if (!hdev_is_powered(hdev)) {
4943                 err = mgmt_cmd_complete(sk, hdev->id, op,
4944                                         MGMT_STATUS_NOT_POWERED,
4945                                         &cp->type, sizeof(cp->type));
4946                 goto failed;
4947         }
4948
4949         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4950             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4951                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4952                                         &cp->type, sizeof(cp->type));
4953                 goto failed;
4954         }
4955
4956         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4957                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
4958                                         &cp->type, sizeof(cp->type));
4959                 goto failed;
4960         }
4961
4962         /* Can't start discovery when it is paused */
4963         if (hdev->discovery_paused) {
4964                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4965                                         &cp->type, sizeof(cp->type));
4966                 goto failed;
4967         }
4968
4969         /* Clear the discovery filter first to free any previously
4970          * allocated memory for the UUID list.
4971          */
4972         hci_discovery_filter_clear(hdev);
4973
4974         hdev->discovery.type = cp->type;
4975         hdev->discovery.report_invalid_rssi = false;
4976         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
4977                 hdev->discovery.limited = true;
4978         else
4979                 hdev->discovery.limited = false;
4980
4981         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4982         if (!cmd) {
4983                 err = -ENOMEM;
4984                 goto failed;
4985         }
4986
4987         cmd->cmd_complete = generic_cmd_complete;
4988
4989         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4990         queue_work(hdev->req_workqueue, &hdev->discov_update);
4991         err = 0;
4992
4993 failed:
4994         hci_dev_unlock(hdev);
4995         return err;
4996 }
4997
4998 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4999                            void *data, u16 len)
5000 {
5001         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
5002                                         data, len);
5003 }
5004
5005 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
5006                                    void *data, u16 len)
5007 {
5008         return start_discovery_internal(sk, hdev,
5009                                         MGMT_OP_START_LIMITED_DISCOVERY,
5010                                         data, len);
5011 }
5012
5013 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
5014                                           u8 status)
5015 {
5016         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
5017                                  cmd->param, 1);
5018 }
5019
5020 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
5021                                    void *data, u16 len)
5022 {
5023         struct mgmt_cp_start_service_discovery *cp = data;
5024         struct mgmt_pending_cmd *cmd;
5025         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
5026         u16 uuid_count, expected_len;
5027         u8 status;
5028         int err;
5029
5030         bt_dev_dbg(hdev, "sock %p", sk);
5031
5032         hci_dev_lock(hdev);
5033
5034         if (!hdev_is_powered(hdev)) {
5035                 err = mgmt_cmd_complete(sk, hdev->id,
5036                                         MGMT_OP_START_SERVICE_DISCOVERY,
5037                                         MGMT_STATUS_NOT_POWERED,
5038                                         &cp->type, sizeof(cp->type));
5039                 goto failed;
5040         }
5041
5042         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5043             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5044                 err = mgmt_cmd_complete(sk, hdev->id,
5045                                         MGMT_OP_START_SERVICE_DISCOVERY,
5046                                         MGMT_STATUS_BUSY, &cp->type,
5047                                         sizeof(cp->type));
5048                 goto failed;
5049         }
5050
5051         if (hdev->discovery_paused) {
5052                 err = mgmt_cmd_complete(sk, hdev->id,
5053                                         MGMT_OP_START_SERVICE_DISCOVERY,
5054                                         MGMT_STATUS_BUSY, &cp->type,
5055                                         sizeof(cp->type));
5056                 goto failed;
5057         }
5058
5059         uuid_count = __le16_to_cpu(cp->uuid_count);
5060         if (uuid_count > max_uuid_count) {
5061                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
5062                            uuid_count);
5063                 err = mgmt_cmd_complete(sk, hdev->id,
5064                                         MGMT_OP_START_SERVICE_DISCOVERY,
5065                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5066                                         sizeof(cp->type));
5067                 goto failed;
5068         }
5069
5070         expected_len = sizeof(*cp) + uuid_count * 16;
5071         if (expected_len != len) {
5072                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
5073                            expected_len, len);
5074                 err = mgmt_cmd_complete(sk, hdev->id,
5075                                         MGMT_OP_START_SERVICE_DISCOVERY,
5076                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5077                                         sizeof(cp->type));
5078                 goto failed;
5079         }
5080
5081         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5082                 err = mgmt_cmd_complete(sk, hdev->id,
5083                                         MGMT_OP_START_SERVICE_DISCOVERY,
5084                                         status, &cp->type, sizeof(cp->type));
5085                 goto failed;
5086         }
5087
5088         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
5089                                hdev, data, len);
5090         if (!cmd) {
5091                 err = -ENOMEM;
5092                 goto failed;
5093         }
5094
5095         cmd->cmd_complete = service_discovery_cmd_complete;
5096
5097         /* Clear the discovery filter first to free any previously
5098          * allocated memory for the UUID list.
5099          */
5100         hci_discovery_filter_clear(hdev);
5101
5102         hdev->discovery.result_filtering = true;
5103         hdev->discovery.type = cp->type;
5104         hdev->discovery.rssi = cp->rssi;
5105         hdev->discovery.uuid_count = uuid_count;
5106
5107         if (uuid_count > 0) {
5108                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
5109                                                 GFP_KERNEL);
5110                 if (!hdev->discovery.uuids) {
5111                         err = mgmt_cmd_complete(sk, hdev->id,
5112                                                 MGMT_OP_START_SERVICE_DISCOVERY,
5113                                                 MGMT_STATUS_FAILED,
5114                                                 &cp->type, sizeof(cp->type));
5115                         mgmt_pending_remove(cmd);
5116                         goto failed;
5117                 }
5118         }
5119
5120         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5121         queue_work(hdev->req_workqueue, &hdev->discov_update);
5122         err = 0;
5123
5124 failed:
5125         hci_dev_unlock(hdev);
5126         return err;
5127 }
5128
5129 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
5130 {
5131         struct mgmt_pending_cmd *cmd;
5132
5133         bt_dev_dbg(hdev, "status %u", status);
5134
5135         hci_dev_lock(hdev);
5136
5137         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
5138         if (cmd) {
5139                 cmd->cmd_complete(cmd, mgmt_status(status));
5140                 mgmt_pending_remove(cmd);
5141         }
5142
5143         hci_dev_unlock(hdev);
5144
5145         /* Handle suspend notifier */
5146         if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) {
5147                 bt_dev_dbg(hdev, "Paused discovery");
5148                 wake_up(&hdev->suspend_wait_q);
5149         }
5150 }
5151
5152 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
5153                           u16 len)
5154 {
5155         struct mgmt_cp_stop_discovery *mgmt_cp = data;
5156         struct mgmt_pending_cmd *cmd;
5157         int err;
5158
5159         bt_dev_dbg(hdev, "sock %p", sk);
5160
5161         hci_dev_lock(hdev);
5162
5163         if (!hci_discovery_active(hdev)) {
5164                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5165                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
5166                                         sizeof(mgmt_cp->type));
5167                 goto unlock;
5168         }
5169
5170         if (hdev->discovery.type != mgmt_cp->type) {
5171                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5172                                         MGMT_STATUS_INVALID_PARAMS,
5173                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
5174                 goto unlock;
5175         }
5176
5177         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
5178         if (!cmd) {
5179                 err = -ENOMEM;
5180                 goto unlock;
5181         }
5182
5183         cmd->cmd_complete = generic_cmd_complete;
5184
5185         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
5186         queue_work(hdev->req_workqueue, &hdev->discov_update);
5187         err = 0;
5188
5189 unlock:
5190         hci_dev_unlock(hdev);
5191         return err;
5192 }
5193
5194 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
5195                         u16 len)
5196 {
5197         struct mgmt_cp_confirm_name *cp = data;
5198         struct inquiry_entry *e;
5199         int err;
5200
5201         bt_dev_dbg(hdev, "sock %p", sk);
5202
5203         hci_dev_lock(hdev);
5204
5205         if (!hci_discovery_active(hdev)) {
5206                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5207                                         MGMT_STATUS_FAILED, &cp->addr,
5208                                         sizeof(cp->addr));
5209                 goto failed;
5210         }
5211
5212         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
5213         if (!e) {
5214                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5215                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
5216                                         sizeof(cp->addr));
5217                 goto failed;
5218         }
5219
5220         if (cp->name_known) {
5221                 e->name_state = NAME_KNOWN;
5222                 list_del(&e->list);
5223         } else {
5224                 e->name_state = NAME_NEEDED;
5225                 hci_inquiry_cache_update_resolve(hdev, e);
5226         }
5227
5228         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
5229                                 &cp->addr, sizeof(cp->addr));
5230
5231 failed:
5232         hci_dev_unlock(hdev);
5233         return err;
5234 }
5235
5236 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
5237                         u16 len)
5238 {
5239         struct mgmt_cp_block_device *cp = data;
5240         u8 status;
5241         int err;
5242
5243         bt_dev_dbg(hdev, "sock %p", sk);
5244
5245         if (!bdaddr_type_is_valid(cp->addr.type))
5246                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
5247                                          MGMT_STATUS_INVALID_PARAMS,
5248                                          &cp->addr, sizeof(cp->addr));
5249
5250         hci_dev_lock(hdev);
5251
5252         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
5253                                   cp->addr.type);
5254         if (err < 0) {
5255                 status = MGMT_STATUS_FAILED;
5256                 goto done;
5257         }
5258
5259         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5260                    sk);
5261         status = MGMT_STATUS_SUCCESS;
5262
5263 done:
5264         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
5265                                 &cp->addr, sizeof(cp->addr));
5266
5267         hci_dev_unlock(hdev);
5268
5269         return err;
5270 }
5271
5272 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
5273                           u16 len)
5274 {
5275         struct mgmt_cp_unblock_device *cp = data;
5276         u8 status;
5277         int err;
5278
5279         bt_dev_dbg(hdev, "sock %p", sk);
5280
5281         if (!bdaddr_type_is_valid(cp->addr.type))
5282                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
5283                                          MGMT_STATUS_INVALID_PARAMS,
5284                                          &cp->addr, sizeof(cp->addr));
5285
5286         hci_dev_lock(hdev);
5287
5288         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
5289                                   cp->addr.type);
5290         if (err < 0) {
5291                 status = MGMT_STATUS_INVALID_PARAMS;
5292                 goto done;
5293         }
5294
5295         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5296                    sk);
5297         status = MGMT_STATUS_SUCCESS;
5298
5299 done:
5300         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
5301                                 &cp->addr, sizeof(cp->addr));
5302
5303         hci_dev_unlock(hdev);
5304
5305         return err;
5306 }
5307
5308 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
5309                          u16 len)
5310 {
5311         struct mgmt_cp_set_device_id *cp = data;
5312         struct hci_request req;
5313         int err;
5314         __u16 source;
5315
5316         bt_dev_dbg(hdev, "sock %p", sk);
5317
5318         source = __le16_to_cpu(cp->source);
5319
5320         if (source > 0x0002)
5321                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
5322                                        MGMT_STATUS_INVALID_PARAMS);
5323
5324         hci_dev_lock(hdev);
5325
5326         hdev->devid_source = source;
5327         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
5328         hdev->devid_product = __le16_to_cpu(cp->product);
5329         hdev->devid_version = __le16_to_cpu(cp->version);
5330
5331         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
5332                                 NULL, 0);
5333
5334         hci_req_init(&req, hdev);
5335         __hci_req_update_eir(&req);
5336         hci_req_run(&req, NULL);
5337
5338         hci_dev_unlock(hdev);
5339
5340         return err;
5341 }
5342
5343 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
5344                                         u16 opcode)
5345 {
5346         bt_dev_dbg(hdev, "status %u", status);
5347 }
5348
5349 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
5350                                      u16 opcode)
5351 {
5352         struct cmd_lookup match = { NULL, hdev };
5353         struct hci_request req;
5354         u8 instance;
5355         struct adv_info *adv_instance;
5356         int err;
5357
5358         hci_dev_lock(hdev);
5359
5360         if (status) {
5361                 u8 mgmt_err = mgmt_status(status);
5362
5363                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
5364                                      cmd_status_rsp, &mgmt_err);
5365                 goto unlock;
5366         }
5367
5368         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
5369                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
5370         else
5371                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
5372
5373         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
5374                              &match);
5375
5376         new_settings(hdev, match.sk);
5377
5378         if (match.sk)
5379                 sock_put(match.sk);
5380
5381         /* Handle suspend notifier */
5382         if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING,
5383                                hdev->suspend_tasks)) {
5384                 bt_dev_dbg(hdev, "Paused advertising");
5385                 wake_up(&hdev->suspend_wait_q);
5386         } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING,
5387                                       hdev->suspend_tasks)) {
5388                 bt_dev_dbg(hdev, "Unpaused advertising");
5389                 wake_up(&hdev->suspend_wait_q);
5390         }
5391
5392         /* If "Set Advertising" was just disabled and instance advertising was
5393          * set up earlier, then re-enable multi-instance advertising.
5394          */
5395         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
5396             list_empty(&hdev->adv_instances))
5397                 goto unlock;
5398
5399         instance = hdev->cur_adv_instance;
5400         if (!instance) {
5401                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
5402                                                         struct adv_info, list);
5403                 if (!adv_instance)
5404                         goto unlock;
5405
5406                 instance = adv_instance->instance;
5407         }
5408
5409         hci_req_init(&req, hdev);
5410
5411         err = __hci_req_schedule_adv_instance(&req, instance, true);
5412
5413         if (!err)
5414                 err = hci_req_run(&req, enable_advertising_instance);
5415
5416         if (err)
5417                 bt_dev_err(hdev, "failed to re-configure advertising");
5418
5419 unlock:
5420         hci_dev_unlock(hdev);
5421 }
5422
5423 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
5424                            u16 len)
5425 {
5426         struct mgmt_mode *cp = data;
5427         struct mgmt_pending_cmd *cmd;
5428         struct hci_request req;
5429         u8 val, status;
5430         int err;
5431
5432         bt_dev_dbg(hdev, "sock %p", sk);
5433
5434         status = mgmt_le_support(hdev);
5435         if (status)
5436                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5437                                        status);
5438
5439         /* Enabling the experimental LL Privay support disables support for
5440          * advertising.
5441          */
5442         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
5443                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5444                                        MGMT_STATUS_NOT_SUPPORTED);
5445
5446         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5447                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5448                                        MGMT_STATUS_INVALID_PARAMS);
5449
5450         if (hdev->advertising_paused)
5451                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5452                                        MGMT_STATUS_BUSY);
5453
5454         hci_dev_lock(hdev);
5455
5456         val = !!cp->val;
5457
5458         /* The following conditions are ones which mean that we should
5459          * not do any HCI communication but directly send a mgmt
5460          * response to user space (after toggling the flag if
5461          * necessary).
5462          */
5463         if (!hdev_is_powered(hdev) ||
5464             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
5465              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
5466             hci_conn_num(hdev, LE_LINK) > 0 ||
5467             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5468              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
5469                 bool changed;
5470
5471                 if (cp->val) {
5472                         hdev->cur_adv_instance = 0x00;
5473                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
5474                         if (cp->val == 0x02)
5475                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5476                         else
5477                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5478                 } else {
5479                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
5480                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5481                 }
5482
5483                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
5484                 if (err < 0)
5485                         goto unlock;
5486
5487                 if (changed)
5488                         err = new_settings(hdev, sk);
5489
5490                 goto unlock;
5491         }
5492
5493         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
5494             pending_find(MGMT_OP_SET_LE, hdev)) {
5495                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5496                                       MGMT_STATUS_BUSY);
5497                 goto unlock;
5498         }
5499
5500         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
5501         if (!cmd) {
5502                 err = -ENOMEM;
5503                 goto unlock;
5504         }
5505
5506         hci_req_init(&req, hdev);
5507
5508         if (cp->val == 0x02)
5509                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5510         else
5511                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5512
5513         cancel_adv_timeout(hdev);
5514
5515         if (val) {
5516                 /* Switch to instance "0" for the Set Advertising setting.
5517                  * We cannot use update_[adv|scan_rsp]_data() here as the
5518                  * HCI_ADVERTISING flag is not yet set.
5519                  */
5520                 hdev->cur_adv_instance = 0x00;
5521
5522                 if (ext_adv_capable(hdev)) {
5523                         __hci_req_start_ext_adv(&req, 0x00);
5524                 } else {
5525                         __hci_req_update_adv_data(&req, 0x00);
5526                         __hci_req_update_scan_rsp_data(&req, 0x00);
5527                         __hci_req_enable_advertising(&req);
5528                 }
5529         } else {
5530                 __hci_req_disable_advertising(&req);
5531         }
5532
5533         err = hci_req_run(&req, set_advertising_complete);
5534         if (err < 0)
5535                 mgmt_pending_remove(cmd);
5536
5537 unlock:
5538         hci_dev_unlock(hdev);
5539         return err;
5540 }
5541
5542 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
5543                               void *data, u16 len)
5544 {
5545         struct mgmt_cp_set_static_address *cp = data;
5546         int err;
5547
5548         bt_dev_dbg(hdev, "sock %p", sk);
5549
5550         if (!lmp_le_capable(hdev))
5551                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5552                                        MGMT_STATUS_NOT_SUPPORTED);
5553
5554         if (hdev_is_powered(hdev))
5555                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5556                                        MGMT_STATUS_REJECTED);
5557
5558         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
5559                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
5560                         return mgmt_cmd_status(sk, hdev->id,
5561                                                MGMT_OP_SET_STATIC_ADDRESS,
5562                                                MGMT_STATUS_INVALID_PARAMS);
5563
5564                 /* Two most significant bits shall be set */
5565                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
5566                         return mgmt_cmd_status(sk, hdev->id,
5567                                                MGMT_OP_SET_STATIC_ADDRESS,
5568                                                MGMT_STATUS_INVALID_PARAMS);
5569         }
5570
5571         hci_dev_lock(hdev);
5572
5573         bacpy(&hdev->static_addr, &cp->bdaddr);
5574
5575         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
5576         if (err < 0)
5577                 goto unlock;
5578
5579         err = new_settings(hdev, sk);
5580
5581 unlock:
5582         hci_dev_unlock(hdev);
5583         return err;
5584 }
5585
5586 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5587                            void *data, u16 len)
5588 {
5589         struct mgmt_cp_set_scan_params *cp = data;
5590         __u16 interval, window;
5591         int err;
5592
5593         bt_dev_dbg(hdev, "sock %p", sk);
5594
5595         if (!lmp_le_capable(hdev))
5596                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5597                                        MGMT_STATUS_NOT_SUPPORTED);
5598
5599         interval = __le16_to_cpu(cp->interval);
5600
5601         if (interval < 0x0004 || interval > 0x4000)
5602                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5603                                        MGMT_STATUS_INVALID_PARAMS);
5604
5605         window = __le16_to_cpu(cp->window);
5606
5607         if (window < 0x0004 || window > 0x4000)
5608                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5609                                        MGMT_STATUS_INVALID_PARAMS);
5610
5611         if (window > interval)
5612                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5613                                        MGMT_STATUS_INVALID_PARAMS);
5614
5615         hci_dev_lock(hdev);
5616
5617         hdev->le_scan_interval = interval;
5618         hdev->le_scan_window = window;
5619
5620         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5621                                 NULL, 0);
5622
5623         /* If background scan is running, restart it so new parameters are
5624          * loaded.
5625          */
5626         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5627             hdev->discovery.state == DISCOVERY_STOPPED) {
5628                 struct hci_request req;
5629
5630                 hci_req_init(&req, hdev);
5631
5632                 hci_req_add_le_scan_disable(&req, false);
5633                 hci_req_add_le_passive_scan(&req);
5634
5635                 hci_req_run(&req, NULL);
5636         }
5637
5638         hci_dev_unlock(hdev);
5639
5640         return err;
5641 }
5642
5643 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5644                                       u16 opcode)
5645 {
5646         struct mgmt_pending_cmd *cmd;
5647
5648         bt_dev_dbg(hdev, "status 0x%02x", status);
5649
5650         hci_dev_lock(hdev);
5651
5652         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5653         if (!cmd)
5654                 goto unlock;
5655
5656         if (status) {
5657                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5658                                 mgmt_status(status));
5659         } else {
5660                 struct mgmt_mode *cp = cmd->param;
5661
5662                 if (cp->val)
5663                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
5664                 else
5665                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5666
5667                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5668                 new_settings(hdev, cmd->sk);
5669         }
5670
5671         mgmt_pending_remove(cmd);
5672
5673 unlock:
5674         hci_dev_unlock(hdev);
5675 }
5676
5677 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
5678                                 void *data, u16 len)
5679 {
5680         struct mgmt_mode *cp = data;
5681         struct mgmt_pending_cmd *cmd;
5682         struct hci_request req;
5683         int err;
5684
5685         bt_dev_dbg(hdev, "sock %p", sk);
5686
5687         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
5688             hdev->hci_ver < BLUETOOTH_VER_1_2)
5689                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5690                                        MGMT_STATUS_NOT_SUPPORTED);
5691
5692         if (cp->val != 0x00 && cp->val != 0x01)
5693                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5694                                        MGMT_STATUS_INVALID_PARAMS);
5695
5696         hci_dev_lock(hdev);
5697
5698         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
5699                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5700                                       MGMT_STATUS_BUSY);
5701                 goto unlock;
5702         }
5703
5704         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
5705                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5706                                         hdev);
5707                 goto unlock;
5708         }
5709
5710         if (!hdev_is_powered(hdev)) {
5711                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
5712                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5713                                         hdev);
5714                 new_settings(hdev, sk);
5715                 goto unlock;
5716         }
5717
5718         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5719                                data, len);
5720         if (!cmd) {
5721                 err = -ENOMEM;
5722                 goto unlock;
5723         }
5724
5725         hci_req_init(&req, hdev);
5726
5727         __hci_req_write_fast_connectable(&req, cp->val);
5728
5729         err = hci_req_run(&req, fast_connectable_complete);
5730         if (err < 0) {
5731                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5732                                       MGMT_STATUS_FAILED);
5733                 mgmt_pending_remove(cmd);
5734         }
5735
5736 unlock:
5737         hci_dev_unlock(hdev);
5738
5739         return err;
5740 }
5741
5742 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5743 {
5744         struct mgmt_pending_cmd *cmd;
5745
5746         bt_dev_dbg(hdev, "status 0x%02x", status);
5747
5748         hci_dev_lock(hdev);
5749
5750         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
5751         if (!cmd)
5752                 goto unlock;
5753
5754         if (status) {
5755                 u8 mgmt_err = mgmt_status(status);
5756
5757                 /* We need to restore the flag if related HCI commands
5758                  * failed.
5759                  */
5760                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
5761
5762                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5763         } else {
5764                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5765                 new_settings(hdev, cmd->sk);
5766         }
5767
5768         mgmt_pending_remove(cmd);
5769
5770 unlock:
5771         hci_dev_unlock(hdev);
5772 }
5773
5774 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5775 {
5776         struct mgmt_mode *cp = data;
5777         struct mgmt_pending_cmd *cmd;
5778         struct hci_request req;
5779         int err;
5780
5781         bt_dev_dbg(hdev, "sock %p", sk);
5782
5783         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5784                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5785                                        MGMT_STATUS_NOT_SUPPORTED);
5786
5787         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5788                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5789                                        MGMT_STATUS_REJECTED);
5790
5791         if (cp->val != 0x00 && cp->val != 0x01)
5792                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5793                                        MGMT_STATUS_INVALID_PARAMS);
5794
5795         hci_dev_lock(hdev);
5796
5797         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5798                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5799                 goto unlock;
5800         }
5801
5802         if (!hdev_is_powered(hdev)) {
5803                 if (!cp->val) {
5804                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5805                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5806                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5807                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5808                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5809                 }
5810
5811                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5812
5813                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5814                 if (err < 0)
5815                         goto unlock;
5816
5817                 err = new_settings(hdev, sk);
5818                 goto unlock;
5819         }
5820
5821         /* Reject disabling when powered on */
5822         if (!cp->val) {
5823                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5824                                       MGMT_STATUS_REJECTED);
5825                 goto unlock;
5826         } else {
5827                 /* When configuring a dual-mode controller to operate
5828                  * with LE only and using a static address, then switching
5829                  * BR/EDR back on is not allowed.
5830                  *
5831                  * Dual-mode controllers shall operate with the public
5832                  * address as its identity address for BR/EDR and LE. So
5833                  * reject the attempt to create an invalid configuration.
5834                  *
5835                  * The same restrictions applies when secure connections
5836                  * has been enabled. For BR/EDR this is a controller feature
5837                  * while for LE it is a host stack feature. This means that
5838                  * switching BR/EDR back on when secure connections has been
5839                  * enabled is not a supported transaction.
