net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #ifdef TIZEN_BT
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #endif
  38
  39 #include "hci_request.h"
  40 #include "smp.h"
  41 #include "mgmt_util.h"
  42 #include "mgmt_config.h"
  43 #include "msft.h"
  44 #include "eir.h"
  45 #include "aosp.h"
  46
  47 #define MGMT_VERSION    1
  48 #define MGMT_REVISION   22
  49
  50 static const u16 mgmt_commands[] = {
  51         MGMT_OP_READ_INDEX_LIST,
  52         MGMT_OP_READ_INFO,
  53         MGMT_OP_SET_POWERED,
  54         MGMT_OP_SET_DISCOVERABLE,
  55         MGMT_OP_SET_CONNECTABLE,
  56         MGMT_OP_SET_FAST_CONNECTABLE,
  57         MGMT_OP_SET_BONDABLE,
  58         MGMT_OP_SET_LINK_SECURITY,
  59         MGMT_OP_SET_SSP,
  60         MGMT_OP_SET_HS,
  61         MGMT_OP_SET_LE,
  62         MGMT_OP_SET_DEV_CLASS,
  63         MGMT_OP_SET_LOCAL_NAME,
  64         MGMT_OP_ADD_UUID,
  65         MGMT_OP_REMOVE_UUID,
  66         MGMT_OP_LOAD_LINK_KEYS,
  67         MGMT_OP_LOAD_LONG_TERM_KEYS,
  68         MGMT_OP_DISCONNECT,
  69         MGMT_OP_GET_CONNECTIONS,
  70         MGMT_OP_PIN_CODE_REPLY,
  71         MGMT_OP_PIN_CODE_NEG_REPLY,
  72         MGMT_OP_SET_IO_CAPABILITY,
  73         MGMT_OP_PAIR_DEVICE,
  74         MGMT_OP_CANCEL_PAIR_DEVICE,
  75         MGMT_OP_UNPAIR_DEVICE,
  76         MGMT_OP_USER_CONFIRM_REPLY,
  77         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  78         MGMT_OP_USER_PASSKEY_REPLY,
  79         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  80         MGMT_OP_READ_LOCAL_OOB_DATA,
  81         MGMT_OP_ADD_REMOTE_OOB_DATA,
  82         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  83         MGMT_OP_START_DISCOVERY,
  84         MGMT_OP_STOP_DISCOVERY,
  85         MGMT_OP_CONFIRM_NAME,
  86         MGMT_OP_BLOCK_DEVICE,
  87         MGMT_OP_UNBLOCK_DEVICE,
  88         MGMT_OP_SET_DEVICE_ID,
  89         MGMT_OP_SET_ADVERTISING,
  90         MGMT_OP_SET_BREDR,
  91         MGMT_OP_SET_STATIC_ADDRESS,
  92         MGMT_OP_SET_SCAN_PARAMS,
  93         MGMT_OP_SET_SECURE_CONN,
  94         MGMT_OP_SET_DEBUG_KEYS,
  95         MGMT_OP_SET_PRIVACY,
  96         MGMT_OP_LOAD_IRKS,
  97         MGMT_OP_GET_CONN_INFO,
  98         MGMT_OP_GET_CLOCK_INFO,
  99         MGMT_OP_ADD_DEVICE,
 100         MGMT_OP_REMOVE_DEVICE,
 101         MGMT_OP_LOAD_CONN_PARAM,
 102         MGMT_OP_READ_UNCONF_INDEX_LIST,
 103         MGMT_OP_READ_CONFIG_INFO,
 104         MGMT_OP_SET_EXTERNAL_CONFIG,
 105         MGMT_OP_SET_PUBLIC_ADDRESS,
 106         MGMT_OP_START_SERVICE_DISCOVERY,
 107         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 108         MGMT_OP_READ_EXT_INDEX_LIST,
 109         MGMT_OP_READ_ADV_FEATURES,
 110         MGMT_OP_ADD_ADVERTISING,
 111         MGMT_OP_REMOVE_ADVERTISING,
 112         MGMT_OP_GET_ADV_SIZE_INFO,
 113         MGMT_OP_START_LIMITED_DISCOVERY,
 114         MGMT_OP_READ_EXT_INFO,
 115         MGMT_OP_SET_APPEARANCE,
 116         MGMT_OP_GET_PHY_CONFIGURATION,
 117         MGMT_OP_SET_PHY_CONFIGURATION,
 118         MGMT_OP_SET_BLOCKED_KEYS,
 119         MGMT_OP_SET_WIDEBAND_SPEECH,
 120         MGMT_OP_READ_CONTROLLER_CAP,
 121         MGMT_OP_READ_EXP_FEATURES_INFO,
 122         MGMT_OP_SET_EXP_FEATURE,
 123         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 124         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 125         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 126         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 127         MGMT_OP_GET_DEVICE_FLAGS,
 128         MGMT_OP_SET_DEVICE_FLAGS,
 129         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 130         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 131         MGMT_OP_REMOVE_ADV_MONITOR,
 132         MGMT_OP_ADD_EXT_ADV_PARAMS,
 133         MGMT_OP_ADD_EXT_ADV_DATA,
 134         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 135         MGMT_OP_SET_MESH_RECEIVER,
 136         MGMT_OP_MESH_READ_FEATURES,
 137         MGMT_OP_MESH_SEND,
 138         MGMT_OP_MESH_SEND_CANCEL,
 139 };
 140
 141 static const u16 mgmt_events[] = {
 142         MGMT_EV_CONTROLLER_ERROR,
 143         MGMT_EV_INDEX_ADDED,
 144         MGMT_EV_INDEX_REMOVED,
 145         MGMT_EV_NEW_SETTINGS,
 146         MGMT_EV_CLASS_OF_DEV_CHANGED,
 147         MGMT_EV_LOCAL_NAME_CHANGED,
 148         MGMT_EV_NEW_LINK_KEY,
 149         MGMT_EV_NEW_LONG_TERM_KEY,
 150         MGMT_EV_DEVICE_CONNECTED,
 151         MGMT_EV_DEVICE_DISCONNECTED,
 152         MGMT_EV_CONNECT_FAILED,
 153         MGMT_EV_PIN_CODE_REQUEST,
 154         MGMT_EV_USER_CONFIRM_REQUEST,
 155         MGMT_EV_USER_PASSKEY_REQUEST,
 156         MGMT_EV_AUTH_FAILED,
 157         MGMT_EV_DEVICE_FOUND,
 158         MGMT_EV_DISCOVERING,
 159         MGMT_EV_DEVICE_BLOCKED,
 160         MGMT_EV_DEVICE_UNBLOCKED,
 161         MGMT_EV_DEVICE_UNPAIRED,
 162         MGMT_EV_PASSKEY_NOTIFY,
 163         MGMT_EV_NEW_IRK,
 164         MGMT_EV_NEW_CSRK,
 165         MGMT_EV_DEVICE_ADDED,
 166         MGMT_EV_DEVICE_REMOVED,
 167         MGMT_EV_NEW_CONN_PARAM,
 168         MGMT_EV_UNCONF_INDEX_ADDED,
 169         MGMT_EV_UNCONF_INDEX_REMOVED,
 170         MGMT_EV_NEW_CONFIG_OPTIONS,
 171         MGMT_EV_EXT_INDEX_ADDED,
 172         MGMT_EV_EXT_INDEX_REMOVED,
 173         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 174         MGMT_EV_ADVERTISING_ADDED,
 175         MGMT_EV_ADVERTISING_REMOVED,
 176         MGMT_EV_EXT_INFO_CHANGED,
 177         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 178         MGMT_EV_EXP_FEATURE_CHANGED,
 179         MGMT_EV_DEVICE_FLAGS_CHANGED,
 180         MGMT_EV_ADV_MONITOR_ADDED,
 181         MGMT_EV_ADV_MONITOR_REMOVED,
 182         MGMT_EV_CONTROLLER_SUSPEND,
 183         MGMT_EV_CONTROLLER_RESUME,
 184         MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
 185         MGMT_EV_ADV_MONITOR_DEVICE_LOST,
 186 };
 187
 188 static const u16 mgmt_untrusted_commands[] = {
 189         MGMT_OP_READ_INDEX_LIST,
 190         MGMT_OP_READ_INFO,
 191         MGMT_OP_READ_UNCONF_INDEX_LIST,
 192         MGMT_OP_READ_CONFIG_INFO,
 193         MGMT_OP_READ_EXT_INDEX_LIST,
 194         MGMT_OP_READ_EXT_INFO,
 195         MGMT_OP_READ_CONTROLLER_CAP,
 196         MGMT_OP_READ_EXP_FEATURES_INFO,
 197         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 198         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 199 };
 200
 201 static const u16 mgmt_untrusted_events[] = {
 202         MGMT_EV_INDEX_ADDED,
 203         MGMT_EV_INDEX_REMOVED,
 204         MGMT_EV_NEW_SETTINGS,
 205         MGMT_EV_CLASS_OF_DEV_CHANGED,
 206         MGMT_EV_LOCAL_NAME_CHANGED,
 207         MGMT_EV_UNCONF_INDEX_ADDED,
 208         MGMT_EV_UNCONF_INDEX_REMOVED,
 209         MGMT_EV_NEW_CONFIG_OPTIONS,
 210         MGMT_EV_EXT_INDEX_ADDED,
 211         MGMT_EV_EXT_INDEX_REMOVED,
 212         MGMT_EV_EXT_INFO_CHANGED,
 213         MGMT_EV_EXP_FEATURE_CHANGED,
 214 };
 215
 216 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 217
 218 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 219                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 220
 221 /* HCI to MGMT error code conversion table */
 222 static const u8 mgmt_status_table[] = {
 223         MGMT_STATUS_SUCCESS,
 224         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 225         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 226         MGMT_STATUS_FAILED,             /* Hardware Failure */
 227         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 228         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 229         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 230         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 231         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 232         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 233         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 234         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 235         MGMT_STATUS_BUSY,               /* Command Disallowed */
 236         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 237         MGMT_STATUS_REJECTED,           /* Rejected Security */
 238         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 239         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 240         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 241         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 242         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 243         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 244         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 245         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 246         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 247         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 248         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 249         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 250         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 251         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 252         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 253         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 254         MGMT_STATUS_FAILED,             /* Unspecified Error */
 255         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 256         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 257         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 258         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 259         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 260         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 261         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 262         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 263         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 264         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 265         MGMT_STATUS_FAILED,             /* Transaction Collision */
 266         MGMT_STATUS_FAILED,             /* Reserved for future use */
 267         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 268         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 269         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 270         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 271         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 272         MGMT_STATUS_FAILED,             /* Reserved for future use */
 273         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 274         MGMT_STATUS_FAILED,             /* Reserved for future use */
 275         MGMT_STATUS_FAILED,             /* Slot Violation */
 276         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 277         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 278         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 279         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 280         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 281         MGMT_STATUS_BUSY,               /* Controller Busy */
 282         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 283         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 284         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 285         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 286         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 287 };
 288
 289 static u8 mgmt_errno_status(int err)
 290 {
 291         switch (err) {
 292         case 0:
 293                 return MGMT_STATUS_SUCCESS;
 294         case -EPERM:
 295                 return MGMT_STATUS_REJECTED;
 296         case -EINVAL:
 297                 return MGMT_STATUS_INVALID_PARAMS;
 298         case -EOPNOTSUPP:
 299                 return MGMT_STATUS_NOT_SUPPORTED;
 300         case -EBUSY:
 301                 return MGMT_STATUS_BUSY;
 302         case -ETIMEDOUT:
 303                 return MGMT_STATUS_AUTH_FAILED;
 304         case -ENOMEM:
 305                 return MGMT_STATUS_NO_RESOURCES;
 306         case -EISCONN:
 307                 return MGMT_STATUS_ALREADY_CONNECTED;
 308         case -ENOTCONN:
 309                 return MGMT_STATUS_DISCONNECTED;
 310         }
 311
 312         return MGMT_STATUS_FAILED;
 313 }
 314
 315 static u8 mgmt_status(int err)
 316 {
 317         if (err < 0)
 318                 return mgmt_errno_status(err);
 319
 320         if (err < ARRAY_SIZE(mgmt_status_table))
 321                 return mgmt_status_table[err];
 322
 323         return MGMT_STATUS_FAILED;
 324 }
 325
 326 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 327                             u16 len, int flag)
 328 {
 329         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 330                                flag, NULL);
 331 }
 332
 333 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 334                               u16 len, int flag, struct sock *skip_sk)
 335 {
 336         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 337                                flag, skip_sk);
 338 }
 339
 340 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 341                       struct sock *skip_sk)
 342 {
 343         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 344                                HCI_SOCK_TRUSTED, skip_sk);
 345 }
 346
 347 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk)
 348 {
 349         return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED,
 350                                    skip_sk);
 351 }
 352
 353 static u8 le_addr_type(u8 mgmt_addr_type)
 354 {
 355         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 356                 return ADDR_LE_DEV_PUBLIC;
 357         else
 358                 return ADDR_LE_DEV_RANDOM;
 359 }
 360
 361 void mgmt_fill_version_info(void *ver)
 362 {
 363         struct mgmt_rp_read_version *rp = ver;
 364
 365         rp->version = MGMT_VERSION;
 366         rp->revision = cpu_to_le16(MGMT_REVISION);
 367 }
 368
 369 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 370                         u16 data_len)
 371 {
 372         struct mgmt_rp_read_version rp;
 373
 374         bt_dev_dbg(hdev, "sock %p", sk);
 375
 376         mgmt_fill_version_info(&rp);
 377
 378         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 379                                  &rp, sizeof(rp));
 380 }
 381
 382 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 383                          u16 data_len)
 384 {
 385         struct mgmt_rp_read_commands *rp;
 386         u16 num_commands, num_events;
 387         size_t rp_size;
 388         int i, err;
 389
 390         bt_dev_dbg(hdev, "sock %p", sk);
 391
 392         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 393                 num_commands = ARRAY_SIZE(mgmt_commands);
 394                 num_events = ARRAY_SIZE(mgmt_events);
 395         } else {
 396                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 397                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 398         }
 399
 400         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 401
 402         rp = kmalloc(rp_size, GFP_KERNEL);
 403         if (!rp)
 404                 return -ENOMEM;
 405
 406         rp->num_commands = cpu_to_le16(num_commands);
 407         rp->num_events = cpu_to_le16(num_events);
 408
 409         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 410                 __le16 *opcode = rp->opcodes;
 411
 412                 for (i = 0; i < num_commands; i++, opcode++)
 413                         put_unaligned_le16(mgmt_commands[i], opcode);
 414
 415                 for (i = 0; i < num_events; i++, opcode++)
 416                         put_unaligned_le16(mgmt_events[i], opcode);
 417         } else {
 418                 __le16 *opcode = rp->opcodes;
 419
 420                 for (i = 0; i < num_commands; i++, opcode++)
 421                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 422
 423                 for (i = 0; i < num_events; i++, opcode++)
 424                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 425         }
 426
 427         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 428                                 rp, rp_size);
 429         kfree(rp);
 430
 431         return err;
 432 }
 433
 434 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 435                            u16 data_len)
 436 {
 437         struct mgmt_rp_read_index_list *rp;
 438         struct hci_dev *d;
 439         size_t rp_len;
 440         u16 count;
 441         int err;
 442
 443         bt_dev_dbg(hdev, "sock %p", sk);
 444
 445         read_lock(&hci_dev_list_lock);
 446
 447         count = 0;
 448         list_for_each_entry(d, &hci_dev_list, list) {
 449                 if (d->dev_type == HCI_PRIMARY &&
 450                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 451                         count++;
 452         }
 453
 454         rp_len = sizeof(*rp) + (2 * count);
 455         rp = kmalloc(rp_len, GFP_ATOMIC);
 456         if (!rp) {
 457                 read_unlock(&hci_dev_list_lock);
 458                 return -ENOMEM;
 459         }
 460
 461         count = 0;
 462         list_for_each_entry(d, &hci_dev_list, list) {
 463                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 464                     hci_dev_test_flag(d, HCI_CONFIG) ||
 465                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 466                         continue;
 467
 468                 /* Devices marked as raw-only are neither configured
 469                  * nor unconfigured controllers.
 470                  */
 471                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 472                         continue;
 473
 474                 if (d->dev_type == HCI_PRIMARY &&
 475                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 476                         rp->index[count++] = cpu_to_le16(d->id);
 477                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 478                 }
 479         }
 480
 481         rp->num_controllers = cpu_to_le16(count);
 482         rp_len = sizeof(*rp) + (2 * count);
 483
 484         read_unlock(&hci_dev_list_lock);
 485
 486         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 487                                 0, rp, rp_len);
 488
 489         kfree(rp);
 490
 491         return err;
 492 }
 493
 494 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 495                                   void *data, u16 data_len)
 496 {
 497         struct mgmt_rp_read_unconf_index_list *rp;
 498         struct hci_dev *d;
 499         size_t rp_len;
 500         u16 count;
 501         int err;
 502
 503         bt_dev_dbg(hdev, "sock %p", sk);
 504
 505         read_lock(&hci_dev_list_lock);
 506
 507         count = 0;
 508         list_for_each_entry(d, &hci_dev_list, list) {
 509                 if (d->dev_type == HCI_PRIMARY &&
 510                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 511                         count++;
 512         }
 513
 514         rp_len = sizeof(*rp) + (2 * count);
 515         rp = kmalloc(rp_len, GFP_ATOMIC);
 516         if (!rp) {
 517                 read_unlock(&hci_dev_list_lock);
 518                 return -ENOMEM;
 519         }
 520
 521         count = 0;
 522         list_for_each_entry(d, &hci_dev_list, list) {
 523                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 524                     hci_dev_test_flag(d, HCI_CONFIG) ||
 525                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 526                         continue;
 527
 528                 /* Devices marked as raw-only are neither configured
 529                  * nor unconfigured controllers.
 530                  */
 531                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 532                         continue;
 533
 534                 if (d->dev_type == HCI_PRIMARY &&
 535                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 536                         rp->index[count++] = cpu_to_le16(d->id);
 537                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 538                 }
 539         }
 540
 541         rp->num_controllers = cpu_to_le16(count);
 542         rp_len = sizeof(*rp) + (2 * count);
 543
 544         read_unlock(&hci_dev_list_lock);
 545
 546         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 547                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 548
 549         kfree(rp);
 550
 551         return err;
 552 }
 553
 554 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 555                                void *data, u16 data_len)
 556 {
 557         struct mgmt_rp_read_ext_index_list *rp;
 558         struct hci_dev *d;
 559         u16 count;
 560         int err;
 561
 562         bt_dev_dbg(hdev, "sock %p", sk);
 563
 564         read_lock(&hci_dev_list_lock);
 565
 566         count = 0;
 567         list_for_each_entry(d, &hci_dev_list, list) {
 568                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 569                         count++;
 570         }
 571
 572         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 573         if (!rp) {
 574                 read_unlock(&hci_dev_list_lock);
 575                 return -ENOMEM;
 576         }
 577
 578         count = 0;
 579         list_for_each_entry(d, &hci_dev_list, list) {
 580                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 581                     hci_dev_test_flag(d, HCI_CONFIG) ||
 582                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 583                         continue;
 584
 585                 /* Devices marked as raw-only are neither configured
 586                  * nor unconfigured controllers.
 587                  */
 588                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 589                         continue;
 590
 591                 if (d->dev_type == HCI_PRIMARY) {
 592                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 593                                 rp->entry[count].type = 0x01;
 594                         else
 595                                 rp->entry[count].type = 0x00;
 596                 } else if (d->dev_type == HCI_AMP) {
 597                         rp->entry[count].type = 0x02;
 598                 } else {
 599                         continue;
 600                 }
 601
 602                 rp->entry[count].bus = d->bus;
 603                 rp->entry[count++].index = cpu_to_le16(d->id);
 604                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 605         }
 606
 607         rp->num_controllers = cpu_to_le16(count);
 608
 609         read_unlock(&hci_dev_list_lock);
 610
 611         /* If this command is called at least once, then all the
 612          * default index and unconfigured index events are disabled
 613          * and from now on only extended index events are used.
 614          */
 615         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 616         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 617         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 618
 619         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 620                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 621                                 struct_size(rp, entry, count));
 622
 623         kfree(rp);
 624
 625         return err;
 626 }
 627
 628 static bool is_configured(struct hci_dev *hdev)
 629 {
 630         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 631             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 632                 return false;
 633
 634         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 635              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 636             !bacmp(&hdev->public_addr, BDADDR_ANY))
 637                 return false;
 638
 639         return true;
 640 }
 641
 642 static __le32 get_missing_options(struct hci_dev *hdev)
 643 {
 644         u32 options = 0;
 645
 646         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 647             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 648                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 649
 650         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 651              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 652             !bacmp(&hdev->public_addr, BDADDR_ANY))
 653                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 654
 655         return cpu_to_le32(options);
 656 }
 657
 658 static int new_options(struct hci_dev *hdev, struct sock *skip)
 659 {
 660         __le32 options = get_missing_options(hdev);
 661
 662         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 663                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 664 }
 665
 666 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 667 {
 668         __le32 options = get_missing_options(hdev);
 669
 670         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 671                                  sizeof(options));
 672 }
 673
 674 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 675                             void *data, u16 data_len)
 676 {
 677         struct mgmt_rp_read_config_info rp;
 678         u32 options = 0;
 679
 680         bt_dev_dbg(hdev, "sock %p", sk);
 681
 682         hci_dev_lock(hdev);
 683
 684         memset(&rp, 0, sizeof(rp));
 685         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 686
 687         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 688                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 689
 690         if (hdev->set_bdaddr)
 691                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 692
 693         rp.supported_options = cpu_to_le32(options);
 694         rp.missing_options = get_missing_options(hdev);
 695
 696         hci_dev_unlock(hdev);
 697
 698         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 699                                  &rp, sizeof(rp));
 700 }
 701
 702 static u32 get_supported_phys(struct hci_dev *hdev)
 703 {
 704         u32 supported_phys = 0;
 705
 706         if (lmp_bredr_capable(hdev)) {
 707                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 708
 709                 if (hdev->features[0][0] & LMP_3SLOT)
 710                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 711
 712                 if (hdev->features[0][0] & LMP_5SLOT)
 713                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 714
 715                 if (lmp_edr_2m_capable(hdev)) {
 716                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 717
 718                         if (lmp_edr_3slot_capable(hdev))
 719                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 720
 721                         if (lmp_edr_5slot_capable(hdev))
 722                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 723
 724                         if (lmp_edr_3m_capable(hdev)) {
 725                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 726
 727                                 if (lmp_edr_3slot_capable(hdev))
 728                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 729
 730                                 if (lmp_edr_5slot_capable(hdev))
 731                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 732                         }
 733                 }
 734         }
 735
 736         if (lmp_le_capable(hdev)) {
 737                 supported_phys |= MGMT_PHY_LE_1M_TX;
 738                 supported_phys |= MGMT_PHY_LE_1M_RX;
 739
 740                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 741                         supported_phys |= MGMT_PHY_LE_2M_TX;
 742                         supported_phys |= MGMT_PHY_LE_2M_RX;
 743                 }
 744
 745                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 746                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 747                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 748                 }
 749         }
 750
 751         return supported_phys;
 752 }
 753
 754 static u32 get_selected_phys(struct hci_dev *hdev)
 755 {
 756         u32 selected_phys = 0;
 757
 758         if (lmp_bredr_capable(hdev)) {
 759                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 760
 761                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 762                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 763
 764                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 765                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 766
 767                 if (lmp_edr_2m_capable(hdev)) {
 768                         if (!(hdev->pkt_type & HCI_2DH1))
 769                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 770
 771                         if (lmp_edr_3slot_capable(hdev) &&
 772                             !(hdev->pkt_type & HCI_2DH3))
 773                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 774
 775                         if (lmp_edr_5slot_capable(hdev) &&
 776                             !(hdev->pkt_type & HCI_2DH5))
 777                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 778
 779                         if (lmp_edr_3m_capable(hdev)) {
 780                                 if (!(hdev->pkt_type & HCI_3DH1))
 781                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 782
 783                                 if (lmp_edr_3slot_capable(hdev) &&
 784                                     !(hdev->pkt_type & HCI_3DH3))
 785                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 786
 787                                 if (lmp_edr_5slot_capable(hdev) &&
 788                                     !(hdev->pkt_type & HCI_3DH5))
 789                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 790                         }
 791                 }
 792         }
 793
 794         if (lmp_le_capable(hdev)) {
 795                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 796                         selected_phys |= MGMT_PHY_LE_1M_TX;
 797
 798                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 799                         selected_phys |= MGMT_PHY_LE_1M_RX;
 800
 801                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 802                         selected_phys |= MGMT_PHY_LE_2M_TX;
 803
 804                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 805                         selected_phys |= MGMT_PHY_LE_2M_RX;
 806
 807                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 808                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 809
 810                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 811                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 812         }
 813
 814         return selected_phys;
 815 }
 816
 817 static u32 get_configurable_phys(struct hci_dev *hdev)
 818 {
 819         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 820                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 821 }
 822
 823 static u32 get_supported_settings(struct hci_dev *hdev)
 824 {
 825         u32 settings = 0;
 826
 827         settings |= MGMT_SETTING_POWERED;
 828         settings |= MGMT_SETTING_BONDABLE;
 829         settings |= MGMT_SETTING_DEBUG_KEYS;
 830         settings |= MGMT_SETTING_CONNECTABLE;
 831         settings |= MGMT_SETTING_DISCOVERABLE;
 832
 833         if (lmp_bredr_capable(hdev)) {
 834                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 835                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 836                 settings |= MGMT_SETTING_BREDR;
 837                 settings |= MGMT_SETTING_LINK_SECURITY;
 838
 839                 if (lmp_ssp_capable(hdev)) {
 840                         settings |= MGMT_SETTING_SSP;
 841                         if (IS_ENABLED(CONFIG_BT_HS))
 842                                 settings |= MGMT_SETTING_HS;
 843                 }
 844
 845                 if (lmp_sc_capable(hdev))
 846                         settings |= MGMT_SETTING_SECURE_CONN;
 847
 848                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 849                              &hdev->quirks))
 850                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 851         }
 852
 853         if (lmp_le_capable(hdev)) {
 854                 settings |= MGMT_SETTING_LE;
 855                 settings |= MGMT_SETTING_SECURE_CONN;
 856                 settings |= MGMT_SETTING_PRIVACY;
 857                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 858                 settings |= MGMT_SETTING_ADVERTISING;
 859         }
 860
 861         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 862             hdev->set_bdaddr)
 863                 settings |= MGMT_SETTING_CONFIGURATION;
 864
 865         if (cis_central_capable(hdev))
 866                 settings |= MGMT_SETTING_CIS_CENTRAL;
 867
 868         if (cis_peripheral_capable(hdev))
 869                 settings |= MGMT_SETTING_CIS_PERIPHERAL;
 870
 871         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 872
 873         return settings;
 874 }
 875
 876 static u32 get_current_settings(struct hci_dev *hdev)
 877 {
 878         u32 settings = 0;
 879
 880         if (hdev_is_powered(hdev))
 881                 settings |= MGMT_SETTING_POWERED;
 882
 883         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 884                 settings |= MGMT_SETTING_CONNECTABLE;
 885
 886         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 887                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 888
 889         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 890                 settings |= MGMT_SETTING_DISCOVERABLE;
 891
 892         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 893                 settings |= MGMT_SETTING_BONDABLE;
 894
 895         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 896                 settings |= MGMT_SETTING_BREDR;
 897
 898         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 899                 settings |= MGMT_SETTING_LE;
 900
 901         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 902                 settings |= MGMT_SETTING_LINK_SECURITY;
 903
 904         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 905                 settings |= MGMT_SETTING_SSP;
 906
 907         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 908                 settings |= MGMT_SETTING_HS;
 909
 910         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 911                 settings |= MGMT_SETTING_ADVERTISING;
 912
 913         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 914                 settings |= MGMT_SETTING_SECURE_CONN;
 915
 916         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 917                 settings |= MGMT_SETTING_DEBUG_KEYS;
 918
 919         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 920                 settings |= MGMT_SETTING_PRIVACY;
 921
 922         /* The current setting for static address has two purposes. The
 923          * first is to indicate if the static address will be used and
 924          * the second is to indicate if it is actually set.
 925          *
 926          * This means if the static address is not configured, this flag
 927          * will never be set. If the address is configured, then if the
 928          * address is actually used decides if the flag is set or not.
 929          *
 930          * For single mode LE only controllers and dual-mode controllers
 931          * with BR/EDR disabled, the existence of the static address will
 932          * be evaluated.
 933          */
 934         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 935             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 936             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 937                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 938                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 939         }
 940
 941         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 942                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 943
 944         if (cis_central_capable(hdev))
 945                 settings |= MGMT_SETTING_CIS_CENTRAL;
 946
 947         if (cis_peripheral_capable(hdev))
 948                 settings |= MGMT_SETTING_CIS_PERIPHERAL;
 949
 950         return settings;
 951 }
 952
 953 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 954 {
 955         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 956 }
 957
 958 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 959 {
 960         struct mgmt_pending_cmd *cmd;
 961
 962         /* If there's a pending mgmt command the flags will not yet have
 963          * their final values, so check for this first.
 964          */
 965         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 966         if (cmd) {
 967                 struct mgmt_mode *cp = cmd->param;
 968                 if (cp->val == 0x01)
 969                         return LE_AD_GENERAL;
 970                 else if (cp->val == 0x02)
 971                         return LE_AD_LIMITED;
 972         } else {
 973                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 974                         return LE_AD_LIMITED;
 975                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 976                         return LE_AD_GENERAL;
 977         }
 978
 979         return 0;
 980 }
 981
 982 bool mgmt_get_connectable(struct hci_dev *hdev)
 983 {
 984         struct mgmt_pending_cmd *cmd;
 985
 986         /* If there's a pending mgmt command the flag will not yet have
 987          * it's final value, so check for this first.
 988          */
 989         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 990         if (cmd) {
 991                 struct mgmt_mode *cp = cmd->param;
 992
 993                 return cp->val;
 994         }
 995
 996         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 997 }
 998
 999 static int service_cache_sync(struct hci_dev *hdev, void *data)
1000 {
1001         hci_update_eir_sync(hdev);
1002         hci_update_class_sync(hdev);
1003
1004         return 0;
1005 }
1006
1007 static void service_cache_off(struct work_struct *work)
1008 {
1009         struct hci_dev *hdev = container_of(work, struct hci_dev,
1010                                             service_cache.work);
1011
1012         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1013                 return;
1014
1015         hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL);
1016 }
1017
1018 static int rpa_expired_sync(struct hci_dev *hdev, void *data)
1019 {
1020         /* The generation of a new RPA and programming it into the
1021          * controller happens in the hci_req_enable_advertising()
1022          * function.
1023          */
1024         if (ext_adv_capable(hdev))
1025                 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance);
1026         else
1027                 return hci_enable_advertising_sync(hdev);
1028 }
1029
1030 static void rpa_expired(struct work_struct *work)
1031 {
1032         struct hci_dev *hdev = container_of(work, struct hci_dev,
1033                                             rpa_expired.work);
1034
1035         bt_dev_dbg(hdev, "");
1036
1037         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1038
1039         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1040                 return;
1041
1042         hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL);
1043 }
1044
1045 static void discov_off(struct work_struct *work)
1046 {
1047         struct hci_dev *hdev = container_of(work, struct hci_dev,
1048                                             discov_off.work);
1049
1050         bt_dev_dbg(hdev, "");
1051
1052         hci_dev_lock(hdev);
1053
1054         /* When discoverable timeout triggers, then just make sure
1055          * the limited discoverable flag is cleared. Even in the case
1056          * of a timeout triggered from general discoverable, it is
1057          * safe to unconditionally clear the flag.
1058          */
1059         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1060         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1061         hdev->discov_timeout = 0;
1062
1063         hci_update_discoverable(hdev);
1064
1065         mgmt_new_settings(hdev);
1066
1067         hci_dev_unlock(hdev);
1068 }
1069
1070 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev);
1071
1072 static void mesh_send_complete(struct hci_dev *hdev,
1073                                struct mgmt_mesh_tx *mesh_tx, bool silent)
1074 {
1075         u8 handle = mesh_tx->handle;
1076
1077         if (!silent)
1078                 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle,
1079                            sizeof(handle), NULL);
1080
1081         mgmt_mesh_remove(mesh_tx);
1082 }
1083
1084 static int mesh_send_done_sync(struct hci_dev *hdev, void *data)
1085 {
1086         struct mgmt_mesh_tx *mesh_tx;
1087
1088         hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
1089         hci_disable_advertising_sync(hdev);
1090         mesh_tx = mgmt_mesh_next(hdev, NULL);
1091
1092         if (mesh_tx)
1093                 mesh_send_complete(hdev, mesh_tx, false);
1094
1095         return 0;
1096 }
1097
1098 static int mesh_send_sync(struct hci_dev *hdev, void *data);
1099 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err);
1100 static void mesh_next(struct hci_dev *hdev, void *data, int err)
1101 {
1102         struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL);
1103
1104         if (!mesh_tx)
1105                 return;
1106
1107         err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
1108                                  mesh_send_start_complete);
1109
1110         if (err < 0)
1111                 mesh_send_complete(hdev, mesh_tx, false);
1112         else
1113                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
1114 }
1115
1116 static void mesh_send_done(struct work_struct *work)
1117 {
1118         struct hci_dev *hdev = container_of(work, struct hci_dev,
1119                                             mesh_send_done.work);
1120
1121         if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING))
1122                 return;
1123
1124         hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next);
1125 }
1126
1127 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1128 {
1129         if (hci_dev_test_flag(hdev, HCI_MGMT))
1130                 return;
1131
1132         BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION);
1133
1134         INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
1135         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1136         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1137         INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done);
1138
1139         /* Non-mgmt controlled devices get this bit set
1140          * implicitly so that pairing works for them, however
1141          * for mgmt we require user-space to explicitly enable
1142          * it
1143          */
1144         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1145
1146         hci_dev_set_flag(hdev, HCI_MGMT);
1147 }
1148
1149 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1150                                 void *data, u16 data_len)
1151 {
1152         struct mgmt_rp_read_info rp;
1153
1154         bt_dev_dbg(hdev, "sock %p", sk);
1155
1156         hci_dev_lock(hdev);
1157
1158         memset(&rp, 0, sizeof(rp));
1159
1160         bacpy(&rp.bdaddr, &hdev->bdaddr);
1161
1162         rp.version = hdev->hci_ver;
1163         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1164
1165         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1166         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1167
1168         memcpy(rp.dev_class, hdev->dev_class, 3);
1169
1170         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1171         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1172
1173         hci_dev_unlock(hdev);
1174
1175         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1176                                  sizeof(rp));
1177 }
1178
1179 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1180 {
1181         u16 eir_len = 0;
1182         size_t name_len;
1183
1184         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1185                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1186                                           hdev->dev_class, 3);
1187
1188         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1189                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1190                                           hdev->appearance);
1191
1192         name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name));
1193         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1194                                   hdev->dev_name, name_len);
1195
1196         name_len = strnlen(hdev->short_name, sizeof(hdev->short_name));
1197         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1198                                   hdev->short_name, name_len);
1199
1200         return eir_len;
1201 }
1202
1203 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1204                                     void *data, u16 data_len)
1205 {
1206         char buf[512];
1207         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1208         u16 eir_len;
1209
1210         bt_dev_dbg(hdev, "sock %p", sk);
1211
1212         memset(&buf, 0, sizeof(buf));
1213
1214         hci_dev_lock(hdev);
1215
1216         bacpy(&rp->bdaddr, &hdev->bdaddr);
1217
1218         rp->version = hdev->hci_ver;
1219         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1220
1221         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1222         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1223
1224
1225         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1226         rp->eir_len = cpu_to_le16(eir_len);
1227
1228         hci_dev_unlock(hdev);
1229
1230         /* If this command is called at least once, then the events
1231          * for class of device and local name changes are disabled
1232          * and only the new extended controller information event
1233          * is used.
1234          */
1235         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1236         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1237         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1238
1239         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1240                                  sizeof(*rp) + eir_len);
1241 }
1242
1243 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1244 {
1245         char buf[512];
1246         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1247         u16 eir_len;
1248
1249         memset(buf, 0, sizeof(buf));
1250
1251         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1252         ev->eir_len = cpu_to_le16(eir_len);
1253
1254         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1255                                   sizeof(*ev) + eir_len,
1256                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1257 }
1258
1259 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1260 {
1261         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1262
1263         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1264                                  sizeof(settings));
1265 }
1266
1267 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1268 {
1269         struct mgmt_ev_advertising_added ev;
1270
1271         ev.instance = instance;
1272
1273         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1274 }
1275
1276 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1277                               u8 instance)
1278 {
1279         struct mgmt_ev_advertising_removed ev;
1280
1281         ev.instance = instance;
1282
1283         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1284 }
1285
1286 static void cancel_adv_timeout(struct hci_dev *hdev)
1287 {
1288         if (hdev->adv_instance_timeout) {
1289                 hdev->adv_instance_timeout = 0;
1290                 cancel_delayed_work(&hdev->adv_instance_expire);
1291         }
1292 }
1293
1294 /* This function requires the caller holds hdev->lock */
1295 static void restart_le_actions(struct hci_dev *hdev)
1296 {
1297         struct hci_conn_params *p;
1298
1299         list_for_each_entry(p, &hdev->le_conn_params, list) {
1300                 /* Needed for AUTO_OFF case where might not "really"
1301                  * have been powered off.
1302                  */
1303                 list_del_init(&p->action);
1304
1305                 switch (p->auto_connect) {
1306                 case HCI_AUTO_CONN_DIRECT:
1307                 case HCI_AUTO_CONN_ALWAYS:
1308                         list_add(&p->action, &hdev->pend_le_conns);
1309                         break;
1310                 case HCI_AUTO_CONN_REPORT:
1311                         list_add(&p->action, &hdev->pend_le_reports);
1312                         break;
1313                 default:
1314                         break;
1315                 }
1316         }
1317 }
1318
1319 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1320 {
1321         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1322
1323         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1324                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1325 }
1326
1327 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
1328 {
1329         struct mgmt_pending_cmd *cmd = data;
1330         struct mgmt_mode *cp;
1331
1332         /* Make sure cmd still outstanding. */
1333         if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
1334                 return;
1335
1336         cp = cmd->param;
1337
1338         bt_dev_dbg(hdev, "err %d", err);
1339
1340         if (!err) {
1341                 if (cp->val) {
1342                         hci_dev_lock(hdev);
1343                         restart_le_actions(hdev);
1344                         hci_update_passive_scan(hdev);
1345                         hci_dev_unlock(hdev);
1346                 }
1347
1348                 send_settings_rsp(cmd->sk, cmd->opcode, hdev);
1349
1350                 /* Only call new_setting for power on as power off is deferred
1351                  * to hdev->power_off work which does call hci_dev_do_close.
1352                  */
1353                 if (cp->val)
1354                         new_settings(hdev, cmd->sk);
1355         } else {
1356                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED,
1357                                 mgmt_status(err));
1358         }
1359
1360         mgmt_pending_remove(cmd);
1361 }
1362
1363 static int set_powered_sync(struct hci_dev *hdev, void *data)
1364 {
1365         struct mgmt_pending_cmd *cmd = data;
1366         struct mgmt_mode *cp = cmd->param;
1367
1368         BT_DBG("%s", hdev->name);
1369
1370         return hci_set_powered_sync(hdev, cp->val);
1371 }
1372
1373 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1374                        u16 len)
1375 {
1376         struct mgmt_mode *cp = data;
1377         struct mgmt_pending_cmd *cmd;
1378         int err;
1379
1380         bt_dev_dbg(hdev, "sock %p", sk);
1381
1382         if (cp->val != 0x00 && cp->val != 0x01)
1383                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1384                                        MGMT_STATUS_INVALID_PARAMS);
1385
1386         hci_dev_lock(hdev);
1387
1388         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1389                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1390                                       MGMT_STATUS_BUSY);
1391                 goto failed;
1392         }
1393
1394         if (!!cp->val == hdev_is_powered(hdev)) {
1395                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1396                 goto failed;
1397         }
1398
1399         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1400         if (!cmd) {
1401                 err = -ENOMEM;
1402                 goto failed;
1403         }
1404
1405         err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd,
1406                                  mgmt_set_powered_complete);
1407
1408         if (err < 0)
1409                 mgmt_pending_remove(cmd);
1410
1411 failed:
1412         hci_dev_unlock(hdev);
1413         return err;
1414 }
1415
1416 int mgmt_new_settings(struct hci_dev *hdev)
1417 {
1418         return new_settings(hdev, NULL);
1419 }
1420
1421 struct cmd_lookup {
1422         struct sock *sk;
1423         struct hci_dev *hdev;
1424         u8 mgmt_status;
1425 };
1426
1427 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1428 {
1429         struct cmd_lookup *match = data;
1430
1431         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1432
1433         list_del(&cmd->list);
1434
1435         if (match->sk == NULL) {
1436                 match->sk = cmd->sk;
1437                 sock_hold(match->sk);
1438         }
1439
1440         mgmt_pending_free(cmd);
1441 }
1442
1443 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1444 {
1445         u8 *status = data;
1446
1447         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1448         mgmt_pending_remove(cmd);
1449 }
1450
1451 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1452 {
1453         if (cmd->cmd_complete) {
1454                 u8 *status = data;
1455
1456                 cmd->cmd_complete(cmd, *status);
1457                 mgmt_pending_remove(cmd);
1458
1459                 return;
1460         }
1461
1462         cmd_status_rsp(cmd, data);
1463 }
1464
1465 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1466 {
1467         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1468                                  cmd->param, cmd->param_len);
1469 }
1470
1471 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1472 {
1473         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1474                                  cmd->param, sizeof(struct mgmt_addr_info));
1475 }
1476
1477 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1478 {
1479         if (!lmp_bredr_capable(hdev))
1480                 return MGMT_STATUS_NOT_SUPPORTED;
1481         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1482                 return MGMT_STATUS_REJECTED;
1483         else
1484                 return MGMT_STATUS_SUCCESS;
1485 }
1486
1487 static u8 mgmt_le_support(struct hci_dev *hdev)
1488 {
1489         if (!lmp_le_capable(hdev))
1490                 return MGMT_STATUS_NOT_SUPPORTED;
1491         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1492                 return MGMT_STATUS_REJECTED;
1493         else
1494                 return MGMT_STATUS_SUCCESS;
1495 }
1496
1497 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
1498                                            int err)
1499 {
1500         struct mgmt_pending_cmd *cmd = data;
1501
1502         bt_dev_dbg(hdev, "err %d", err);
1503
1504         /* Make sure cmd still outstanding. */
1505         if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
1506                 return;
1507
1508         hci_dev_lock(hdev);
1509
1510         if (err) {
1511                 u8 mgmt_err = mgmt_status(err);
1512                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1513                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1514                 goto done;
1515         }
1516
1517         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1518             hdev->discov_timeout > 0) {
1519                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1520                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1521         }
1522
1523         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1524         new_settings(hdev, cmd->sk);
1525
1526 done:
1527         mgmt_pending_remove(cmd);
1528         hci_dev_unlock(hdev);
1529 }
1530
1531 static int set_discoverable_sync(struct hci_dev *hdev, void *data)
1532 {
1533         BT_DBG("%s", hdev->name);
1534
1535         return hci_update_discoverable_sync(hdev);
1536 }
1537
1538 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1539                             u16 len)
1540 {
1541         struct mgmt_cp_set_discoverable *cp = data;
1542         struct mgmt_pending_cmd *cmd;
1543         u16 timeout;
1544         int err;
1545
1546         bt_dev_dbg(hdev, "sock %p", sk);
1547
1548         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1549             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1550                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1551                                        MGMT_STATUS_REJECTED);
1552
1553         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1554                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1555                                        MGMT_STATUS_INVALID_PARAMS);
1556
1557         timeout = __le16_to_cpu(cp->timeout);
1558
1559         /* Disabling discoverable requires that no timeout is set,
1560          * and enabling limited discoverable requires a timeout.