5840                  */
5841                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5842                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5843                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5844                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5845                                               MGMT_STATUS_REJECTED);
5846                         goto unlock;
5847                 }
5848         }
5849
5850         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5851                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5852                                       MGMT_STATUS_BUSY);
5853                 goto unlock;
5854         }
5855
5856         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5857         if (!cmd) {
5858                 err = -ENOMEM;
5859                 goto unlock;
5860         }
5861
5862         /* We need to flip the bit already here so that
5863          * hci_req_update_adv_data generates the correct flags.
5864          */
5865         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5866
5867         hci_req_init(&req, hdev);
5868
5869         __hci_req_write_fast_connectable(&req, false);
5870         __hci_req_update_scan(&req);
5871
5872         /* Since only the advertising data flags will change, there
5873          * is no need to update the scan response data.
5874          */
5875         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
5876
5877         err = hci_req_run(&req, set_bredr_complete);
5878         if (err < 0)
5879                 mgmt_pending_remove(cmd);
5880
5881 unlock:
5882         hci_dev_unlock(hdev);
5883         return err;
5884 }
5885
5886 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5887 {
5888         struct mgmt_pending_cmd *cmd;
5889         struct mgmt_mode *cp;
5890
5891         bt_dev_dbg(hdev, "status %u", status);
5892
5893         hci_dev_lock(hdev);
5894
5895         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5896         if (!cmd)
5897                 goto unlock;
5898
5899         if (status) {
5900                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5901                                 mgmt_status(status));
5902                 goto remove;
5903         }
5904
5905         cp = cmd->param;
5906
5907         switch (cp->val) {
5908         case 0x00:
5909                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5910                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5911                 break;
5912         case 0x01:
5913                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5914                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5915                 break;
5916         case 0x02:
5917                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5918                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5919                 break;
5920         }
5921
5922         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5923         new_settings(hdev, cmd->sk);
5924
5925 remove:
5926         mgmt_pending_remove(cmd);
5927 unlock:
5928         hci_dev_unlock(hdev);
5929 }
5930
5931 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5932                            void *data, u16 len)
5933 {
5934         struct mgmt_mode *cp = data;
5935         struct mgmt_pending_cmd *cmd;
5936         struct hci_request req;
5937         u8 val;
5938         int err;
5939
5940         bt_dev_dbg(hdev, "sock %p", sk);
5941
5942         if (!lmp_sc_capable(hdev) &&
5943             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5944                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5945                                        MGMT_STATUS_NOT_SUPPORTED);
5946
5947         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5948             lmp_sc_capable(hdev) &&
5949             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5950                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5951                                        MGMT_STATUS_REJECTED);
5952
5953         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5954                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5955                                   MGMT_STATUS_INVALID_PARAMS);
5956
5957         hci_dev_lock(hdev);
5958
5959         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5960             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5961                 bool changed;
5962
5963                 if (cp->val) {
5964                         changed = !hci_dev_test_and_set_flag(hdev,
5965                                                              HCI_SC_ENABLED);
5966                         if (cp->val == 0x02)
5967                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5968                         else
5969                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5970                 } else {
5971                         changed = hci_dev_test_and_clear_flag(hdev,
5972                                                               HCI_SC_ENABLED);
5973                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5974                 }
5975
5976                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5977                 if (err < 0)
5978                         goto failed;
5979
5980                 if (changed)
5981                         err = new_settings(hdev, sk);
5982
5983                 goto failed;
5984         }
5985
5986         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5987                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5988                                       MGMT_STATUS_BUSY);
5989                 goto failed;
5990         }
5991
5992         val = !!cp->val;
5993
5994         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5995             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5996                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5997                 goto failed;
5998         }
5999
6000         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
6001         if (!cmd) {
6002                 err = -ENOMEM;
6003                 goto failed;
6004         }
6005
6006         hci_req_init(&req, hdev);
6007         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
6008         err = hci_req_run(&req, sc_enable_complete);
6009         if (err < 0) {
6010                 mgmt_pending_remove(cmd);
6011                 goto failed;
6012         }
6013
6014 failed:
6015         hci_dev_unlock(hdev);
6016         return err;
6017 }
6018
6019 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
6020                           void *data, u16 len)
6021 {
6022         struct mgmt_mode *cp = data;
6023         bool changed, use_changed;
6024         int err;
6025
6026         bt_dev_dbg(hdev, "sock %p", sk);
6027
6028         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6029                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
6030                                        MGMT_STATUS_INVALID_PARAMS);
6031
6032         hci_dev_lock(hdev);
6033
6034         if (cp->val)
6035                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6036         else
6037                 changed = hci_dev_test_and_clear_flag(hdev,
6038                                                       HCI_KEEP_DEBUG_KEYS);
6039
6040         if (cp->val == 0x02)
6041                 use_changed = !hci_dev_test_and_set_flag(hdev,
6042                                                          HCI_USE_DEBUG_KEYS);
6043         else
6044                 use_changed = hci_dev_test_and_clear_flag(hdev,
6045                                                           HCI_USE_DEBUG_KEYS);
6046
6047         if (hdev_is_powered(hdev) && use_changed &&
6048             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6049                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6050                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6051                              sizeof(mode), &mode);
6052         }
6053
6054         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
6055         if (err < 0)
6056                 goto unlock;
6057
6058         if (changed)
6059                 err = new_settings(hdev, sk);
6060
6061 unlock:
6062         hci_dev_unlock(hdev);
6063         return err;
6064 }
6065
6066 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6067                        u16 len)
6068 {
6069         struct mgmt_cp_set_privacy *cp = cp_data;
6070         bool changed;
6071         int err;
6072
6073         bt_dev_dbg(hdev, "sock %p", sk);
6074
6075         if (!lmp_le_capable(hdev))
6076                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6077                                        MGMT_STATUS_NOT_SUPPORTED);
6078
6079         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
6080                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6081                                        MGMT_STATUS_INVALID_PARAMS);
6082
6083         if (hdev_is_powered(hdev))
6084                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6085                                        MGMT_STATUS_REJECTED);
6086
6087         hci_dev_lock(hdev);
6088
6089         /* If user space supports this command it is also expected to
6090          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
6091          */
6092         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6093
6094         if (cp->privacy) {
6095                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
6096                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
6097                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
6098                 hci_adv_instances_set_rpa_expired(hdev, true);
6099                 if (cp->privacy == 0x02)
6100                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
6101                 else
6102                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6103         } else {
6104                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
6105                 memset(hdev->irk, 0, sizeof(hdev->irk));
6106                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
6107                 hci_adv_instances_set_rpa_expired(hdev, false);
6108                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6109         }
6110
6111         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
6112         if (err < 0)
6113                 goto unlock;
6114
6115         if (changed)
6116                 err = new_settings(hdev, sk);
6117
6118 unlock:
6119         hci_dev_unlock(hdev);
6120         return err;
6121 }
6122
6123 static bool irk_is_valid(struct mgmt_irk_info *irk)
6124 {
6125         switch (irk->addr.type) {
6126         case BDADDR_LE_PUBLIC:
6127                 return true;
6128
6129         case BDADDR_LE_RANDOM:
6130                 /* Two most significant bits shall be set */
6131                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6132                         return false;
6133                 return true;
6134         }
6135
6136         return false;
6137 }
6138
6139 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6140                      u16 len)
6141 {
6142         struct mgmt_cp_load_irks *cp = cp_data;
6143         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
6144                                    sizeof(struct mgmt_irk_info));
6145         u16 irk_count, expected_len;
6146         int i, err;
6147
6148         bt_dev_dbg(hdev, "sock %p", sk);
6149
6150         if (!lmp_le_capable(hdev))
6151                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6152                                        MGMT_STATUS_NOT_SUPPORTED);
6153
6154         irk_count = __le16_to_cpu(cp->irk_count);
6155         if (irk_count > max_irk_count) {
6156                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
6157                            irk_count);
6158                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6159                                        MGMT_STATUS_INVALID_PARAMS);
6160         }
6161
6162         expected_len = struct_size(cp, irks, irk_count);
6163         if (expected_len != len) {
6164                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
6165                            expected_len, len);
6166                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6167                                        MGMT_STATUS_INVALID_PARAMS);
6168         }
6169
6170         bt_dev_dbg(hdev, "irk_count %u", irk_count);
6171
6172         for (i = 0; i < irk_count; i++) {
6173                 struct mgmt_irk_info *key = &cp->irks[i];
6174
6175                 if (!irk_is_valid(key))
6176                         return mgmt_cmd_status(sk, hdev->id,
6177                                                MGMT_OP_LOAD_IRKS,
6178                                                MGMT_STATUS_INVALID_PARAMS);
6179         }
6180
6181         hci_dev_lock(hdev);
6182
6183         hci_smp_irks_clear(hdev);
6184
6185         for (i = 0; i < irk_count; i++) {
6186                 struct mgmt_irk_info *irk = &cp->irks[i];
6187
6188                 if (hci_is_blocked_key(hdev,
6189                                        HCI_BLOCKED_KEY_TYPE_IRK,
6190                                        irk->val)) {
6191                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
6192                                     &irk->addr.bdaddr);
6193                         continue;
6194                 }
6195
6196                 hci_add_irk(hdev, &irk->addr.bdaddr,
6197                             le_addr_type(irk->addr.type), irk->val,
6198                             BDADDR_ANY);
6199         }
6200
6201         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6202
6203         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
6204
6205         hci_dev_unlock(hdev);
6206
6207         return err;
6208 }
6209
6210 #ifdef TIZEN_BT
6211 static int set_advertising_params(struct sock *sk, struct hci_dev *hdev,
6212                         void *data, u16 len)
6213 {
6214         struct mgmt_cp_set_advertising_params *cp = data;
6215         __u16 min_interval;
6216         __u16 max_interval;
6217         int err;
6218
6219         BT_DBG("%s", hdev->name);
6220
6221         if (!lmp_le_capable(hdev))
6222                 return mgmt_cmd_status(sk, hdev->id,
6223                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6224                                 MGMT_STATUS_NOT_SUPPORTED);
6225
6226         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6227                 return mgmt_cmd_status(sk, hdev->id,
6228                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6229                                 MGMT_STATUS_BUSY);
6230
6231         min_interval = __le16_to_cpu(cp->interval_min);
6232         max_interval = __le16_to_cpu(cp->interval_max);
6233
6234         if (min_interval > max_interval ||
6235             min_interval < 0x0020 || max_interval > 0x4000)
6236                 return mgmt_cmd_status(sk, hdev->id,
6237                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6238                                 MGMT_STATUS_INVALID_PARAMS);
6239
6240         hci_dev_lock(hdev);
6241
6242         hdev->le_adv_min_interval = min_interval;
6243         hdev->le_adv_max_interval = max_interval;
6244         hdev->adv_filter_policy = cp->filter_policy;
6245         hdev->adv_type = cp->type;
6246
6247         err = mgmt_cmd_complete(sk, hdev->id,
6248                         MGMT_OP_SET_ADVERTISING_PARAMS, 0, NULL, 0);
6249
6250         hci_dev_unlock(hdev);
6251
6252         return err;
6253 }
6254
6255 static void set_advertising_data_complete(struct hci_dev *hdev,
6256                         u8 status, u16 opcode)
6257 {
6258         struct mgmt_cp_set_advertising_data *cp;
6259         struct mgmt_pending_cmd *cmd;
6260
6261         BT_DBG("status 0x%02x", status);
6262
6263         hci_dev_lock(hdev);
6264
6265         cmd = pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev);
6266         if (!cmd)
6267                 goto unlock;
6268
6269         cp = cmd->param;
6270
6271         if (status)
6272                 mgmt_cmd_status(cmd->sk, hdev->id,
6273                                 MGMT_OP_SET_ADVERTISING_DATA,
6274                                 mgmt_status(status));
6275         else
6276                 mgmt_cmd_complete(cmd->sk, hdev->id,
6277                                 MGMT_OP_SET_ADVERTISING_DATA, 0,
6278                                 cp, sizeof(*cp));
6279
6280         mgmt_pending_remove(cmd);
6281
6282 unlock:
6283         hci_dev_unlock(hdev);
6284 }
6285
6286 static int set_advertising_data(struct sock *sk, struct hci_dev *hdev,
6287                         void *data, u16 len)
6288 {
6289         struct mgmt_pending_cmd *cmd;
6290         struct hci_request req;
6291         struct mgmt_cp_set_advertising_data *cp = data;
6292         struct hci_cp_le_set_adv_data adv;
6293         int err;
6294
6295         BT_DBG("%s", hdev->name);
6296
6297         if (!lmp_le_capable(hdev)) {
6298                 return mgmt_cmd_status(sk, hdev->id,
6299                                 MGMT_OP_SET_ADVERTISING_DATA,
6300                                 MGMT_STATUS_NOT_SUPPORTED);
6301         }
6302
6303         hci_dev_lock(hdev);
6304
6305         if (pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev)) {
6306                 err = mgmt_cmd_status(sk, hdev->id,
6307                                 MGMT_OP_SET_ADVERTISING_DATA,
6308                                 MGMT_STATUS_BUSY);
6309                 goto unlocked;
6310         }
6311
6312         if (len > HCI_MAX_AD_LENGTH) {
6313                 err = mgmt_cmd_status(sk, hdev->id,
6314                                 MGMT_OP_SET_ADVERTISING_DATA,
6315                                 MGMT_STATUS_INVALID_PARAMS);
6316                 goto unlocked;
6317         }
6318
6319         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING_DATA,
6320                                hdev, data, len);
6321         if (!cmd) {
6322                 err = -ENOMEM;
6323                 goto unlocked;
6324         }
6325
6326         hci_req_init(&req, hdev);
6327
6328         memset(&adv, 0, sizeof(adv));
6329         memcpy(adv.data, cp->data, len);
6330         adv.length = len;
6331
6332         hci_req_add(&req, HCI_OP_LE_SET_ADV_DATA, sizeof(adv), &adv);
6333
6334         err = hci_req_run(&req, set_advertising_data_complete);
6335         if (err < 0)
6336                 mgmt_pending_remove(cmd);
6337
6338 unlocked:
6339         hci_dev_unlock(hdev);
6340
6341         return err;
6342 }
6343
6344 static void set_scan_rsp_data_complete(struct hci_dev *hdev, u8 status,
6345                         u16 opcode)
6346 {
6347         struct mgmt_cp_set_scan_rsp_data *cp;
6348         struct mgmt_pending_cmd *cmd;
6349
6350         BT_DBG("status 0x%02x", status);
6351
6352         hci_dev_lock(hdev);
6353
6354         cmd = pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev);
6355         if (!cmd)
6356                 goto unlock;
6357
6358         cp = cmd->param;
6359
6360         if (status)
6361                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6362                                 mgmt_status(status));
6363         else
6364                 mgmt_cmd_complete(cmd->sk, hdev->id,
6365                                 MGMT_OP_SET_SCAN_RSP_DATA, 0,
6366                                 cp, sizeof(*cp));
6367
6368         mgmt_pending_remove(cmd);
6369
6370 unlock:
6371         hci_dev_unlock(hdev);
6372 }
6373
6374 static int set_scan_rsp_data(struct sock *sk, struct hci_dev *hdev, void *data,
6375                         u16 len)
6376 {
6377         struct mgmt_pending_cmd *cmd;
6378         struct hci_request req;
6379         struct mgmt_cp_set_scan_rsp_data *cp = data;
6380         struct hci_cp_le_set_scan_rsp_data rsp;
6381         int err;
6382
6383         BT_DBG("%s", hdev->name);
6384
6385         if (!lmp_le_capable(hdev))
6386                 return mgmt_cmd_status(sk, hdev->id,
6387                                 MGMT_OP_SET_SCAN_RSP_DATA,
6388                                 MGMT_STATUS_NOT_SUPPORTED);
6389
6390         hci_dev_lock(hdev);
6391
6392         if (pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev)) {
6393                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6394                                 MGMT_STATUS_BUSY);
6395                 goto unlocked;
6396         }
6397
6398         if (len > HCI_MAX_AD_LENGTH) {
6399                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6400                                 MGMT_STATUS_INVALID_PARAMS);
6401                 goto unlocked;
6402         }
6403
6404         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SCAN_RSP_DATA, hdev, data, len);
6405         if (!cmd) {
6406                 err = -ENOMEM;
6407                 goto unlocked;
6408         }
6409
6410         hci_req_init(&req, hdev);
6411
6412         memset(&rsp, 0, sizeof(rsp));
6413         memcpy(rsp.data, cp->data, len);
6414         rsp.length = len;
6415
6416         hci_req_add(&req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(rsp), &rsp);
6417
6418         err = hci_req_run(&req, set_scan_rsp_data_complete);
6419         if (err < 0)
6420                 mgmt_pending_remove(cmd);
6421
6422 unlocked:
6423         hci_dev_unlock(hdev);
6424
6425         return err;
6426 }
6427
6428 /* Adv White List feature */
6429 static void add_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6430 {
6431         struct mgmt_cp_add_dev_white_list *cp;
6432         struct mgmt_pending_cmd *cmd;
6433
6434         BT_DBG("status 0x%02x", status);
6435
6436         hci_dev_lock(hdev);
6437
6438         cmd = pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev);
6439         if (!cmd)
6440                 goto unlock;
6441
6442         cp = cmd->param;
6443
6444         if (status)
6445                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6446                            mgmt_status(status));
6447         else
6448                 mgmt_cmd_complete(cmd->sk, hdev->id,
6449                                 MGMT_OP_ADD_DEV_WHITE_LIST, 0, cp, sizeof(*cp));
6450
6451         mgmt_pending_remove(cmd);
6452
6453 unlock:
6454         hci_dev_unlock(hdev);
6455 }
6456
6457 static int add_white_list(struct sock *sk, struct hci_dev *hdev,
6458                            void *data, u16 len)
6459 {
6460         struct mgmt_pending_cmd *cmd;
6461         struct mgmt_cp_add_dev_white_list *cp = data;
6462         struct hci_request req;
6463         int err;
6464
6465         BT_DBG("%s", hdev->name);
6466
6467         if (!lmp_le_capable(hdev))
6468                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6469                                   MGMT_STATUS_NOT_SUPPORTED);
6470
6471         if (!hdev_is_powered(hdev))
6472                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6473                                   MGMT_STATUS_REJECTED);
6474
6475         hci_dev_lock(hdev);
6476
6477         if (pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev)) {
6478                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6479                                 MGMT_STATUS_BUSY);
6480                 goto unlocked;
6481         }
6482
6483         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEV_WHITE_LIST, hdev, data, len);
6484         if (!cmd) {
6485                 err = -ENOMEM;
6486                 goto unlocked;
6487         }
6488
6489         hci_req_init(&req, hdev);
6490
6491         hci_req_add(&req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(*cp), cp);
6492
6493         err = hci_req_run(&req, add_white_list_complete);
6494         if (err < 0) {
6495                 mgmt_pending_remove(cmd);
6496                 goto unlocked;
6497         }
6498
6499 unlocked:
6500         hci_dev_unlock(hdev);
6501
6502         return err;
6503 }
6504
6505 static void remove_from_white_list_complete(struct hci_dev *hdev,
6506                         u8 status, u16 opcode)
6507 {
6508         struct mgmt_cp_remove_dev_from_white_list *cp;
6509         struct mgmt_pending_cmd *cmd;
6510
6511         BT_DBG("status 0x%02x", status);
6512
6513         hci_dev_lock(hdev);
6514
6515         cmd = pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev);
6516         if (!cmd)
6517                 goto unlock;
6518
6519         cp = cmd->param;
6520
6521         if (status)
6522                 mgmt_cmd_status(cmd->sk, hdev->id,
6523                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6524                         mgmt_status(status));
6525         else
6526                 mgmt_cmd_complete(cmd->sk, hdev->id,
6527                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, 0,
6528                         cp, sizeof(*cp));
6529
6530         mgmt_pending_remove(cmd);
6531
6532 unlock:
6533         hci_dev_unlock(hdev);
6534 }
6535
6536 static int remove_from_white_list(struct sock *sk, struct hci_dev *hdev,
6537                            void *data, u16 len)
6538 {
6539         struct mgmt_pending_cmd *cmd;
6540         struct mgmt_cp_remove_dev_from_white_list *cp = data;
6541         struct hci_request req;
6542         int err;
6543
6544         BT_DBG("%s", hdev->name);
6545
6546         if (!lmp_le_capable(hdev))
6547                 return mgmt_cmd_status(sk, hdev->id,
6548                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6549                                 MGMT_STATUS_NOT_SUPPORTED);
6550
6551         if (!hdev_is_powered(hdev))
6552                 return mgmt_cmd_status(sk, hdev->id,
6553                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6554                                 MGMT_STATUS_REJECTED);
6555
6556         hci_dev_lock(hdev);
6557
6558         if (pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev)) {
6559                 err = mgmt_cmd_status(sk, hdev->id,
6560                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6561                                 MGMT_STATUS_BUSY);
6562                 goto unlocked;
6563         }
6564
6565         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6566                                 hdev, data, len);
6567         if (!cmd) {
6568                 err = -ENOMEM;
6569                 goto unlocked;
6570         }
6571
6572         hci_req_init(&req, hdev);
6573
6574         hci_req_add(&req, HCI_OP_LE_DEL_FROM_WHITE_LIST, sizeof(*cp), cp);
6575
6576         err = hci_req_run(&req, remove_from_white_list_complete);
6577         if (err < 0) {
6578                 mgmt_pending_remove(cmd);
6579                 goto unlocked;
6580         }
6581
6582 unlocked:
6583         hci_dev_unlock(hdev);
6584
6585         return err;
6586 }
6587
6588 static void clear_white_list_complete(struct hci_dev *hdev, u8 status,
6589                         u16 opcode)
6590 {
6591         struct mgmt_pending_cmd *cmd;
6592
6593         BT_DBG("status 0x%02x", status);
6594
6595         hci_dev_lock(hdev);
6596
6597         cmd = pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev);
6598         if (!cmd)
6599                 goto unlock;
6600
6601         if (status)
6602                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
6603                            mgmt_status(status));
6604         else
6605                 mgmt_cmd_complete(cmd->sk, hdev->id,
6606                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6607                                 0, NULL, 0);
6608
6609         mgmt_pending_remove(cmd);
6610
6611 unlock:
6612         hci_dev_unlock(hdev);
6613 }
6614
6615 static int clear_white_list(struct sock *sk, struct hci_dev *hdev,
6616                            void *data, u16 len)
6617 {
6618         struct mgmt_pending_cmd *cmd;
6619         struct hci_request req;
6620         int err;
6621
6622         BT_DBG("%s", hdev->name);
6623
6624         if (!lmp_le_capable(hdev))
6625                 return mgmt_cmd_status(sk, hdev->id,
6626                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6627                                 MGMT_STATUS_NOT_SUPPORTED);
6628
6629         if (!hdev_is_powered(hdev))
6630                 return mgmt_cmd_status(sk, hdev->id,
6631                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6632                                 MGMT_STATUS_REJECTED);
6633
6634         hci_dev_lock(hdev);
6635
6636         if (pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev)) {
6637                 err = mgmt_cmd_status(sk, hdev->id,
6638                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6639                                 MGMT_STATUS_BUSY);
6640                 goto unlocked;
6641         }
6642
6643         cmd = mgmt_pending_add(sk, MGMT_OP_CLEAR_DEV_WHITE_LIST,
6644                                 hdev, NULL, 0);
6645         if (!cmd) {
6646                 err = -ENOMEM;
6647                 goto unlocked;
6648         }
6649
6650         hci_req_init(&req, hdev);
6651
6652         hci_req_add(&req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
6653
6654         err = hci_req_run(&req, clear_white_list_complete);
6655         if (err < 0) {
6656                 mgmt_pending_remove(cmd);
6657                 goto unlocked;
6658         }
6659
6660 unlocked:
6661         hci_dev_unlock(hdev);
6662
6663         return err;
6664 }
6665
6666 static void set_rssi_threshold_complete(struct hci_dev *hdev,
6667                         u8 status, u16 opcode)
6668 {
6669         struct mgmt_pending_cmd *cmd;
6670
6671         BT_DBG("status 0x%02x", status);
6672
6673         hci_dev_lock(hdev);
6674
6675         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6676         if (!cmd)
6677                 goto unlock;
6678
6679         if (status)
6680                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6681                                 mgmt_status(status));
6682         else
6683                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
6684                                 NULL, 0);
6685
6686         mgmt_pending_remove(cmd);
6687
6688 unlock:
6689         hci_dev_unlock(hdev);
6690 }
6691
6692 static void set_rssi_disable_complete(struct hci_dev *hdev,
6693                         u8 status, u16 opcode)
6694 {
6695         struct mgmt_pending_cmd *cmd;
6696
6697         BT_DBG("status 0x%02x", status);
6698
6699         hci_dev_lock(hdev);
6700
6701         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6702         if (!cmd)
6703                 goto unlock;
6704
6705         if (status)
6706                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6707                                 mgmt_status(status));
6708         else
6709                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6710                                 0, NULL, 0);
6711
6712         mgmt_pending_remove(cmd);
6713
6714 unlock:
6715         hci_dev_unlock(hdev);
6716 }
6717
6718 int mgmt_set_rssi_threshold(struct sock *sk, struct hci_dev *hdev,
6719                 void *data, u16 len)
6720 {
6721         int err = 0;
6722         struct hci_cp_set_rssi_threshold th = { 0, };
6723         struct mgmt_cp_set_enable_rssi *cp = data;
6724         struct hci_conn *conn;
6725         struct mgmt_pending_cmd *cmd;
6726         struct hci_request req;
6727         __u8 dest_type;
6728
6729         hci_dev_lock(hdev);
6730
6731         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6732         if (!cmd) {
6733                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6734                                 MGMT_STATUS_FAILED);
6735                 goto unlocked;
6736         }
6737
6738         if (!lmp_le_capable(hdev)) {
6739                 mgmt_pending_remove(cmd);
6740                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6741                                 MGMT_STATUS_NOT_SUPPORTED);
6742                 goto unlocked;
6743         }
6744
6745         if (!hdev_is_powered(hdev)) {
6746                 BT_DBG("%s", hdev->name);
6747                 mgmt_pending_remove(cmd);
6748                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6749                                 MGMT_STATUS_NOT_POWERED);
6750                 goto unlocked;
6751         }
6752
6753         if (cp->link_type == 0x01)
6754                 dest_type = LE_LINK;
6755         else
6756                 dest_type = ACL_LINK;
6757
6758         /* Get LE/ACL link handle info */
6759         conn = hci_conn_hash_lookup_ba(hdev,
6760                         dest_type, &cp->bdaddr);
6761
6762         if (!conn) {
6763                 err = mgmt_cmd_complete(sk, hdev->id,
6764                                 MGMT_OP_SET_RSSI_ENABLE, 1, NULL, 0);
6765                 mgmt_pending_remove(cmd);
6766                 goto unlocked;
6767         }
6768
6769         hci_req_init(&req, hdev);
6770
6771         th.hci_le_ext_opcode = 0x0B;
6772         th.mode = 0x01;
6773         th.conn_handle = conn->handle;
6774         th.alert_mask = 0x07;
6775         th.low_th = cp->low_th;
6776         th.in_range_th = cp->in_range_th;
6777         th.high_th = cp->high_th;
6778
6779         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
6780         err = hci_req_run(&req, set_rssi_threshold_complete);
6781
6782         if (err < 0) {
6783                 mgmt_pending_remove(cmd);
6784                 BT_ERR("Error in requesting hci_req_run");
6785                 goto unlocked;
6786         }
6787
6788 unlocked:
6789         hci_dev_unlock(hdev);
6790         return err;
6791 }
6792
6793 void mgmt_rssi_enable_success(struct sock *sk, struct hci_dev *hdev,
6794                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6795 {
6796         struct mgmt_cc_rsp_enable_rssi mgmt_rp = { 0, };
6797         struct mgmt_cp_set_enable_rssi *cp = data;
6798         struct mgmt_pending_cmd *cmd;
6799
6800         if (!cp || !rp)
6801                 goto remove_cmd;
6802
6803         mgmt_rp.status = rp->status;
6804         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6805         mgmt_rp.bt_address = cp->bdaddr;
6806         mgmt_rp.link_type = cp->link_type;
6807
6808         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6809                         MGMT_STATUS_SUCCESS, &mgmt_rp,
6810                         sizeof(struct mgmt_cc_rsp_enable_rssi));
6811
6812         mgmt_event(MGMT_EV_RSSI_ENABLED, hdev, &mgmt_rp,
6813                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6814
6815         hci_conn_rssi_unset_all(hdev, mgmt_rp.link_type);
6816         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6817                         &mgmt_rp.bt_address, true);
6818
6819 remove_cmd:
6820         hci_dev_lock(hdev);
6821         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6822         if (cmd)
6823                 mgmt_pending_remove(cmd);
6824
6825         hci_dev_unlock(hdev);
6826 }
6827
6828 void mgmt_rssi_disable_success(struct sock *sk, struct hci_dev *hdev,
6829                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6830 {
6831         struct mgmt_cc_rp_disable_rssi mgmt_rp = { 0, };
6832         struct mgmt_cp_disable_rssi *cp = data;
6833         struct mgmt_pending_cmd *cmd;
6834
6835         if (!cp || !rp)
6836                 goto remove_cmd;
6837
6838         mgmt_rp.status = rp->status;
6839         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6840         mgmt_rp.bt_address = cp->bdaddr;
6841         mgmt_rp.link_type = cp->link_type;
6842
6843         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6844                         MGMT_STATUS_SUCCESS, &mgmt_rp,
6845                         sizeof(struct mgmt_cc_rsp_enable_rssi));
6846
6847         mgmt_event(MGMT_EV_RSSI_DISABLED, hdev, &mgmt_rp,
6848                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6849
6850         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6851                         &mgmt_rp.bt_address, false);
6852
6853 remove_cmd:
6854         hci_dev_lock(hdev);
6855         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6856         if (cmd)
6857                 mgmt_pending_remove(cmd);
6858
6859         hci_dev_unlock(hdev);
6860 }
6861
6862 static int mgmt_set_disable_rssi(struct sock *sk, struct hci_dev *hdev,
6863                 void *data, u16 len)
6864 {
6865         struct mgmt_pending_cmd *cmd;
6866         struct hci_request req;
6867         struct hci_cp_set_enable_rssi cp_en = { 0, };
6868         int err;
6869
6870         BT_DBG("Set Disable RSSI.");
6871
6872         cp_en.hci_le_ext_opcode = 0x01;
6873         cp_en.le_enable_cs_Features = 0x00;
6874         cp_en.data[0] = 0x00;
6875         cp_en.data[1] = 0x00;
6876         cp_en.data[2] = 0x00;
6877
6878         hci_dev_lock(hdev);
6879
6880         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6881         if (!cmd) {
6882                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6883                                 MGMT_STATUS_FAILED);
6884                 goto unlocked;
6885         }
6886
6887         if (!lmp_le_capable(hdev)) {
6888                 mgmt_pending_remove(cmd);
6889                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6890                                 MGMT_STATUS_NOT_SUPPORTED);
6891                 goto unlocked;
6892         }
6893
6894         if (!hdev_is_powered(hdev)) {
6895                 BT_DBG("%s", hdev->name);
6896                 mgmt_pending_remove(cmd);
6897                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6898                                 MGMT_STATUS_NOT_POWERED);
6899                 goto unlocked;
6900         }
6901
6902         hci_req_init(&req, hdev);
6903
6904         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
6905                         sizeof(struct hci_cp_set_enable_rssi),
6906                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
6907                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
6908
6909         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
6910         err = hci_req_run(&req, set_rssi_disable_complete);
6911
6912         if (err < 0) {
6913                 mgmt_pending_remove(cmd);
6914                 BT_ERR("Error in requesting hci_req_run");
6915                 goto unlocked;
6916         }
6917
6918 unlocked:
6919         hci_dev_unlock(hdev);
6920         return err;
6921 }
6922
6923 void mgmt_enable_rssi_cc(struct hci_dev *hdev, void *response, u8 status)
6924 {
6925         struct hci_cc_rsp_enable_rssi *rp = response;
6926         struct mgmt_pending_cmd *cmd_enable = NULL;
6927         struct mgmt_pending_cmd *cmd_disable = NULL;
6928         struct mgmt_cp_set_enable_rssi *cp_en;
6929         struct mgmt_cp_disable_rssi *cp_dis;
6930
6931         hci_dev_lock(hdev);
6932         cmd_enable = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6933         cmd_disable = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6934         hci_dev_unlock(hdev);
6935
6936         if (cmd_enable)
6937                 BT_DBG("Enable Request");
6938
6939         if (cmd_disable)
6940                 BT_DBG("Disable Request");
6941
6942         if (cmd_enable) {
6943                 cp_en = cmd_enable->param;
6944
6945                 if (status != 0x00)
6946                         return;
6947
6948                 switch (rp->le_ext_opcode) {
6949                 case 0x01:
6950                         BT_DBG("RSSI enabled.. Setting Threshold...");
6951                         mgmt_set_rssi_threshold(cmd_enable->sk, hdev,
6952                                         cp_en, sizeof(*cp_en));
6953                         break;
6954
6955                 case 0x0B:
6956                         BT_DBG("Sending RSSI enable success");
6957                         mgmt_rssi_enable_success(cmd_enable->sk, hdev,
6958                                         cp_en, rp, rp->status);
6959                         break;
6960                 }
6961
6962         } else if (cmd_disable) {
6963                 cp_dis = cmd_disable->param;
6964
6965                 if (status != 0x00)
6966                         return;
6967
6968                 switch (rp->le_ext_opcode) {
6969                 case 0x01:
6970                         BT_DBG("Sending RSSI disable success");
6971                         mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6972                                         cp_dis, rp, rp->status);
6973                         break;
6974
6975                 case 0x0B:
6976                         /*
6977                          * Only unset RSSI Threshold values for the Link if
6978                          * RSSI is monitored for other BREDR or LE Links
6979                          */
6980                         if (hci_conn_hash_lookup_rssi_count(hdev) > 1) {
6981                                 BT_DBG("Unset Threshold. Other links being monitored");
6982                                 mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6983                                                 cp_dis, rp, rp->status);
6984                         } else {
6985                                 BT_DBG("Unset Threshold. Disabling...");
6986                                 mgmt_set_disable_rssi(cmd_disable->sk, hdev,
6987                                                 cp_dis, sizeof(*cp_dis));
6988                         }
6989                         break;
6990                 }
6991         }
6992 }
6993
6994 static void set_rssi_enable_complete(struct hci_dev *hdev, u8 status,
6995                 u16 opcode)
6996 {
6997         struct mgmt_pending_cmd *cmd;
6998
6999         BT_DBG("status 0x%02x", status);
7000
7001         hci_dev_lock(hdev);
7002
7003         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7004         if (!cmd)
7005                 goto unlock;
7006
7007         if (status)
7008                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7009                                 mgmt_status(status));
7010         else
7011                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
7012                                 NULL, 0);
7013
7014         mgmt_pending_remove(cmd);
7015
7016 unlock:
7017         hci_dev_unlock(hdev);
7018 }
7019
7020 static int set_enable_rssi(struct sock *sk, struct hci_dev *hdev,
7021                 void *data, u16 len)
7022 {
7023         struct mgmt_pending_cmd *cmd;
7024         struct hci_request req;
7025         struct mgmt_cp_set_enable_rssi *cp = data;
7026         struct hci_cp_set_enable_rssi cp_en = { 0, };
7027         int err;
7028
7029         BT_DBG("Set Enable RSSI.");
7030
7031         cp_en.hci_le_ext_opcode = 0x01;
7032         cp_en.le_enable_cs_Features = 0x04;
7033         cp_en.data[0] = 0x00;
7034         cp_en.data[1] = 0x00;
7035         cp_en.data[2] = 0x00;
7036
7037         hci_dev_lock(hdev);
7038
7039         if (!lmp_le_capable(hdev)) {
7040                 err =  mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7041                                 MGMT_STATUS_NOT_SUPPORTED);
7042                 goto unlocked;
7043         }
7044
7045         if (!hdev_is_powered(hdev)) {
7046                 BT_DBG("%s", hdev->name);
7047                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7048                                 MGMT_STATUS_NOT_POWERED);
7049                 goto unlocked;
7050         }
7051
7052         if (pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev)) {
7053                 BT_DBG("%s", hdev->name);
7054                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7055                                 MGMT_STATUS_BUSY);
7056                 goto unlocked;
7057         }
7058
7059         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_ENABLE, hdev, cp,
7060                         sizeof(*cp));
7061         if (!cmd) {
7062                 BT_DBG("%s", hdev->name);
7063                 err = -ENOMEM;
7064                 goto unlocked;
7065         }
7066
7067         /* If RSSI is already enabled directly set Threshold values */
7068         if (hci_conn_hash_lookup_rssi_count(hdev) > 0) {
7069                 hci_dev_unlock(hdev);
7070                 BT_DBG("RSSI Enabled. Directly set Threshold");
7071                 err = mgmt_set_rssi_threshold(sk, hdev, cp, sizeof(*cp));
7072                 return err;
7073         }
7074
7075         hci_req_init(&req, hdev);
7076
7077         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
7078                         sizeof(struct hci_cp_set_enable_rssi),
7079                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
7080                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
7081
7082         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
7083         err = hci_req_run(&req, set_rssi_enable_complete);
7084
7085         if (err < 0) {
7086                 mgmt_pending_remove(cmd);
7087                 BT_ERR("Error in requesting hci_req_run");
7088                 goto unlocked;
7089         }
7090
7091 unlocked:
7092         hci_dev_unlock(hdev);
7093
7094         return err;
7095 }
7096
7097 static void get_raw_rssi_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7098 {
7099         struct mgmt_pending_cmd *cmd;
7100
7101         BT_DBG("status 0x%02x", status);
7102
7103         hci_dev_lock(hdev);
7104
7105         cmd = pending_find(MGMT_OP_GET_RAW_RSSI, hdev);
7106         if (!cmd)
7107                 goto unlock;
7108
7109         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7110                         MGMT_STATUS_SUCCESS, &status, 1);
7111
7112         mgmt_pending_remove(cmd);
7113
7114 unlock:
7115         hci_dev_unlock(hdev);
7116 }
7117
7118 static int get_raw_rssi(struct sock *sk, struct hci_dev *hdev, void *data,
7119                         u16 len)
7120 {
7121         struct mgmt_pending_cmd *cmd;
7122         struct hci_request req;
7123         struct mgmt_cp_get_raw_rssi *cp = data;
7124         struct hci_cp_get_raw_rssi hci_cp;
7125
7126         struct hci_conn *conn;
7127         int err;
7128         __u8 dest_type;
7129
7130         BT_DBG("Get Raw RSSI.");
7131
7132         hci_dev_lock(hdev);
7133
7134         if (!lmp_le_capable(hdev)) {
7135                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7136                                 MGMT_STATUS_NOT_SUPPORTED);
7137                 goto unlocked;
7138         }
7139
7140         if (cp->link_type == 0x01)
7141                 dest_type = LE_LINK;
7142         else
7143                 dest_type = ACL_LINK;
7144
7145         /* Get LE/BREDR link handle info */
7146         conn = hci_conn_hash_lookup_ba(hdev,
7147                         dest_type, &cp->bt_address);
7148         if (!conn) {
7149                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7150                                                    MGMT_STATUS_NOT_CONNECTED);
7151                 goto unlocked;
7152         }
7153         hci_cp.conn_handle = conn->handle;
7154
7155         if (!hdev_is_powered(hdev)) {
7156                 BT_DBG("%s", hdev->name);
7157                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7158                                 MGMT_STATUS_NOT_POWERED);
7159                 goto unlocked;
7160         }
7161
7162         if (pending_find(MGMT_OP_GET_RAW_RSSI, hdev)) {
7163                 BT_DBG("%s", hdev->name);
7164                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7165                                 MGMT_STATUS_BUSY);
7166                 goto unlocked;
7167         }
7168
7169         cmd = mgmt_pending_add(sk, MGMT_OP_GET_RAW_RSSI, hdev, data, len);
7170         if (!cmd) {
7171                 BT_DBG("%s", hdev->name);
7172                 err = -ENOMEM;
7173                 goto unlocked;
7174         }
7175
7176         hci_req_init(&req, hdev);
7177
7178         BT_DBG("Connection Handle [%d]", hci_cp.conn_handle);
7179         hci_req_add(&req, HCI_OP_GET_RAW_RSSI, sizeof(hci_cp), &hci_cp);
7180         err = hci_req_run(&req, get_raw_rssi_complete);
7181
7182         if (err < 0) {
7183                 mgmt_pending_remove(cmd);
7184                 BT_ERR("Error in requesting hci_req_run");
7185         }
7186
7187 unlocked:
7188         hci_dev_unlock(hdev);
7189
7190         return err;
7191 }
7192
7193 void mgmt_raw_rssi_response(struct hci_dev *hdev,
7194                 struct hci_cc_rp_get_raw_rssi *rp, int success)
7195 {
7196         struct mgmt_cc_rp_get_raw_rssi mgmt_rp = { 0, };
7197         struct hci_conn *conn;
7198
7199         mgmt_rp.status = rp->status;
7200         mgmt_rp.rssi_dbm = rp->rssi_dbm;
7201
7202         conn = hci_conn_hash_lookup_handle(hdev, rp->conn_handle);
7203         if (!conn)
7204                 return;
7205
7206         bacpy(&mgmt_rp.bt_address, &conn->dst);
7207         if (conn->type == LE_LINK)
7208                 mgmt_rp.link_type = 0x01;
7209         else
7210                 mgmt_rp.link_type = 0x00;
7211
7212         mgmt_event(MGMT_EV_RAW_RSSI, hdev, &mgmt_rp,
7213                         sizeof(struct mgmt_cc_rp_get_raw_rssi), NULL);
7214 }
7215
7216 static void set_disable_threshold_complete(struct hci_dev *hdev,
7217                         u8 status, u16 opcode)
7218 {
7219         struct mgmt_pending_cmd *cmd;
7220
7221         BT_DBG("status 0x%02x", status);
7222
7223         hci_dev_lock(hdev);
7224
7225         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7226         if (!cmd)
7227                 goto unlock;
7228
7229         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7230                         MGMT_STATUS_SUCCESS, &status, 1);
7231
7232         mgmt_pending_remove(cmd);
7233
7234 unlock:
7235         hci_dev_unlock(hdev);
7236 }
7237
7238 /** Removes monitoring for a link*/
7239 static int set_disable_threshold(struct sock *sk, struct hci_dev *hdev,
7240                 void *data, u16 len)
7241 {
7242         int err = 0;
7243         struct hci_cp_set_rssi_threshold th = { 0, };
7244         struct mgmt_cp_disable_rssi *cp = data;
7245         struct hci_conn *conn;
7246         struct mgmt_pending_cmd *cmd;
7247         struct hci_request req;
7248         __u8 dest_type;
7249
7250         BT_DBG("Set Disable RSSI.");
7251
7252         hci_dev_lock(hdev);
7253
7254         if (!lmp_le_capable(hdev)) {
7255                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7256                                 MGMT_STATUS_NOT_SUPPORTED);
7257                 goto unlocked;
7258         }
7259
7260         /* Get LE/ACL link handle info*/
7261         if (cp->link_type == 0x01)
7262                 dest_type = LE_LINK;
7263         else
7264                 dest_type = ACL_LINK;
7265
7266         conn = hci_conn_hash_lookup_ba(hdev, dest_type, &cp->bdaddr);
7267         if (!conn) {
7268                 err = mgmt_cmd_complete(sk, hdev->id,
7269                                 MGMT_OP_SET_RSSI_DISABLE, 1, NULL, 0);
7270                 goto unlocked;
7271         }
7272
7273         th.hci_le_ext_opcode = 0x0B;
7274         th.mode = 0x01;
7275         th.conn_handle = conn->handle;
7276         th.alert_mask = 0x00;
7277         th.low_th = 0x00;
7278         th.in_range_th = 0x00;
7279         th.high_th = 0x00;
7280
7281         if (!hdev_is_powered(hdev)) {
7282                 BT_DBG("%s", hdev->name);
7283                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7284                                 0, data, len);
7285                 goto unlocked;
7286         }
7287
7288         if (pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev)) {
7289                 BT_DBG("%s", hdev->name);
7290                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7291                                 MGMT_STATUS_BUSY);
7292                 goto unlocked;
7293         }
7294
7295         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_DISABLE, hdev, cp,
7296                         sizeof(*cp));
7297         if (!cmd) {
7298                 BT_DBG("%s", hdev->name);
7299                 err = -ENOMEM;
7300                 goto unlocked;
7301         }
7302
7303         hci_req_init(&req, hdev);
7304
7305         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
7306         err = hci_req_run(&req, set_disable_threshold_complete);
7307         if (err < 0) {
7308                 mgmt_pending_remove(cmd);
7309                 BT_ERR("Error in requesting hci_req_run");
7310                 goto unlocked;
7311         }
7312
7313 unlocked:
7314         hci_dev_unlock(hdev);
7315
7316         return err;
7317 }
7318
7319 void mgmt_rssi_alert_evt(struct hci_dev *hdev, u16 conn_handle,
7320                 s8 alert_type, s8 rssi_dbm)
7321 {
7322         struct mgmt_ev_vendor_specific_rssi_alert mgmt_ev;
7323         struct hci_conn *conn;
7324
7325         BT_DBG("RSSI alert [%2.2X %2.2X %2.2X]",
7326                         conn_handle, alert_type, rssi_dbm);
7327
7328         conn = hci_conn_hash_lookup_handle(hdev, conn_handle);
7329
7330         if (!conn) {
7331                 BT_ERR("RSSI alert Error: Device not found for handle");
7332                 return;
7333         }
7334         bacpy(&mgmt_ev.bdaddr, &conn->dst);
7335
7336         if (conn->type == LE_LINK)
7337                 mgmt_ev.link_type = 0x01;
7338         else
7339                 mgmt_ev.link_type = 0x00;
7340
7341         mgmt_ev.alert_type = alert_type;
7342         mgmt_ev.rssi_dbm = rssi_dbm;
7343
7344         mgmt_event(MGMT_EV_RSSI_ALERT, hdev, &mgmt_ev,
7345                         sizeof(struct mgmt_ev_vendor_specific_rssi_alert),
7346                         NULL);
7347 }
7348
7349 static int mgmt_start_le_discovery_failed(struct hci_dev *hdev, u8 status)
7350 {
7351         struct mgmt_pending_cmd *cmd;
7352         u8 type;
7353         int err;
7354
7355         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
7356
7357         cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
7358         if (!cmd)
7359                 return -ENOENT;
7360
7361         type = hdev->le_discovery.type;
7362
7363         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
7364                                 mgmt_status(status), &type, sizeof(type));
7365         mgmt_pending_remove(cmd);
7366
7367         return err;
7368 }
7369
7370 static void start_le_discovery_complete(struct hci_dev *hdev, u8 status,
7371                 u16 opcode)
7372 {
7373         unsigned long timeout = 0;
7374
7375         BT_DBG("status %d", status);
7376
7377         if (status) {
7378                 hci_dev_lock(hdev);
7379                 mgmt_start_le_discovery_failed(hdev, status);
7380                 hci_dev_unlock(hdev);
7381                 return;
7382         }
7383
7384         hci_dev_lock(hdev);
7385         hci_le_discovery_set_state(hdev, DISCOVERY_FINDING);
7386         hci_dev_unlock(hdev);
7387
7388         if (hdev->le_discovery.type != DISCOV_TYPE_LE)
7389                 BT_ERR("Invalid discovery type %d", hdev->le_discovery.type);
7390
7391         if (!timeout)
7392                 return;
7393
7394         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
7395 }
7396
7397 static int start_le_discovery(struct sock *sk, struct hci_dev *hdev,
7398                 void *data, u16 len)
7399 {
7400         struct mgmt_cp_start_le_discovery *cp = data;
7401         struct mgmt_pending_cmd *cmd;
7402         struct hci_cp_le_set_scan_param param_cp;
7403         struct hci_cp_le_set_scan_enable enable_cp;
7404         struct hci_request req;
7405         u8 status, own_addr_type;
7406         int err;
7407
7408         BT_DBG("%s", hdev->name);
7409
7410         hci_dev_lock(hdev);
7411
7412         if (!hdev_is_powered(hdev)) {
7413                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7414                                 MGMT_STATUS_NOT_POWERED);
7415                 goto unlock;
7416         }
7417
7418         if (hdev->le_discovery.state != DISCOVERY_STOPPED) {
7419                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7420                                 MGMT_STATUS_BUSY);
7421                 goto unlock;
7422         }
7423
7424         if (cp->type != DISCOV_TYPE_LE) {
7425                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7426                                 MGMT_STATUS_INVALID_PARAMS);
7427                 goto unlock;
7428         }
7429
7430         cmd = mgmt_pending_add(sk, MGMT_OP_START_LE_DISCOVERY, hdev, NULL, 0);
7431         if (!cmd) {
7432                 err = -ENOMEM;
7433                 goto unlock;
7434         }
7435
7436         hdev->le_discovery.type = cp->type;
7437
7438         hci_req_init(&req, hdev);
7439
7440         status = mgmt_le_support(hdev);
7441         if (status) {
7442                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7443                                 status);
7444                 mgmt_pending_remove(cmd);
7445                 goto unlock;
7446         }
7447
7448         /* If controller is scanning, it means the background scanning
7449          * is running. Thus, we should temporarily stop it in order to
7450          * set the discovery scanning parameters.