1561          */
1562         if ((cp->val == 0x00 && timeout > 0) ||
1563             (cp->val == 0x02 && timeout == 0))
1564                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1565                                        MGMT_STATUS_INVALID_PARAMS);
1566
1567         hci_dev_lock(hdev);
1568
1569         if (!hdev_is_powered(hdev) && timeout > 0) {
1570                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1571                                       MGMT_STATUS_NOT_POWERED);
1572                 goto failed;
1573         }
1574
1575         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1576             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1577                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1578                                       MGMT_STATUS_BUSY);
1579                 goto failed;
1580         }
1581
1582         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1583                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1584                                       MGMT_STATUS_REJECTED);
1585                 goto failed;
1586         }
1587
1588         if (hdev->advertising_paused) {
1589                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1590                                       MGMT_STATUS_BUSY);
1591                 goto failed;
1592         }
1593
1594         if (!hdev_is_powered(hdev)) {
1595                 bool changed = false;
1596
1597                 /* Setting limited discoverable when powered off is
1598                  * not a valid operation since it requires a timeout
1599                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1600                  */
1601                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1602                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1603                         changed = true;
1604                 }
1605
1606                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1607                 if (err < 0)
1608                         goto failed;
1609
1610                 if (changed)
1611                         err = new_settings(hdev, sk);
1612
1613                 goto failed;
1614         }
1615
1616         /* If the current mode is the same, then just update the timeout
1617          * value with the new value. And if only the timeout gets updated,
1618          * then no need for any HCI transactions.
1619          */
1620         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1621             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1622                                                    HCI_LIMITED_DISCOVERABLE)) {
1623                 cancel_delayed_work(&hdev->discov_off);
1624                 hdev->discov_timeout = timeout;
1625
1626                 if (cp->val && hdev->discov_timeout > 0) {
1627                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1628                         queue_delayed_work(hdev->req_workqueue,
1629                                            &hdev->discov_off, to);
1630                 }
1631
1632                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1633                 goto failed;
1634         }
1635
1636         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1637         if (!cmd) {
1638                 err = -ENOMEM;
1639                 goto failed;
1640         }
1641
1642         /* Cancel any potential discoverable timeout that might be
1643          * still active and store new timeout value. The arming of
1644          * the timeout happens in the complete handler.
1645          */
1646         cancel_delayed_work(&hdev->discov_off);
1647         hdev->discov_timeout = timeout;
1648
1649         if (cp->val)
1650                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1651         else
1652                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1653
1654         /* Limited discoverable mode */
1655         if (cp->val == 0x02)
1656                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1657         else
1658                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1659
1660         err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd,
1661                                  mgmt_set_discoverable_complete);
1662
1663         if (err < 0)
1664                 mgmt_pending_remove(cmd);
1665
1666 failed:
1667         hci_dev_unlock(hdev);
1668         return err;
1669 }
1670
1671 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
1672                                           int err)
1673 {
1674         struct mgmt_pending_cmd *cmd = data;
1675
1676         bt_dev_dbg(hdev, "err %d", err);
1677
1678         /* Make sure cmd still outstanding. */
1679         if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
1680                 return;
1681
1682         hci_dev_lock(hdev);
1683
1684         if (err) {
1685                 u8 mgmt_err = mgmt_status(err);
1686                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1687                 goto done;
1688         }
1689
1690         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1691         new_settings(hdev, cmd->sk);
1692
1693 done:
1694         if (cmd)
1695                 mgmt_pending_remove(cmd);
1696
1697         hci_dev_unlock(hdev);
1698 }
1699
1700 static int set_connectable_update_settings(struct hci_dev *hdev,
1701                                            struct sock *sk, u8 val)
1702 {
1703         bool changed = false;
1704         int err;
1705
1706         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1707                 changed = true;
1708
1709         if (val) {
1710                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1711         } else {
1712                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1713                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1714         }
1715
1716         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1717         if (err < 0)
1718                 return err;
1719
1720         if (changed) {
1721                 hci_update_scan(hdev);
1722                 hci_update_passive_scan(hdev);
1723                 return new_settings(hdev, sk);
1724         }
1725
1726         return 0;
1727 }
1728
1729 static int set_connectable_sync(struct hci_dev *hdev, void *data)
1730 {
1731         BT_DBG("%s", hdev->name);
1732
1733         return hci_update_connectable_sync(hdev);
1734 }
1735
1736 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1737                            u16 len)
1738 {
1739         struct mgmt_mode *cp = data;
1740         struct mgmt_pending_cmd *cmd;
1741         int err;
1742
1743         bt_dev_dbg(hdev, "sock %p", sk);
1744
1745         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1746             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1747                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1748                                        MGMT_STATUS_REJECTED);
1749
1750         if (cp->val != 0x00 && cp->val != 0x01)
1751                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1752                                        MGMT_STATUS_INVALID_PARAMS);
1753
1754         hci_dev_lock(hdev);
1755
1756         if (!hdev_is_powered(hdev)) {
1757                 err = set_connectable_update_settings(hdev, sk, cp->val);
1758                 goto failed;
1759         }
1760
1761         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1762             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1763                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1764                                       MGMT_STATUS_BUSY);
1765                 goto failed;
1766         }
1767
1768         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1769         if (!cmd) {
1770                 err = -ENOMEM;
1771                 goto failed;
1772         }
1773
1774         if (cp->val) {
1775                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1776         } else {
1777                 if (hdev->discov_timeout > 0)
1778                         cancel_delayed_work(&hdev->discov_off);
1779
1780                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1781                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1782                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1783         }
1784
1785         err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd,
1786                                  mgmt_set_connectable_complete);
1787
1788         if (err < 0)
1789                 mgmt_pending_remove(cmd);
1790
1791 failed:
1792         hci_dev_unlock(hdev);
1793         return err;
1794 }
1795
1796 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1797                         u16 len)
1798 {
1799         struct mgmt_mode *cp = data;
1800         bool changed;
1801         int err;
1802
1803         bt_dev_dbg(hdev, "sock %p", sk);
1804
1805         if (cp->val != 0x00 && cp->val != 0x01)
1806                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1807                                        MGMT_STATUS_INVALID_PARAMS);
1808
1809         hci_dev_lock(hdev);
1810
1811         if (cp->val)
1812                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1813         else
1814                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1815
1816         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1817         if (err < 0)
1818                 goto unlock;
1819
1820         if (changed) {
1821                 /* In limited privacy mode the change of bondable mode
1822                  * may affect the local advertising address.
1823                  */
1824                 hci_update_discoverable(hdev);
1825
1826                 err = new_settings(hdev, sk);
1827         }
1828
1829 unlock:
1830         hci_dev_unlock(hdev);
1831         return err;
1832 }
1833
1834 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1835                              u16 len)
1836 {
1837         struct mgmt_mode *cp = data;
1838         struct mgmt_pending_cmd *cmd;
1839         u8 val, status;
1840         int err;
1841
1842         bt_dev_dbg(hdev, "sock %p", sk);
1843
1844         status = mgmt_bredr_support(hdev);
1845         if (status)
1846                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1847                                        status);
1848
1849         if (cp->val != 0x00 && cp->val != 0x01)
1850                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1851                                        MGMT_STATUS_INVALID_PARAMS);
1852
1853         hci_dev_lock(hdev);
1854
1855         if (!hdev_is_powered(hdev)) {
1856                 bool changed = false;
1857
1858                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1859                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1860                         changed = true;
1861                 }
1862
1863                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1864                 if (err < 0)
1865                         goto failed;
1866
1867                 if (changed)
1868                         err = new_settings(hdev, sk);
1869
1870                 goto failed;
1871         }
1872
1873         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1874                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1875                                       MGMT_STATUS_BUSY);
1876                 goto failed;
1877         }
1878
1879         val = !!cp->val;
1880
1881         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1882                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1883                 goto failed;
1884         }
1885
1886         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1887         if (!cmd) {
1888                 err = -ENOMEM;
1889                 goto failed;
1890         }
1891
1892         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1893         if (err < 0) {
1894                 mgmt_pending_remove(cmd);
1895                 goto failed;
1896         }
1897
1898 failed:
1899         hci_dev_unlock(hdev);
1900         return err;
1901 }
1902
1903 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
1904 {
1905         struct cmd_lookup match = { NULL, hdev };
1906         struct mgmt_pending_cmd *cmd = data;
1907         struct mgmt_mode *cp = cmd->param;
1908         u8 enable = cp->val;
1909         bool changed;
1910
1911         /* Make sure cmd still outstanding. */
1912         if (cmd != pending_find(MGMT_OP_SET_SSP, hdev))
1913                 return;
1914
1915         if (err) {
1916                 u8 mgmt_err = mgmt_status(err);
1917
1918                 if (enable && hci_dev_test_and_clear_flag(hdev,
1919                                                           HCI_SSP_ENABLED)) {
1920                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1921                         new_settings(hdev, NULL);
1922                 }
1923
1924                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
1925                                      &mgmt_err);
1926                 return;
1927         }
1928
1929         if (enable) {
1930                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1931         } else {
1932                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
1933
1934                 if (!changed)
1935                         changed = hci_dev_test_and_clear_flag(hdev,
1936                                                               HCI_HS_ENABLED);
1937                 else
1938                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1939         }
1940
1941         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
1942
1943         if (changed)
1944                 new_settings(hdev, match.sk);
1945
1946         if (match.sk)
1947                 sock_put(match.sk);
1948
1949         hci_update_eir_sync(hdev);
1950 }
1951
1952 static int set_ssp_sync(struct hci_dev *hdev, void *data)
1953 {
1954         struct mgmt_pending_cmd *cmd = data;
1955         struct mgmt_mode *cp = cmd->param;
1956         bool changed = false;
1957         int err;
1958
1959         if (cp->val)
1960                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1961
1962         err = hci_write_ssp_mode_sync(hdev, cp->val);
1963
1964         if (!err && changed)
1965                 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
1966
1967         return err;
1968 }
1969
1970 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1971 {
1972         struct mgmt_mode *cp = data;
1973         struct mgmt_pending_cmd *cmd;
1974         u8 status;
1975         int err;
1976
1977         bt_dev_dbg(hdev, "sock %p", sk);
1978
1979         status = mgmt_bredr_support(hdev);
1980         if (status)
1981                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1982
1983         if (!lmp_ssp_capable(hdev))
1984                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1985                                        MGMT_STATUS_NOT_SUPPORTED);
1986
1987         if (cp->val != 0x00 && cp->val != 0x01)
1988                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1989                                        MGMT_STATUS_INVALID_PARAMS);
1990
1991         hci_dev_lock(hdev);
1992
1993         if (!hdev_is_powered(hdev)) {
1994                 bool changed;
1995
1996                 if (cp->val) {
1997                         changed = !hci_dev_test_and_set_flag(hdev,
1998                                                              HCI_SSP_ENABLED);
1999                 } else {
2000                         changed = hci_dev_test_and_clear_flag(hdev,
2001                                                               HCI_SSP_ENABLED);
2002                         if (!changed)
2003                                 changed = hci_dev_test_and_clear_flag(hdev,
2004                                                                       HCI_HS_ENABLED);
2005                         else
2006                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
2007                 }
2008
2009                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2010                 if (err < 0)
2011                         goto failed;
2012
2013                 if (changed)
2014                         err = new_settings(hdev, sk);
2015
2016                 goto failed;
2017         }
2018
2019         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2020                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2021                                       MGMT_STATUS_BUSY);
2022                 goto failed;
2023         }
2024
2025         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2026                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2027                 goto failed;
2028         }
2029
2030         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2031         if (!cmd)
2032                 err = -ENOMEM;
2033         else
2034                 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd,
2035                                          set_ssp_complete);
2036
2037         if (err < 0) {
2038                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2039                                       MGMT_STATUS_FAILED);
2040
2041                 if (cmd)
2042                         mgmt_pending_remove(cmd);
2043         }
2044
2045 failed:
2046         hci_dev_unlock(hdev);
2047         return err;
2048 }
2049
2050 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2051 {
2052         struct mgmt_mode *cp = data;
2053         bool changed;
2054         u8 status;
2055         int err;
2056
2057         bt_dev_dbg(hdev, "sock %p", sk);
2058
2059         if (!IS_ENABLED(CONFIG_BT_HS))
2060                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2061                                        MGMT_STATUS_NOT_SUPPORTED);
2062
2063         status = mgmt_bredr_support(hdev);
2064         if (status)
2065                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2066
2067         if (!lmp_ssp_capable(hdev))
2068                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2069                                        MGMT_STATUS_NOT_SUPPORTED);
2070
2071         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
2072                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2073                                        MGMT_STATUS_REJECTED);
2074
2075         if (cp->val != 0x00 && cp->val != 0x01)
2076                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2077                                        MGMT_STATUS_INVALID_PARAMS);
2078
2079         hci_dev_lock(hdev);
2080
2081         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2082                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2083                                       MGMT_STATUS_BUSY);
2084                 goto unlock;
2085         }
2086
2087         if (cp->val) {
2088                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
2089         } else {
2090                 if (hdev_is_powered(hdev)) {
2091                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2092                                               MGMT_STATUS_REJECTED);
2093                         goto unlock;
2094                 }
2095
2096                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
2097         }
2098
2099         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2100         if (err < 0)
2101                 goto unlock;
2102
2103         if (changed)
2104                 err = new_settings(hdev, sk);
2105
2106 unlock:
2107         hci_dev_unlock(hdev);
2108         return err;
2109 }
2110
2111 static void set_le_complete(struct hci_dev *hdev, void *data, int err)
2112 {
2113         struct cmd_lookup match = { NULL, hdev };
2114         u8 status = mgmt_status(err);
2115
2116         bt_dev_dbg(hdev, "err %d", err);
2117
2118         if (status) {
2119                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2120                                                         &status);
2121                 return;
2122         }
2123
2124         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2125
2126         new_settings(hdev, match.sk);
2127
2128         if (match.sk)
2129                 sock_put(match.sk);
2130 }
2131
2132 static int set_le_sync(struct hci_dev *hdev, void *data)
2133 {
2134         struct mgmt_pending_cmd *cmd = data;
2135         struct mgmt_mode *cp = cmd->param;
2136         u8 val = !!cp->val;
2137         int err;
2138
2139         if (!val) {
2140                 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true);
2141
2142                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2143                         hci_disable_advertising_sync(hdev);
2144
2145                 if (ext_adv_capable(hdev))
2146                         hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk);
2147         } else {
2148                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2149         }
2150
2151         err = hci_write_le_host_supported_sync(hdev, val, 0);
2152
2153         /* Make sure the controller has a good default for
2154          * advertising data. Restrict the update to when LE
2155          * has actually been enabled. During power on, the
2156          * update in powered_update_hci will take care of it.
2157          */
2158         if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2159                 if (ext_adv_capable(hdev)) {
2160                         int status;
2161
2162                         status = hci_setup_ext_adv_instance_sync(hdev, 0x00);
2163                         if (!status)
2164                                 hci_update_scan_rsp_data_sync(hdev, 0x00);
2165                 } else {
2166                         hci_update_adv_data_sync(hdev, 0x00);
2167                         hci_update_scan_rsp_data_sync(hdev, 0x00);
2168                 }
2169
2170                 hci_update_passive_scan(hdev);
2171         }
2172
2173         return err;
2174 }
2175
2176 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err)
2177 {
2178         struct mgmt_pending_cmd *cmd = data;
2179         u8 status = mgmt_status(err);
2180         struct sock *sk = cmd->sk;
2181
2182         if (status) {
2183                 mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev,
2184                                      cmd_status_rsp, &status);
2185                 return;
2186         }
2187
2188         mgmt_pending_remove(cmd);
2189         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0);
2190 }
2191
2192 static int set_mesh_sync(struct hci_dev *hdev, void *data)
2193 {
2194         struct mgmt_pending_cmd *cmd = data;
2195         struct mgmt_cp_set_mesh *cp = cmd->param;
2196         size_t len = cmd->param_len;
2197
2198         memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types));
2199
2200         if (cp->enable)
2201                 hci_dev_set_flag(hdev, HCI_MESH);
2202         else
2203                 hci_dev_clear_flag(hdev, HCI_MESH);
2204
2205         len -= sizeof(*cp);
2206
2207         /* If filters don't fit, forward all adv pkts */
2208         if (len <= sizeof(hdev->mesh_ad_types))
2209                 memcpy(hdev->mesh_ad_types, cp->ad_types, len);
2210
2211         hci_update_passive_scan_sync(hdev);
2212         return 0;
2213 }
2214
2215 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2216 {
2217         struct mgmt_cp_set_mesh *cp = data;
2218         struct mgmt_pending_cmd *cmd;
2219         int err = 0;
2220
2221         bt_dev_dbg(hdev, "sock %p", sk);
2222
2223         if (!lmp_le_capable(hdev) ||
2224             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2225                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2226                                        MGMT_STATUS_NOT_SUPPORTED);
2227
2228         if (cp->enable != 0x00 && cp->enable != 0x01)
2229                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2230                                        MGMT_STATUS_INVALID_PARAMS);
2231
2232         hci_dev_lock(hdev);
2233
2234         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len);
2235         if (!cmd)
2236                 err = -ENOMEM;
2237         else
2238                 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd,
2239                                          set_mesh_complete);
2240
2241         if (err < 0) {
2242                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2243                                       MGMT_STATUS_FAILED);
2244
2245                 if (cmd)
2246                         mgmt_pending_remove(cmd);
2247         }
2248
2249         hci_dev_unlock(hdev);
2250         return err;
2251 }
2252
2253 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err)
2254 {
2255         struct mgmt_mesh_tx *mesh_tx = data;
2256         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2257         unsigned long mesh_send_interval;
2258         u8 mgmt_err = mgmt_status(err);
2259
2260         /* Report any errors here, but don't report completion */
2261
2262         if (mgmt_err) {
2263                 hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
2264                 /* Send Complete Error Code for handle */
2265                 mesh_send_complete(hdev, mesh_tx, false);
2266                 return;
2267         }
2268
2269         mesh_send_interval = msecs_to_jiffies((send->cnt) * 25);
2270         queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done,
2271                            mesh_send_interval);
2272 }
2273
2274 static int mesh_send_sync(struct hci_dev *hdev, void *data)
2275 {
2276         struct mgmt_mesh_tx *mesh_tx = data;
2277         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2278         struct adv_info *adv, *next_instance;
2279         u8 instance = hdev->le_num_of_adv_sets + 1;
2280         u16 timeout, duration;
2281         int err = 0;
2282
2283         if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt)
2284                 return MGMT_STATUS_BUSY;
2285
2286         timeout = 1000;
2287         duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval);
2288         adv = hci_add_adv_instance(hdev, instance, 0,
2289                                    send->adv_data_len, send->adv_data,
2290                                    0, NULL,
2291                                    timeout, duration,
2292                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
2293                                    hdev->le_adv_min_interval,
2294                                    hdev->le_adv_max_interval,
2295                                    mesh_tx->handle);
2296
2297         if (!IS_ERR(adv))
2298                 mesh_tx->instance = instance;
2299         else
2300                 err = PTR_ERR(adv);
2301
2302         if (hdev->cur_adv_instance == instance) {
2303                 /* If the currently advertised instance is being changed then
2304                  * cancel the current advertising and schedule the next
2305                  * instance. If there is only one instance then the overridden
2306                  * advertising data will be visible right away.
2307                  */
2308                 cancel_adv_timeout(hdev);
2309
2310                 next_instance = hci_get_next_instance(hdev, instance);
2311                 if (next_instance)
2312                         instance = next_instance->instance;
2313                 else
2314                         instance = 0;
2315         } else if (hdev->adv_instance_timeout) {
2316                 /* Immediately advertise the new instance if no other, or
2317                  * let it go naturally from queue if ADV is already happening
2318                  */
2319                 instance = 0;
2320         }
2321
2322         if (instance)
2323                 return hci_schedule_adv_instance_sync(hdev, instance, true);
2324
2325         return err;
2326 }
2327
2328 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data)
2329 {
2330         struct mgmt_rp_mesh_read_features *rp = data;
2331
2332         if (rp->used_handles >= rp->max_handles)
2333                 return;
2334
2335         rp->handles[rp->used_handles++] = mesh_tx->handle;
2336 }
2337
2338 static int mesh_features(struct sock *sk, struct hci_dev *hdev,
2339                          void *data, u16 len)
2340 {
2341         struct mgmt_rp_mesh_read_features rp;
2342
2343         if (!lmp_le_capable(hdev) ||
2344             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2345                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES,
2346                                        MGMT_STATUS_NOT_SUPPORTED);
2347
2348         memset(&rp, 0, sizeof(rp));
2349         rp.index = cpu_to_le16(hdev->id);
2350         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2351                 rp.max_handles = MESH_HANDLES_MAX;
2352
2353         hci_dev_lock(hdev);
2354
2355         if (rp.max_handles)
2356                 mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2357
2358         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp,
2359                           rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX);
2360
2361         hci_dev_unlock(hdev);
2362         return 0;
2363 }
2364
2365 static int send_cancel(struct hci_dev *hdev, void *data)
2366 {
2367         struct mgmt_pending_cmd *cmd = data;
2368         struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param;
2369         struct mgmt_mesh_tx *mesh_tx;
2370
2371         if (!cancel->handle) {
2372                 do {
2373                         mesh_tx = mgmt_mesh_next(hdev, cmd->sk);
2374
2375                         if (mesh_tx)
2376                                 mesh_send_complete(hdev, mesh_tx, false);
2377                 } while (mesh_tx);
2378         } else {
2379                 mesh_tx = mgmt_mesh_find(hdev, cancel->handle);
2380
2381                 if (mesh_tx && mesh_tx->sk == cmd->sk)
2382                         mesh_send_complete(hdev, mesh_tx, false);
2383         }
2384
2385         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2386                           0, NULL, 0);
2387         mgmt_pending_free(cmd);
2388
2389         return 0;
2390 }
2391
2392 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev,
2393                             void *data, u16 len)
2394 {
2395         struct mgmt_pending_cmd *cmd;
2396         int err;
2397
2398         if (!lmp_le_capable(hdev) ||
2399             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2400                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2401                                        MGMT_STATUS_NOT_SUPPORTED);
2402
2403         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2404                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2405                                        MGMT_STATUS_REJECTED);
2406
2407         hci_dev_lock(hdev);
2408         cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len);
2409         if (!cmd)
2410                 err = -ENOMEM;
2411         else
2412                 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL);
2413
2414         if (err < 0) {
2415                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2416                                       MGMT_STATUS_FAILED);
2417
2418                 if (cmd)
2419                         mgmt_pending_free(cmd);
2420         }
2421
2422         hci_dev_unlock(hdev);
2423         return err;
2424 }
2425
2426 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2427 {
2428         struct mgmt_mesh_tx *mesh_tx;
2429         struct mgmt_cp_mesh_send *send = data;
2430         struct mgmt_rp_mesh_read_features rp;
2431         bool sending;
2432         int err = 0;
2433
2434         if (!lmp_le_capable(hdev) ||
2435             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2436                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2437                                        MGMT_STATUS_NOT_SUPPORTED);
2438         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) ||
2439             len <= MGMT_MESH_SEND_SIZE ||
2440             len > (MGMT_MESH_SEND_SIZE + 31))
2441                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2442                                        MGMT_STATUS_REJECTED);
2443
2444         hci_dev_lock(hdev);
2445
2446         memset(&rp, 0, sizeof(rp));
2447         rp.max_handles = MESH_HANDLES_MAX;
2448
2449         mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2450
2451         if (rp.max_handles <= rp.used_handles) {
2452                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2453                                       MGMT_STATUS_BUSY);
2454                 goto done;
2455         }
2456
2457         sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING);
2458         mesh_tx = mgmt_mesh_add(sk, hdev, send, len);
2459
2460         if (!mesh_tx)
2461                 err = -ENOMEM;
2462         else if (!sending)
2463                 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
2464                                          mesh_send_start_complete);
2465
2466         if (err < 0) {
2467                 bt_dev_err(hdev, "Send Mesh Failed %d", err);
2468                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2469                                       MGMT_STATUS_FAILED);
2470
2471                 if (mesh_tx) {
2472                         if (sending)
2473                                 mgmt_mesh_remove(mesh_tx);
2474                 }
2475         } else {
2476                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
2477
2478                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0,
2479                                   &mesh_tx->handle, 1);
2480         }
2481
2482 done:
2483         hci_dev_unlock(hdev);
2484         return err;
2485 }
2486
2487 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2488 {
2489         struct mgmt_mode *cp = data;
2490         struct mgmt_pending_cmd *cmd;
2491         int err;
2492         u8 val, enabled;
2493
2494         bt_dev_dbg(hdev, "sock %p", sk);
2495
2496         if (!lmp_le_capable(hdev))
2497                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2498                                        MGMT_STATUS_NOT_SUPPORTED);
2499
2500         if (cp->val != 0x00 && cp->val != 0x01)
2501                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2502                                        MGMT_STATUS_INVALID_PARAMS);
2503
2504         /* Bluetooth single mode LE only controllers or dual-mode
2505          * controllers configured as LE only devices, do not allow
2506          * switching LE off. These have either LE enabled explicitly
2507          * or BR/EDR has been previously switched off.
2508          *
2509          * When trying to enable an already enabled LE, then gracefully
2510          * send a positive response. Trying to disable it however will
2511          * result into rejection.
2512          */
2513         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2514                 if (cp->val == 0x01)
2515                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2516
2517                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2518                                        MGMT_STATUS_REJECTED);
2519         }
2520
2521         hci_dev_lock(hdev);
2522
2523         val = !!cp->val;
2524         enabled = lmp_host_le_capable(hdev);
2525
2526         if (!hdev_is_powered(hdev) || val == enabled) {
2527                 bool changed = false;
2528
2529                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2530                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2531                         changed = true;
2532                 }
2533
2534                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2535                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2536                         changed = true;
2537                 }
2538
2539                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2540                 if (err < 0)
2541                         goto unlock;
2542
2543                 if (changed)
2544                         err = new_settings(hdev, sk);
2545
2546                 goto unlock;
2547         }
2548
2549         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2550             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2551                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2552                                       MGMT_STATUS_BUSY);
2553                 goto unlock;
2554         }
2555
2556         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2557         if (!cmd)
2558                 err = -ENOMEM;
2559         else
2560                 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd,
2561                                          set_le_complete);
2562
2563         if (err < 0) {
2564                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2565                                       MGMT_STATUS_FAILED);
2566
2567                 if (cmd)
2568                         mgmt_pending_remove(cmd);
2569         }
2570
2571 unlock:
2572         hci_dev_unlock(hdev);
2573         return err;
2574 }
2575
2576 /* This is a helper function to test for pending mgmt commands that can
2577  * cause CoD or EIR HCI commands. We can only allow one such pending
2578  * mgmt command at a time since otherwise we cannot easily track what
2579  * the current values are, will be, and based on that calculate if a new
2580  * HCI command needs to be sent and if yes with what value.
2581  */
2582 static bool pending_eir_or_class(struct hci_dev *hdev)
2583 {
2584         struct mgmt_pending_cmd *cmd;
2585
2586         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2587                 switch (cmd->opcode) {
2588                 case MGMT_OP_ADD_UUID:
2589                 case MGMT_OP_REMOVE_UUID:
2590                 case MGMT_OP_SET_DEV_CLASS:
2591                 case MGMT_OP_SET_POWERED:
2592                         return true;
2593                 }
2594         }
2595
2596         return false;
2597 }
2598
2599 static const u8 bluetooth_base_uuid[] = {
2600                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2601                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2602 };
2603
2604 static u8 get_uuid_size(const u8 *uuid)
2605 {
2606         u32 val;
2607
2608         if (memcmp(uuid, bluetooth_base_uuid, 12))
2609                 return 128;
2610
2611         val = get_unaligned_le32(&uuid[12]);
2612         if (val > 0xffff)
2613                 return 32;
2614
2615         return 16;
2616 }
2617
2618 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err)
2619 {
2620         struct mgmt_pending_cmd *cmd = data;
2621
2622         bt_dev_dbg(hdev, "err %d", err);
2623
2624         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2625                           mgmt_status(err), hdev->dev_class, 3);
2626
2627         mgmt_pending_free(cmd);
2628 }
2629
2630 static int add_uuid_sync(struct hci_dev *hdev, void *data)
2631 {
2632         int err;
2633
2634         err = hci_update_class_sync(hdev);
2635         if (err)
2636                 return err;
2637
2638         return hci_update_eir_sync(hdev);
2639 }
2640
2641 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2642 {
2643         struct mgmt_cp_add_uuid *cp = data;
2644         struct mgmt_pending_cmd *cmd;
2645         struct bt_uuid *uuid;
2646         int err;
2647
2648         bt_dev_dbg(hdev, "sock %p", sk);
2649
2650         hci_dev_lock(hdev);
2651
2652         if (pending_eir_or_class(hdev)) {
2653                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2654                                       MGMT_STATUS_BUSY);
2655                 goto failed;
2656         }
2657
2658         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2659         if (!uuid) {
2660                 err = -ENOMEM;
2661                 goto failed;
2662         }
2663
2664         memcpy(uuid->uuid, cp->uuid, 16);
2665         uuid->svc_hint = cp->svc_hint;
2666         uuid->size = get_uuid_size(cp->uuid);
2667
2668         list_add_tail(&uuid->list, &hdev->uuids);
2669
2670         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2671         if (!cmd) {
2672                 err = -ENOMEM;
2673                 goto failed;
2674         }
2675
2676         err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete);
2677         if (err < 0) {
2678                 mgmt_pending_free(cmd);
2679                 goto failed;
2680         }
2681
2682 failed:
2683         hci_dev_unlock(hdev);
2684         return err;
2685 }
2686
2687 static bool enable_service_cache(struct hci_dev *hdev)
2688 {
2689         if (!hdev_is_powered(hdev))
2690                 return false;
2691
2692         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2693                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2694                                    CACHE_TIMEOUT);
2695                 return true;
2696         }
2697
2698         return false;
2699 }
2700
2701 static int remove_uuid_sync(struct hci_dev *hdev, void *data)
2702 {
2703         int err;
2704
2705         err = hci_update_class_sync(hdev);
2706         if (err)
2707                 return err;
2708
2709         return hci_update_eir_sync(hdev);
2710 }
2711
2712 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2713                        u16 len)
2714 {
2715         struct mgmt_cp_remove_uuid *cp = data;
2716         struct mgmt_pending_cmd *cmd;
2717         struct bt_uuid *match, *tmp;
2718         static const u8 bt_uuid_any[] = {
2719                 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
2720         };
2721         int err, found;
2722
2723         bt_dev_dbg(hdev, "sock %p", sk);
2724
2725         hci_dev_lock(hdev);
2726
2727         if (pending_eir_or_class(hdev)) {
2728                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2729                                       MGMT_STATUS_BUSY);
2730                 goto unlock;
2731         }
2732
2733         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2734                 hci_uuids_clear(hdev);
2735
2736                 if (enable_service_cache(hdev)) {
2737                         err = mgmt_cmd_complete(sk, hdev->id,
2738                                                 MGMT_OP_REMOVE_UUID,
2739                                                 0, hdev->dev_class, 3);
2740                         goto unlock;
2741                 }
2742
2743                 goto update_class;
2744         }
2745
2746         found = 0;
2747
2748         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2749                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2750                         continue;
2751
2752                 list_del(&match->list);
2753                 kfree(match);
2754                 found++;
2755         }
2756
2757         if (found == 0) {
2758                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2759                                       MGMT_STATUS_INVALID_PARAMS);
2760                 goto unlock;
2761         }
2762
2763 update_class:
2764         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2765         if (!cmd) {
2766                 err = -ENOMEM;
2767                 goto unlock;
2768         }
2769
2770         err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd,
2771                                  mgmt_class_complete);
2772         if (err < 0)
2773                 mgmt_pending_free(cmd);
2774
2775 unlock:
2776         hci_dev_unlock(hdev);
2777         return err;
2778 }
2779
2780 static int set_class_sync(struct hci_dev *hdev, void *data)
2781 {
2782         int err = 0;
2783
2784         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2785                 cancel_delayed_work_sync(&hdev->service_cache);
2786                 err = hci_update_eir_sync(hdev);
2787         }
2788
2789         if (err)
2790                 return err;
2791
2792         return hci_update_class_sync(hdev);
2793 }
2794
2795 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2796                          u16 len)
2797 {
2798         struct mgmt_cp_set_dev_class *cp = data;
2799         struct mgmt_pending_cmd *cmd;
2800         int err;
2801
2802         bt_dev_dbg(hdev, "sock %p", sk);
2803
2804         if (!lmp_bredr_capable(hdev))
2805                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2806                                        MGMT_STATUS_NOT_SUPPORTED);
2807
2808         hci_dev_lock(hdev);
2809
2810         if (pending_eir_or_class(hdev)) {
2811                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2812                                       MGMT_STATUS_BUSY);
2813                 goto unlock;
2814         }
2815
2816         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2817                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2818                                       MGMT_STATUS_INVALID_PARAMS);
2819                 goto unlock;
2820         }
2821
2822         hdev->major_class = cp->major;
2823         hdev->minor_class = cp->minor;
2824
2825         if (!hdev_is_powered(hdev)) {
2826                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2827                                         hdev->dev_class, 3);
2828                 goto unlock;
2829         }
2830
2831         cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2832         if (!cmd) {
2833                 err = -ENOMEM;
2834                 goto unlock;
2835         }
2836
2837         err = hci_cmd_sync_queue(hdev, set_class_sync, cmd,
2838                                  mgmt_class_complete);
2839         if (err < 0)
2840                 mgmt_pending_free(cmd);
2841
2842 unlock:
2843         hci_dev_unlock(hdev);
2844         return err;
2845 }
2846
2847 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2848                           u16 len)
2849 {
2850         struct mgmt_cp_load_link_keys *cp = data;
2851         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2852                                    sizeof(struct mgmt_link_key_info));
2853         u16 key_count, expected_len;
2854         bool changed;
2855         int i;
2856
2857         bt_dev_dbg(hdev, "sock %p", sk);
2858
2859         if (!lmp_bredr_capable(hdev))
2860                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2861                                        MGMT_STATUS_NOT_SUPPORTED);
2862
2863         key_count = __le16_to_cpu(cp->key_count);
2864         if (key_count > max_key_count) {
2865                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2866                            key_count);
2867                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2868                                        MGMT_STATUS_INVALID_PARAMS);
2869         }
2870
2871         expected_len = struct_size(cp, keys, key_count);
2872         if (expected_len != len) {
2873                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2874                            expected_len, len);
2875                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2876                                        MGMT_STATUS_INVALID_PARAMS);
2877         }
2878
2879         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2880                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2881                                        MGMT_STATUS_INVALID_PARAMS);
2882
2883         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2884                    key_count);
2885
2886         for (i = 0; i < key_count; i++) {
2887                 struct mgmt_link_key_info *key = &cp->keys[i];
2888
2889                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2890                         return mgmt_cmd_status(sk, hdev->id,
2891                                                MGMT_OP_LOAD_LINK_KEYS,
2892                                                MGMT_STATUS_INVALID_PARAMS);
2893         }
2894
2895         hci_dev_lock(hdev);
2896
2897         hci_link_keys_clear(hdev);
2898
2899         if (cp->debug_keys)
2900                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2901         else
2902                 changed = hci_dev_test_and_clear_flag(hdev,
2903                                                       HCI_KEEP_DEBUG_KEYS);
2904
2905         if (changed)
2906                 new_settings(hdev, NULL);
2907
2908         for (i = 0; i < key_count; i++) {
2909                 struct mgmt_link_key_info *key = &cp->keys[i];
2910
2911                 if (hci_is_blocked_key(hdev,
2912                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2913                                        key->val)) {
2914                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2915                                     &key->addr.bdaddr);
2916                         continue;
2917                 }
2918
2919                 /* Always ignore debug keys and require a new pairing if
2920                  * the user wants to use them.
2921                  */
2922                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2923                         continue;
2924
2925                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2926                                  key->type, key->pin_len, NULL);
2927         }
2928
2929         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2930
2931         hci_dev_unlock(hdev);
2932
2933         return 0;
2934 }
2935
2936 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2937                            u8 addr_type, struct sock *skip_sk)
2938 {
2939         struct mgmt_ev_device_unpaired ev;
2940
2941         bacpy(&ev.addr.bdaddr, bdaddr);
2942         ev.addr.type = addr_type;
2943
2944         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2945                           skip_sk);
2946 }
2947
2948 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err)
2949 {
2950         struct mgmt_pending_cmd *cmd = data;
2951         struct mgmt_cp_unpair_device *cp = cmd->param;
2952
2953         if (!err)
2954                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
2955
2956         cmd->cmd_complete(cmd, err);
2957         mgmt_pending_free(cmd);
2958 }
2959
2960 static int unpair_device_sync(struct hci_dev *hdev, void *data)
2961 {
2962         struct mgmt_pending_cmd *cmd = data;
2963         struct mgmt_cp_unpair_device *cp = cmd->param;
2964         struct hci_conn *conn;
2965
2966         if (cp->addr.type == BDADDR_BREDR)
2967                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2968                                                &cp->addr.bdaddr);
2969         else
2970                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2971                                                le_addr_type(cp->addr.type));
2972
2973         if (!conn)
2974                 return 0;
2975
2976         return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
2977 }
2978
2979 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2980                          u16 len)
2981 {
2982         struct mgmt_cp_unpair_device *cp = data;
2983         struct mgmt_rp_unpair_device rp;
2984         struct hci_conn_params *params;
2985         struct mgmt_pending_cmd *cmd;
2986         struct hci_conn *conn;
2987         u8 addr_type;
2988         int err;
2989
2990         memset(&rp, 0, sizeof(rp));
2991         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2992         rp.addr.type = cp->addr.type;
2993
2994         if (!bdaddr_type_is_valid(cp->addr.type))
2995                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2996                                          MGMT_STATUS_INVALID_PARAMS,
2997                                          &rp, sizeof(rp));
2998
2999         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
3000                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3001                                          MGMT_STATUS_INVALID_PARAMS,
3002                                          &rp, sizeof(rp));
3003
3004         hci_dev_lock(hdev);
3005
3006         if (!hdev_is_powered(hdev)) {
3007                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3008                                         MGMT_STATUS_NOT_POWERED, &rp,
3009                                         sizeof(rp));
3010                 goto unlock;
3011         }
3012
3013         if (cp->addr.type == BDADDR_BREDR) {
3014                 /* If disconnection is requested, then look up the
3015                  * connection. If the remote device is connected, it
3016                  * will be later used to terminate the link.
3017                  *
3018                  * Setting it to NULL explicitly will cause no
3019                  * termination of the link.
3020                  */
3021                 if (cp->disconnect)
3022                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3023                                                        &cp->addr.bdaddr);
3024                 else
3025                         conn = NULL;
3026
3027                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
3028                 if (err < 0) {
3029                         err = mgmt_cmd_complete(sk, hdev->id,
3030                                                 MGMT_OP_UNPAIR_DEVICE,
3031                                                 MGMT_STATUS_NOT_PAIRED, &rp,
3032                                                 sizeof(rp));
3033                         goto unlock;
3034                 }
3035
3036                 goto done;
3037         }
3038
3039         /* LE address type */
3040         addr_type = le_addr_type(cp->addr.type);
3041
3042         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
3043         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
3044         if (err < 0) {
3045                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3046                                         MGMT_STATUS_NOT_PAIRED, &rp,
3047                                         sizeof(rp));
3048                 goto unlock;
3049         }
3050
3051         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
3052         if (!conn) {
3053                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
3054                 goto done;
3055         }
3056
3057
3058         /* Defer clearing up the connection parameters until closing to
3059          * give a chance of keeping them if a repairing happens.