7451          */
7452         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
7453                 hci_req_add_le_scan_disable(&req, false);
7454
7455         memset(&param_cp, 0, sizeof(param_cp));
7456
7457         /* All active scans will be done with either a resolvable
7458          * private address (when privacy feature has been enabled)
7459          * or unresolvable private address.
7460          */
7461         err = hci_update_random_address(&req, true, hci_dev_test_flag(hdev, HCI_PRIVACY), &own_addr_type);
7462         if (err < 0) {
7463                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7464                                 MGMT_STATUS_FAILED);
7465                 mgmt_pending_remove(cmd);
7466                 goto unlock;
7467         }
7468
7469         param_cp.type = hdev->le_scan_type;
7470         param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
7471         param_cp.window = cpu_to_le16(hdev->le_scan_window);
7472         param_cp.own_address_type = own_addr_type;
7473         hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
7474                     &param_cp);
7475
7476         memset(&enable_cp, 0, sizeof(enable_cp));
7477         enable_cp.enable = LE_SCAN_ENABLE;
7478         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
7479
7480         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
7481                     &enable_cp);
7482
7483         err = hci_req_run(&req, start_le_discovery_complete);
7484         if (err < 0)
7485                 mgmt_pending_remove(cmd);
7486         else
7487                 hci_le_discovery_set_state(hdev, DISCOVERY_STARTING);
7488
7489 unlock:
7490         hci_dev_unlock(hdev);
7491         return err;
7492 }
7493
7494 static int mgmt_stop_le_discovery_failed(struct hci_dev *hdev, u8 status)
7495 {
7496         struct mgmt_pending_cmd *cmd;
7497         int err;
7498
7499         cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
7500         if (!cmd)
7501                 return -ENOENT;
7502
7503         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
7504                                 mgmt_status(status), &hdev->le_discovery.type,
7505                                 sizeof(hdev->le_discovery.type));
7506         mgmt_pending_remove(cmd);
7507
7508         return err;
7509 }
7510
7511 static void stop_le_discovery_complete(struct hci_dev *hdev, u8 status,
7512                 u16 opcode)
7513 {
7514         BT_DBG("status %d", status);
7515
7516         hci_dev_lock(hdev);
7517
7518         if (status) {
7519                 mgmt_stop_le_discovery_failed(hdev, status);
7520                 goto unlock;
7521         }
7522
7523         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
7524
7525 unlock:
7526         hci_dev_unlock(hdev);
7527 }
7528
7529 static int stop_le_discovery(struct sock *sk, struct hci_dev *hdev,
7530                 void *data, u16 len)
7531 {
7532         struct mgmt_cp_stop_le_discovery *mgmt_cp = data;
7533         struct mgmt_pending_cmd *cmd;
7534         struct hci_request req;
7535         int err;
7536
7537         BT_DBG("%s", hdev->name);
7538
7539         hci_dev_lock(hdev);
7540
7541         if (!hci_le_discovery_active(hdev)) {
7542                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7543                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
7544                                         sizeof(mgmt_cp->type));
7545                 goto unlock;
7546         }
7547
7548         if (hdev->le_discovery.type != mgmt_cp->type) {
7549                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7550                                         MGMT_STATUS_INVALID_PARAMS,
7551                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
7552                 goto unlock;
7553         }
7554
7555         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_LE_DISCOVERY, hdev, NULL, 0);
7556         if (!cmd) {
7557                 err = -ENOMEM;
7558                 goto unlock;
7559         }
7560
7561         hci_req_init(&req, hdev);
7562
7563         if (hdev->le_discovery.state  != DISCOVERY_FINDING) {
7564                 BT_DBG("unknown le discovery state %u",
7565                                         hdev->le_discovery.state);
7566
7567                 mgmt_pending_remove(cmd);
7568                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7569                                         MGMT_STATUS_FAILED, &mgmt_cp->type,
7570                                         sizeof(mgmt_cp->type));
7571                 goto unlock;
7572         }
7573
7574         cancel_delayed_work(&hdev->le_scan_disable);
7575         hci_req_add_le_scan_disable(&req, false);
7576
7577         err = hci_req_run(&req, stop_le_discovery_complete);
7578         if (err < 0)
7579                 mgmt_pending_remove(cmd);
7580         else
7581                 hci_le_discovery_set_state(hdev, DISCOVERY_STOPPING);
7582
7583 unlock:
7584         hci_dev_unlock(hdev);
7585         return err;
7586 }
7587
7588 /* Separate LE discovery */
7589 void mgmt_le_discovering(struct hci_dev *hdev, u8 discovering)
7590 {
7591         struct mgmt_ev_discovering ev;
7592         struct mgmt_pending_cmd *cmd;
7593
7594         BT_DBG("%s le discovering %u", hdev->name, discovering);
7595
7596         if (discovering)
7597                 cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
7598         else
7599                 cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
7600
7601         if (cmd) {
7602                 u8 type = hdev->le_discovery.type;
7603
7604                 mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
7605                                   sizeof(type));
7606                 mgmt_pending_remove(cmd);
7607         }
7608
7609         memset(&ev, 0, sizeof(ev));
7610         ev.type = hdev->le_discovery.type;
7611         ev.discovering = discovering;
7612
7613         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7614 }
7615
7616 static int disable_le_auto_connect(struct sock *sk, struct hci_dev *hdev,
7617                         void *data, u16 len)
7618 {
7619         int err;
7620
7621         BT_DBG("%s", hdev->name);
7622
7623         hci_dev_lock(hdev);
7624
7625         err = hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
7626         if (err < 0)
7627                 BT_ERR("HCI_OP_LE_CREATE_CONN_CANCEL is failed");
7628
7629         hci_dev_unlock(hdev);
7630
7631         return err;
7632 }
7633
7634 static inline int check_le_conn_update_param(u16 min, u16 max, u16 latency,
7635                 u16 to_multiplier)
7636 {
7637         u16 max_latency;
7638
7639         if (min > max || min < 6 || max > 3200)
7640                 return -EINVAL;
7641
7642         if (to_multiplier < 10 || to_multiplier > 3200)
7643                 return -EINVAL;
7644
7645         if (max >= to_multiplier * 8)
7646                 return -EINVAL;
7647
7648         max_latency = (to_multiplier * 8 / max) - 1;
7649
7650         if (latency > 499 || latency > max_latency)
7651                 return -EINVAL;
7652
7653         return 0;
7654 }
7655
7656 static int le_conn_update(struct sock *sk, struct hci_dev *hdev, void *data,
7657                 u16 len)
7658 {
7659         struct mgmt_cp_le_conn_update *cp = data;
7660
7661         struct hci_conn *conn;
7662         u16 min, max, latency, supervision_timeout;
7663         int err = -1;
7664
7665         if (!hdev_is_powered(hdev))
7666                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7667                                 MGMT_STATUS_NOT_POWERED);
7668
7669         min = __le16_to_cpu(cp->conn_interval_min);
7670         max = __le16_to_cpu(cp->conn_interval_max);
7671         latency = __le16_to_cpu(cp->conn_latency);
7672         supervision_timeout = __le16_to_cpu(cp->supervision_timeout);
7673
7674         BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x supervision_timeout: 0x%4.4x",
7675                         min, max, latency, supervision_timeout);
7676
7677         err = check_le_conn_update_param(min, max, latency,
7678                         supervision_timeout);
7679
7680         if (err < 0)
7681                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7682                                 MGMT_STATUS_INVALID_PARAMS);
7683
7684         hci_dev_lock(hdev);
7685
7686         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
7687         if (!conn) {
7688                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7689                                 MGMT_STATUS_NOT_CONNECTED);
7690                 hci_dev_unlock(hdev);
7691                 return err;
7692         }
7693
7694         hci_dev_unlock(hdev);
7695
7696         hci_le_conn_update(conn, min, max, latency, supervision_timeout);
7697
7698         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE, 0,
7699                                  NULL, 0);
7700 }
7701
7702 static void set_manufacturer_data_complete(struct hci_dev *hdev, u8 status,
7703                 u16 opcode)
7704 {
7705         struct mgmt_cp_set_manufacturer_data *cp;
7706         struct mgmt_pending_cmd *cmd;
7707
7708         BT_DBG("status 0x%02x", status);
7709
7710         hci_dev_lock(hdev);
7711
7712         cmd = pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev);
7713         if (!cmd)
7714                 goto unlock;
7715
7716         cp = cmd->param;
7717
7718         if (status)
7719                 mgmt_cmd_status(cmd->sk, hdev->id,
7720                                 MGMT_OP_SET_MANUFACTURER_DATA,
7721                                 mgmt_status(status));
7722         else
7723                 mgmt_cmd_complete(cmd->sk, hdev->id,
7724                                   MGMT_OP_SET_MANUFACTURER_DATA, 0,
7725                                   cp, sizeof(*cp));
7726
7727         mgmt_pending_remove(cmd);
7728
7729 unlock:
7730         hci_dev_unlock(hdev);
7731 }
7732
7733 static int set_manufacturer_data(struct sock *sk, struct hci_dev *hdev,
7734                 void *data, u16 len)
7735 {
7736         struct mgmt_pending_cmd *cmd;
7737         struct hci_request req;
7738         struct mgmt_cp_set_manufacturer_data *cp = data;
7739         u8 old_data[HCI_MAX_EIR_LENGTH] = {0, };
7740         u8 old_len;
7741         int err;
7742
7743         BT_DBG("%s", hdev->name);
7744
7745         if (!lmp_bredr_capable(hdev))
7746                 return mgmt_cmd_status(sk, hdev->id,
7747                                 MGMT_OP_SET_MANUFACTURER_DATA,
7748                                 MGMT_STATUS_NOT_SUPPORTED);
7749
7750         if (cp->data[0] == 0 ||
7751                         cp->data[0] - 1 > sizeof(hdev->manufacturer_data))
7752                 return mgmt_cmd_status(sk, hdev->id,
7753                                 MGMT_OP_SET_MANUFACTURER_DATA,
7754                                 MGMT_STATUS_INVALID_PARAMS);
7755
7756         if (cp->data[1] != 0xFF)
7757                 return mgmt_cmd_status(sk, hdev->id,
7758                                 MGMT_OP_SET_MANUFACTURER_DATA,
7759                                 MGMT_STATUS_NOT_SUPPORTED);
7760
7761         hci_dev_lock(hdev);
7762
7763         if (pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev)) {
7764                 err = mgmt_cmd_status(sk, hdev->id,
7765                                 MGMT_OP_SET_MANUFACTURER_DATA,
7766                                 MGMT_STATUS_BUSY);
7767                 goto unlocked;
7768         }
7769
7770         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MANUFACTURER_DATA, hdev, data,
7771                         len);
7772         if (!cmd) {
7773                 err = -ENOMEM;
7774                 goto unlocked;
7775         }
7776
7777         hci_req_init(&req, hdev);
7778
7779         /* if new data is same as previous data then return command
7780          * complete event
7781          */
7782         if (hdev->manufacturer_len == cp->data[0] - 1 &&
7783             !memcmp(hdev->manufacturer_data, cp->data + 2, cp->data[0] - 1)) {
7784                 mgmt_pending_remove(cmd);
7785                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
7786                                   0, cp, sizeof(*cp));
7787                 err = 0;
7788                 goto unlocked;
7789         }
7790
7791         old_len = hdev->manufacturer_len;
7792         if (old_len > 0)
7793                 memcpy(old_data, hdev->manufacturer_data, old_len);
7794
7795         hdev->manufacturer_len = cp->data[0] - 1;
7796         if (hdev->manufacturer_len > 0)
7797                 memcpy(hdev->manufacturer_data, cp->data + 2,
7798                                 hdev->manufacturer_len);
7799
7800         __hci_req_update_eir(&req);
7801
7802         err = hci_req_run(&req, set_manufacturer_data_complete);
7803         if (err < 0) {
7804                 mgmt_pending_remove(cmd);
7805                 goto failed;
7806         }
7807
7808 unlocked:
7809         hci_dev_unlock(hdev);
7810
7811         return err;
7812
7813 failed:
7814         memset(hdev->manufacturer_data, 0x00, sizeof(hdev->manufacturer_data));
7815         hdev->manufacturer_len = old_len;
7816         if (hdev->manufacturer_len > 0)
7817                 memcpy(hdev->manufacturer_data, old_data,
7818                        hdev->manufacturer_len);
7819         hci_dev_unlock(hdev);
7820         return err;
7821 }
7822
7823 static int le_set_scan_params(struct sock *sk, struct hci_dev *hdev,
7824                 void *data, u16 len)
7825 {
7826         struct mgmt_cp_le_set_scan_params *cp = data;
7827         __u16 interval, window;
7828         int err;
7829
7830         BT_DBG("%s", hdev->name);
7831
7832         if (!lmp_le_capable(hdev))
7833                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7834                                 MGMT_STATUS_NOT_SUPPORTED);
7835
7836         interval = __le16_to_cpu(cp->interval);
7837
7838         if (interval < 0x0004 || interval > 0x4000)
7839                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7840                                 MGMT_STATUS_INVALID_PARAMS);
7841
7842         window = __le16_to_cpu(cp->window);
7843
7844         if (window < 0x0004 || window > 0x4000)
7845                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7846                                 MGMT_STATUS_INVALID_PARAMS);
7847
7848         if (window > interval)
7849                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7850                                 MGMT_STATUS_INVALID_PARAMS);
7851
7852         hci_dev_lock(hdev);
7853
7854         hdev->le_scan_type = cp->type;
7855         hdev->le_scan_interval = interval;
7856         hdev->le_scan_window = window;
7857
7858         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS, 0,
7859                                 NULL, 0);
7860
7861         /* If background scan is running, restart it so new parameters are
7862          * loaded.
7863          */
7864         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
7865             hdev->discovery.state == DISCOVERY_STOPPED) {
7866                 struct hci_request req;
7867
7868                 hci_req_init(&req, hdev);
7869
7870                 hci_req_add_le_scan_disable(&req, false);
7871                 hci_req_add_le_passive_scan(&req);
7872
7873                 hci_req_run(&req, NULL);
7874         }
7875
7876         hci_dev_unlock(hdev);
7877
7878         return err;
7879 }
7880
7881 static int set_voice_setting(struct sock *sk, struct hci_dev *hdev,
7882                 void *data, u16 len)
7883 {
7884         struct mgmt_cp_set_voice_setting *cp = data;
7885         struct hci_conn *conn;
7886         struct hci_conn *sco_conn;
7887
7888         int err;
7889
7890         BT_DBG("%s", hdev->name);
7891
7892         if (!lmp_bredr_capable(hdev)) {
7893                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING,
7894                                 MGMT_STATUS_NOT_SUPPORTED);
7895         }
7896
7897         hci_dev_lock(hdev);
7898
7899         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
7900         if (!conn) {
7901                 err = mgmt_cmd_complete(sk, hdev->id,
7902                                 MGMT_OP_SET_VOICE_SETTING, 0, NULL, 0);
7903                 goto unlock;
7904         }
7905
7906         conn->voice_setting = cp->voice_setting;
7907         conn->sco_role = cp->sco_role;
7908
7909         sco_conn = hci_conn_hash_lookup_sco(hdev);
7910         if (sco_conn && bacmp(&sco_conn->dst, &cp->bdaddr) != 0) {
7911                 BT_ERR("There is other SCO connection.");
7912                 goto done;
7913         }
7914
7915         if (conn->sco_role == MGMT_SCO_ROLE_HANDSFREE) {
7916                 if (conn->voice_setting == 0x0063)
7917                         sco_connect_set_wbc(hdev);
7918                 else
7919                         sco_connect_set_nbc(hdev);
7920         } else {
7921                 if (conn->voice_setting == 0x0063)
7922                         sco_connect_set_gw_wbc(hdev);
7923                 else
7924                         sco_connect_set_gw_nbc(hdev);
7925         }
7926
7927 done:
7928         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING, 0,
7929                         cp, sizeof(cp));
7930
7931 unlock:
7932         hci_dev_unlock(hdev);
7933         return err;
7934 }
7935
7936 static int get_adv_tx_power(struct sock *sk, struct hci_dev *hdev,
7937                 void *data, u16 len)
7938 {
7939         struct mgmt_rp_get_adv_tx_power *rp;
7940         size_t rp_len;
7941         int err;
7942
7943         BT_DBG("%s", hdev->name);
7944
7945         hci_dev_lock(hdev);
7946
7947         rp_len = sizeof(*rp);
7948         rp = kmalloc(rp_len, GFP_KERNEL);
7949         if (!rp) {
7950                 err = -ENOMEM;
7951                 goto unlock;
7952         }
7953
7954         rp->adv_tx_power = hdev->adv_tx_power;
7955
7956         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_TX_POWER, 0, rp,
7957                                 rp_len);
7958
7959         kfree(rp);
7960
7961 unlock:
7962         hci_dev_unlock(hdev);
7963
7964         return err;
7965 }
7966
7967 void mgmt_hardware_error(struct hci_dev *hdev, u8 err_code)
7968 {
7969         struct mgmt_ev_hardware_error ev;
7970
7971         ev.error_code = err_code;
7972         mgmt_event(MGMT_EV_HARDWARE_ERROR, hdev, &ev, sizeof(ev), NULL);
7973 }
7974
7975 void mgmt_tx_timeout_error(struct hci_dev *hdev)
7976 {
7977         mgmt_event(MGMT_EV_TX_TIMEOUT_ERROR, hdev, NULL, 0, NULL);
7978 }
7979
7980 void mgmt_multi_adv_state_change_evt(struct hci_dev *hdev, u8 adv_instance,
7981                 u8 state_change_reason, u16 connection_handle)
7982 {
7983         struct mgmt_ev_vendor_specific_multi_adv_state_changed mgmt_ev;
7984
7985         BT_DBG("Multi adv state changed [%2.2X %2.2X %2.2X]",
7986                adv_instance, state_change_reason, connection_handle);
7987
7988         mgmt_ev.adv_instance = adv_instance;
7989         mgmt_ev.state_change_reason = state_change_reason;
7990         mgmt_ev.connection_handle = connection_handle;
7991
7992         mgmt_event(MGMT_EV_MULTI_ADV_STATE_CHANGED, hdev, &mgmt_ev,
7993                 sizeof(struct mgmt_ev_vendor_specific_multi_adv_state_changed),
7994                 NULL);
7995 }
7996 #endif /* TIZEN_BT */
7997
7998 static bool ltk_is_valid(struct mgmt_ltk_info *key)
7999 {
8000         if (key->initiator != 0x00 && key->initiator != 0x01)
8001                 return false;
8002
8003         switch (key->addr.type) {
8004         case BDADDR_LE_PUBLIC:
8005                 return true;
8006
8007         case BDADDR_LE_RANDOM:
8008                 /* Two most significant bits shall be set */
8009                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
8010                         return false;
8011                 return true;
8012         }
8013
8014         return false;
8015 }
8016
8017 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
8018                                void *cp_data, u16 len)
8019 {
8020         struct mgmt_cp_load_long_term_keys *cp = cp_data;
8021         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
8022                                    sizeof(struct mgmt_ltk_info));
8023         u16 key_count, expected_len;
8024         int i, err;
8025
8026         bt_dev_dbg(hdev, "sock %p", sk);
8027
8028         if (!lmp_le_capable(hdev))
8029                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8030                                        MGMT_STATUS_NOT_SUPPORTED);
8031
8032         key_count = __le16_to_cpu(cp->key_count);
8033         if (key_count > max_key_count) {
8034                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
8035                            key_count);
8036                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8037                                        MGMT_STATUS_INVALID_PARAMS);
8038         }
8039
8040         expected_len = struct_size(cp, keys, key_count);
8041         if (expected_len != len) {
8042                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
8043                            expected_len, len);
8044                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8045                                        MGMT_STATUS_INVALID_PARAMS);
8046         }
8047
8048         bt_dev_dbg(hdev, "key_count %u", key_count);
8049
8050         for (i = 0; i < key_count; i++) {
8051                 struct mgmt_ltk_info *key = &cp->keys[i];
8052
8053                 if (!ltk_is_valid(key))
8054                         return mgmt_cmd_status(sk, hdev->id,
8055                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
8056                                                MGMT_STATUS_INVALID_PARAMS);
8057         }
8058
8059         hci_dev_lock(hdev);
8060
8061         hci_smp_ltks_clear(hdev);
8062
8063         for (i = 0; i < key_count; i++) {
8064                 struct mgmt_ltk_info *key = &cp->keys[i];
8065                 u8 type, authenticated;
8066
8067                 if (hci_is_blocked_key(hdev,
8068                                        HCI_BLOCKED_KEY_TYPE_LTK,
8069                                        key->val)) {
8070                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
8071                                     &key->addr.bdaddr);
8072                         continue;
8073                 }
8074
8075                 switch (key->type) {
8076                 case MGMT_LTK_UNAUTHENTICATED:
8077                         authenticated = 0x00;
8078                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
8079                         break;
8080                 case MGMT_LTK_AUTHENTICATED:
8081                         authenticated = 0x01;
8082                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
8083                         break;
8084                 case MGMT_LTK_P256_UNAUTH:
8085                         authenticated = 0x00;
8086                         type = SMP_LTK_P256;
8087                         break;
8088                 case MGMT_LTK_P256_AUTH:
8089                         authenticated = 0x01;
8090                         type = SMP_LTK_P256;
8091                         break;
8092                 case MGMT_LTK_P256_DEBUG:
8093                         authenticated = 0x00;
8094                         type = SMP_LTK_P256_DEBUG;
8095                         fallthrough;
8096                 default:
8097                         continue;
8098                 }
8099
8100                 hci_add_ltk(hdev, &key->addr.bdaddr,
8101                             le_addr_type(key->addr.type), type, authenticated,
8102                             key->val, key->enc_size, key->ediv, key->rand);
8103         }
8104
8105         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
8106                            NULL, 0);
8107
8108         hci_dev_unlock(hdev);
8109
8110         return err;
8111 }
8112
8113 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
8114 {
8115         struct hci_conn *conn = cmd->user_data;
8116         struct mgmt_rp_get_conn_info rp;
8117         int err;
8118
8119         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
8120
8121         if (status == MGMT_STATUS_SUCCESS) {
8122                 rp.rssi = conn->rssi;
8123                 rp.tx_power = conn->tx_power;
8124                 rp.max_tx_power = conn->max_tx_power;
8125         } else {
8126                 rp.rssi = HCI_RSSI_INVALID;
8127                 rp.tx_power = HCI_TX_POWER_INVALID;
8128                 rp.max_tx_power = HCI_TX_POWER_INVALID;
8129         }
8130
8131         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
8132                                 status, &rp, sizeof(rp));
8133
8134         hci_conn_drop(conn);
8135         hci_conn_put(conn);
8136
8137         return err;
8138 }
8139
8140 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
8141                                        u16 opcode)
8142 {
8143         struct hci_cp_read_rssi *cp;
8144         struct mgmt_pending_cmd *cmd;
8145         struct hci_conn *conn;
8146         u16 handle;
8147         u8 status;
8148
8149         bt_dev_dbg(hdev, "status 0x%02x", hci_status);
8150
8151         hci_dev_lock(hdev);
8152
8153         /* Commands sent in request are either Read RSSI or Read Transmit Power
8154          * Level so we check which one was last sent to retrieve connection
8155          * handle.  Both commands have handle as first parameter so it's safe to
8156          * cast data on the same command struct.
8157          *
8158          * First command sent is always Read RSSI and we fail only if it fails.
8159          * In other case we simply override error to indicate success as we
8160          * already remembered if TX power value is actually valid.
8161          */
8162         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
8163         if (!cp) {
8164                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
8165                 status = MGMT_STATUS_SUCCESS;
8166         } else {
8167                 status = mgmt_status(hci_status);
8168         }
8169
8170         if (!cp) {
8171                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
8172                 goto unlock;
8173         }
8174
8175         handle = __le16_to_cpu(cp->handle);
8176         conn = hci_conn_hash_lookup_handle(hdev, handle);
8177         if (!conn) {
8178                 bt_dev_err(hdev, "unknown handle (%u) in conn_info response",
8179                            handle);
8180                 goto unlock;
8181         }
8182
8183         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
8184         if (!cmd)
8185                 goto unlock;
8186
8187         cmd->cmd_complete(cmd, status);
8188         mgmt_pending_remove(cmd);
8189
8190 unlock:
8191         hci_dev_unlock(hdev);
8192 }
8193
8194 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
8195                          u16 len)
8196 {
8197         struct mgmt_cp_get_conn_info *cp = data;
8198         struct mgmt_rp_get_conn_info rp;
8199         struct hci_conn *conn;
8200         unsigned long conn_info_age;
8201         int err = 0;
8202
8203         bt_dev_dbg(hdev, "sock %p", sk);
8204
8205         memset(&rp, 0, sizeof(rp));
8206         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8207         rp.addr.type = cp->addr.type;
8208
8209         if (!bdaddr_type_is_valid(cp->addr.type))
8210                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8211                                          MGMT_STATUS_INVALID_PARAMS,
8212                                          &rp, sizeof(rp));
8213
8214         hci_dev_lock(hdev);
8215
8216         if (!hdev_is_powered(hdev)) {
8217                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8218                                         MGMT_STATUS_NOT_POWERED, &rp,
8219                                         sizeof(rp));
8220                 goto unlock;
8221         }
8222
8223         if (cp->addr.type == BDADDR_BREDR)
8224                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8225                                                &cp->addr.bdaddr);
8226         else
8227                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
8228
8229         if (!conn || conn->state != BT_CONNECTED) {
8230                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8231                                         MGMT_STATUS_NOT_CONNECTED, &rp,
8232                                         sizeof(rp));
8233                 goto unlock;
8234         }
8235
8236         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
8237                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8238                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
8239                 goto unlock;
8240         }
8241
8242         /* To avoid client trying to guess when to poll again for information we
8243          * calculate conn info age as random value between min/max set in hdev.
8244          */
8245         conn_info_age = hdev->conn_info_min_age +
8246                         prandom_u32_max(hdev->conn_info_max_age -
8247                                         hdev->conn_info_min_age);
8248
8249         /* Query controller to refresh cached values if they are too old or were
8250          * never read.
8251          */
8252         if (time_after(jiffies, conn->conn_info_timestamp +
8253                        msecs_to_jiffies(conn_info_age)) ||
8254             !conn->conn_info_timestamp) {
8255                 struct hci_request req;
8256                 struct hci_cp_read_tx_power req_txp_cp;
8257                 struct hci_cp_read_rssi req_rssi_cp;
8258                 struct mgmt_pending_cmd *cmd;
8259
8260                 hci_req_init(&req, hdev);
8261                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
8262                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
8263                             &req_rssi_cp);
8264
8265                 /* For LE links TX power does not change thus we don't need to
8266                  * query for it once value is known.
8267                  */
8268                 if (!bdaddr_type_is_le(cp->addr.type) ||
8269                     conn->tx_power == HCI_TX_POWER_INVALID) {
8270                         req_txp_cp.handle = cpu_to_le16(conn->handle);
8271                         req_txp_cp.type = 0x00;
8272                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
8273                                     sizeof(req_txp_cp), &req_txp_cp);
8274                 }
8275
8276                 /* Max TX power needs to be read only once per connection */
8277                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
8278                         req_txp_cp.handle = cpu_to_le16(conn->handle);
8279                         req_txp_cp.type = 0x01;
8280                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
8281                                     sizeof(req_txp_cp), &req_txp_cp);
8282                 }
8283
8284                 err = hci_req_run(&req, conn_info_refresh_complete);
8285                 if (err < 0)
8286                         goto unlock;
8287
8288                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
8289                                        data, len);
8290                 if (!cmd) {
8291                         err = -ENOMEM;
8292                         goto unlock;
8293                 }
8294
8295                 hci_conn_hold(conn);
8296                 cmd->user_data = hci_conn_get(conn);
8297                 cmd->cmd_complete = conn_info_cmd_complete;
8298
8299                 conn->conn_info_timestamp = jiffies;
8300         } else {
8301                 /* Cache is valid, just reply with values cached in hci_conn */
8302                 rp.rssi = conn->rssi;
8303                 rp.tx_power = conn->tx_power;
8304                 rp.max_tx_power = conn->max_tx_power;
8305
8306                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8307                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8308         }
8309
8310 unlock:
8311         hci_dev_unlock(hdev);
8312         return err;
8313 }
8314
8315 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
8316 {
8317         struct hci_conn *conn = cmd->user_data;
8318         struct mgmt_rp_get_clock_info rp;
8319         struct hci_dev *hdev;
8320         int err;
8321
8322         memset(&rp, 0, sizeof(rp));
8323         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
8324
8325         if (status)
8326                 goto complete;
8327
8328         hdev = hci_dev_get(cmd->index);
8329         if (hdev) {
8330                 rp.local_clock = cpu_to_le32(hdev->clock);
8331                 hci_dev_put(hdev);
8332         }
8333
8334         if (conn) {
8335                 rp.piconet_clock = cpu_to_le32(conn->clock);
8336                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
8337         }
8338
8339 complete:
8340         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
8341                                 sizeof(rp));
8342
8343         if (conn) {
8344                 hci_conn_drop(conn);
8345                 hci_conn_put(conn);
8346         }
8347
8348         return err;
8349 }
8350
8351 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8352 {
8353         struct hci_cp_read_clock *hci_cp;
8354         struct mgmt_pending_cmd *cmd;
8355         struct hci_conn *conn;
8356
8357         bt_dev_dbg(hdev, "status %u", status);
8358
8359         hci_dev_lock(hdev);
8360
8361         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
8362         if (!hci_cp)
8363                 goto unlock;
8364
8365         if (hci_cp->which) {
8366                 u16 handle = __le16_to_cpu(hci_cp->handle);
8367                 conn = hci_conn_hash_lookup_handle(hdev, handle);
8368         } else {
8369                 conn = NULL;
8370         }
8371
8372         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
8373         if (!cmd)
8374                 goto unlock;
8375
8376         cmd->cmd_complete(cmd, mgmt_status(status));
8377         mgmt_pending_remove(cmd);
8378
8379 unlock:
8380         hci_dev_unlock(hdev);
8381 }
8382
8383 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
8384                          u16 len)
8385 {
8386         struct mgmt_cp_get_clock_info *cp = data;
8387         struct mgmt_rp_get_clock_info rp;
8388         struct hci_cp_read_clock hci_cp;
8389         struct mgmt_pending_cmd *cmd;
8390         struct hci_request req;
8391         struct hci_conn *conn;
8392         int err;
8393
8394         bt_dev_dbg(hdev, "sock %p", sk);
8395
8396         memset(&rp, 0, sizeof(rp));
8397         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8398         rp.addr.type = cp->addr.type;
8399
8400         if (cp->addr.type != BDADDR_BREDR)
8401                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8402                                          MGMT_STATUS_INVALID_PARAMS,
8403                                          &rp, sizeof(rp));
8404
8405         hci_dev_lock(hdev);
8406
8407         if (!hdev_is_powered(hdev)) {
8408                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8409                                         MGMT_STATUS_NOT_POWERED, &rp,
8410                                         sizeof(rp));
8411                 goto unlock;
8412         }
8413
8414         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8415                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8416                                                &cp->addr.bdaddr);
8417                 if (!conn || conn->state != BT_CONNECTED) {
8418                         err = mgmt_cmd_complete(sk, hdev->id,
8419                                                 MGMT_OP_GET_CLOCK_INFO,
8420                                                 MGMT_STATUS_NOT_CONNECTED,
8421                                                 &rp, sizeof(rp));
8422                         goto unlock;
8423                 }
8424         } else {
8425                 conn = NULL;
8426         }
8427
8428         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
8429         if (!cmd) {
8430                 err = -ENOMEM;
8431                 goto unlock;
8432         }
8433
8434         cmd->cmd_complete = clock_info_cmd_complete;
8435
8436         hci_req_init(&req, hdev);
8437
8438         memset(&hci_cp, 0, sizeof(hci_cp));
8439         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
8440
8441         if (conn) {
8442                 hci_conn_hold(conn);
8443                 cmd->user_data = hci_conn_get(conn);
8444
8445                 hci_cp.handle = cpu_to_le16(conn->handle);
8446                 hci_cp.which = 0x01; /* Piconet clock */
8447                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
8448         }
8449
8450         err = hci_req_run(&req, get_clock_info_complete);
8451         if (err < 0)
8452                 mgmt_pending_remove(cmd);
8453
8454 unlock:
8455         hci_dev_unlock(hdev);
8456         return err;
8457 }
8458
8459 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
8460 {
8461         struct hci_conn *conn;
8462
8463         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
8464         if (!conn)
8465                 return false;
8466
8467         if (conn->dst_type != type)
8468                 return false;
8469
8470         if (conn->state != BT_CONNECTED)
8471                 return false;
8472
8473         return true;
8474 }
8475
8476 /* This function requires the caller holds hdev->lock */
8477 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
8478                                u8 addr_type, u8 auto_connect)
8479 {
8480         struct hci_conn_params *params;
8481
8482         params = hci_conn_params_add(hdev, addr, addr_type);
8483         if (!params)
8484                 return -EIO;
8485
8486         if (params->auto_connect == auto_connect)
8487                 return 0;
8488
8489         list_del_init(&params->action);
8490
8491         switch (auto_connect) {
8492         case HCI_AUTO_CONN_DISABLED:
8493         case HCI_AUTO_CONN_LINK_LOSS:
8494                 /* If auto connect is being disabled when we're trying to
8495                  * connect to device, keep connecting.
8496                  */
8497                 if (params->explicit_connect)
8498                         list_add(&params->action, &hdev->pend_le_conns);
8499                 break;
8500         case HCI_AUTO_CONN_REPORT:
8501                 if (params->explicit_connect)
8502                         list_add(&params->action, &hdev->pend_le_conns);
8503                 else
8504                         list_add(&params->action, &hdev->pend_le_reports);
8505                 break;
8506         case HCI_AUTO_CONN_DIRECT:
8507         case HCI_AUTO_CONN_ALWAYS:
8508                 if (!is_connected(hdev, addr, addr_type))
8509                         list_add(&params->action, &hdev->pend_le_conns);
8510                 break;
8511         }
8512
8513         params->auto_connect = auto_connect;
8514
8515         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
8516                    addr, addr_type, auto_connect);
8517
8518         return 0;
8519 }
8520
8521 static void device_added(struct sock *sk, struct hci_dev *hdev,
8522                          bdaddr_t *bdaddr, u8 type, u8 action)
8523 {
8524         struct mgmt_ev_device_added ev;
8525
8526         bacpy(&ev.addr.bdaddr, bdaddr);
8527         ev.addr.type = type;
8528         ev.action = action;
8529
8530         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
8531 }
8532
8533 static int add_device(struct sock *sk, struct hci_dev *hdev,
8534                       void *data, u16 len)
8535 {
8536         struct mgmt_cp_add_device *cp = data;
8537         u8 auto_conn, addr_type;
8538         struct hci_conn_params *params;
8539         int err;
8540         u32 current_flags = 0;
8541
8542         bt_dev_dbg(hdev, "sock %p", sk);
8543
8544         if (!bdaddr_type_is_valid(cp->addr.type) ||
8545             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
8546                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8547                                          MGMT_STATUS_INVALID_PARAMS,
8548                                          &cp->addr, sizeof(cp->addr));
8549
8550         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
8551                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8552                                          MGMT_STATUS_INVALID_PARAMS,
8553                                          &cp->addr, sizeof(cp->addr));
8554
8555         hci_dev_lock(hdev);
8556
8557         if (cp->addr.type == BDADDR_BREDR) {
8558                 /* Only incoming connections action is supported for now */
8559                 if (cp->action != 0x01) {
8560                         err = mgmt_cmd_complete(sk, hdev->id,
8561                                                 MGMT_OP_ADD_DEVICE,
8562                                                 MGMT_STATUS_INVALID_PARAMS,
8563                                                 &cp->addr, sizeof(cp->addr));
8564                         goto unlock;
8565                 }
8566
8567                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
8568                                                      &cp->addr.bdaddr,
8569                                                      cp->addr.type, 0);
8570                 if (err)
8571                         goto unlock;
8572
8573                 hci_req_update_scan(hdev);
8574
8575                 goto added;
8576         }
8577
8578         addr_type = le_addr_type(cp->addr.type);
8579
8580         if (cp->action == 0x02)
8581                 auto_conn = HCI_AUTO_CONN_ALWAYS;
8582         else if (cp->action == 0x01)
8583                 auto_conn = HCI_AUTO_CONN_DIRECT;
8584         else
8585                 auto_conn = HCI_AUTO_CONN_REPORT;
8586
8587         /* Kernel internally uses conn_params with resolvable private
8588          * address, but Add Device allows only identity addresses.
8589          * Make sure it is enforced before calling
8590          * hci_conn_params_lookup.
8591          */
8592         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
8593                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8594                                         MGMT_STATUS_INVALID_PARAMS,
8595                                         &cp->addr, sizeof(cp->addr));
8596                 goto unlock;
8597         }
8598
8599         /* If the connection parameters don't exist for this device,
8600          * they will be created and configured with defaults.
8601          */
8602         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
8603                                 auto_conn) < 0) {
8604                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8605                                         MGMT_STATUS_FAILED, &cp->addr,
8606                                         sizeof(cp->addr));
8607                 goto unlock;
8608         } else {
8609                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
8610                                                 addr_type);
8611                 if (params)
8612                         current_flags = params->current_flags;
8613         }
8614
8615         hci_update_background_scan(hdev);
8616
8617 added:
8618         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
8619         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
8620                              SUPPORTED_DEVICE_FLAGS(), current_flags);
8621
8622         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8623                                 MGMT_STATUS_SUCCESS, &cp->addr,
8624                                 sizeof(cp->addr));
8625
8626 unlock:
8627         hci_dev_unlock(hdev);
8628         return err;
8629 }
8630
8631 static void device_removed(struct sock *sk, struct hci_dev *hdev,
8632                            bdaddr_t *bdaddr, u8 type)
8633 {
8634         struct mgmt_ev_device_removed ev;
8635
8636         bacpy(&ev.addr.bdaddr, bdaddr);
8637         ev.addr.type = type;
8638
8639         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
8640 }
8641
8642 static int remove_device(struct sock *sk, struct hci_dev *hdev,
8643                          void *data, u16 len)
8644 {
8645         struct mgmt_cp_remove_device *cp = data;
8646         int err;
8647
8648         bt_dev_dbg(hdev, "sock %p", sk);
8649
8650         hci_dev_lock(hdev);
8651
8652         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8653                 struct hci_conn_params *params;
8654                 u8 addr_type;
8655
8656                 if (!bdaddr_type_is_valid(cp->addr.type)) {
8657                         err = mgmt_cmd_complete(sk, hdev->id,
8658                                                 MGMT_OP_REMOVE_DEVICE,
8659                                                 MGMT_STATUS_INVALID_PARAMS,
8660                                                 &cp->addr, sizeof(cp->addr));
8661                         goto unlock;
8662                 }
8663
8664                 if (cp->addr.type == BDADDR_BREDR) {
8665                         err = hci_bdaddr_list_del(&hdev->accept_list,
8666                                                   &cp->addr.bdaddr,
8667                                                   cp->addr.type);
8668                         if (err) {
8669                                 err = mgmt_cmd_complete(sk, hdev->id,
8670                                                         MGMT_OP_REMOVE_DEVICE,
8671                                                         MGMT_STATUS_INVALID_PARAMS,
8672                                                         &cp->addr,
8673                                                         sizeof(cp->addr));
8674                                 goto unlock;
8675                         }
8676
8677                         hci_req_update_scan(hdev);
8678
8679                         device_removed(sk, hdev, &cp->addr.bdaddr,
8680                                        cp->addr.type);
8681                         goto complete;
8682                 }
8683
8684                 addr_type = le_addr_type(cp->addr.type);
8685
8686                 /* Kernel internally uses conn_params with resolvable private
8687                  * address, but Remove Device allows only identity addresses.
8688                  * Make sure it is enforced before calling
8689                  * hci_conn_params_lookup.
8690                  */
8691                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
8692                         err = mgmt_cmd_complete(sk, hdev->id,
8693                                                 MGMT_OP_REMOVE_DEVICE,
8694                                                 MGMT_STATUS_INVALID_PARAMS,
8695                                                 &cp->addr, sizeof(cp->addr));
8696                         goto unlock;
8697                 }
8698
8699                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
8700                                                 addr_type);
8701                 if (!params) {
8702                         err = mgmt_cmd_complete(sk, hdev->id,
8703                                                 MGMT_OP_REMOVE_DEVICE,
8704                                                 MGMT_STATUS_INVALID_PARAMS,
8705                                                 &cp->addr, sizeof(cp->addr));
8706                         goto unlock;
8707                 }
8708
8709                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
8710                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
8711                         err = mgmt_cmd_complete(sk, hdev->id,
8712                                                 MGMT_OP_REMOVE_DEVICE,
8713                                                 MGMT_STATUS_INVALID_PARAMS,
8714                                                 &cp->addr, sizeof(cp->addr));
8715                         goto unlock;
8716                 }
8717
8718                 list_del(&params->action);
8719                 list_del(&params->list);
8720                 kfree(params);
8721                 hci_update_background_scan(hdev);
8722
8723                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
8724         } else {
8725                 struct hci_conn_params *p, *tmp;
8726                 struct bdaddr_list *b, *btmp;
8727
8728                 if (cp->addr.type) {
8729                         err = mgmt_cmd_complete(sk, hdev->id,
8730                                                 MGMT_OP_REMOVE_DEVICE,
8731                                                 MGMT_STATUS_INVALID_PARAMS,
8732                                                 &cp->addr, sizeof(cp->addr));
8733                         goto unlock;
8734                 }
8735
8736                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
8737                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
8738                         list_del(&b->list);
8739                         kfree(b);
8740                 }
8741
8742                 hci_req_update_scan(hdev);
8743
8744                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
8745                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
8746                                 continue;
8747                         device_removed(sk, hdev, &p->addr, p->addr_type);
8748                         if (p->explicit_connect) {
8749                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
8750                                 continue;
8751                         }
8752                         list_del(&p->action);
8753                         list_del(&p->list);
8754                         kfree(p);
8755                 }
8756
8757                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
8758
8759                 hci_update_background_scan(hdev);
8760         }
8761
8762 complete:
8763         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
8764                                 MGMT_STATUS_SUCCESS, &cp->addr,
8765                                 sizeof(cp->addr));
8766 unlock:
8767         hci_dev_unlock(hdev);
8768         return err;
8769 }
8770
8771 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
8772                            u16 len)
8773 {
8774         struct mgmt_cp_load_conn_param *cp = data;
8775         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
8776                                      sizeof(struct mgmt_conn_param));
8777         u16 param_count, expected_len;
8778         int i;
8779
8780         if (!lmp_le_capable(hdev))
8781                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8782                                        MGMT_STATUS_NOT_SUPPORTED);
8783
8784         param_count = __le16_to_cpu(cp->param_count);
8785         if (param_count > max_param_count) {
8786                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
8787                            param_count);
8788                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8789                                        MGMT_STATUS_INVALID_PARAMS);
8790         }
8791
8792         expected_len = struct_size(cp, params, param_count);
8793         if (expected_len != len) {
8794                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
8795                            expected_len, len);
8796                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8797                                        MGMT_STATUS_INVALID_PARAMS);
8798         }
8799
8800         bt_dev_dbg(hdev, "param_count %u", param_count);
8801
8802         hci_dev_lock(hdev);
8803
8804         hci_conn_params_clear_disabled(hdev);
8805
8806         for (i = 0; i < param_count; i++) {
8807                 struct mgmt_conn_param *param = &cp->params[i];
8808                 struct hci_conn_params *hci_param;
8809                 u16 min, max, latency, timeout;
8810                 u8 addr_type;
8811
8812                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
8813                            param->addr.type);
8814
8815                 if (param->addr.type == BDADDR_LE_PUBLIC) {
8816                         addr_type = ADDR_LE_DEV_PUBLIC;
8817                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
8818                         addr_type = ADDR_LE_DEV_RANDOM;
8819                 } else {
8820                         bt_dev_err(hdev, "ignoring invalid connection parameters");
8821                         continue;
8822                 }
8823
8824                 min = le16_to_cpu(param->min_interval);
8825                 max = le16_to_cpu(param->max_interval);
8826                 latency = le16_to_cpu(param->latency);
8827                 timeout = le16_to_cpu(param->timeout);
8828
8829                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
8830                            min, max, latency, timeout);
8831
8832                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
8833                         bt_dev_err(hdev, "ignoring invalid connection parameters");
8834                         continue;
8835                 }
8836
8837                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
8838                                                 addr_type);
8839                 if (!hci_param) {
8840                         bt_dev_err(hdev, "failed to add connection parameters");
8841                         continue;
8842                 }
8843
8844                 hci_param->conn_min_interval = min;
8845                 hci_param->conn_max_interval = max;
8846                 hci_param->conn_latency = latency;
8847                 hci_param->supervision_timeout = timeout;
8848         }
8849
8850         hci_dev_unlock(hdev);
8851
8852         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
8853                                  NULL, 0);
8854 }
8855
8856 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
8857                                void *data, u16 len)
8858 {
8859         struct mgmt_cp_set_external_config *cp = data;
8860         bool changed;
8861         int err;
8862
8863         bt_dev_dbg(hdev, "sock %p", sk);
8864
8865         if (hdev_is_powered(hdev))
8866                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8867                                        MGMT_STATUS_REJECTED);
8868
8869         if (cp->config != 0x00 && cp->config != 0x01)
8870                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8871                                          MGMT_STATUS_INVALID_PARAMS);
8872
8873         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
8874                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8875                                        MGMT_STATUS_NOT_SUPPORTED);
8876
8877         hci_dev_lock(hdev);
8878
8879         if (cp->config)
8880                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
8881         else
8882                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
8883
8884         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
8885         if (err < 0)
8886                 goto unlock;
8887
8888         if (!changed)
8889                 goto unlock;
8890
8891         err = new_options(hdev, sk);
8892
8893         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
8894                 mgmt_index_removed(hdev);
8895
8896                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
8897                         hci_dev_set_flag(hdev, HCI_CONFIG);
8898                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8899
8900                         queue_work(hdev->req_workqueue, &hdev->power_on);
8901                 } else {
8902                         set_bit(HCI_RAW, &hdev->flags);
8903                         mgmt_index_added(hdev);
8904                 }
8905         }
8906
8907 unlock:
8908         hci_dev_unlock(hdev);
8909         return err;
8910 }
8911
8912 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
8913                               void *data, u16 len)
8914 {
8915         struct mgmt_cp_set_public_address *cp = data;
8916         bool changed;
8917         int err;
8918
8919         bt_dev_dbg(hdev, "sock %p", sk);
8920
8921         if (hdev_is_powered(hdev))
8922                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8923                                        MGMT_STATUS_REJECTED);
8924
8925         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
8926                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8927                                        MGMT_STATUS_INVALID_PARAMS);
8928
8929         if (!hdev->set_bdaddr)
8930                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8931                                        MGMT_STATUS_NOT_SUPPORTED);
8932
8933         hci_dev_lock(hdev);
8934
8935         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
8936         bacpy(&hdev->public_addr, &cp->bdaddr);
8937
8938         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
8939         if (err < 0)
8940                 goto unlock;
8941
8942         if (!changed)
8943                 goto unlock;
8944
8945         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
8946                 err = new_options(hdev, sk);
8947
8948         if (is_configured(hdev)) {
8949                 mgmt_index_removed(hdev);
8950
8951                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
8952
8953                 hci_dev_set_flag(hdev, HCI_CONFIG);
8954                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8955
8956                 queue_work(hdev->req_workqueue, &hdev->power_on);
8957         }
8958
8959 unlock:
8960         hci_dev_unlock(hdev);
8961         return err;
8962 }
8963
8964 #ifdef TIZEN_BT
8965 int mgmt_device_name_update(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name,
8966                             u8 name_len)
8967 {
8968         char buf[512];
8969         struct mgmt_ev_device_name_update *ev = (void *)buf;
8970         u16 eir_len = 0;
8971
8972         if (name_len <= 0)
8973                 return -EINVAL;
8974
8975         bacpy(&ev->addr.bdaddr, bdaddr);
8976         ev->addr.type = BDADDR_BREDR;
8977
8978         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
8979                                   name_len);
8980
8981         ev->eir_len = cpu_to_le16(eir_len);
8982
8983         return mgmt_event(MGMT_EV_DEVICE_NAME_UPDATE, hdev, buf,
8984                           sizeof(*ev) + eir_len, NULL);
8985 }
8986
8987 int mgmt_le_conn_update_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
8988                                u8 link_type, u8 addr_type, u8 status)
8989 {
8990         struct mgmt_ev_conn_update_failed ev;
8991
8992         bacpy(&ev.addr.bdaddr, bdaddr);
8993         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8994         ev.status = status;
8995
8996         return mgmt_event(MGMT_EV_CONN_UPDATE_FAILED, hdev,
8997                                 &ev, sizeof(ev), NULL);
8998 }
8999
9000 int mgmt_le_conn_updated(struct hci_dev *hdev, bdaddr_t *bdaddr,
9001                          u8 link_type, u8 addr_type, u16 conn_interval,
9002                          u16 conn_latency, u16 supervision_timeout)
9003 {
9004         struct mgmt_ev_conn_updated ev;
9005
9006         bacpy(&ev.addr.bdaddr, bdaddr);
9007         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9008         ev.conn_interval = cpu_to_le16(conn_interval);
9009         ev.conn_latency = cpu_to_le16(conn_latency);
9010         ev.supervision_timeout = cpu_to_le16(supervision_timeout);
9011
9012         return mgmt_event(MGMT_EV_CONN_UPDATED, hdev,
9013                                 &ev, sizeof(ev), NULL);
9014 }
9015
9016 /* le device found event - Pass adv type */
9017 void mgmt_le_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9018                 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, u8 *eir,
9019                 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, u8 adv_type)
9020 {
9021         char buf[512];
9022         struct mgmt_ev_le_device_found *ev = (void *)buf;
9023         size_t ev_size;
9024
9025         if (!hci_discovery_active(hdev) && !hci_le_discovery_active(hdev))
9026                 return;
9027
9028         /* Make sure that the buffer is big enough. The 5 extra bytes
9029          * are for the potential CoD field.