3060          */
3061         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3062
3063         /* Disable auto-connection parameters if present */
3064         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
3065         if (params) {
3066                 if (params->explicit_connect)
3067                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3068                 else
3069                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
3070         }
3071
3072         /* If disconnection is not requested, then clear the connection
3073          * variable so that the link is not terminated.
3074          */
3075         if (!cp->disconnect)
3076                 conn = NULL;
3077
3078 done:
3079         /* If the connection variable is set, then termination of the
3080          * link is requested.
3081          */
3082         if (!conn) {
3083                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3084                                         &rp, sizeof(rp));
3085                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
3086                 goto unlock;
3087         }
3088
3089         cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
3090                                sizeof(*cp));
3091         if (!cmd) {
3092                 err = -ENOMEM;
3093                 goto unlock;
3094         }
3095
3096         cmd->cmd_complete = addr_cmd_complete;
3097
3098         err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd,
3099                                  unpair_device_complete);
3100         if (err < 0)
3101                 mgmt_pending_free(cmd);
3102
3103 unlock:
3104         hci_dev_unlock(hdev);
3105         return err;
3106 }
3107
3108 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
3109                       u16 len)
3110 {
3111         struct mgmt_cp_disconnect *cp = data;
3112         struct mgmt_rp_disconnect rp;
3113         struct mgmt_pending_cmd *cmd;
3114         struct hci_conn *conn;
3115         int err;
3116
3117         bt_dev_dbg(hdev, "sock %p", sk);
3118
3119         memset(&rp, 0, sizeof(rp));
3120         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3121         rp.addr.type = cp->addr.type;
3122
3123         if (!bdaddr_type_is_valid(cp->addr.type))
3124                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3125                                          MGMT_STATUS_INVALID_PARAMS,
3126                                          &rp, sizeof(rp));
3127
3128         hci_dev_lock(hdev);
3129
3130         if (!test_bit(HCI_UP, &hdev->flags)) {
3131                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3132                                         MGMT_STATUS_NOT_POWERED, &rp,
3133                                         sizeof(rp));
3134                 goto failed;
3135         }
3136
3137         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
3138                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3139                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3140                 goto failed;
3141         }
3142
3143         if (cp->addr.type == BDADDR_BREDR)
3144                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3145                                                &cp->addr.bdaddr);
3146         else
3147                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3148                                                le_addr_type(cp->addr.type));
3149
3150         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
3151                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3152                                         MGMT_STATUS_NOT_CONNECTED, &rp,
3153                                         sizeof(rp));
3154                 goto failed;
3155         }
3156
3157         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3158         if (!cmd) {
3159                 err = -ENOMEM;
3160                 goto failed;
3161         }
3162
3163         cmd->cmd_complete = generic_cmd_complete;
3164
3165         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
3166         if (err < 0)
3167                 mgmt_pending_remove(cmd);
3168
3169 failed:
3170         hci_dev_unlock(hdev);
3171         return err;
3172 }
3173
3174 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3175 {
3176         switch (link_type) {
3177         case LE_LINK:
3178                 switch (addr_type) {
3179                 case ADDR_LE_DEV_PUBLIC:
3180                         return BDADDR_LE_PUBLIC;
3181
3182                 default:
3183                         /* Fallback to LE Random address type */
3184                         return BDADDR_LE_RANDOM;
3185                 }
3186
3187         default:
3188                 /* Fallback to BR/EDR type */
3189                 return BDADDR_BREDR;
3190         }
3191 }
3192
3193 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3194                            u16 data_len)
3195 {
3196         struct mgmt_rp_get_connections *rp;
3197         struct hci_conn *c;
3198         int err;
3199         u16 i;
3200
3201         bt_dev_dbg(hdev, "sock %p", sk);
3202
3203         hci_dev_lock(hdev);
3204
3205         if (!hdev_is_powered(hdev)) {
3206                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3207                                       MGMT_STATUS_NOT_POWERED);
3208                 goto unlock;
3209         }
3210
3211         i = 0;
3212         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3213                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3214                         i++;
3215         }
3216
3217         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
3218         if (!rp) {
3219                 err = -ENOMEM;
3220                 goto unlock;
3221         }
3222
3223         i = 0;
3224         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3225                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3226                         continue;
3227                 bacpy(&rp->addr[i].bdaddr, &c->dst);
3228                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3229                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3230                         continue;
3231                 i++;
3232         }
3233
3234         rp->conn_count = cpu_to_le16(i);
3235
3236         /* Recalculate length in case of filtered SCO connections, etc */
3237         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3238                                 struct_size(rp, addr, i));
3239
3240         kfree(rp);
3241
3242 unlock:
3243         hci_dev_unlock(hdev);
3244         return err;
3245 }
3246
3247 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3248                                    struct mgmt_cp_pin_code_neg_reply *cp)
3249 {
3250         struct mgmt_pending_cmd *cmd;
3251         int err;
3252
3253         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3254                                sizeof(*cp));
3255         if (!cmd)
3256                 return -ENOMEM;
3257
3258         cmd->cmd_complete = addr_cmd_complete;
3259
3260         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3261                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3262         if (err < 0)
3263                 mgmt_pending_remove(cmd);
3264
3265         return err;
3266 }
3267
3268 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3269                           u16 len)
3270 {
3271         struct hci_conn *conn;
3272         struct mgmt_cp_pin_code_reply *cp = data;
3273         struct hci_cp_pin_code_reply reply;
3274         struct mgmt_pending_cmd *cmd;
3275         int err;
3276
3277         bt_dev_dbg(hdev, "sock %p", sk);
3278
3279         hci_dev_lock(hdev);
3280
3281         if (!hdev_is_powered(hdev)) {
3282                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3283                                       MGMT_STATUS_NOT_POWERED);
3284                 goto failed;
3285         }
3286
3287         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3288         if (!conn) {
3289                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3290                                       MGMT_STATUS_NOT_CONNECTED);
3291                 goto failed;
3292         }
3293
3294         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3295                 struct mgmt_cp_pin_code_neg_reply ncp;
3296
3297                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3298
3299                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
3300
3301                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3302                 if (err >= 0)
3303                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3304                                               MGMT_STATUS_INVALID_PARAMS);
3305
3306                 goto failed;
3307         }
3308
3309         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3310         if (!cmd) {
3311                 err = -ENOMEM;
3312                 goto failed;
3313         }
3314
3315         cmd->cmd_complete = addr_cmd_complete;
3316
3317         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3318         reply.pin_len = cp->pin_len;
3319         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3320
3321         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3322         if (err < 0)
3323                 mgmt_pending_remove(cmd);
3324
3325 failed:
3326         hci_dev_unlock(hdev);
3327         return err;
3328 }
3329
3330 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3331                              u16 len)
3332 {
3333         struct mgmt_cp_set_io_capability *cp = data;
3334
3335         bt_dev_dbg(hdev, "sock %p", sk);
3336
3337         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3338                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3339                                        MGMT_STATUS_INVALID_PARAMS);
3340
3341         hci_dev_lock(hdev);
3342
3343         hdev->io_capability = cp->io_capability;
3344
3345         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
3346
3347         hci_dev_unlock(hdev);
3348
3349         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3350                                  NULL, 0);
3351 }
3352
3353 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
3354 {
3355         struct hci_dev *hdev = conn->hdev;
3356         struct mgmt_pending_cmd *cmd;
3357
3358         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3359                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3360                         continue;
3361
3362                 if (cmd->user_data != conn)
3363                         continue;
3364
3365                 return cmd;
3366         }
3367
3368         return NULL;
3369 }
3370
3371 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3372 {
3373         struct mgmt_rp_pair_device rp;
3374         struct hci_conn *conn = cmd->user_data;
3375         int err;
3376
3377         bacpy(&rp.addr.bdaddr, &conn->dst);
3378         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3379
3380         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3381                                 status, &rp, sizeof(rp));
3382
3383         /* So we don't get further callbacks for this connection */
3384         conn->connect_cfm_cb = NULL;
3385         conn->security_cfm_cb = NULL;
3386         conn->disconn_cfm_cb = NULL;
3387
3388         hci_conn_drop(conn);
3389
3390         /* The device is paired so there is no need to remove
3391          * its connection parameters anymore.
3392          */
3393         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3394
3395         hci_conn_put(conn);
3396
3397         return err;
3398 }
3399
3400 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3401 {
3402         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3403         struct mgmt_pending_cmd *cmd;
3404
3405         cmd = find_pairing(conn);
3406         if (cmd) {
3407                 cmd->cmd_complete(cmd, status);
3408                 mgmt_pending_remove(cmd);
3409         }
3410 }
3411
3412 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3413 {
3414         struct mgmt_pending_cmd *cmd;
3415
3416         BT_DBG("status %u", status);
3417
3418         cmd = find_pairing(conn);
3419         if (!cmd) {
3420                 BT_DBG("Unable to find a pending command");
3421                 return;
3422         }
3423
3424         cmd->cmd_complete(cmd, mgmt_status(status));
3425         mgmt_pending_remove(cmd);
3426 }
3427
3428 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3429 {
3430         struct mgmt_pending_cmd *cmd;
3431
3432         BT_DBG("status %u", status);
3433
3434         if (!status)
3435                 return;
3436
3437         cmd = find_pairing(conn);
3438         if (!cmd) {
3439                 BT_DBG("Unable to find a pending command");
3440                 return;
3441         }
3442
3443         cmd->cmd_complete(cmd, mgmt_status(status));
3444         mgmt_pending_remove(cmd);
3445 }
3446
3447 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3448                        u16 len)
3449 {
3450         struct mgmt_cp_pair_device *cp = data;
3451         struct mgmt_rp_pair_device rp;
3452         struct mgmt_pending_cmd *cmd;
3453         u8 sec_level, auth_type;
3454         struct hci_conn *conn;
3455         int err;
3456
3457         bt_dev_dbg(hdev, "sock %p", sk);
3458
3459         memset(&rp, 0, sizeof(rp));
3460         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3461         rp.addr.type = cp->addr.type;
3462
3463         if (!bdaddr_type_is_valid(cp->addr.type))
3464                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3465                                          MGMT_STATUS_INVALID_PARAMS,
3466                                          &rp, sizeof(rp));
3467
3468         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3469                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3470                                          MGMT_STATUS_INVALID_PARAMS,
3471                                          &rp, sizeof(rp));
3472
3473         hci_dev_lock(hdev);
3474
3475         if (!hdev_is_powered(hdev)) {
3476                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3477                                         MGMT_STATUS_NOT_POWERED, &rp,
3478                                         sizeof(rp));
3479                 goto unlock;
3480         }
3481
3482         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3483                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3484                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3485                                         sizeof(rp));
3486                 goto unlock;
3487         }
3488
3489         sec_level = BT_SECURITY_MEDIUM;
3490         auth_type = HCI_AT_DEDICATED_BONDING;
3491
3492         if (cp->addr.type == BDADDR_BREDR) {
3493                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3494                                        auth_type, CONN_REASON_PAIR_DEVICE);
3495         } else {
3496                 u8 addr_type = le_addr_type(cp->addr.type);
3497                 struct hci_conn_params *p;
3498
3499                 /* When pairing a new device, it is expected to remember
3500                  * this device for future connections. Adding the connection
3501                  * parameter information ahead of time allows tracking
3502                  * of the peripheral preferred values and will speed up any
3503                  * further connection establishment.
3504                  *
3505                  * If connection parameters already exist, then they
3506                  * will be kept and this function does nothing.
3507                  */
3508                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3509
3510                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
3511                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
3512
3513                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
3514                                            sec_level, HCI_LE_CONN_TIMEOUT,
3515                                            CONN_REASON_PAIR_DEVICE);
3516         }
3517
3518         if (IS_ERR(conn)) {
3519                 int status;
3520
3521                 if (PTR_ERR(conn) == -EBUSY)
3522                         status = MGMT_STATUS_BUSY;
3523                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3524                         status = MGMT_STATUS_NOT_SUPPORTED;
3525                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3526                         status = MGMT_STATUS_REJECTED;
3527                 else
3528                         status = MGMT_STATUS_CONNECT_FAILED;
3529
3530                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3531                                         status, &rp, sizeof(rp));
3532                 goto unlock;
3533         }
3534
3535         if (conn->connect_cfm_cb) {
3536                 hci_conn_drop(conn);
3537                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3538                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3539                 goto unlock;
3540         }
3541
3542         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3543         if (!cmd) {
3544                 err = -ENOMEM;
3545                 hci_conn_drop(conn);
3546                 goto unlock;
3547         }
3548
3549         cmd->cmd_complete = pairing_complete;
3550
3551         /* For LE, just connecting isn't a proof that the pairing finished */
3552         if (cp->addr.type == BDADDR_BREDR) {
3553                 conn->connect_cfm_cb = pairing_complete_cb;
3554                 conn->security_cfm_cb = pairing_complete_cb;
3555                 conn->disconn_cfm_cb = pairing_complete_cb;
3556         } else {
3557                 conn->connect_cfm_cb = le_pairing_complete_cb;
3558                 conn->security_cfm_cb = le_pairing_complete_cb;
3559                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3560         }
3561
3562         conn->io_capability = cp->io_cap;
3563         cmd->user_data = hci_conn_get(conn);
3564
3565         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3566             hci_conn_security(conn, sec_level, auth_type, true)) {
3567                 cmd->cmd_complete(cmd, 0);
3568                 mgmt_pending_remove(cmd);
3569         }
3570
3571         err = 0;
3572
3573 unlock:
3574         hci_dev_unlock(hdev);
3575         return err;
3576 }
3577
3578 static int abort_conn_sync(struct hci_dev *hdev, void *data)
3579 {
3580         struct hci_conn *conn;
3581         u16 handle = PTR_ERR(data);
3582
3583         conn = hci_conn_hash_lookup_handle(hdev, handle);
3584         if (!conn)
3585                 return 0;
3586
3587         return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
3588 }
3589
3590 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3591                               u16 len)
3592 {
3593         struct mgmt_addr_info *addr = data;
3594         struct mgmt_pending_cmd *cmd;
3595         struct hci_conn *conn;
3596         int err;
3597
3598         bt_dev_dbg(hdev, "sock %p", sk);
3599
3600         hci_dev_lock(hdev);
3601
3602         if (!hdev_is_powered(hdev)) {
3603                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3604                                       MGMT_STATUS_NOT_POWERED);
3605                 goto unlock;
3606         }
3607
3608         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3609         if (!cmd) {
3610                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3611                                       MGMT_STATUS_INVALID_PARAMS);
3612                 goto unlock;
3613         }
3614
3615         conn = cmd->user_data;
3616
3617         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3618                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3619                                       MGMT_STATUS_INVALID_PARAMS);
3620                 goto unlock;
3621         }
3622
3623         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3624         mgmt_pending_remove(cmd);
3625
3626         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3627                                 addr, sizeof(*addr));
3628
3629         /* Since user doesn't want to proceed with the connection, abort any
3630          * ongoing pairing and then terminate the link if it was created
3631          * because of the pair device action.
3632          */
3633         if (addr->type == BDADDR_BREDR)
3634                 hci_remove_link_key(hdev, &addr->bdaddr);
3635         else
3636                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3637                                               le_addr_type(addr->type));
3638
3639         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3640                 hci_cmd_sync_queue(hdev, abort_conn_sync, ERR_PTR(conn->handle),
3641                                    NULL);
3642
3643 unlock:
3644         hci_dev_unlock(hdev);
3645         return err;
3646 }
3647
3648 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3649                              struct mgmt_addr_info *addr, u16 mgmt_op,
3650                              u16 hci_op, __le32 passkey)
3651 {
3652         struct mgmt_pending_cmd *cmd;
3653         struct hci_conn *conn;
3654         int err;
3655
3656         hci_dev_lock(hdev);
3657
3658         if (!hdev_is_powered(hdev)) {
3659                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3660                                         MGMT_STATUS_NOT_POWERED, addr,
3661                                         sizeof(*addr));
3662                 goto done;
3663         }
3664
3665         if (addr->type == BDADDR_BREDR)
3666                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3667         else
3668                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3669                                                le_addr_type(addr->type));
3670
3671         if (!conn) {
3672                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3673                                         MGMT_STATUS_NOT_CONNECTED, addr,
3674                                         sizeof(*addr));
3675                 goto done;
3676         }
3677
3678         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3679                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3680                 if (!err)
3681                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3682                                                 MGMT_STATUS_SUCCESS, addr,
3683                                                 sizeof(*addr));
3684                 else
3685                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3686                                                 MGMT_STATUS_FAILED, addr,
3687                                                 sizeof(*addr));
3688
3689                 goto done;
3690         }
3691
3692         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3693         if (!cmd) {
3694                 err = -ENOMEM;
3695                 goto done;
3696         }
3697
3698         cmd->cmd_complete = addr_cmd_complete;
3699
3700         /* Continue with pairing via HCI */
3701         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3702                 struct hci_cp_user_passkey_reply cp;
3703
3704                 bacpy(&cp.bdaddr, &addr->bdaddr);
3705                 cp.passkey = passkey;
3706                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3707         } else
3708                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3709                                    &addr->bdaddr);
3710
3711         if (err < 0)
3712                 mgmt_pending_remove(cmd);
3713
3714 done:
3715         hci_dev_unlock(hdev);
3716         return err;
3717 }
3718
3719 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3720                               void *data, u16 len)
3721 {
3722         struct mgmt_cp_pin_code_neg_reply *cp = data;
3723
3724         bt_dev_dbg(hdev, "sock %p", sk);
3725
3726         return user_pairing_resp(sk, hdev, &cp->addr,
3727                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3728                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3729 }
3730
3731 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3732                               u16 len)
3733 {
3734         struct mgmt_cp_user_confirm_reply *cp = data;
3735
3736         bt_dev_dbg(hdev, "sock %p", sk);
3737
3738         if (len != sizeof(*cp))
3739                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3740                                        MGMT_STATUS_INVALID_PARAMS);
3741
3742         return user_pairing_resp(sk, hdev, &cp->addr,
3743                                  MGMT_OP_USER_CONFIRM_REPLY,
3744                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3745 }
3746
3747 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3748                                   void *data, u16 len)
3749 {
3750         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3751
3752         bt_dev_dbg(hdev, "sock %p", sk);
3753
3754         return user_pairing_resp(sk, hdev, &cp->addr,
3755                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3756                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3757 }
3758
3759 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3760                               u16 len)
3761 {
3762         struct mgmt_cp_user_passkey_reply *cp = data;
3763
3764         bt_dev_dbg(hdev, "sock %p", sk);
3765
3766         return user_pairing_resp(sk, hdev, &cp->addr,
3767                                  MGMT_OP_USER_PASSKEY_REPLY,
3768                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3769 }
3770
3771 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3772                                   void *data, u16 len)
3773 {
3774         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3775
3776         bt_dev_dbg(hdev, "sock %p", sk);
3777
3778         return user_pairing_resp(sk, hdev, &cp->addr,
3779                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3780                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3781 }
3782
3783 static int adv_expire_sync(struct hci_dev *hdev, u32 flags)
3784 {
3785         struct adv_info *adv_instance;
3786
3787         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3788         if (!adv_instance)
3789                 return 0;
3790
3791         /* stop if current instance doesn't need to be changed */
3792         if (!(adv_instance->flags & flags))
3793                 return 0;
3794
3795         cancel_adv_timeout(hdev);
3796
3797         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3798         if (!adv_instance)
3799                 return 0;
3800
3801         hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true);
3802
3803         return 0;
3804 }
3805
3806 static int name_changed_sync(struct hci_dev *hdev, void *data)
3807 {
3808         return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3809 }
3810
3811 static void set_name_complete(struct hci_dev *hdev, void *data, int err)
3812 {
3813         struct mgmt_pending_cmd *cmd = data;
3814         struct mgmt_cp_set_local_name *cp = cmd->param;
3815         u8 status = mgmt_status(err);
3816
3817         bt_dev_dbg(hdev, "err %d", err);
3818
3819         if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
3820                 return;
3821
3822         if (status) {
3823                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3824                                 status);
3825         } else {
3826                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3827                                   cp, sizeof(*cp));
3828
3829                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3830                         hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL);
3831         }
3832
3833         mgmt_pending_remove(cmd);
3834 }
3835
3836 static int set_name_sync(struct hci_dev *hdev, void *data)
3837 {
3838         if (lmp_bredr_capable(hdev)) {
3839                 hci_update_name_sync(hdev);
3840                 hci_update_eir_sync(hdev);
3841         }
3842
3843         /* The name is stored in the scan response data and so
3844          * no need to update the advertising data here.
3845          */
3846         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3847                 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance);
3848
3849         return 0;
3850 }
3851
3852 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3853                           u16 len)
3854 {
3855         struct mgmt_cp_set_local_name *cp = data;
3856         struct mgmt_pending_cmd *cmd;
3857         int err;
3858
3859         bt_dev_dbg(hdev, "sock %p", sk);
3860
3861         hci_dev_lock(hdev);
3862
3863         /* If the old values are the same as the new ones just return a
3864          * direct command complete event.