9030          */
9031         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
9032                 return;
9033
9034         memset(buf, 0, sizeof(buf));
9035
9036         bacpy(&ev->addr.bdaddr, bdaddr);
9037         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9038         ev->rssi = rssi;
9039         ev->flags = cpu_to_le32(flags);
9040         ev->adv_type = adv_type;
9041
9042         if (eir_len > 0)
9043                 memcpy(ev->eir, eir, eir_len);
9044
9045         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, NULL))
9046                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
9047                                           dev_class, 3);
9048
9049         if (scan_rsp_len > 0)
9050                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
9051
9052         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
9053         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
9054
9055         mgmt_event(MGMT_EV_LE_DEVICE_FOUND, hdev, ev, ev_size, NULL);
9056 }
9057 #endif
9058
9059 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
9060                                              u16 opcode, struct sk_buff *skb)
9061 {
9062         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
9063         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
9064         u8 *h192, *r192, *h256, *r256;
9065         struct mgmt_pending_cmd *cmd;
9066         u16 eir_len;
9067         int err;
9068
9069         bt_dev_dbg(hdev, "status %u", status);
9070
9071         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
9072         if (!cmd)
9073                 return;
9074
9075         mgmt_cp = cmd->param;
9076
9077         if (status) {
9078                 status = mgmt_status(status);
9079                 eir_len = 0;
9080
9081                 h192 = NULL;
9082                 r192 = NULL;
9083                 h256 = NULL;
9084                 r256 = NULL;
9085         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
9086                 struct hci_rp_read_local_oob_data *rp;
9087
9088                 if (skb->len != sizeof(*rp)) {
9089                         status = MGMT_STATUS_FAILED;
9090                         eir_len = 0;
9091                 } else {
9092                         status = MGMT_STATUS_SUCCESS;
9093                         rp = (void *)skb->data;
9094
9095                         eir_len = 5 + 18 + 18;
9096                         h192 = rp->hash;
9097                         r192 = rp->rand;
9098                         h256 = NULL;
9099                         r256 = NULL;
9100                 }
9101         } else {
9102                 struct hci_rp_read_local_oob_ext_data *rp;
9103
9104                 if (skb->len != sizeof(*rp)) {
9105                         status = MGMT_STATUS_FAILED;
9106                         eir_len = 0;
9107                 } else {
9108                         status = MGMT_STATUS_SUCCESS;
9109                         rp = (void *)skb->data;
9110
9111                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
9112                                 eir_len = 5 + 18 + 18;
9113                                 h192 = NULL;
9114                                 r192 = NULL;
9115                         } else {
9116                                 eir_len = 5 + 18 + 18 + 18 + 18;
9117                                 h192 = rp->hash192;
9118                                 r192 = rp->rand192;
9119                         }
9120
9121                         h256 = rp->hash256;
9122                         r256 = rp->rand256;
9123                 }
9124         }
9125
9126         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
9127         if (!mgmt_rp)
9128                 goto done;
9129
9130         if (eir_len == 0)
9131                 goto send_rsp;
9132
9133         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
9134                                   hdev->dev_class, 3);
9135
9136         if (h192 && r192) {
9137                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9138                                           EIR_SSP_HASH_C192, h192, 16);
9139                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9140                                           EIR_SSP_RAND_R192, r192, 16);
9141         }
9142
9143         if (h256 && r256) {
9144                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9145                                           EIR_SSP_HASH_C256, h256, 16);
9146                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9147                                           EIR_SSP_RAND_R256, r256, 16);
9148         }
9149
9150 send_rsp:
9151         mgmt_rp->type = mgmt_cp->type;
9152         mgmt_rp->eir_len = cpu_to_le16(eir_len);
9153
9154         err = mgmt_cmd_complete(cmd->sk, hdev->id,
9155                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
9156                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
9157         if (err < 0 || status)
9158                 goto done;
9159
9160         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
9161
9162         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9163                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
9164                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
9165 done:
9166         kfree(mgmt_rp);
9167         mgmt_pending_remove(cmd);
9168 }
9169
9170 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
9171                                   struct mgmt_cp_read_local_oob_ext_data *cp)
9172 {
9173         struct mgmt_pending_cmd *cmd;
9174         struct hci_request req;
9175         int err;
9176
9177         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
9178                                cp, sizeof(*cp));
9179         if (!cmd)
9180                 return -ENOMEM;
9181
9182         hci_req_init(&req, hdev);
9183
9184         if (bredr_sc_enabled(hdev))
9185                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
9186         else
9187                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
9188
9189         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
9190         if (err < 0) {
9191                 mgmt_pending_remove(cmd);
9192                 return err;
9193         }
9194
9195         return 0;
9196 }
9197
9198 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
9199                                    void *data, u16 data_len)
9200 {
9201         struct mgmt_cp_read_local_oob_ext_data *cp = data;
9202         struct mgmt_rp_read_local_oob_ext_data *rp;
9203         size_t rp_len;
9204         u16 eir_len;
9205         u8 status, flags, role, addr[7], hash[16], rand[16];
9206         int err;
9207
9208         bt_dev_dbg(hdev, "sock %p", sk);
9209
9210         if (hdev_is_powered(hdev)) {
9211                 switch (cp->type) {
9212                 case BIT(BDADDR_BREDR):
9213                         status = mgmt_bredr_support(hdev);
9214                         if (status)
9215                                 eir_len = 0;
9216                         else
9217                                 eir_len = 5;
9218                         break;
9219                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9220                         status = mgmt_le_support(hdev);
9221                         if (status)
9222                                 eir_len = 0;
9223                         else
9224                                 eir_len = 9 + 3 + 18 + 18 + 3;
9225                         break;
9226                 default:
9227                         status = MGMT_STATUS_INVALID_PARAMS;
9228                         eir_len = 0;
9229                         break;
9230                 }
9231         } else {
9232                 status = MGMT_STATUS_NOT_POWERED;
9233                 eir_len = 0;
9234         }
9235
9236         rp_len = sizeof(*rp) + eir_len;
9237         rp = kmalloc(rp_len, GFP_ATOMIC);
9238         if (!rp)
9239                 return -ENOMEM;
9240
9241         if (status)
9242                 goto complete;
9243
9244         hci_dev_lock(hdev);
9245
9246         eir_len = 0;
9247         switch (cp->type) {
9248         case BIT(BDADDR_BREDR):
9249                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
9250                         err = read_local_ssp_oob_req(hdev, sk, cp);
9251                         hci_dev_unlock(hdev);
9252                         if (!err)
9253                                 goto done;
9254
9255                         status = MGMT_STATUS_FAILED;
9256                         goto complete;
9257                 } else {
9258                         eir_len = eir_append_data(rp->eir, eir_len,
9259                                                   EIR_CLASS_OF_DEV,
9260                                                   hdev->dev_class, 3);
9261                 }
9262                 break;
9263         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9264                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
9265                     smp_generate_oob(hdev, hash, rand) < 0) {
9266                         hci_dev_unlock(hdev);
9267                         status = MGMT_STATUS_FAILED;
9268                         goto complete;
9269                 }
9270
9271                 /* This should return the active RPA, but since the RPA
9272                  * is only programmed on demand, it is really hard to fill
9273                  * this in at the moment. For now disallow retrieving
9274                  * local out-of-band data when privacy is in use.
9275                  *
9276                  * Returning the identity address will not help here since
9277                  * pairing happens before the identity resolving key is
9278                  * known and thus the connection establishment happens
9279                  * based on the RPA and not the identity address.
9280                  */
9281                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
9282                         hci_dev_unlock(hdev);
9283                         status = MGMT_STATUS_REJECTED;
9284                         goto complete;
9285                 }
9286
9287                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
9288                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
9289                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
9290                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
9291                         memcpy(addr, &hdev->static_addr, 6);
9292                         addr[6] = 0x01;
9293                 } else {
9294                         memcpy(addr, &hdev->bdaddr, 6);
9295                         addr[6] = 0x00;
9296                 }
9297
9298                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
9299                                           addr, sizeof(addr));
9300
9301                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
9302                         role = 0x02;
9303                 else
9304                         role = 0x01;
9305
9306                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
9307                                           &role, sizeof(role));
9308
9309                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
9310                         eir_len = eir_append_data(rp->eir, eir_len,
9311                                                   EIR_LE_SC_CONFIRM,
9312                                                   hash, sizeof(hash));
9313
9314                         eir_len = eir_append_data(rp->eir, eir_len,
9315                                                   EIR_LE_SC_RANDOM,
9316                                                   rand, sizeof(rand));
9317                 }
9318
9319                 flags = mgmt_get_adv_discov_flags(hdev);
9320
9321                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
9322                         flags |= LE_AD_NO_BREDR;
9323
9324                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
9325                                           &flags, sizeof(flags));
9326                 break;
9327         }
9328
9329         hci_dev_unlock(hdev);
9330
9331         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
9332
9333         status = MGMT_STATUS_SUCCESS;
9334
9335 complete:
9336         rp->type = cp->type;
9337         rp->eir_len = cpu_to_le16(eir_len);
9338
9339         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
9340                                 status, rp, sizeof(*rp) + eir_len);
9341         if (err < 0 || status)
9342                 goto done;
9343
9344         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9345                                  rp, sizeof(*rp) + eir_len,
9346                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
9347
9348 done:
9349         kfree(rp);
9350
9351         return err;
9352 }
9353
9354 static u32 get_supported_adv_flags(struct hci_dev *hdev)
9355 {
9356         u32 flags = 0;
9357
9358         flags |= MGMT_ADV_FLAG_CONNECTABLE;
9359         flags |= MGMT_ADV_FLAG_DISCOV;
9360         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
9361         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
9362         flags |= MGMT_ADV_FLAG_APPEARANCE;
9363         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
9364         flags |= MGMT_ADV_PARAM_DURATION;
9365         flags |= MGMT_ADV_PARAM_TIMEOUT;
9366         flags |= MGMT_ADV_PARAM_INTERVALS;
9367         flags |= MGMT_ADV_PARAM_TX_POWER;
9368         flags |= MGMT_ADV_PARAM_SCAN_RSP;
9369
9370         /* In extended adv TX_POWER returned from Set Adv Param
9371          * will be always valid.
9372          */
9373         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
9374             ext_adv_capable(hdev))
9375                 flags |= MGMT_ADV_FLAG_TX_POWER;
9376
9377         if (ext_adv_capable(hdev)) {
9378                 flags |= MGMT_ADV_FLAG_SEC_1M;
9379                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
9380                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
9381
9382                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
9383                         flags |= MGMT_ADV_FLAG_SEC_2M;
9384
9385                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
9386                         flags |= MGMT_ADV_FLAG_SEC_CODED;
9387         }
9388
9389         return flags;
9390 }
9391
9392 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
9393                              void *data, u16 data_len)
9394 {
9395         struct mgmt_rp_read_adv_features *rp;
9396         size_t rp_len;
9397         int err;
9398         struct adv_info *adv_instance;
9399         u32 supported_flags;
9400         u8 *instance;
9401
9402         bt_dev_dbg(hdev, "sock %p", sk);
9403
9404         if (!lmp_le_capable(hdev))
9405                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9406                                        MGMT_STATUS_REJECTED);
9407
9408         /* Enabling the experimental LL Privay support disables support for
9409          * advertising.
9410          */
9411         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
9412                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9413                                        MGMT_STATUS_NOT_SUPPORTED);
9414
9415         hci_dev_lock(hdev);
9416
9417         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
9418         rp = kmalloc(rp_len, GFP_ATOMIC);
9419         if (!rp) {
9420                 hci_dev_unlock(hdev);
9421                 return -ENOMEM;
9422         }
9423
9424         supported_flags = get_supported_adv_flags(hdev);
9425
9426         rp->supported_flags = cpu_to_le32(supported_flags);
9427         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
9428         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
9429         rp->max_instances = hdev->le_num_of_adv_sets;
9430         rp->num_instances = hdev->adv_instance_cnt;
9431
9432         instance = rp->instance;
9433         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
9434                 *instance = adv_instance->instance;
9435                 instance++;
9436         }
9437
9438         hci_dev_unlock(hdev);
9439
9440         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9441                                 MGMT_STATUS_SUCCESS, rp, rp_len);
9442
9443         kfree(rp);
9444
9445         return err;
9446 }
9447
9448 static u8 calculate_name_len(struct hci_dev *hdev)
9449 {
9450         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
9451
9452         return append_local_name(hdev, buf, 0);
9453 }
9454
9455 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
9456                            bool is_adv_data)
9457 {
9458         u8 max_len = HCI_MAX_AD_LENGTH;
9459
9460         if (is_adv_data) {
9461                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
9462                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
9463                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
9464                         max_len -= 3;
9465
9466                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
9467                         max_len -= 3;
9468         } else {
9469                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
9470                         max_len -= calculate_name_len(hdev);
9471
9472                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
9473                         max_len -= 4;
9474         }
9475
9476         return max_len;
9477 }
9478
9479 static bool flags_managed(u32 adv_flags)
9480 {
9481         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
9482                             MGMT_ADV_FLAG_LIMITED_DISCOV |
9483                             MGMT_ADV_FLAG_MANAGED_FLAGS);
9484 }
9485
9486 static bool tx_power_managed(u32 adv_flags)
9487 {
9488         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
9489 }
9490
9491 static bool name_managed(u32 adv_flags)
9492 {
9493         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
9494 }
9495
9496 static bool appearance_managed(u32 adv_flags)
9497 {
9498         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
9499 }
9500
9501 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
9502                               u8 len, bool is_adv_data)
9503 {
9504         int i, cur_len;
9505         u8 max_len;
9506
9507         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
9508
9509         if (len > max_len)
9510                 return false;
9511
9512         /* Make sure that the data is correctly formatted. */
9513         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
9514                 cur_len = data[i];
9515
9516                 if (!cur_len)
9517                         continue;
9518
9519                 if (data[i + 1] == EIR_FLAGS &&
9520                     (!is_adv_data || flags_managed(adv_flags)))
9521                         return false;
9522
9523                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
9524                         return false;
9525
9526                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
9527                         return false;
9528
9529                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
9530                         return false;
9531
9532                 if (data[i + 1] == EIR_APPEARANCE &&
9533                     appearance_managed(adv_flags))
9534                         return false;
9535
9536                 /* If the current field length would exceed the total data
9537                  * length, then it's invalid.
9538                  */
9539                 if (i + cur_len >= len)
9540                         return false;
9541         }
9542
9543         return true;
9544 }
9545
9546 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
9547 {
9548         u32 supported_flags, phy_flags;
9549
9550         /* The current implementation only supports a subset of the specified
9551          * flags. Also need to check mutual exclusiveness of sec flags.
9552          */
9553         supported_flags = get_supported_adv_flags(hdev);
9554         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
9555         if (adv_flags & ~supported_flags ||
9556             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
9557                 return false;
9558
9559         return true;
9560 }
9561
9562 static bool adv_busy(struct hci_dev *hdev)
9563 {
9564         return (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
9565                 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
9566                 pending_find(MGMT_OP_SET_LE, hdev) ||
9567                 pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev) ||
9568                 pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev));
9569 }
9570
9571 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
9572                                      u16 opcode)
9573 {
9574         struct mgmt_pending_cmd *cmd;
9575         struct mgmt_cp_add_advertising *cp;
9576         struct mgmt_rp_add_advertising rp;
9577         struct adv_info *adv_instance, *n;
9578         u8 instance;
9579
9580         bt_dev_dbg(hdev, "status %u", status);
9581
9582         hci_dev_lock(hdev);
9583
9584         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
9585         if (!cmd)
9586                 cmd = pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev);
9587
9588         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
9589                 if (!adv_instance->pending)
9590                         continue;
9591
9592                 if (!status) {
9593                         adv_instance->pending = false;
9594                         continue;
9595                 }
9596
9597                 instance = adv_instance->instance;
9598
9599                 if (hdev->cur_adv_instance == instance)
9600                         cancel_adv_timeout(hdev);
9601
9602                 hci_remove_adv_instance(hdev, instance);
9603                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
9604         }
9605
9606         if (!cmd)
9607                 goto unlock;
9608
9609         cp = cmd->param;
9610         rp.instance = cp->instance;
9611
9612         if (status)
9613                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9614                                 mgmt_status(status));
9615         else
9616                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9617                                   mgmt_status(status), &rp, sizeof(rp));
9618
9619         mgmt_pending_remove(cmd);
9620
9621 unlock:
9622         hci_dev_unlock(hdev);
9623 }
9624
9625 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
9626                            void *data, u16 data_len)
9627 {
9628         struct mgmt_cp_add_advertising *cp = data;
9629         struct mgmt_rp_add_advertising rp;
9630         u32 flags;
9631         u8 status;
9632         u16 timeout, duration;
9633         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
9634         u8 schedule_instance = 0;
9635         struct adv_info *next_instance;
9636         int err;
9637         struct mgmt_pending_cmd *cmd;
9638         struct hci_request req;
9639
9640         bt_dev_dbg(hdev, "sock %p", sk);
9641
9642         status = mgmt_le_support(hdev);
9643         if (status)
9644                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9645                                        status);
9646
9647         /* Enabling the experimental LL Privay support disables support for
9648          * advertising.
9649          */
9650         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
9651                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9652                                        MGMT_STATUS_NOT_SUPPORTED);
9653
9654         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9655                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9656                                        MGMT_STATUS_INVALID_PARAMS);
9657
9658         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
9659                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9660                                        MGMT_STATUS_INVALID_PARAMS);
9661
9662         flags = __le32_to_cpu(cp->flags);
9663         timeout = __le16_to_cpu(cp->timeout);
9664         duration = __le16_to_cpu(cp->duration);
9665
9666         if (!requested_adv_flags_are_valid(hdev, flags))
9667                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9668                                        MGMT_STATUS_INVALID_PARAMS);
9669
9670         hci_dev_lock(hdev);
9671
9672         if (timeout && !hdev_is_powered(hdev)) {
9673                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9674                                       MGMT_STATUS_REJECTED);
9675                 goto unlock;
9676         }
9677
9678         if (adv_busy(hdev)) {
9679                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9680                                       MGMT_STATUS_BUSY);
9681                 goto unlock;
9682         }
9683
9684         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
9685             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
9686                                cp->scan_rsp_len, false)) {
9687                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9688                                       MGMT_STATUS_INVALID_PARAMS);
9689                 goto unlock;
9690         }
9691
9692         err = hci_add_adv_instance(hdev, cp->instance, flags,
9693                                    cp->adv_data_len, cp->data,
9694                                    cp->scan_rsp_len,
9695                                    cp->data + cp->adv_data_len,
9696                                    timeout, duration,
9697                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
9698                                    hdev->le_adv_min_interval,
9699                                    hdev->le_adv_max_interval);
9700         if (err < 0) {
9701                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9702                                       MGMT_STATUS_FAILED);
9703                 goto unlock;
9704         }
9705
9706         /* Only trigger an advertising added event if a new instance was
9707          * actually added.
9708          */
9709         if (hdev->adv_instance_cnt > prev_instance_cnt)
9710                 mgmt_advertising_added(sk, hdev, cp->instance);
9711
9712         if (hdev->cur_adv_instance == cp->instance) {
9713                 /* If the currently advertised instance is being changed then
9714                  * cancel the current advertising and schedule the next
9715                  * instance. If there is only one instance then the overridden
9716                  * advertising data will be visible right away.
9717                  */
9718                 cancel_adv_timeout(hdev);
9719
9720                 next_instance = hci_get_next_instance(hdev, cp->instance);
9721                 if (next_instance)
9722                         schedule_instance = next_instance->instance;
9723         } else if (!hdev->adv_instance_timeout) {
9724                 /* Immediately advertise the new instance if no other
9725                  * instance is currently being advertised.
9726                  */
9727                 schedule_instance = cp->instance;
9728         }
9729
9730         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
9731          * there is no instance to be advertised then we have no HCI
9732          * communication to make. Simply return.
9733          */
9734         if (!hdev_is_powered(hdev) ||
9735             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
9736             !schedule_instance) {
9737                 rp.instance = cp->instance;
9738                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9739                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9740                 goto unlock;
9741         }
9742
9743         /* We're good to go, update advertising data, parameters, and start
9744          * advertising.
9745          */
9746         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
9747                                data_len);
9748         if (!cmd) {
9749                 err = -ENOMEM;
9750                 goto unlock;
9751         }
9752
9753         hci_req_init(&req, hdev);
9754
9755         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
9756
9757         if (!err)
9758                 err = hci_req_run(&req, add_advertising_complete);
9759
9760         if (err < 0) {
9761                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9762                                       MGMT_STATUS_FAILED);
9763                 mgmt_pending_remove(cmd);
9764         }
9765
9766 unlock:
9767         hci_dev_unlock(hdev);
9768
9769         return err;
9770 }
9771
9772 static void add_ext_adv_params_complete(struct hci_dev *hdev, u8 status,
9773                                         u16 opcode)
9774 {
9775         struct mgmt_pending_cmd *cmd;
9776         struct mgmt_cp_add_ext_adv_params *cp;
9777         struct mgmt_rp_add_ext_adv_params rp;
9778         struct adv_info *adv_instance;
9779         u32 flags;
9780
9781         BT_DBG("%s", hdev->name);
9782
9783         hci_dev_lock(hdev);
9784
9785         cmd = pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev);
9786         if (!cmd)
9787                 goto unlock;
9788
9789         cp = cmd->param;
9790         adv_instance = hci_find_adv_instance(hdev, cp->instance);
9791         if (!adv_instance)
9792                 goto unlock;
9793
9794         rp.instance = cp->instance;
9795         rp.tx_power = adv_instance->tx_power;
9796
9797         /* While we're at it, inform userspace of the available space for this
9798          * advertisement, given the flags that will be used.