3865          */
3866         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3867             !memcmp(hdev->short_name, cp->short_name,
3868                     sizeof(hdev->short_name))) {
3869                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3870                                         data, len);
3871                 goto failed;
3872         }
3873
3874         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3875
3876         if (!hdev_is_powered(hdev)) {
3877                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3878
3879                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3880                                         data, len);
3881                 if (err < 0)
3882                         goto failed;
3883
3884                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3885                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3886                 ext_info_changed(hdev, sk);
3887
3888                 goto failed;
3889         }
3890
3891         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3892         if (!cmd)
3893                 err = -ENOMEM;
3894         else
3895                 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd,
3896                                          set_name_complete);
3897
3898         if (err < 0) {
3899                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3900                                       MGMT_STATUS_FAILED);
3901
3902                 if (cmd)
3903                         mgmt_pending_remove(cmd);
3904
3905                 goto failed;
3906         }
3907
3908         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3909
3910 failed:
3911         hci_dev_unlock(hdev);
3912         return err;
3913 }
3914
3915 static int appearance_changed_sync(struct hci_dev *hdev, void *data)
3916 {
3917         return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE);
3918 }
3919
3920 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3921                           u16 len)
3922 {
3923         struct mgmt_cp_set_appearance *cp = data;
3924         u16 appearance;
3925         int err;
3926
3927         bt_dev_dbg(hdev, "sock %p", sk);
3928
3929         if (!lmp_le_capable(hdev))
3930                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3931                                        MGMT_STATUS_NOT_SUPPORTED);
3932
3933         appearance = le16_to_cpu(cp->appearance);
3934
3935         hci_dev_lock(hdev);
3936
3937         if (hdev->appearance != appearance) {
3938                 hdev->appearance = appearance;
3939
3940                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3941                         hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL,
3942                                            NULL);
3943
3944                 ext_info_changed(hdev, sk);
3945         }
3946
3947         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3948                                 0);
3949
3950         hci_dev_unlock(hdev);
3951
3952         return err;
3953 }
3954
3955 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3956                                  void *data, u16 len)
3957 {
3958         struct mgmt_rp_get_phy_configuration rp;
3959
3960         bt_dev_dbg(hdev, "sock %p", sk);
3961
3962         hci_dev_lock(hdev);
3963
3964         memset(&rp, 0, sizeof(rp));
3965
3966         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3967         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3968         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3969
3970         hci_dev_unlock(hdev);
3971
3972         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3973                                  &rp, sizeof(rp));
3974 }
3975
3976 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3977 {
3978         struct mgmt_ev_phy_configuration_changed ev;
3979
3980         memset(&ev, 0, sizeof(ev));
3981
3982         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3983
3984         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3985                           sizeof(ev), skip);
3986 }
3987
3988 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
3989 {
3990         struct mgmt_pending_cmd *cmd = data;
3991         struct sk_buff *skb = cmd->skb;
3992         u8 status = mgmt_status(err);
3993
3994         if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
3995                 return;
3996
3997         if (!status) {
3998                 if (!skb)
3999                         status = MGMT_STATUS_FAILED;
4000                 else if (IS_ERR(skb))
4001                         status = mgmt_status(PTR_ERR(skb));
4002                 else
4003                         status = mgmt_status(skb->data[0]);
4004         }
4005
4006         bt_dev_dbg(hdev, "status %d", status);
4007
4008         if (status) {
4009                 mgmt_cmd_status(cmd->sk, hdev->id,
4010                                 MGMT_OP_SET_PHY_CONFIGURATION, status);
4011         } else {
4012                 mgmt_cmd_complete(cmd->sk, hdev->id,
4013                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
4014                                   NULL, 0);
4015
4016                 mgmt_phy_configuration_changed(hdev, cmd->sk);
4017         }
4018
4019         if (skb && !IS_ERR(skb))
4020                 kfree_skb(skb);
4021
4022         mgmt_pending_remove(cmd);
4023 }
4024
4025 static int set_default_phy_sync(struct hci_dev *hdev, void *data)
4026 {
4027         struct mgmt_pending_cmd *cmd = data;
4028         struct mgmt_cp_set_phy_configuration *cp = cmd->param;
4029         struct hci_cp_le_set_default_phy cp_phy;
4030         u32 selected_phys = __le32_to_cpu(cp->selected_phys);
4031
4032         memset(&cp_phy, 0, sizeof(cp_phy));
4033
4034         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
4035                 cp_phy.all_phys |= 0x01;
4036
4037         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
4038                 cp_phy.all_phys |= 0x02;
4039
4040         if (selected_phys & MGMT_PHY_LE_1M_TX)
4041                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
4042
4043         if (selected_phys & MGMT_PHY_LE_2M_TX)
4044                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
4045
4046         if (selected_phys & MGMT_PHY_LE_CODED_TX)
4047                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
4048
4049         if (selected_phys & MGMT_PHY_LE_1M_RX)
4050                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
4051
4052         if (selected_phys & MGMT_PHY_LE_2M_RX)
4053                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
4054
4055         if (selected_phys & MGMT_PHY_LE_CODED_RX)
4056                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
4057
4058         cmd->skb =  __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY,
4059                                    sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT);
4060
4061         return 0;
4062 }
4063
4064 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
4065                                  void *data, u16 len)
4066 {
4067         struct mgmt_cp_set_phy_configuration *cp = data;
4068         struct mgmt_pending_cmd *cmd;
4069         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
4070         u16 pkt_type = (HCI_DH1 | HCI_DM1);
4071         bool changed = false;
4072         int err;
4073
4074         bt_dev_dbg(hdev, "sock %p", sk);
4075
4076         configurable_phys = get_configurable_phys(hdev);
4077         supported_phys = get_supported_phys(hdev);
4078         selected_phys = __le32_to_cpu(cp->selected_phys);
4079
4080         if (selected_phys & ~supported_phys)
4081                 return mgmt_cmd_status(sk, hdev->id,
4082                                        MGMT_OP_SET_PHY_CONFIGURATION,
4083                                        MGMT_STATUS_INVALID_PARAMS);
4084
4085         unconfigure_phys = supported_phys & ~configurable_phys;
4086
4087         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
4088                 return mgmt_cmd_status(sk, hdev->id,
4089                                        MGMT_OP_SET_PHY_CONFIGURATION,
4090                                        MGMT_STATUS_INVALID_PARAMS);
4091
4092         if (selected_phys == get_selected_phys(hdev))
4093                 return mgmt_cmd_complete(sk, hdev->id,
4094                                          MGMT_OP_SET_PHY_CONFIGURATION,
4095                                          0, NULL, 0);
4096
4097         hci_dev_lock(hdev);
4098
4099         if (!hdev_is_powered(hdev)) {
4100                 err = mgmt_cmd_status(sk, hdev->id,
4101                                       MGMT_OP_SET_PHY_CONFIGURATION,
4102                                       MGMT_STATUS_REJECTED);
4103                 goto unlock;
4104         }
4105
4106         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
4107                 err = mgmt_cmd_status(sk, hdev->id,
4108                                       MGMT_OP_SET_PHY_CONFIGURATION,
4109                                       MGMT_STATUS_BUSY);
4110                 goto unlock;
4111         }
4112
4113         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
4114                 pkt_type |= (HCI_DH3 | HCI_DM3);
4115         else
4116                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
4117
4118         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
4119                 pkt_type |= (HCI_DH5 | HCI_DM5);
4120         else
4121                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
4122
4123         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
4124                 pkt_type &= ~HCI_2DH1;
4125         else
4126                 pkt_type |= HCI_2DH1;
4127
4128         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
4129                 pkt_type &= ~HCI_2DH3;
4130         else
4131                 pkt_type |= HCI_2DH3;
4132
4133         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
4134                 pkt_type &= ~HCI_2DH5;
4135         else
4136                 pkt_type |= HCI_2DH5;
4137
4138         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
4139                 pkt_type &= ~HCI_3DH1;
4140         else
4141                 pkt_type |= HCI_3DH1;
4142
4143         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
4144                 pkt_type &= ~HCI_3DH3;
4145         else
4146                 pkt_type |= HCI_3DH3;
4147
4148         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
4149                 pkt_type &= ~HCI_3DH5;
4150         else
4151                 pkt_type |= HCI_3DH5;
4152
4153         if (pkt_type != hdev->pkt_type) {
4154                 hdev->pkt_type = pkt_type;
4155                 changed = true;
4156         }
4157
4158         if ((selected_phys & MGMT_PHY_LE_MASK) ==
4159             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
4160                 if (changed)
4161                         mgmt_phy_configuration_changed(hdev, sk);
4162
4163                 err = mgmt_cmd_complete(sk, hdev->id,
4164                                         MGMT_OP_SET_PHY_CONFIGURATION,
4165                                         0, NULL, 0);
4166
4167                 goto unlock;
4168         }
4169
4170         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
4171                                len);
4172         if (!cmd)
4173                 err = -ENOMEM;
4174         else
4175                 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd,
4176                                          set_default_phy_complete);
4177
4178         if (err < 0) {
4179                 err = mgmt_cmd_status(sk, hdev->id,
4180                                       MGMT_OP_SET_PHY_CONFIGURATION,
4181                                       MGMT_STATUS_FAILED);
4182
4183                 if (cmd)
4184                         mgmt_pending_remove(cmd);
4185         }
4186
4187 unlock:
4188         hci_dev_unlock(hdev);
4189
4190         return err;
4191 }
4192
4193 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
4194                             u16 len)
4195 {
4196         int err = MGMT_STATUS_SUCCESS;
4197         struct mgmt_cp_set_blocked_keys *keys = data;
4198         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
4199                                    sizeof(struct mgmt_blocked_key_info));
4200         u16 key_count, expected_len;
4201         int i;
4202
4203         bt_dev_dbg(hdev, "sock %p", sk);
4204
4205         key_count = __le16_to_cpu(keys->key_count);
4206         if (key_count > max_key_count) {
4207                 bt_dev_err(hdev, "too big key_count value %u", key_count);
4208                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4209                                        MGMT_STATUS_INVALID_PARAMS);
4210         }
4211
4212         expected_len = struct_size(keys, keys, key_count);
4213         if (expected_len != len) {
4214                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
4215                            expected_len, len);
4216                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4217                                        MGMT_STATUS_INVALID_PARAMS);
4218         }
4219
4220         hci_dev_lock(hdev);
4221
4222         hci_blocked_keys_clear(hdev);
4223
4224         for (i = 0; i < key_count; ++i) {
4225                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
4226
4227                 if (!b) {
4228                         err = MGMT_STATUS_NO_RESOURCES;
4229                         break;
4230                 }
4231
4232                 b->type = keys->keys[i].type;
4233                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
4234                 list_add_rcu(&b->list, &hdev->blocked_keys);
4235         }
4236         hci_dev_unlock(hdev);
4237
4238         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4239                                 err, NULL, 0);
4240 }
4241
4242 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
4243                                void *data, u16 len)
4244 {
4245         struct mgmt_mode *cp = data;
4246         int err;
4247         bool changed = false;
4248
4249         bt_dev_dbg(hdev, "sock %p", sk);
4250
4251         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
4252                 return mgmt_cmd_status(sk, hdev->id,
4253                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4254                                        MGMT_STATUS_NOT_SUPPORTED);
4255
4256         if (cp->val != 0x00 && cp->val != 0x01)
4257                 return mgmt_cmd_status(sk, hdev->id,
4258                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4259                                        MGMT_STATUS_INVALID_PARAMS);
4260
4261         hci_dev_lock(hdev);
4262
4263         if (hdev_is_powered(hdev) &&
4264             !!cp->val != hci_dev_test_flag(hdev,
4265                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
4266                 err = mgmt_cmd_status(sk, hdev->id,
4267                                       MGMT_OP_SET_WIDEBAND_SPEECH,
4268                                       MGMT_STATUS_REJECTED);
4269                 goto unlock;
4270         }
4271
4272         if (cp->val)
4273                 changed = !hci_dev_test_and_set_flag(hdev,
4274                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4275         else
4276                 changed = hci_dev_test_and_clear_flag(hdev,
4277                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4278
4279         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
4280         if (err < 0)
4281                 goto unlock;
4282
4283         if (changed)
4284                 err = new_settings(hdev, sk);
4285
4286 unlock:
4287         hci_dev_unlock(hdev);
4288         return err;
4289 }
4290
4291 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
4292                                void *data, u16 data_len)
4293 {
4294         char buf[20];
4295         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
4296         u16 cap_len = 0;
4297         u8 flags = 0;
4298         u8 tx_power_range[2];
4299
4300         bt_dev_dbg(hdev, "sock %p", sk);
4301
4302         memset(&buf, 0, sizeof(buf));
4303
4304         hci_dev_lock(hdev);
4305
4306         /* When the Read Simple Pairing Options command is supported, then
4307          * the remote public key validation is supported.
4308          *
4309          * Alternatively, when Microsoft extensions are available, they can
4310          * indicate support for public key validation as well.
4311          */
4312         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
4313                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
4314
4315         flags |= 0x02;          /* Remote public key validation (LE) */
4316
4317         /* When the Read Encryption Key Size command is supported, then the
4318          * encryption key size is enforced.
4319          */
4320         if (hdev->commands[20] & 0x10)
4321                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
4322
4323         flags |= 0x08;          /* Encryption key size enforcement (LE) */
4324
4325         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
4326                                   &flags, 1);
4327
4328         /* When the Read Simple Pairing Options command is supported, then
4329          * also max encryption key size information is provided.
4330          */
4331         if (hdev->commands[41] & 0x08)
4332                 cap_len = eir_append_le16(rp->cap, cap_len,
4333                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
4334                                           hdev->max_enc_key_size);
4335
4336         cap_len = eir_append_le16(rp->cap, cap_len,
4337                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
4338                                   SMP_MAX_ENC_KEY_SIZE);
4339
4340         /* Append the min/max LE tx power parameters if we were able to fetch
4341          * it from the controller
4342          */
4343         if (hdev->commands[38] & 0x80) {
4344                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
4345                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
4346                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
4347                                           tx_power_range, 2);
4348         }
4349
4350         rp->cap_len = cpu_to_le16(cap_len);
4351
4352         hci_dev_unlock(hdev);
4353
4354         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
4355                                  rp, sizeof(*rp) + cap_len);
4356 }
4357
4358 #ifdef CONFIG_BT_FEATURE_DEBUG
4359 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
4360 static const u8 debug_uuid[16] = {
4361         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
4362         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
4363 };
4364 #endif
4365
4366 /* 330859bc-7506-492d-9370-9a6f0614037f */
4367 static const u8 quality_report_uuid[16] = {
4368         0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93,
4369         0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33,
4370 };
4371
4372 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */
4373 static const u8 offload_codecs_uuid[16] = {
4374         0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88,
4375         0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6,
4376 };
4377
4378 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
4379 static const u8 le_simultaneous_roles_uuid[16] = {
4380         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
4381         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
4382 };
4383
4384 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
4385 static const u8 rpa_resolution_uuid[16] = {
4386         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
4387         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
4388 };
4389
4390 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */
4391 static const u8 iso_socket_uuid[16] = {
4392         0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98,
4393         0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f,
4394 };
4395
4396 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */
4397 static const u8 mgmt_mesh_uuid[16] = {
4398         0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf,
4399         0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c,
4400 };
4401
4402 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
4403                                   void *data, u16 data_len)
4404 {
4405         struct mgmt_rp_read_exp_features_info *rp;
4406         size_t len;
4407         u16 idx = 0;
4408         u32 flags;
4409         int status;
4410
4411         bt_dev_dbg(hdev, "sock %p", sk);
4412
4413         /* Enough space for 7 features */
4414         len = sizeof(*rp) + (sizeof(rp->features[0]) * 7);
4415         rp = kzalloc(len, GFP_KERNEL);
4416         if (!rp)
4417                 return -ENOMEM;
4418
4419 #ifdef CONFIG_BT_FEATURE_DEBUG
4420         if (!hdev) {
4421                 flags = bt_dbg_get() ? BIT(0) : 0;
4422
4423                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
4424                 rp->features[idx].flags = cpu_to_le32(flags);
4425                 idx++;
4426         }
4427 #endif
4428
4429         if (hdev && hci_dev_le_state_simultaneous(hdev)) {
4430                 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES))
4431                         flags = BIT(0);
4432                 else
4433                         flags = 0;
4434
4435                 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16);
4436                 rp->features[idx].flags = cpu_to_le32(flags);
4437                 idx++;
4438         }
4439
4440         if (hdev && ll_privacy_capable(hdev)) {
4441                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
4442                         flags = BIT(0) | BIT(1);
4443                 else
4444                         flags = BIT(1);
4445
4446                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
4447                 rp->features[idx].flags = cpu_to_le32(flags);
4448                 idx++;
4449         }
4450
4451         if (hdev && (aosp_has_quality_report(hdev) ||
4452                      hdev->set_quality_report)) {
4453                 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT))
4454                         flags = BIT(0);
4455                 else
4456                         flags = 0;
4457
4458                 memcpy(rp->features[idx].uuid, quality_report_uuid, 16);
4459                 rp->features[idx].flags = cpu_to_le32(flags);
4460                 idx++;
4461         }
4462
4463         if (hdev && hdev->get_data_path_id) {
4464                 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED))
4465                         flags = BIT(0);
4466                 else
4467                         flags = 0;
4468
4469                 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16);
4470                 rp->features[idx].flags = cpu_to_le32(flags);
4471                 idx++;
4472         }
4473
4474         if (IS_ENABLED(CONFIG_BT_LE)) {
4475                 flags = iso_enabled() ? BIT(0) : 0;
4476                 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16);
4477                 rp->features[idx].flags = cpu_to_le32(flags);
4478                 idx++;
4479         }
4480
4481         if (hdev && lmp_le_capable(hdev)) {
4482                 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
4483                         flags = BIT(0);
4484                 else
4485                         flags = 0;
4486
4487                 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16);
4488                 rp->features[idx].flags = cpu_to_le32(flags);
4489                 idx++;
4490         }
4491
4492         rp->feature_count = cpu_to_le16(idx);
4493
4494         /* After reading the experimental features information, enable
4495          * the events to update client on any future change.
4496          */
4497         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4498
4499         status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4500                                    MGMT_OP_READ_EXP_FEATURES_INFO,
4501                                    0, rp, sizeof(*rp) + (20 * idx));
4502
4503         kfree(rp);
4504         return status;
4505 }
4506
4507 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
4508                                           struct sock *skip)
4509 {
4510         struct mgmt_ev_exp_feature_changed ev;
4511
4512         memset(&ev, 0, sizeof(ev));
4513         memcpy(ev.uuid, rpa_resolution_uuid, 16);
4514         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
4515
4516         // Do we need to be atomic with the conn_flags?
4517         if (enabled && privacy_mode_capable(hdev))
4518                 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY;
4519         else
4520                 hdev->conn_flags &= ~HCI_CONN_FLAG_DEVICE_PRIVACY;
4521
4522         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4523                                   &ev, sizeof(ev),
4524                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4525
4526 }
4527
4528 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid,
4529                                bool enabled, struct sock *skip)
4530 {
4531         struct mgmt_ev_exp_feature_changed ev;
4532
4533         memset(&ev, 0, sizeof(ev));
4534         memcpy(ev.uuid, uuid, 16);
4535         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
4536
4537         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4538                                   &ev, sizeof(ev),
4539                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4540 }
4541
4542 #define EXP_FEAT(_uuid, _set_func)      \
4543 {                                       \
4544         .uuid = _uuid,                  \
4545         .set_func = _set_func,          \
4546 }
4547
4548 /* The zero key uuid is special. Multiple exp features are set through it. */
4549 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
4550                              struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4551 {
4552         struct mgmt_rp_set_exp_feature rp;
4553
4554         memset(rp.uuid, 0, 16);
4555         rp.flags = cpu_to_le32(0);
4556
4557 #ifdef CONFIG_BT_FEATURE_DEBUG
4558         if (!hdev) {
4559                 bool changed = bt_dbg_get();
4560
4561                 bt_dbg_set(false);
4562
4563                 if (changed)
4564                         exp_feature_changed(NULL, ZERO_KEY, false, sk);
4565         }
4566 #endif
4567
4568         if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
4569                 bool changed;
4570
4571                 changed = hci_dev_test_and_clear_flag(hdev,
4572                                                       HCI_ENABLE_LL_PRIVACY);
4573                 if (changed)
4574                         exp_feature_changed(hdev, rpa_resolution_uuid, false,
4575                                             sk);
4576         }
4577
4578         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4579
4580         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4581                                  MGMT_OP_SET_EXP_FEATURE, 0,
4582                                  &rp, sizeof(rp));
4583 }
4584
4585 #ifdef CONFIG_BT_FEATURE_DEBUG
4586 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
4587                           struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4588 {
4589         struct mgmt_rp_set_exp_feature rp;
4590
4591         bool val, changed;
4592         int err;
4593
4594         /* Command requires to use the non-controller index */
4595         if (hdev)
4596                 return mgmt_cmd_status(sk, hdev->id,
4597                                        MGMT_OP_SET_EXP_FEATURE,
4598                                        MGMT_STATUS_INVALID_INDEX);
4599
4600         /* Parameters are limited to a single octet */
4601         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4602                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4603                                        MGMT_OP_SET_EXP_FEATURE,
4604                                        MGMT_STATUS_INVALID_PARAMS);
4605
4606         /* Only boolean on/off is supported */
4607         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4608                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4609                                        MGMT_OP_SET_EXP_FEATURE,
4610                                        MGMT_STATUS_INVALID_PARAMS);
4611
4612         val = !!cp->param[0];
4613         changed = val ? !bt_dbg_get() : bt_dbg_get();
4614         bt_dbg_set(val);
4615
4616         memcpy(rp.uuid, debug_uuid, 16);
4617         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4618
4619         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4620
4621         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4622                                 MGMT_OP_SET_EXP_FEATURE, 0,
4623                                 &rp, sizeof(rp));
4624
4625         if (changed)
4626                 exp_feature_changed(hdev, debug_uuid, val, sk);
4627
4628         return err;
4629 }
4630 #endif
4631
4632 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev,
4633                               struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4634 {
4635         struct mgmt_rp_set_exp_feature rp;
4636         bool val, changed;
4637         int err;
4638
4639         /* Command requires to use the controller index */
4640         if (!hdev)
4641                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4642                                        MGMT_OP_SET_EXP_FEATURE,
4643                                        MGMT_STATUS_INVALID_INDEX);
4644
4645         /* Parameters are limited to a single octet */
4646         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4647                 return mgmt_cmd_status(sk, hdev->id,
4648                                        MGMT_OP_SET_EXP_FEATURE,
4649                                        MGMT_STATUS_INVALID_PARAMS);
4650
4651         /* Only boolean on/off is supported */
4652         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4653                 return mgmt_cmd_status(sk, hdev->id,
4654                                        MGMT_OP_SET_EXP_FEATURE,
4655                                        MGMT_STATUS_INVALID_PARAMS);
4656
4657         val = !!cp->param[0];
4658
4659         if (val) {
4660                 changed = !hci_dev_test_and_set_flag(hdev,
4661                                                      HCI_MESH_EXPERIMENTAL);
4662         } else {
4663                 hci_dev_clear_flag(hdev, HCI_MESH);
4664                 changed = hci_dev_test_and_clear_flag(hdev,
4665                                                       HCI_MESH_EXPERIMENTAL);
4666         }
4667
4668         memcpy(rp.uuid, mgmt_mesh_uuid, 16);
4669         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4670
4671         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4672
4673         err = mgmt_cmd_complete(sk, hdev->id,
4674                                 MGMT_OP_SET_EXP_FEATURE, 0,
4675                                 &rp, sizeof(rp));
4676
4677         if (changed)
4678                 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk);
4679
4680         return err;
4681 }
4682
4683 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev,
4684                                    struct mgmt_cp_set_exp_feature *cp,
4685                                    u16 data_len)
4686 {
4687         struct mgmt_rp_set_exp_feature rp;
4688         bool val, changed;
4689         int err;
4690         u32 flags;
4691
4692         /* Command requires to use the controller index */
4693         if (!hdev)
4694                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4695                                        MGMT_OP_SET_EXP_FEATURE,
4696                                        MGMT_STATUS_INVALID_INDEX);
4697
4698         /* Changes can only be made when controller is powered down */
4699         if (hdev_is_powered(hdev))
4700                 return mgmt_cmd_status(sk, hdev->id,
4701                                        MGMT_OP_SET_EXP_FEATURE,
4702                                        MGMT_STATUS_REJECTED);
4703
4704         /* Parameters are limited to a single octet */
4705         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4706                 return mgmt_cmd_status(sk, hdev->id,
4707                                        MGMT_OP_SET_EXP_FEATURE,
4708                                        MGMT_STATUS_INVALID_PARAMS);
4709
4710         /* Only boolean on/off is supported */
4711         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4712                 return mgmt_cmd_status(sk, hdev->id,
4713                                        MGMT_OP_SET_EXP_FEATURE,
4714                                        MGMT_STATUS_INVALID_PARAMS);
4715
4716         val = !!cp->param[0];
4717
4718         if (val) {
4719                 changed = !hci_dev_test_and_set_flag(hdev,
4720                                                      HCI_ENABLE_LL_PRIVACY);
4721                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4722
4723                 /* Enable LL privacy + supported settings changed */
4724                 flags = BIT(0) | BIT(1);
4725         } else {
4726                 changed = hci_dev_test_and_clear_flag(hdev,
4727                                                       HCI_ENABLE_LL_PRIVACY);
4728
4729                 /* Disable LL privacy + supported settings changed */
4730                 flags = BIT(1);
4731         }
4732
4733         memcpy(rp.uuid, rpa_resolution_uuid, 16);
4734         rp.flags = cpu_to_le32(flags);
4735
4736         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4737
4738         err = mgmt_cmd_complete(sk, hdev->id,
4739                                 MGMT_OP_SET_EXP_FEATURE, 0,
4740                                 &rp, sizeof(rp));
4741
4742         if (changed)
4743                 exp_ll_privacy_feature_changed(val, hdev, sk);
4744
4745         return err;
4746 }
4747
4748 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev,
4749                                    struct mgmt_cp_set_exp_feature *cp,
4750                                    u16 data_len)
4751 {
4752         struct mgmt_rp_set_exp_feature rp;
4753         bool val, changed;
4754         int err;
4755
4756         /* Command requires to use a valid controller index */
4757         if (!hdev)
4758                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4759                                        MGMT_OP_SET_EXP_FEATURE,
4760                                        MGMT_STATUS_INVALID_INDEX);
4761
4762         /* Parameters are limited to a single octet */
4763         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4764                 return mgmt_cmd_status(sk, hdev->id,
4765                                        MGMT_OP_SET_EXP_FEATURE,
4766                                        MGMT_STATUS_INVALID_PARAMS);
4767
4768         /* Only boolean on/off is supported */
4769         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4770                 return mgmt_cmd_status(sk, hdev->id,
4771                                        MGMT_OP_SET_EXP_FEATURE,
4772                                        MGMT_STATUS_INVALID_PARAMS);
4773
4774         hci_req_sync_lock(hdev);
4775
4776         val = !!cp->param[0];
4777         changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT));
4778
4779         if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) {
4780                 err = mgmt_cmd_status(sk, hdev->id,
4781                                       MGMT_OP_SET_EXP_FEATURE,
4782                                       MGMT_STATUS_NOT_SUPPORTED);
4783                 goto unlock_quality_report;
4784         }
4785
4786         if (changed) {
4787                 if (hdev->set_quality_report)
4788                         err = hdev->set_quality_report(hdev, val);
4789                 else
4790                         err = aosp_set_quality_report(hdev, val);
4791
4792                 if (err) {
4793                         err = mgmt_cmd_status(sk, hdev->id,
4794                                               MGMT_OP_SET_EXP_FEATURE,
4795                                               MGMT_STATUS_FAILED);
4796                         goto unlock_quality_report;
4797                 }
4798
4799                 if (val)
4800                         hci_dev_set_flag(hdev, HCI_QUALITY_REPORT);
4801                 else
4802                         hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
4803         }
4804
4805         bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed);
4806
4807         memcpy(rp.uuid, quality_report_uuid, 16);
4808         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4809         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4810
4811         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0,
4812                                 &rp, sizeof(rp));
4813
4814         if (changed)
4815                 exp_feature_changed(hdev, quality_report_uuid, val, sk);
4816
4817 unlock_quality_report:
4818         hci_req_sync_unlock(hdev);
4819         return err;
4820 }
4821
4822 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev,
4823                                   struct mgmt_cp_set_exp_feature *cp,
4824                                   u16 data_len)
4825 {
4826         bool val, changed;
4827         int err;
4828         struct mgmt_rp_set_exp_feature rp;
4829
4830         /* Command requires to use a valid controller index */
4831         if (!hdev)
4832                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4833                                        MGMT_OP_SET_EXP_FEATURE,
4834                                        MGMT_STATUS_INVALID_INDEX);
4835
4836         /* Parameters are limited to a single octet */
4837         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4838                 return mgmt_cmd_status(sk, hdev->id,
4839                                        MGMT_OP_SET_EXP_FEATURE,
4840                                        MGMT_STATUS_INVALID_PARAMS);
4841
4842         /* Only boolean on/off is supported */
4843         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4844                 return mgmt_cmd_status(sk, hdev->id,
4845                                        MGMT_OP_SET_EXP_FEATURE,
4846                                        MGMT_STATUS_INVALID_PARAMS);
4847
4848         val = !!cp->param[0];
4849         changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED));
4850
4851         if (!hdev->get_data_path_id) {
4852                 return mgmt_cmd_status(sk, hdev->id,
4853                                        MGMT_OP_SET_EXP_FEATURE,
4854                                        MGMT_STATUS_NOT_SUPPORTED);
4855         }
4856
4857         if (changed) {
4858                 if (val)
4859                         hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4860                 else
4861                         hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4862         }
4863
4864         bt_dev_info(hdev, "offload codecs enable %d changed %d",
4865                     val, changed);
4866
4867         memcpy(rp.uuid, offload_codecs_uuid, 16);
4868         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4869         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4870         err = mgmt_cmd_complete(sk, hdev->id,
4871                                 MGMT_OP_SET_EXP_FEATURE, 0,
4872                                 &rp, sizeof(rp));
4873
4874         if (changed)
4875                 exp_feature_changed(hdev, offload_codecs_uuid, val, sk);
4876
4877         return err;
4878 }
4879
4880 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev,
4881                                           struct mgmt_cp_set_exp_feature *cp,
4882                                           u16 data_len)
4883 {
4884         bool val, changed;
4885         int err;
4886         struct mgmt_rp_set_exp_feature rp;
4887
4888         /* Command requires to use a valid controller index */
4889         if (!hdev)
4890                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4891                                        MGMT_OP_SET_EXP_FEATURE,
4892                                        MGMT_STATUS_INVALID_INDEX);
4893
4894         /* Parameters are limited to a single octet */
4895         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4896                 return mgmt_cmd_status(sk, hdev->id,
4897                                        MGMT_OP_SET_EXP_FEATURE,
4898                                        MGMT_STATUS_INVALID_PARAMS);
4899
4900         /* Only boolean on/off is supported */
4901         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4902                 return mgmt_cmd_status(sk, hdev->id,
4903                                        MGMT_OP_SET_EXP_FEATURE,
4904                                        MGMT_STATUS_INVALID_PARAMS);
4905
4906         val = !!cp->param[0];
4907         changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES));
4908
4909         if (!hci_dev_le_state_simultaneous(hdev)) {
4910                 return mgmt_cmd_status(sk, hdev->id,
4911                                        MGMT_OP_SET_EXP_FEATURE,
4912                                        MGMT_STATUS_NOT_SUPPORTED);
4913         }
4914
4915         if (changed) {
4916                 if (val)
4917                         hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4918                 else
4919                         hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4920         }
4921
4922         bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d",
4923                     val, changed);
4924
4925         memcpy(rp.uuid, le_simultaneous_roles_uuid, 16);
4926         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4927         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4928         err = mgmt_cmd_complete(sk, hdev->id,
4929                                 MGMT_OP_SET_EXP_FEATURE, 0,
4930                                 &rp, sizeof(rp));
4931
4932         if (changed)
4933                 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk);
4934
4935         return err;
4936 }
4937
4938 #ifdef CONFIG_BT_LE
4939 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev,
4940                                struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4941 {
4942         struct mgmt_rp_set_exp_feature rp;
4943         bool val, changed = false;
4944         int err;
4945
4946         /* Command requires to use the non-controller index */
4947         if (hdev)
4948                 return mgmt_cmd_status(sk, hdev->id,
4949                                        MGMT_OP_SET_EXP_FEATURE,
4950                                        MGMT_STATUS_INVALID_INDEX);
4951
4952         /* Parameters are limited to a single octet */
4953         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4954                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4955                                        MGMT_OP_SET_EXP_FEATURE,
4956                                        MGMT_STATUS_INVALID_PARAMS);
4957
4958         /* Only boolean on/off is supported */
4959         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4960                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4961                                        MGMT_OP_SET_EXP_FEATURE,
4962                                        MGMT_STATUS_INVALID_PARAMS);
4963
4964         val = cp->param[0] ? true : false;
4965         if (val)
4966                 err = iso_init();
4967         else
4968                 err = iso_exit();
4969
4970         if (!err)
4971                 changed = true;
4972
4973         memcpy(rp.uuid, iso_socket_uuid, 16);
4974         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4975
4976         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4977
4978         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4979                                 MGMT_OP_SET_EXP_FEATURE, 0,
4980                                 &rp, sizeof(rp));
4981
4982         if (changed)
4983                 exp_feature_changed(hdev, iso_socket_uuid, val, sk);
4984
4985         return err;
4986 }
4987 #endif
4988
4989 static const struct mgmt_exp_feature {
4990         const u8 *uuid;
4991         int (*set_func)(struct sock *sk, struct hci_dev *hdev,
4992                         struct mgmt_cp_set_exp_feature *cp, u16 data_len);
4993 } exp_features[] = {
4994         EXP_FEAT(ZERO_KEY, set_zero_key_func),
4995 #ifdef CONFIG_BT_FEATURE_DEBUG
4996         EXP_FEAT(debug_uuid, set_debug_func),
4997 #endif
4998         EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func),
4999         EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func),
5000         EXP_FEAT(quality_report_uuid, set_quality_report_func),
5001         EXP_FEAT(offload_codecs_uuid, set_offload_codec_func),
5002         EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func),
5003 #ifdef CONFIG_BT_LE
5004         EXP_FEAT(iso_socket_uuid, set_iso_socket_func),
5005 #endif
5006
5007         /* end with a null feature */
5008         EXP_FEAT(NULL, NULL)
5009 };
5010
5011 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
5012                            void *data, u16 data_len)
5013 {
5014         struct mgmt_cp_set_exp_feature *cp = data;
5015         size_t i = 0;
5016
5017         bt_dev_dbg(hdev, "sock %p", sk);
5018
5019         for (i = 0; exp_features[i].uuid; i++) {
5020                 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
5021                         return exp_features[i].set_func(sk, hdev, cp, data_len);
5022         }
5023
5024         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
5025                                MGMT_OP_SET_EXP_FEATURE,
5026                                MGMT_STATUS_NOT_SUPPORTED);
5027 }
5028
5029 static u32 get_params_flags(struct hci_dev *hdev,
5030                             struct hci_conn_params *params)
5031 {
5032         u32 flags = hdev->conn_flags;
5033
5034         /* Devices using RPAs can only be programmed in the acceptlist if
5035          * LL Privacy has been enable otherwise they cannot mark
5036          * HCI_CONN_FLAG_REMOTE_WAKEUP.
5037          */
5038         if ((flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && !use_ll_privacy(hdev) &&
5039             hci_find_irk_by_addr(hdev, &params->addr, params->addr_type))
5040                 flags &= ~HCI_CONN_FLAG_REMOTE_WAKEUP;
5041
5042         return flags;
5043 }
5044
5045 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5046                             u16 data_len)
5047 {
5048         struct mgmt_cp_get_device_flags *cp = data;
5049         struct mgmt_rp_get_device_flags rp;
5050         struct bdaddr_list_with_flags *br_params;
5051         struct hci_conn_params *params;
5052         u32 supported_flags;
5053         u32 current_flags = 0;
5054         u8 status = MGMT_STATUS_INVALID_PARAMS;
5055
5056         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
5057                    &cp->addr.bdaddr, cp->addr.type);
5058
5059         hci_dev_lock(hdev);
5060
5061         supported_flags = hdev->conn_flags;
5062
5063         memset(&rp, 0, sizeof(rp));
5064
5065         if (cp->addr.type == BDADDR_BREDR) {
5066                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5067                                                               &cp->addr.bdaddr,
5068                                                               cp->addr.type);
5069                 if (!br_params)
5070                         goto done;
5071
5072                 current_flags = br_params->flags;
5073         } else {
5074                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5075                                                 le_addr_type(cp->addr.type));
5076                 if (!params)
5077                         goto done;
5078
5079                 supported_flags = get_params_flags(hdev, params);
5080                 current_flags = params->flags;
5081         }
5082
5083         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5084         rp.addr.type = cp->addr.type;
5085         rp.supported_flags = cpu_to_le32(supported_flags);
5086         rp.current_flags = cpu_to_le32(current_flags);
5087
5088         status = MGMT_STATUS_SUCCESS;
5089
5090 done:
5091         hci_dev_unlock(hdev);
5092
5093         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
5094                                 &rp, sizeof(rp));
5095 }
5096
5097 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
5098                                  bdaddr_t *bdaddr, u8 bdaddr_type,
5099                                  u32 supported_flags, u32 current_flags)
5100 {
5101         struct mgmt_ev_device_flags_changed ev;
5102
5103         bacpy(&ev.addr.bdaddr, bdaddr);
5104         ev.addr.type = bdaddr_type;
5105         ev.supported_flags = cpu_to_le32(supported_flags);
5106         ev.current_flags = cpu_to_le32(current_flags);
5107
5108         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
5109 }
5110
5111 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5112                             u16 len)
5113 {
5114         struct mgmt_cp_set_device_flags *cp = data;
5115         struct bdaddr_list_with_flags *br_params;
5116         struct hci_conn_params *params;
5117         u8 status = MGMT_STATUS_INVALID_PARAMS;
5118         u32 supported_flags;
5119         u32 current_flags = __le32_to_cpu(cp->current_flags);
5120
5121         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
5122                    &cp->addr.bdaddr, cp->addr.type, current_flags);
5123
5124         // We should take hci_dev_lock() early, I think.. conn_flags can change
5125         supported_flags = hdev->conn_flags;
5126
5127         if ((supported_flags | current_flags) != supported_flags) {
5128                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5129                             current_flags, supported_flags);
5130                 goto done;
5131         }
5132
5133         hci_dev_lock(hdev);
5134
5135         if (cp->addr.type == BDADDR_BREDR) {
5136                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5137                                                               &cp->addr.bdaddr,
5138                                                               cp->addr.type);
5139
5140                 if (br_params) {
5141                         br_params->flags = current_flags;
5142                         status = MGMT_STATUS_SUCCESS;
5143                 } else {
5144                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
5145                                     &cp->addr.bdaddr, cp->addr.type);
5146                 }
5147
5148                 goto unlock;
5149         }
5150
5151         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5152                                         le_addr_type(cp->addr.type));
5153         if (!params) {
5154                 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
5155                             &cp->addr.bdaddr, le_addr_type(cp->addr.type));
5156                 goto unlock;
5157         }
5158
5159         supported_flags = get_params_flags(hdev, params);
5160
5161         if ((supported_flags | current_flags) != supported_flags) {
5162                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5163                             current_flags, supported_flags);
5164                 goto unlock;
5165         }
5166
5167         params->flags = current_flags;
5168         status = MGMT_STATUS_SUCCESS;
5169
5170         /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY
5171          * has been set.