9799          */
9800         flags = __le32_to_cpu(cp->flags);
9801         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9802         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9803
9804         if (status) {
9805                 /* If this advertisement was previously advertising and we
9806                  * failed to update it, we signal that it has been removed and
9807                  * delete its structure
9808                  */
9809                 if (!adv_instance->pending)
9810                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
9811
9812                 hci_remove_adv_instance(hdev, cp->instance);
9813
9814                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9815                                 mgmt_status(status));
9816
9817         } else {
9818                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9819                                   mgmt_status(status), &rp, sizeof(rp));
9820         }
9821
9822 unlock:
9823         if (cmd)
9824                 mgmt_pending_remove(cmd);
9825
9826         hci_dev_unlock(hdev);
9827 }
9828
9829 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
9830                               void *data, u16 data_len)
9831 {
9832         struct mgmt_cp_add_ext_adv_params *cp = data;
9833         struct mgmt_rp_add_ext_adv_params rp;
9834         struct mgmt_pending_cmd *cmd = NULL;
9835         struct adv_info *adv_instance;
9836         struct hci_request req;
9837         u32 flags, min_interval, max_interval;
9838         u16 timeout, duration;
9839         u8 status;
9840         s8 tx_power;
9841         int err;
9842
9843         BT_DBG("%s", hdev->name);
9844
9845         status = mgmt_le_support(hdev);
9846         if (status)
9847                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9848                                        status);
9849
9850         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9851                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9852                                        MGMT_STATUS_INVALID_PARAMS);
9853
9854         /* The purpose of breaking add_advertising into two separate MGMT calls
9855          * for params and data is to allow more parameters to be added to this
9856          * structure in the future. For this reason, we verify that we have the
9857          * bare minimum structure we know of when the interface was defined. Any
9858          * extra parameters we don't know about will be ignored in this request.
9859          */
9860         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
9861                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9862                                        MGMT_STATUS_INVALID_PARAMS);
9863
9864         flags = __le32_to_cpu(cp->flags);
9865
9866         if (!requested_adv_flags_are_valid(hdev, flags))
9867                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9868                                        MGMT_STATUS_INVALID_PARAMS);
9869
9870         hci_dev_lock(hdev);
9871
9872         /* In new interface, we require that we are powered to register */
9873         if (!hdev_is_powered(hdev)) {
9874                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9875                                       MGMT_STATUS_REJECTED);
9876                 goto unlock;
9877         }
9878
9879         if (adv_busy(hdev)) {
9880                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9881                                       MGMT_STATUS_BUSY);
9882                 goto unlock;
9883         }
9884
9885         /* Parse defined parameters from request, use defaults otherwise */
9886         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
9887                   __le16_to_cpu(cp->timeout) : 0;
9888
9889         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
9890                    __le16_to_cpu(cp->duration) :
9891                    hdev->def_multi_adv_rotation_duration;
9892
9893         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
9894                        __le32_to_cpu(cp->min_interval) :
9895                        hdev->le_adv_min_interval;
9896
9897         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
9898                        __le32_to_cpu(cp->max_interval) :
9899                        hdev->le_adv_max_interval;
9900
9901         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
9902                    cp->tx_power :
9903                    HCI_ADV_TX_POWER_NO_PREFERENCE;
9904
9905         /* Create advertising instance with no advertising or response data */
9906         err = hci_add_adv_instance(hdev, cp->instance, flags,
9907                                    0, NULL, 0, NULL, timeout, duration,
9908                                    tx_power, min_interval, max_interval);
9909
9910         if (err < 0) {
9911                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9912                                       MGMT_STATUS_FAILED);
9913                 goto unlock;
9914         }
9915
9916         /* Submit request for advertising params if ext adv available */
9917         if (ext_adv_capable(hdev)) {
9918                 hci_req_init(&req, hdev);
9919                 adv_instance = hci_find_adv_instance(hdev, cp->instance);
9920
9921                 /* Updating parameters of an active instance will return a
9922                  * Command Disallowed error, so we must first disable the
9923                  * instance if it is active.
9924                  */
9925                 if (!adv_instance->pending)
9926                         __hci_req_disable_ext_adv_instance(&req, cp->instance);
9927
9928                 __hci_req_setup_ext_adv_instance(&req, cp->instance);
9929
9930                 err = hci_req_run(&req, add_ext_adv_params_complete);
9931
9932                 if (!err)
9933                         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_PARAMS,
9934                                                hdev, data, data_len);
9935                 if (!cmd) {
9936                         err = -ENOMEM;
9937                         hci_remove_adv_instance(hdev, cp->instance);
9938                         goto unlock;
9939                 }
9940
9941         } else {
9942                 rp.instance = cp->instance;
9943                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
9944                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9945                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9946                 err = mgmt_cmd_complete(sk, hdev->id,
9947                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
9948                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9949         }
9950
9951 unlock:
9952         hci_dev_unlock(hdev);
9953
9954         return err;
9955 }
9956
9957 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
9958                             u16 data_len)
9959 {
9960         struct mgmt_cp_add_ext_adv_data *cp = data;
9961         struct mgmt_rp_add_ext_adv_data rp;
9962         u8 schedule_instance = 0;
9963         struct adv_info *next_instance;
9964         struct adv_info *adv_instance;
9965         int err = 0;
9966         struct mgmt_pending_cmd *cmd;
9967         struct hci_request req;
9968
9969         BT_DBG("%s", hdev->name);
9970
9971         hci_dev_lock(hdev);
9972
9973         adv_instance = hci_find_adv_instance(hdev, cp->instance);
9974
9975         if (!adv_instance) {
9976                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9977                                       MGMT_STATUS_INVALID_PARAMS);
9978                 goto unlock;
9979         }
9980
9981         /* In new interface, we require that we are powered to register */
9982         if (!hdev_is_powered(hdev)) {
9983                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9984                                       MGMT_STATUS_REJECTED);
9985                 goto clear_new_instance;
9986         }
9987
9988         if (adv_busy(hdev)) {
9989                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9990                                       MGMT_STATUS_BUSY);
9991                 goto clear_new_instance;
9992         }
9993
9994         /* Validate new data */
9995         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
9996                                cp->adv_data_len, true) ||
9997             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
9998                                cp->adv_data_len, cp->scan_rsp_len, false)) {
9999                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10000                                       MGMT_STATUS_INVALID_PARAMS);
10001                 goto clear_new_instance;
10002         }
10003
10004         /* Set the data in the advertising instance */
10005         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
10006                                   cp->data, cp->scan_rsp_len,
10007                                   cp->data + cp->adv_data_len);
10008
10009         /* We're good to go, update advertising data, parameters, and start
10010          * advertising.
10011          */
10012
10013         hci_req_init(&req, hdev);
10014
10015         hci_req_add(&req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
10016
10017         if (ext_adv_capable(hdev)) {
10018                 __hci_req_update_adv_data(&req, cp->instance);
10019                 __hci_req_update_scan_rsp_data(&req, cp->instance);
10020                 __hci_req_enable_ext_advertising(&req, cp->instance);
10021
10022         } else {
10023                 /* If using software rotation, determine next instance to use */
10024
10025                 if (hdev->cur_adv_instance == cp->instance) {
10026                         /* If the currently advertised instance is being changed
10027                          * then cancel the current advertising and schedule the
10028                          * next instance. If there is only one instance then the
10029                          * overridden advertising data will be visible right
10030                          * away
10031                          */
10032                         cancel_adv_timeout(hdev);
10033
10034                         next_instance = hci_get_next_instance(hdev,
10035                                                               cp->instance);
10036                         if (next_instance)
10037                                 schedule_instance = next_instance->instance;
10038                 } else if (!hdev->adv_instance_timeout) {
10039                         /* Immediately advertise the new instance if no other
10040                          * instance is currently being advertised.
10041                          */
10042                         schedule_instance = cp->instance;
10043                 }
10044
10045                 /* If the HCI_ADVERTISING flag is set or there is no instance to
10046                  * be advertised then we have no HCI communication to make.
10047                  * Simply return.
10048                  */
10049                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
10050                     !schedule_instance) {
10051                         if (adv_instance->pending) {
10052                                 mgmt_advertising_added(sk, hdev, cp->instance);
10053                                 adv_instance->pending = false;
10054                         }
10055                         rp.instance = cp->instance;
10056                         err = mgmt_cmd_complete(sk, hdev->id,
10057                                                 MGMT_OP_ADD_EXT_ADV_DATA,
10058                                                 MGMT_STATUS_SUCCESS, &rp,
10059                                                 sizeof(rp));
10060                         goto unlock;
10061                 }
10062
10063                 err = __hci_req_schedule_adv_instance(&req, schedule_instance,
10064                                                       true);
10065         }
10066
10067         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
10068                                data_len);
10069         if (!cmd) {
10070                 err = -ENOMEM;
10071                 goto clear_new_instance;
10072         }
10073
10074         if (!err)
10075                 err = hci_req_run(&req, add_advertising_complete);
10076
10077         if (err < 0) {
10078                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10079                                       MGMT_STATUS_FAILED);
10080                 mgmt_pending_remove(cmd);
10081                 goto clear_new_instance;
10082         }
10083
10084         /* We were successful in updating data, so trigger advertising_added
10085          * event if this is an instance that wasn't previously advertising. If
10086          * a failure occurs in the requests we initiated, we will remove the
10087          * instance again in add_advertising_complete
10088          */
10089         if (adv_instance->pending)
10090                 mgmt_advertising_added(sk, hdev, cp->instance);
10091
10092         goto unlock;
10093
10094 clear_new_instance:
10095         hci_remove_adv_instance(hdev, cp->instance);
10096
10097 unlock:
10098         hci_dev_unlock(hdev);
10099
10100         return err;
10101 }
10102
10103 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
10104                                         u16 opcode)
10105 {
10106         struct mgmt_pending_cmd *cmd;
10107         struct mgmt_cp_remove_advertising *cp;
10108         struct mgmt_rp_remove_advertising rp;
10109
10110         bt_dev_dbg(hdev, "status %u", status);
10111
10112         hci_dev_lock(hdev);
10113
10114         /* A failure status here only means that we failed to disable
10115          * advertising. Otherwise, the advertising instance has been removed,
10116          * so report success.
10117          */
10118         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
10119         if (!cmd)
10120                 goto unlock;
10121
10122         cp = cmd->param;
10123         rp.instance = cp->instance;
10124
10125         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
10126                           &rp, sizeof(rp));
10127         mgmt_pending_remove(cmd);
10128
10129 unlock:
10130         hci_dev_unlock(hdev);
10131 }
10132
10133 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
10134                               void *data, u16 data_len)
10135 {
10136         struct mgmt_cp_remove_advertising *cp = data;
10137         struct mgmt_rp_remove_advertising rp;
10138         struct mgmt_pending_cmd *cmd;
10139         struct hci_request req;
10140         int err;
10141
10142         bt_dev_dbg(hdev, "sock %p", sk);
10143
10144         /* Enabling the experimental LL Privay support disables support for
10145          * advertising.
10146          */
10147         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
10148                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
10149                                        MGMT_STATUS_NOT_SUPPORTED);
10150
10151         hci_dev_lock(hdev);
10152
10153         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
10154                 err = mgmt_cmd_status(sk, hdev->id,
10155                                       MGMT_OP_REMOVE_ADVERTISING,
10156                                       MGMT_STATUS_INVALID_PARAMS);
10157                 goto unlock;
10158         }
10159
10160         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
10161             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
10162             pending_find(MGMT_OP_SET_LE, hdev)) {
10163                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10164                                       MGMT_STATUS_BUSY);
10165                 goto unlock;
10166         }
10167
10168         if (list_empty(&hdev->adv_instances)) {
10169                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10170                                       MGMT_STATUS_INVALID_PARAMS);
10171                 goto unlock;
10172         }
10173
10174         hci_req_init(&req, hdev);
10175
10176         /* If we use extended advertising, instance is disabled and removed */
10177         if (ext_adv_capable(hdev)) {
10178                 __hci_req_disable_ext_adv_instance(&req, cp->instance);
10179                 __hci_req_remove_ext_adv_instance(&req, cp->instance);
10180         }
10181
10182         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
10183
10184         if (list_empty(&hdev->adv_instances))
10185                 __hci_req_disable_advertising(&req);
10186
10187         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
10188          * flag is set or the device isn't powered then we have no HCI
10189          * communication to make. Simply return.
10190          */
10191         if (skb_queue_empty(&req.cmd_q) ||
10192             !hdev_is_powered(hdev) ||
10193             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
10194                 hci_req_purge(&req);
10195                 rp.instance = cp->instance;
10196                 err = mgmt_cmd_complete(sk, hdev->id,
10197                                         MGMT_OP_REMOVE_ADVERTISING,
10198                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10199                 goto unlock;
10200         }
10201
10202         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
10203                                data_len);
10204         if (!cmd) {
10205                 err = -ENOMEM;
10206                 goto unlock;
10207         }
10208
10209         err = hci_req_run(&req, remove_advertising_complete);
10210         if (err < 0)
10211                 mgmt_pending_remove(cmd);
10212
10213 unlock:
10214         hci_dev_unlock(hdev);
10215
10216         return err;
10217 }
10218
10219 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
10220                              void *data, u16 data_len)
10221 {
10222         struct mgmt_cp_get_adv_size_info *cp = data;
10223         struct mgmt_rp_get_adv_size_info rp;
10224         u32 flags, supported_flags;
10225         int err;
10226
10227         bt_dev_dbg(hdev, "sock %p", sk);
10228
10229         if (!lmp_le_capable(hdev))
10230                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10231                                        MGMT_STATUS_REJECTED);
10232
10233         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10234                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10235                                        MGMT_STATUS_INVALID_PARAMS);
10236
10237         flags = __le32_to_cpu(cp->flags);
10238
10239         /* The current implementation only supports a subset of the specified
10240          * flags.
10241          */
10242         supported_flags = get_supported_adv_flags(hdev);
10243         if (flags & ~supported_flags)
10244                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10245                                        MGMT_STATUS_INVALID_PARAMS);
10246
10247         rp.instance = cp->instance;
10248         rp.flags = cp->flags;
10249         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10250         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10251
10252         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10253                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10254
10255         return err;
10256 }
10257
10258 static const struct hci_mgmt_handler mgmt_handlers[] = {
10259         { NULL }, /* 0x0000 (no command) */
10260         { read_version,            MGMT_READ_VERSION_SIZE,
10261                                                 HCI_MGMT_NO_HDEV |
10262                                                 HCI_MGMT_UNTRUSTED },
10263         { read_commands,           MGMT_READ_COMMANDS_SIZE,
10264                                                 HCI_MGMT_NO_HDEV |
10265                                                 HCI_MGMT_UNTRUSTED },
10266         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
10267                                                 HCI_MGMT_NO_HDEV |
10268                                                 HCI_MGMT_UNTRUSTED },
10269         { read_controller_info,    MGMT_READ_INFO_SIZE,
10270                                                 HCI_MGMT_UNTRUSTED },
10271         { set_powered,             MGMT_SETTING_SIZE },
10272         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
10273         { set_connectable,         MGMT_SETTING_SIZE },
10274         { set_fast_connectable,    MGMT_SETTING_SIZE },
10275         { set_bondable,            MGMT_SETTING_SIZE },
10276         { set_link_security,       MGMT_SETTING_SIZE },
10277         { set_ssp,                 MGMT_SETTING_SIZE },
10278         { set_hs,                  MGMT_SETTING_SIZE },
10279         { set_le,                  MGMT_SETTING_SIZE },
10280         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
10281         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
10282         { add_uuid,                MGMT_ADD_UUID_SIZE },
10283         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
10284         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
10285                                                 HCI_MGMT_VAR_LEN },
10286         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
10287                                                 HCI_MGMT_VAR_LEN },
10288         { disconnect,              MGMT_DISCONNECT_SIZE },
10289         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
10290         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
10291         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
10292         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
10293         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
10294         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
10295         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
10296         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
10297         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
10298         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
10299         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
10300         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
10301         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
10302                                                 HCI_MGMT_VAR_LEN },
10303         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
10304         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
10305         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
10306         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
10307         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
10308         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
10309         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
10310         { set_advertising,         MGMT_SETTING_SIZE },
10311         { set_bredr,               MGMT_SETTING_SIZE },
10312         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
10313         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
10314         { set_secure_conn,         MGMT_SETTING_SIZE },
10315         { set_debug_keys,          MGMT_SETTING_SIZE },
10316         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
10317         { load_irks,               MGMT_LOAD_IRKS_SIZE,
10318                                                 HCI_MGMT_VAR_LEN },
10319         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
10320         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
10321         { add_device,              MGMT_ADD_DEVICE_SIZE },
10322         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
10323         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
10324                                                 HCI_MGMT_VAR_LEN },
10325         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
10326                                                 HCI_MGMT_NO_HDEV |
10327                                                 HCI_MGMT_UNTRUSTED },
10328         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
10329                                                 HCI_MGMT_UNCONFIGURED |
10330                                                 HCI_MGMT_UNTRUSTED },
10331         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
10332                                                 HCI_MGMT_UNCONFIGURED },
10333         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
10334                                                 HCI_MGMT_UNCONFIGURED },
10335         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
10336                                                 HCI_MGMT_VAR_LEN },
10337         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
10338         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
10339                                                 HCI_MGMT_NO_HDEV |
10340                                                 HCI_MGMT_UNTRUSTED },
10341         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
10342         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
10343                                                 HCI_MGMT_VAR_LEN },
10344         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
10345         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
10346         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
10347         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
10348                                                 HCI_MGMT_UNTRUSTED },
10349         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
10350         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
10351         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
10352         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
10353                                                 HCI_MGMT_VAR_LEN },
10354         { set_wideband_speech,     MGMT_SETTING_SIZE },
10355         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
10356                                                 HCI_MGMT_UNTRUSTED },
10357         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
10358                                                 HCI_MGMT_UNTRUSTED |
10359                                                 HCI_MGMT_HDEV_OPTIONAL },
10360         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
10361                                                 HCI_MGMT_VAR_LEN |
10362                                                 HCI_MGMT_HDEV_OPTIONAL },
10363         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
10364                                                 HCI_MGMT_UNTRUSTED },
10365         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
10366                                                 HCI_MGMT_VAR_LEN },
10367         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
10368                                                 HCI_MGMT_UNTRUSTED },
10369         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
10370                                                 HCI_MGMT_VAR_LEN },
10371         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
10372         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
10373         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
10374         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
10375                                                 HCI_MGMT_VAR_LEN },
10376         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
10377         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
10378                                                 HCI_MGMT_VAR_LEN },
10379         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
10380                                                 HCI_MGMT_VAR_LEN },
10381         { add_adv_patterns_monitor_rssi,
10382                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
10383                                                 HCI_MGMT_VAR_LEN },
10384 };
10385
10386 #ifdef TIZEN_BT
10387 static const struct hci_mgmt_handler tizen_mgmt_handlers[] = {
10388         { NULL }, /* 0x0000 (no command) */
10389         { set_advertising_params,  MGMT_SET_ADVERTISING_PARAMS_SIZE },
10390         { set_advertising_data,    MGMT_SET_ADV_MIN_APP_DATA_SIZE,
10391                                                 HCI_MGMT_VAR_LEN },
10392         { set_scan_rsp_data,       MGMT_SET_SCAN_RSP_MIN_APP_DATA_SIZE,
10393                                                 HCI_MGMT_VAR_LEN },
10394         { add_white_list,          MGMT_ADD_DEV_WHITE_LIST_SIZE },
10395         { remove_from_white_list,  MGMT_REMOVE_DEV_FROM_WHITE_LIST_SIZE },
10396         { clear_white_list,        MGMT_OP_CLEAR_DEV_WHITE_LIST_SIZE },
10397         { set_enable_rssi,         MGMT_SET_RSSI_ENABLE_SIZE },
10398         { get_raw_rssi,            MGMT_GET_RAW_RSSI_SIZE },
10399         { set_disable_threshold,   MGMT_SET_RSSI_DISABLE_SIZE },
10400         { start_le_discovery,      MGMT_START_LE_DISCOVERY_SIZE },
10401         { stop_le_discovery,       MGMT_STOP_LE_DISCOVERY_SIZE },
10402         { disable_le_auto_connect, MGMT_DISABLE_LE_AUTO_CONNECT_SIZE },
10403         { le_conn_update,          MGMT_LE_CONN_UPDATE_SIZE },
10404         { set_manufacturer_data,   MGMT_SET_MANUFACTURER_DATA_SIZE },
10405         { le_set_scan_params,      MGMT_LE_SET_SCAN_PARAMS_SIZE },
10406         { set_voice_setting,       MGMT_SET_VOICE_SETTING_SIZE },
10407         { get_adv_tx_power,        MGMT_GET_ADV_TX_POWER_SIZE },
10408 };
10409 #endif
10410
10411 void mgmt_index_added(struct hci_dev *hdev)
10412 {
10413         struct mgmt_ev_ext_index ev;
10414
10415         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10416                 return;
10417
10418         switch (hdev->dev_type) {
10419         case HCI_PRIMARY:
10420                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10421                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
10422                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10423                         ev.type = 0x01;
10424                 } else {
10425                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
10426                                          HCI_MGMT_INDEX_EVENTS);
10427                         ev.type = 0x00;
10428                 }
10429                 break;
10430         case HCI_AMP:
10431                 ev.type = 0x02;
10432                 break;
10433         default:
10434                 return;
10435         }
10436
10437         ev.bus = hdev->bus;
10438
10439         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
10440                          HCI_MGMT_EXT_INDEX_EVENTS);
10441 }
10442
10443 void mgmt_index_removed(struct hci_dev *hdev)
10444 {
10445         struct mgmt_ev_ext_index ev;
10446         u8 status = MGMT_STATUS_INVALID_INDEX;
10447
10448         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10449                 return;
10450
10451         switch (hdev->dev_type) {
10452         case HCI_PRIMARY:
10453                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
10454
10455                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10456                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
10457                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10458                         ev.type = 0x01;
10459                 } else {
10460                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
10461                                          HCI_MGMT_INDEX_EVENTS);
10462                         ev.type = 0x00;
10463                 }
10464                 break;
10465         case HCI_AMP:
10466                 ev.type = 0x02;
10467                 break;
10468         default:
10469                 return;
10470         }
10471
10472         ev.bus = hdev->bus;
10473
10474         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
10475                          HCI_MGMT_EXT_INDEX_EVENTS);
10476 }
10477
10478 /* This function requires the caller holds hdev->lock */
10479 static void restart_le_actions(struct hci_dev *hdev)
10480 {
10481         struct hci_conn_params *p;
10482
10483         list_for_each_entry(p, &hdev->le_conn_params, list) {
10484                 /* Needed for AUTO_OFF case where might not "really"
10485                  * have been powered off.
10486                  */
10487                 list_del_init(&p->action);
10488
10489                 switch (p->auto_connect) {
10490                 case HCI_AUTO_CONN_DIRECT:
10491                 case HCI_AUTO_CONN_ALWAYS:
10492                         list_add(&p->action, &hdev->pend_le_conns);
10493                         break;
10494                 case HCI_AUTO_CONN_REPORT:
10495                         list_add(&p->action, &hdev->pend_le_reports);
10496                         break;
10497                 default:
10498                         break;
10499                 }
10500         }
10501 }
10502
10503 void mgmt_power_on(struct hci_dev *hdev, int err)
10504 {
10505         struct cmd_lookup match = { NULL, hdev };
10506
10507         bt_dev_dbg(hdev, "err %d", err);
10508
10509         hci_dev_lock(hdev);
10510
10511         if (!err) {
10512                 restart_le_actions(hdev);
10513                 hci_update_background_scan(hdev);
10514         }
10515
10516         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
10517
10518         new_settings(hdev, match.sk);
10519
10520         if (match.sk)
10521                 sock_put(match.sk);
10522
10523         hci_dev_unlock(hdev);
10524 }
10525
10526 void __mgmt_power_off(struct hci_dev *hdev)
10527 {
10528         struct cmd_lookup match = { NULL, hdev };
10529         u8 status, zero_cod[] = { 0, 0, 0 };
10530
10531         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
10532
10533         /* If the power off is because of hdev unregistration let
10534          * use the appropriate INVALID_INDEX status. Otherwise use
10535          * NOT_POWERED. We cover both scenarios here since later in
10536          * mgmt_index_removed() any hci_conn callbacks will have already
10537          * been triggered, potentially causing misleading DISCONNECTED
10538          * status responses.
10539          */
10540         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
10541                 status = MGMT_STATUS_INVALID_INDEX;
10542         else
10543                 status = MGMT_STATUS_NOT_POWERED;
10544
10545         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
10546
10547         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
10548                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
10549                                    zero_cod, sizeof(zero_cod),
10550                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
10551                 ext_info_changed(hdev, NULL);
10552         }
10553
10554         new_settings(hdev, match.sk);
10555
10556         if (match.sk)
10557                 sock_put(match.sk);
10558 }
10559
10560 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
10561 {
10562         struct mgmt_pending_cmd *cmd;
10563         u8 status;
10564
10565         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
10566         if (!cmd)
10567                 return;
10568
10569         if (err == -ERFKILL)
10570                 status = MGMT_STATUS_RFKILLED;
10571         else
10572                 status = MGMT_STATUS_FAILED;
10573
10574         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
10575
10576         mgmt_pending_remove(cmd);
10577 }
10578
10579 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
10580                        bool persistent)
10581 {
10582         struct mgmt_ev_new_link_key ev;
10583
10584         memset(&ev, 0, sizeof(ev));
10585
10586         ev.store_hint = persistent;
10587         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
10588         ev.key.addr.type = BDADDR_BREDR;
10589         ev.key.type = key->type;
10590         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
10591         ev.key.pin_len = key->pin_len;
10592
10593         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
10594 }
10595
10596 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
10597 {
10598         switch (ltk->type) {
10599         case SMP_LTK:
10600         case SMP_LTK_RESPONDER:
10601                 if (ltk->authenticated)
10602                         return MGMT_LTK_AUTHENTICATED;
10603                 return MGMT_LTK_UNAUTHENTICATED;
10604         case SMP_LTK_P256:
10605                 if (ltk->authenticated)
10606                         return MGMT_LTK_P256_AUTH;
10607                 return MGMT_LTK_P256_UNAUTH;
10608         case SMP_LTK_P256_DEBUG:
10609                 return MGMT_LTK_P256_DEBUG;
10610         }
10611
10612         return MGMT_LTK_UNAUTHENTICATED;
10613 }
10614
10615 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
10616 {
10617         struct mgmt_ev_new_long_term_key ev;
10618
10619         memset(&ev, 0, sizeof(ev));
10620
10621         /* Devices using resolvable or non-resolvable random addresses
10622          * without providing an identity resolving key don't require
10623          * to store long term keys. Their addresses will change the
10624          * next time around.
10625          *
10626          * Only when a remote device provides an identity address
10627          * make sure the long term key is stored. If the remote
10628          * identity is known, the long term keys are internally
10629          * mapped to the identity address. So allow static random
10630          * and public addresses here.
10631          */
10632         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
10633             (key->bdaddr.b[5] & 0xc0) != 0xc0)
10634                 ev.store_hint = 0x00;
10635         else
10636                 ev.store_hint = persistent;
10637
10638         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
10639         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
10640         ev.key.type = mgmt_ltk_type(key);
10641         ev.key.enc_size = key->enc_size;
10642         ev.key.ediv = key->ediv;
10643         ev.key.rand = key->rand;
10644
10645         if (key->type == SMP_LTK)
10646                 ev.key.initiator = 1;
10647
10648         /* Make sure we copy only the significant bytes based on the
10649          * encryption key size, and set the rest of the value to zeroes.
10650          */
10651         memcpy(ev.key.val, key->val, key->enc_size);
10652         memset(ev.key.val + key->enc_size, 0,
10653                sizeof(ev.key.val) - key->enc_size);
10654
10655         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
10656 }
10657
10658 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
10659 {
10660         struct mgmt_ev_new_irk ev;
10661
10662         memset(&ev, 0, sizeof(ev));
10663
10664         ev.store_hint = persistent;
10665
10666         bacpy(&ev.rpa, &irk->rpa);
10667         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
10668         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
10669         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
10670
10671         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
10672 }
10673
10674 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
10675                    bool persistent)
10676 {
10677         struct mgmt_ev_new_csrk ev;
10678
10679         memset(&ev, 0, sizeof(ev));
10680
10681         /* Devices using resolvable or non-resolvable random addresses
10682          * without providing an identity resolving key don't require
10683          * to store signature resolving keys. Their addresses will change
10684          * the next time around.
10685          *
10686          * Only when a remote device provides an identity address
10687          * make sure the signature resolving key is stored. So allow
10688          * static random and public addresses here.
10689          */
10690         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
10691             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
10692                 ev.store_hint = 0x00;
10693         else
10694                 ev.store_hint = persistent;
10695
10696         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
10697         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
10698         ev.key.type = csrk->type;
10699         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
10700
10701         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
10702 }
10703
10704 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
10705                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
10706                          u16 max_interval, u16 latency, u16 timeout)
10707 {
10708         struct mgmt_ev_new_conn_param ev;
10709
10710         if (!hci_is_identity_address(bdaddr, bdaddr_type))
10711                 return;
10712
10713         memset(&ev, 0, sizeof(ev));
10714         bacpy(&ev.addr.bdaddr, bdaddr);
10715         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
10716         ev.store_hint = store_hint;
10717         ev.min_interval = cpu_to_le16(min_interval);
10718         ev.max_interval = cpu_to_le16(max_interval);
10719         ev.latency = cpu_to_le16(latency);
10720         ev.timeout = cpu_to_le16(timeout);
10721
10722         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
10723 }
10724
10725 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
10726                            u8 *name, u8 name_len)
10727 {
10728         char buf[512];
10729         struct mgmt_ev_device_connected *ev = (void *) buf;
10730         u16 eir_len = 0;
10731         u32 flags = 0;
10732
10733         bacpy(&ev->addr.bdaddr, &conn->dst);
10734         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10735
10736         if (conn->out)
10737                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
10738
10739         ev->flags = __cpu_to_le32(flags);
10740
10741         /* We must ensure that the EIR Data fields are ordered and
10742          * unique. Keep it simple for now and avoid the problem by not
10743          * adding any BR/EDR data to the LE adv.
10744          */
10745         if (conn->le_adv_data_len > 0) {
10746                 memcpy(&ev->eir[eir_len],
10747                        conn->le_adv_data, conn->le_adv_data_len);
10748                 eir_len = conn->le_adv_data_len;
10749         } else {
10750                 if (name_len > 0)
10751                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
10752                                                   name, name_len);
10753
10754                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
10755                         eir_len = eir_append_data(ev->eir, eir_len,
10756                                                   EIR_CLASS_OF_DEV,
10757                                                   conn->dev_class, 3);
10758         }
10759
10760         ev->eir_len = cpu_to_le16(eir_len);
10761
10762         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
10763                     sizeof(*ev) + eir_len, NULL);
10764 }
10765
10766 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
10767 {
10768         struct sock **sk = data;
10769
10770         cmd->cmd_complete(cmd, 0);
10771
10772         *sk = cmd->sk;
10773         sock_hold(*sk);
10774
10775         mgmt_pending_remove(cmd);
10776 }
10777
10778 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
10779 {
10780         struct hci_dev *hdev = data;
10781         struct mgmt_cp_unpair_device *cp = cmd->param;
10782
10783         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
10784
10785         cmd->cmd_complete(cmd, 0);
10786         mgmt_pending_remove(cmd);
10787 }
10788
10789 bool mgmt_powering_down(struct hci_dev *hdev)
10790 {
10791         struct mgmt_pending_cmd *cmd;
10792         struct mgmt_mode *cp;
10793
10794         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
10795         if (!cmd)
10796                 return false;
10797
10798         cp = cmd->param;
10799         if (!cp->val)
10800                 return true;
10801
10802         return false;
10803 }
10804
10805 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
10806                               u8 link_type, u8 addr_type, u8 reason,
10807                               bool mgmt_connected)
10808 {
10809         struct mgmt_ev_device_disconnected ev;
10810         struct sock *sk = NULL;
10811
10812         /* The connection is still in hci_conn_hash so test for 1
10813          * instead of 0 to know if this is the last one.
10814          */
10815         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
10816                 cancel_delayed_work(&hdev->power_off);
10817                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
10818         }
10819
10820         if (!mgmt_connected)
10821                 return;
10822
10823         if (link_type != ACL_LINK && link_type != LE_LINK)
10824                 return;
10825
10826         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
10827
10828         bacpy(&ev.addr.bdaddr, bdaddr);
10829         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10830         ev.reason = reason;
10831
10832         /* Report disconnects due to suspend */
10833         if (hdev->suspended)
10834                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
10835
10836         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
10837
10838         if (sk)
10839                 sock_put(sk);
10840
10841         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
10842                              hdev);
10843 }
10844
10845 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
10846                             u8 link_type, u8 addr_type, u8 status)
10847 {
10848         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
10849         struct mgmt_cp_disconnect *cp;
10850         struct mgmt_pending_cmd *cmd;
10851
10852         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
10853                              hdev);
10854
10855         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
10856         if (!cmd)
10857                 return;
10858
10859         cp = cmd->param;
10860
10861         if (bacmp(bdaddr, &cp->addr.bdaddr))
10862                 return;
10863
10864         if (cp->addr.type != bdaddr_type)
10865                 return;
10866
10867         cmd->cmd_complete(cmd, mgmt_status(status));
10868         mgmt_pending_remove(cmd);
10869 }
10870
10871 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10872                          u8 addr_type, u8 status)
10873 {
10874         struct mgmt_ev_connect_failed ev;
10875
10876         /* The connection is still in hci_conn_hash so test for 1
10877          * instead of 0 to know if this is the last one.
10878          */
10879         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
10880                 cancel_delayed_work(&hdev->power_off);
10881                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
10882         }
10883
10884         bacpy(&ev.addr.bdaddr, bdaddr);
10885         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10886         ev.status = mgmt_status(status);
10887
10888         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
10889 }
10890
10891 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
10892 {
10893         struct mgmt_ev_pin_code_request ev;
10894
10895         bacpy(&ev.addr.bdaddr, bdaddr);
10896         ev.addr.type = BDADDR_BREDR;
10897         ev.secure = secure;
10898
10899         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
10900 }
10901
10902 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10903                                   u8 status)
10904 {
10905         struct mgmt_pending_cmd *cmd;
10906
10907         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
10908         if (!cmd)
10909                 return;
10910
10911         cmd->cmd_complete(cmd, mgmt_status(status));
10912         mgmt_pending_remove(cmd);
10913 }
10914
10915 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10916                                       u8 status)
10917 {
10918         struct mgmt_pending_cmd *cmd;
10919
10920         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
10921         if (!cmd)
10922                 return;
10923
10924         cmd->cmd_complete(cmd, mgmt_status(status));
10925         mgmt_pending_remove(cmd);
10926 }
10927
10928 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
10929                               u8 link_type, u8 addr_type, u32 value,
10930                               u8 confirm_hint)
10931 {
10932         struct mgmt_ev_user_confirm_request ev;
10933
10934         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10935
10936         bacpy(&ev.addr.bdaddr, bdaddr);
10937         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10938         ev.confirm_hint = confirm_hint;
10939         ev.value = cpu_to_le32(value);
10940
10941         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
10942                           NULL);
10943 }
10944
10945 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
10946                               u8 link_type, u8 addr_type)
10947 {
10948         struct mgmt_ev_user_passkey_request ev;
10949
10950         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10951
10952         bacpy(&ev.addr.bdaddr, bdaddr);
10953         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10954
10955         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
10956                           NULL);
10957 }
10958
10959 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10960                                       u8 link_type, u8 addr_type, u8 status,
10961                                       u8 opcode)
10962 {
10963         struct mgmt_pending_cmd *cmd;
10964
10965         cmd = pending_find(opcode, hdev);
10966         if (!cmd)
10967                 return -ENOENT;
10968
10969         cmd->cmd_complete(cmd, mgmt_status(status));
10970         mgmt_pending_remove(cmd);
10971
10972         return 0;
10973 }
10974
10975 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10976                                      u8 link_type, u8 addr_type, u8 status)
10977 {
10978         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10979                                           status, MGMT_OP_USER_CONFIRM_REPLY);
10980 }
10981
10982 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10983                                          u8 link_type, u8 addr_type, u8 status)
10984 {
10985         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10986                                           status,
10987                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
10988 }
10989
10990 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10991                                      u8 link_type, u8 addr_type, u8 status)
10992 {
10993         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10994                                           status, MGMT_OP_USER_PASSKEY_REPLY);
10995 }
10996
10997 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10998                                          u8 link_type, u8 addr_type, u8 status)
10999 {
11000         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11001                                           status,
11002                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
11003 }
11004
11005 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
11006                              u8 link_type, u8 addr_type, u32 passkey,
11007                              u8 entered)
11008 {
11009         struct mgmt_ev_passkey_notify ev;
11010
11011         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11012
11013         bacpy(&ev.addr.bdaddr, bdaddr);
11014         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11015         ev.passkey = __cpu_to_le32(passkey);
11016         ev.entered = entered;
11017
11018         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
11019 }
11020
11021 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
11022 {
11023         struct mgmt_ev_auth_failed ev;
11024         struct mgmt_pending_cmd *cmd;
11025         u8 status = mgmt_status(hci_status);
11026
11027         bacpy(&ev.addr.bdaddr, &conn->dst);
11028         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
11029         ev.status = status;
11030
11031         cmd = find_pairing(conn);
11032
11033         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
11034                     cmd ? cmd->sk : NULL);
11035
11036         if (cmd) {
11037                 cmd->cmd_complete(cmd, status);
11038                 mgmt_pending_remove(cmd);
11039         }
11040 }
11041
11042 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
11043 {
11044         struct cmd_lookup match = { NULL, hdev };
11045         bool changed;
11046
11047         if (status) {
11048                 u8 mgmt_err = mgmt_status(status);
11049                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
11050                                      cmd_status_rsp, &mgmt_err);
11051                 return;
11052         }
11053
11054         if (test_bit(HCI_AUTH, &hdev->flags))
11055                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
11056         else
11057                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
11058
11059         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
11060                              &match);
11061
11062         if (changed)
11063                 new_settings(hdev, match.sk);
11064
11065         if (match.sk)
11066                 sock_put(match.sk);
11067 }
11068
11069 static void clear_eir(struct hci_request *req)
11070 {
11071         struct hci_dev *hdev = req->hdev;
11072         struct hci_cp_write_eir cp;
11073
11074         if (!lmp_ext_inq_capable(hdev))
11075                 return;
11076
11077         memset(hdev->eir, 0, sizeof(hdev->eir));
11078
11079         memset(&cp, 0, sizeof(cp));
11080
11081         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
11082 }
11083
11084 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
11085 {
11086         struct cmd_lookup match = { NULL, hdev };
11087         struct hci_request req;
11088         bool changed = false;
11089
11090         if (status) {
11091                 u8 mgmt_err = mgmt_status(status);
11092
11093                 if (enable && hci_dev_test_and_clear_flag(hdev,
11094                                                           HCI_SSP_ENABLED)) {
11095                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
11096                         new_settings(hdev, NULL);
11097                 }
11098
11099                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
11100                                      &mgmt_err);
11101                 return;
11102         }
11103
11104         if (enable) {
11105                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
11106         } else {
11107                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
11108                 if (!changed)
11109                         changed = hci_dev_test_and_clear_flag(hdev,
11110                                                               HCI_HS_ENABLED);
11111                 else
11112                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
11113         }
11114
11115         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
11116
11117         if (changed)
11118                 new_settings(hdev, match.sk);
11119
11120         if (match.sk)
11121                 sock_put(match.sk);
11122
11123         hci_req_init(&req, hdev);
11124
11125         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
11126                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
11127                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
11128                                     sizeof(enable), &enable);
11129                 __hci_req_update_eir(&req);
11130         } else {
11131                 clear_eir(&req);
11132         }
11133
11134         hci_req_run(&req, NULL);
11135 }
11136
11137 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
11138 {
11139         struct cmd_lookup *match = data;
11140
11141         if (match->sk == NULL) {
11142                 match->sk = cmd->sk;
11143                 sock_hold(match->sk);
11144         }
11145 }
11146
11147 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
11148                                     u8 status)
11149 {
11150         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
11151
11152         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
11153         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
11154         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
11155
11156         if (!status) {
11157                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
11158                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
11159                 ext_info_changed(hdev, NULL);
11160         }
11161
11162         if (match.sk)
11163                 sock_put(match.sk);
11164 }
11165
11166 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
11167 {
11168         struct mgmt_cp_set_local_name ev;
11169         struct mgmt_pending_cmd *cmd;
11170
11171         if (status)
11172                 return;
11173
11174         memset(&ev, 0, sizeof(ev));
11175         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
11176         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
11177
11178         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
11179         if (!cmd) {
11180                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
11181
11182                 /* If this is a HCI command related to powering on the
11183                  * HCI dev don't send any mgmt signals.
11184                  */
11185                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
11186                         return;
11187         }
11188
11189         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
11190                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
11191         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
11192 }
11193
11194 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
11195 {
11196         int i;
11197
11198         for (i = 0; i < uuid_count; i++) {
11199                 if (!memcmp(uuid, uuids[i], 16))
11200                         return true;
11201         }
11202
11203         return false;
11204 }
11205
11206 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
11207 {
11208         u16 parsed = 0;
11209
11210         while (parsed < eir_len) {
11211                 u8 field_len = eir[0];
11212                 u8 uuid[16];
11213                 int i;
11214
11215                 if (field_len == 0)
11216                         break;
11217
11218                 if (eir_len - parsed < field_len + 1)
11219                         break;
11220
11221                 switch (eir[1]) {
11222                 case EIR_UUID16_ALL:
11223                 case EIR_UUID16_SOME:
11224                         for (i = 0; i + 3 <= field_len; i += 2) {
11225                                 memcpy(uuid, bluetooth_base_uuid, 16);
11226                                 uuid[13] = eir[i + 3];
11227                                 uuid[12] = eir[i + 2];
11228                                 if (has_uuid(uuid, uuid_count, uuids))
11229                                         return true;
11230                         }
11231                         break;
11232                 case EIR_UUID32_ALL:
11233                 case EIR_UUID32_SOME:
11234                         for (i = 0; i + 5 <= field_len; i += 4) {
11235                                 memcpy(uuid, bluetooth_base_uuid, 16);
11236                                 uuid[15] = eir[i + 5];
11237                                 uuid[14] = eir[i + 4];
11238                                 uuid[13] = eir[i + 3];
11239                                 uuid[12] = eir[i + 2];
11240                                 if (has_uuid(uuid, uuid_count, uuids))
11241                                         return true;
11242                         }
11243                         break;
11244                 case EIR_UUID128_ALL:
11245                 case EIR_UUID128_SOME:
11246                         for (i = 0; i + 17 <= field_len; i += 16) {
11247                                 memcpy(uuid, eir + i + 2, 16);
11248                                 if (has_uuid(uuid, uuid_count, uuids))
11249                                         return true;
11250                         }
11251                         break;
11252                 }
11253
11254                 parsed += field_len + 1;
11255                 eir += field_len + 1;
11256         }
11257
11258         return false;
11259 }
11260
11261 static void restart_le_scan(struct hci_dev *hdev)
11262 {
11263         /* If controller is not scanning we are done. */
11264         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
11265                 return;
11266
11267         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
11268                        hdev->discovery.scan_start +
11269                        hdev->discovery.scan_duration))
11270                 return;
11271
11272         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
11273                            DISCOV_LE_RESTART_DELAY);
11274 }
11275
11276 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
11277                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
11278 {
11279         /* If a RSSI threshold has been specified, and
11280          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
11281          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
11282          * is set, let it through for further processing, as we might need to
11283          * restart the scan.
11284          *
11285          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
11286          * the results are also dropped.
11287          */
11288         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11289             (rssi == HCI_RSSI_INVALID ||
11290             (rssi < hdev->discovery.rssi &&
11291              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
11292                 return  false;
11293
11294         if (hdev->discovery.uuid_count != 0) {
11295                 /* If a list of UUIDs is provided in filter, results with no
11296                  * matching UUID should be dropped.
11297                  */
11298                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
11299                                    hdev->discovery.uuids) &&
11300                     !eir_has_uuids(scan_rsp, scan_rsp_len,
11301                                    hdev->discovery.uuid_count,
11302                                    hdev->discovery.uuids))
11303                         return false;
11304         }
11305
11306         /* If duplicate filtering does not report RSSI changes, then restart
11307          * scanning to ensure updated result with updated RSSI values.
11308          */
11309         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
11310                 restart_le_scan(hdev);
11311
11312                 /* Validate RSSI value against the RSSI threshold once more. */
11313                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11314                     rssi < hdev->discovery.rssi)
11315                         return false;
11316         }
11317
11318         return true;
11319 }
11320
11321 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11322                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
11323                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
11324 {
11325         char buf[512];
11326         struct mgmt_ev_device_found *ev = (void *)buf;
11327         size_t ev_size;
11328
11329         /* Don't send events for a non-kernel initiated discovery. With
11330          * LE one exception is if we have pend_le_reports > 0 in which
11331          * case we're doing passive scanning and want these events.
11332          */
11333         if (!hci_discovery_active(hdev)) {
11334                 if (link_type == ACL_LINK)
11335                         return;
11336                 if (link_type == LE_LINK &&
11337                     list_empty(&hdev->pend_le_reports) &&
11338                     !hci_is_adv_monitoring(hdev)) {
11339                         return;
11340                 }
11341         }
11342
11343         if (hdev->discovery.result_filtering) {
11344                 /* We are using service discovery */
11345                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
11346                                      scan_rsp_len))
11347                         return;
11348         }
11349
11350         if (hdev->discovery.limited) {
11351                 /* Check for limited discoverable bit */
11352                 if (dev_class) {
11353                         if (!(dev_class[1] & 0x20))
11354                                 return;
11355                 } else {
11356                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
11357                         if (!flags || !(flags[0] & LE_AD_LIMITED))
11358                                 return;
11359                 }
11360         }
11361
11362         /* Make sure that the buffer is big enough. The 5 extra bytes
11363          * are for the potential CoD field.
11364          */
11365         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
11366                 return;
11367
11368         memset(buf, 0, sizeof(buf));
11369
11370         /* In case of device discovery with BR/EDR devices (pre 1.2), the
11371          * RSSI value was reported as 0 when not available. This behavior
11372          * is kept when using device discovery. This is required for full
11373          * backwards compatibility with the API.
11374          *
11375          * However when using service discovery, the value 127 will be
11376          * returned when the RSSI is not available.
11377          */
11378         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
11379             link_type == ACL_LINK)
11380                 rssi = 0;
11381
11382         bacpy(&ev->addr.bdaddr, bdaddr);
11383         ev->addr.type = link_to_bdaddr(link_type, addr_type);
11384         ev->rssi = rssi;
11385         ev->flags = cpu_to_le32(flags);
11386
11387         if (eir_len > 0)
11388                 /* Copy EIR or advertising data into event */
11389                 memcpy(ev->eir, eir, eir_len);
11390
11391         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
11392                                        NULL))
11393                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
11394                                           dev_class, 3);
11395
11396         if (scan_rsp_len > 0)
11397                 /* Append scan response data to event */
11398                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
11399
11400         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
11401         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
11402
11403         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
11404 }
11405
11406 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11407                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
11408 {
11409         struct mgmt_ev_device_found *ev;
11410         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
11411         u16 eir_len;
11412
11413         ev = (struct mgmt_ev_device_found *) buf;
11414
11415         memset(buf, 0, sizeof(buf));
11416
11417         bacpy(&ev->addr.bdaddr, bdaddr);
11418         ev->addr.type = link_to_bdaddr(link_type, addr_type);
11419         ev->rssi = rssi;
11420
11421         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
11422                                   name_len);
11423
11424         ev->eir_len = cpu_to_le16(eir_len);
11425
11426         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
11427 }
11428
11429 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
11430 {
11431         struct mgmt_ev_discovering ev;
11432
11433         bt_dev_dbg(hdev, "discovering %u", discovering);
11434
11435         memset(&ev, 0, sizeof(ev));
11436         ev.type = hdev->discovery.type;
11437         ev.discovering = discovering;
11438
11439         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
11440 }
11441
11442 void mgmt_suspending(struct hci_dev *hdev, u8 state)
11443 {
11444         struct mgmt_ev_controller_suspend ev;
11445
11446         ev.suspend_state = state;
11447         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
11448 }
11449
11450 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
11451                    u8 addr_type)
11452 {
11453         struct mgmt_ev_controller_resume ev;
11454
11455         ev.wake_reason = reason;
11456         if (bdaddr) {
11457                 bacpy(&ev.addr.bdaddr, bdaddr);
11458                 ev.addr.type = addr_type;
11459         } else {
11460                 memset(&ev.addr, 0, sizeof(ev.addr));
11461         }
11462
11463         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
11464 }
11465
11466 static struct hci_mgmt_chan chan = {
11467         .channel        = HCI_CHANNEL_CONTROL,
11468         .handler_count  = ARRAY_SIZE(mgmt_handlers),
11469         .handlers       = mgmt_handlers,
11470 #ifdef TIZEN_BT
11471         .tizen_handler_count    = ARRAY_SIZE(tizen_mgmt_handlers),
11472         .tizen_handlers = tizen_mgmt_handlers,
11473 #endif
11474         .hdev_init      = mgmt_init_hdev,
11475 };
11476
11477 int mgmt_init(void)
11478 {
11479         return hci_mgmt_chan_register(&chan);
11480 }
11481
11482 void mgmt_exit(void)
11483 {
11484         hci_mgmt_chan_unregister(&chan);
11485 }