5172          */
5173         if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY)
5174                 hci_update_passive_scan(hdev);
5175
5176 unlock:
5177         hci_dev_unlock(hdev);
5178
5179 done:
5180         if (status == MGMT_STATUS_SUCCESS)
5181                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
5182                                      supported_flags, current_flags);
5183
5184         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
5185                                  &cp->addr, sizeof(cp->addr));
5186 }
5187
5188 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
5189                                    u16 handle)
5190 {
5191         struct mgmt_ev_adv_monitor_added ev;
5192
5193         ev.monitor_handle = cpu_to_le16(handle);
5194
5195         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
5196 }
5197
5198 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
5199 {
5200         struct mgmt_ev_adv_monitor_removed ev;
5201         struct mgmt_pending_cmd *cmd;
5202         struct sock *sk_skip = NULL;
5203         struct mgmt_cp_remove_adv_monitor *cp;
5204
5205         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
5206         if (cmd) {
5207                 cp = cmd->param;
5208
5209                 if (cp->monitor_handle)
5210                         sk_skip = cmd->sk;
5211         }
5212
5213         ev.monitor_handle = cpu_to_le16(handle);
5214
5215         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
5216 }
5217
5218 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
5219                                  void *data, u16 len)
5220 {
5221         struct adv_monitor *monitor = NULL;
5222         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
5223         int handle, err;
5224         size_t rp_size = 0;
5225         __u32 supported = 0;
5226         __u32 enabled = 0;
5227         __u16 num_handles = 0;
5228         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
5229
5230         BT_DBG("request for %s", hdev->name);
5231
5232         hci_dev_lock(hdev);
5233
5234         if (msft_monitor_supported(hdev))
5235                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
5236
5237         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
5238                 handles[num_handles++] = monitor->handle;
5239
5240         hci_dev_unlock(hdev);
5241
5242         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
5243         rp = kmalloc(rp_size, GFP_KERNEL);
5244         if (!rp)
5245                 return -ENOMEM;
5246
5247         /* All supported features are currently enabled */
5248         enabled = supported;
5249
5250         rp->supported_features = cpu_to_le32(supported);
5251         rp->enabled_features = cpu_to_le32(enabled);
5252         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
5253         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
5254         rp->num_handles = cpu_to_le16(num_handles);
5255         if (num_handles)
5256                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
5257
5258         err = mgmt_cmd_complete(sk, hdev->id,
5259                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
5260                                 MGMT_STATUS_SUCCESS, rp, rp_size);
5261
5262         kfree(rp);
5263
5264         return err;
5265 }
5266
5267 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,
5268                                                    void *data, int status)
5269 {
5270         struct mgmt_rp_add_adv_patterns_monitor rp;
5271         struct mgmt_pending_cmd *cmd = data;
5272         struct adv_monitor *monitor = cmd->user_data;
5273
5274         hci_dev_lock(hdev);
5275
5276         rp.monitor_handle = cpu_to_le16(monitor->handle);
5277
5278         if (!status) {
5279                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
5280                 hdev->adv_monitors_cnt++;
5281                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
5282                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
5283                 hci_update_passive_scan(hdev);
5284         }
5285
5286         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5287                           mgmt_status(status), &rp, sizeof(rp));
5288         mgmt_pending_remove(cmd);
5289
5290         hci_dev_unlock(hdev);
5291         bt_dev_dbg(hdev, "add monitor %d complete, status %d",
5292                    rp.monitor_handle, status);
5293 }
5294
5295 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data)
5296 {
5297         struct mgmt_pending_cmd *cmd = data;
5298         struct adv_monitor *monitor = cmd->user_data;
5299
5300         return hci_add_adv_monitor(hdev, monitor);
5301 }
5302
5303 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5304                                       struct adv_monitor *m, u8 status,
5305                                       void *data, u16 len, u16 op)
5306 {
5307         struct mgmt_pending_cmd *cmd;
5308         int err;
5309
5310         hci_dev_lock(hdev);
5311
5312         if (status)
5313                 goto unlock;
5314
5315         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5316             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5317             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
5318             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
5319                 status = MGMT_STATUS_BUSY;
5320                 goto unlock;
5321         }
5322
5323         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5324         if (!cmd) {
5325                 status = MGMT_STATUS_NO_RESOURCES;
5326                 goto unlock;
5327         }
5328
5329         cmd->user_data = m;
5330         err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd,
5331                                  mgmt_add_adv_patterns_monitor_complete);
5332         if (err) {
5333                 if (err == -ENOMEM)
5334                         status = MGMT_STATUS_NO_RESOURCES;
5335                 else
5336                         status = MGMT_STATUS_FAILED;
5337
5338                 goto unlock;
5339         }
5340
5341         hci_dev_unlock(hdev);
5342
5343         return 0;
5344
5345 unlock:
5346         hci_free_adv_monitor(hdev, m);
5347         hci_dev_unlock(hdev);
5348         return mgmt_cmd_status(sk, hdev->id, op, status);
5349 }
5350
5351 static void parse_adv_monitor_rssi(struct adv_monitor *m,
5352                                    struct mgmt_adv_rssi_thresholds *rssi)
5353 {
5354         if (rssi) {
5355                 m->rssi.low_threshold = rssi->low_threshold;
5356                 m->rssi.low_threshold_timeout =
5357                     __le16_to_cpu(rssi->low_threshold_timeout);
5358                 m->rssi.high_threshold = rssi->high_threshold;
5359                 m->rssi.high_threshold_timeout =
5360                     __le16_to_cpu(rssi->high_threshold_timeout);
5361                 m->rssi.sampling_period = rssi->sampling_period;
5362         } else {
5363                 /* Default values. These numbers are the least constricting
5364                  * parameters for MSFT API to work, so it behaves as if there
5365                  * are no rssi parameter to consider. May need to be changed
5366                  * if other API are to be supported.
5367                  */
5368                 m->rssi.low_threshold = -127;
5369                 m->rssi.low_threshold_timeout = 60;
5370                 m->rssi.high_threshold = -127;
5371                 m->rssi.high_threshold_timeout = 0;
5372                 m->rssi.sampling_period = 0;
5373         }
5374 }
5375
5376 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
5377                                     struct mgmt_adv_pattern *patterns)
5378 {
5379         u8 offset = 0, length = 0;
5380         struct adv_pattern *p = NULL;
5381         int i;
5382
5383         for (i = 0; i < pattern_count; i++) {
5384                 offset = patterns[i].offset;
5385                 length = patterns[i].length;
5386                 if (offset >= HCI_MAX_AD_LENGTH ||
5387                     length > HCI_MAX_AD_LENGTH ||
5388                     (offset + length) > HCI_MAX_AD_LENGTH)
5389                         return MGMT_STATUS_INVALID_PARAMS;
5390
5391                 p = kmalloc(sizeof(*p), GFP_KERNEL);
5392                 if (!p)
5393                         return MGMT_STATUS_NO_RESOURCES;
5394
5395                 p->ad_type = patterns[i].ad_type;
5396                 p->offset = patterns[i].offset;
5397                 p->length = patterns[i].length;
5398                 memcpy(p->value, patterns[i].value, p->length);
5399
5400                 INIT_LIST_HEAD(&p->list);
5401                 list_add(&p->list, &m->patterns);
5402         }
5403
5404         return MGMT_STATUS_SUCCESS;
5405 }
5406
5407 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5408                                     void *data, u16 len)
5409 {
5410         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
5411         struct adv_monitor *m = NULL;
5412         u8 status = MGMT_STATUS_SUCCESS;
5413         size_t expected_size = sizeof(*cp);
5414
5415         BT_DBG("request for %s", hdev->name);
5416
5417         if (len <= sizeof(*cp)) {
5418                 status = MGMT_STATUS_INVALID_PARAMS;
5419                 goto done;
5420         }
5421
5422         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5423         if (len != expected_size) {
5424                 status = MGMT_STATUS_INVALID_PARAMS;
5425                 goto done;
5426         }
5427
5428         m = kzalloc(sizeof(*m), GFP_KERNEL);
5429         if (!m) {
5430                 status = MGMT_STATUS_NO_RESOURCES;
5431                 goto done;
5432         }
5433
5434         INIT_LIST_HEAD(&m->patterns);
5435
5436         parse_adv_monitor_rssi(m, NULL);
5437         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5438
5439 done:
5440         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5441                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
5442 }
5443
5444 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
5445                                          void *data, u16 len)
5446 {
5447         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
5448         struct adv_monitor *m = NULL;
5449         u8 status = MGMT_STATUS_SUCCESS;
5450         size_t expected_size = sizeof(*cp);
5451
5452         BT_DBG("request for %s", hdev->name);
5453
5454         if (len <= sizeof(*cp)) {
5455                 status = MGMT_STATUS_INVALID_PARAMS;
5456                 goto done;
5457         }
5458
5459         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5460         if (len != expected_size) {
5461                 status = MGMT_STATUS_INVALID_PARAMS;
5462                 goto done;
5463         }
5464
5465         m = kzalloc(sizeof(*m), GFP_KERNEL);
5466         if (!m) {
5467                 status = MGMT_STATUS_NO_RESOURCES;
5468                 goto done;
5469         }
5470
5471         INIT_LIST_HEAD(&m->patterns);
5472
5473         parse_adv_monitor_rssi(m, &cp->rssi);
5474         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5475
5476 done:
5477         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5478                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
5479 }
5480
5481 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
5482                                              void *data, int status)
5483 {
5484         struct mgmt_rp_remove_adv_monitor rp;
5485         struct mgmt_pending_cmd *cmd = data;
5486         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5487
5488         hci_dev_lock(hdev);
5489
5490         rp.monitor_handle = cp->monitor_handle;
5491
5492         if (!status)
5493                 hci_update_passive_scan(hdev);
5494
5495         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5496                           mgmt_status(status), &rp, sizeof(rp));
5497         mgmt_pending_remove(cmd);
5498
5499         hci_dev_unlock(hdev);
5500         bt_dev_dbg(hdev, "remove monitor %d complete, status %d",
5501                    rp.monitor_handle, status);
5502 }
5503
5504 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data)
5505 {
5506         struct mgmt_pending_cmd *cmd = data;
5507         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5508         u16 handle = __le16_to_cpu(cp->monitor_handle);
5509
5510         if (!handle)
5511                 return hci_remove_all_adv_monitor(hdev);
5512
5513         return hci_remove_single_adv_monitor(hdev, handle);
5514 }
5515
5516 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
5517                               void *data, u16 len)
5518 {
5519         struct mgmt_pending_cmd *cmd;
5520         int err, status;
5521
5522         hci_dev_lock(hdev);
5523
5524         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5525             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
5526             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5527             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
5528                 status = MGMT_STATUS_BUSY;
5529                 goto unlock;
5530         }
5531
5532         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
5533         if (!cmd) {
5534                 status = MGMT_STATUS_NO_RESOURCES;
5535                 goto unlock;
5536         }
5537
5538         err = hci_cmd_sync_queue(hdev, mgmt_remove_adv_monitor_sync, cmd,
5539                                  mgmt_remove_adv_monitor_complete);
5540
5541         if (err) {
5542                 mgmt_pending_remove(cmd);
5543
5544                 if (err == -ENOMEM)
5545                         status = MGMT_STATUS_NO_RESOURCES;
5546                 else
5547                         status = MGMT_STATUS_FAILED;
5548
5549                 goto unlock;
5550         }
5551
5552         hci_dev_unlock(hdev);
5553
5554         return 0;
5555
5556 unlock:
5557         hci_dev_unlock(hdev);
5558         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
5559                                status);
5560 }
5561
5562 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err)
5563 {
5564         struct mgmt_rp_read_local_oob_data mgmt_rp;
5565         size_t rp_size = sizeof(mgmt_rp);
5566         struct mgmt_pending_cmd *cmd = data;
5567         struct sk_buff *skb = cmd->skb;
5568         u8 status = mgmt_status(err);
5569
5570         if (!status) {
5571                 if (!skb)
5572                         status = MGMT_STATUS_FAILED;
5573                 else if (IS_ERR(skb))
5574                         status = mgmt_status(PTR_ERR(skb));
5575                 else
5576                         status = mgmt_status(skb->data[0]);
5577         }
5578
5579         bt_dev_dbg(hdev, "status %d", status);
5580
5581         if (status) {
5582                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status);
5583                 goto remove;
5584         }
5585
5586         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
5587
5588         if (!bredr_sc_enabled(hdev)) {
5589                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
5590
5591                 if (skb->len < sizeof(*rp)) {
5592                         mgmt_cmd_status(cmd->sk, hdev->id,
5593                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5594                                         MGMT_STATUS_FAILED);
5595                         goto remove;
5596                 }
5597
5598                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
5599                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
5600
5601                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
5602         } else {
5603                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
5604
5605                 if (skb->len < sizeof(*rp)) {
5606                         mgmt_cmd_status(cmd->sk, hdev->id,
5607                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5608                                         MGMT_STATUS_FAILED);
5609                         goto remove;
5610                 }
5611
5612                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
5613                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
5614
5615                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
5616                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
5617         }
5618
5619         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5620                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
5621
5622 remove:
5623         if (skb && !IS_ERR(skb))
5624                 kfree_skb(skb);
5625
5626         mgmt_pending_free(cmd);
5627 }
5628
5629 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data)
5630 {
5631         struct mgmt_pending_cmd *cmd = data;
5632
5633         if (bredr_sc_enabled(hdev))
5634                 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk);
5635         else
5636                 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk);
5637
5638         if (IS_ERR(cmd->skb))
5639                 return PTR_ERR(cmd->skb);
5640         else
5641                 return 0;
5642 }
5643
5644 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
5645                                void *data, u16 data_len)
5646 {
5647         struct mgmt_pending_cmd *cmd;
5648         int err;
5649
5650         bt_dev_dbg(hdev, "sock %p", sk);
5651
5652         hci_dev_lock(hdev);
5653
5654         if (!hdev_is_powered(hdev)) {
5655                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5656                                       MGMT_STATUS_NOT_POWERED);
5657                 goto unlock;
5658         }
5659
5660         if (!lmp_ssp_capable(hdev)) {
5661                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5662                                       MGMT_STATUS_NOT_SUPPORTED);
5663                 goto unlock;
5664         }
5665
5666         cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
5667         if (!cmd)
5668                 err = -ENOMEM;
5669         else
5670                 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
5671                                          read_local_oob_data_complete);
5672
5673         if (err < 0) {
5674                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5675                                       MGMT_STATUS_FAILED);
5676
5677                 if (cmd)
5678                         mgmt_pending_free(cmd);
5679         }
5680
5681 unlock:
5682         hci_dev_unlock(hdev);
5683         return err;
5684 }
5685
5686 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5687                                void *data, u16 len)
5688 {
5689         struct mgmt_addr_info *addr = data;
5690         int err;
5691
5692         bt_dev_dbg(hdev, "sock %p", sk);
5693
5694         if (!bdaddr_type_is_valid(addr->type))
5695                 return mgmt_cmd_complete(sk, hdev->id,
5696                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
5697                                          MGMT_STATUS_INVALID_PARAMS,
5698                                          addr, sizeof(*addr));
5699
5700         hci_dev_lock(hdev);
5701
5702         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
5703                 struct mgmt_cp_add_remote_oob_data *cp = data;
5704                 u8 status;
5705
5706                 if (cp->addr.type != BDADDR_BREDR) {
5707                         err = mgmt_cmd_complete(sk, hdev->id,
5708                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
5709                                                 MGMT_STATUS_INVALID_PARAMS,
5710                                                 &cp->addr, sizeof(cp->addr));
5711                         goto unlock;
5712                 }
5713
5714                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5715                                               cp->addr.type, cp->hash,
5716                                               cp->rand, NULL, NULL);
5717                 if (err < 0)
5718                         status = MGMT_STATUS_FAILED;
5719                 else
5720                         status = MGMT_STATUS_SUCCESS;
5721
5722                 err = mgmt_cmd_complete(sk, hdev->id,
5723                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
5724                                         &cp->addr, sizeof(cp->addr));
5725         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
5726                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
5727                 u8 *rand192, *hash192, *rand256, *hash256;
5728                 u8 status;
5729
5730                 if (bdaddr_type_is_le(cp->addr.type)) {
5731                         /* Enforce zero-valued 192-bit parameters as
5732                          * long as legacy SMP OOB isn't implemented.
5733                          */
5734                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
5735                             memcmp(cp->hash192, ZERO_KEY, 16)) {
5736                                 err = mgmt_cmd_complete(sk, hdev->id,
5737                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5738                                                         MGMT_STATUS_INVALID_PARAMS,
5739                                                         addr, sizeof(*addr));
5740                                 goto unlock;
5741                         }
5742
5743                         rand192 = NULL;
5744                         hash192 = NULL;
5745                 } else {
5746                         /* In case one of the P-192 values is set to zero,
5747                          * then just disable OOB data for P-192.
5748                          */
5749                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
5750                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
5751                                 rand192 = NULL;
5752                                 hash192 = NULL;
5753                         } else {
5754                                 rand192 = cp->rand192;
5755                                 hash192 = cp->hash192;
5756                         }
5757                 }
5758
5759                 /* In case one of the P-256 values is set to zero, then just
5760                  * disable OOB data for P-256.
5761                  */
5762                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
5763                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
5764                         rand256 = NULL;
5765                         hash256 = NULL;
5766                 } else {
5767                         rand256 = cp->rand256;
5768                         hash256 = cp->hash256;
5769                 }
5770
5771                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5772                                               cp->addr.type, hash192, rand192,
5773                                               hash256, rand256);
5774                 if (err < 0)
5775                         status = MGMT_STATUS_FAILED;
5776                 else
5777                         status = MGMT_STATUS_SUCCESS;
5778
5779                 err = mgmt_cmd_complete(sk, hdev->id,
5780                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5781                                         status, &cp->addr, sizeof(cp->addr));
5782         } else {
5783                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
5784                            len);
5785                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
5786                                       MGMT_STATUS_INVALID_PARAMS);
5787         }
5788
5789 unlock:
5790         hci_dev_unlock(hdev);
5791         return err;
5792 }
5793
5794 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5795                                   void *data, u16 len)
5796 {
5797         struct mgmt_cp_remove_remote_oob_data *cp = data;
5798         u8 status;
5799         int err;
5800
5801         bt_dev_dbg(hdev, "sock %p", sk);
5802
5803         if (cp->addr.type != BDADDR_BREDR)
5804                 return mgmt_cmd_complete(sk, hdev->id,
5805                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5806                                          MGMT_STATUS_INVALID_PARAMS,
5807                                          &cp->addr, sizeof(cp->addr));
5808
5809         hci_dev_lock(hdev);
5810
5811         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5812                 hci_remote_oob_data_clear(hdev);
5813                 status = MGMT_STATUS_SUCCESS;
5814                 goto done;
5815         }
5816
5817         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
5818         if (err < 0)
5819                 status = MGMT_STATUS_INVALID_PARAMS;
5820         else
5821                 status = MGMT_STATUS_SUCCESS;
5822
5823 done:
5824         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5825                                 status, &cp->addr, sizeof(cp->addr));
5826
5827         hci_dev_unlock(hdev);
5828         return err;
5829 }
5830
5831 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
5832 {
5833         struct mgmt_pending_cmd *cmd;
5834
5835         bt_dev_dbg(hdev, "status %u", status);
5836
5837         hci_dev_lock(hdev);
5838
5839         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
5840         if (!cmd)
5841                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
5842
5843         if (!cmd)
5844                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
5845
5846         if (cmd) {
5847                 cmd->cmd_complete(cmd, mgmt_status(status));
5848                 mgmt_pending_remove(cmd);
5849         }
5850
5851         hci_dev_unlock(hdev);
5852 }
5853
5854 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
5855                                     uint8_t *mgmt_status)
5856 {
5857         switch (type) {
5858         case DISCOV_TYPE_LE:
5859                 *mgmt_status = mgmt_le_support(hdev);
5860                 if (*mgmt_status)
5861                         return false;
5862                 break;
5863         case DISCOV_TYPE_INTERLEAVED:
5864                 *mgmt_status = mgmt_le_support(hdev);
5865                 if (*mgmt_status)
5866                         return false;
5867                 fallthrough;
5868         case DISCOV_TYPE_BREDR:
5869                 *mgmt_status = mgmt_bredr_support(hdev);
5870                 if (*mgmt_status)
5871                         return false;
5872                 break;
5873         default:
5874                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
5875                 return false;
5876         }
5877
5878         return true;
5879 }
5880
5881 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
5882 {
5883         struct mgmt_pending_cmd *cmd = data;
5884
5885         if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) &&
5886             cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) &&
5887             cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev))
5888                 return;
5889
5890         bt_dev_dbg(hdev, "err %d", err);
5891
5892         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
5893                           cmd->param, 1);
5894         mgmt_pending_remove(cmd);
5895
5896         hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED:
5897                                 DISCOVERY_FINDING);
5898 }
5899
5900 static int start_discovery_sync(struct hci_dev *hdev, void *data)
5901 {
5902         return hci_start_discovery_sync(hdev);
5903 }
5904
5905 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
5906                                     u16 op, void *data, u16 len)
5907 {
5908         struct mgmt_cp_start_discovery *cp = data;
5909         struct mgmt_pending_cmd *cmd;
5910         u8 status;
5911         int err;
5912
5913         bt_dev_dbg(hdev, "sock %p", sk);
5914
5915         hci_dev_lock(hdev);
5916
5917         if (!hdev_is_powered(hdev)) {
5918                 err = mgmt_cmd_complete(sk, hdev->id, op,
5919                                         MGMT_STATUS_NOT_POWERED,
5920                                         &cp->type, sizeof(cp->type));
5921                 goto failed;
5922         }
5923
5924         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5925             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5926                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5927                                         &cp->type, sizeof(cp->type));
5928                 goto failed;
5929         }
5930
5931         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5932                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
5933                                         &cp->type, sizeof(cp->type));
5934                 goto failed;
5935         }
5936
5937         /* Can't start discovery when it is paused */
5938         if (hdev->discovery_paused) {
5939                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5940                                         &cp->type, sizeof(cp->type));
5941                 goto failed;
5942         }
5943
5944         /* Clear the discovery filter first to free any previously
5945          * allocated memory for the UUID list.
5946          */
5947         hci_discovery_filter_clear(hdev);
5948
5949         hdev->discovery.type = cp->type;
5950         hdev->discovery.report_invalid_rssi = false;
5951         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
5952                 hdev->discovery.limited = true;
5953         else
5954                 hdev->discovery.limited = false;
5955
5956         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5957         if (!cmd) {
5958                 err = -ENOMEM;
5959                 goto failed;
5960         }
5961
5962         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
5963                                  start_discovery_complete);
5964         if (err < 0) {
5965                 mgmt_pending_remove(cmd);
5966                 goto failed;
5967         }
5968
5969         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5970
5971 failed:
5972         hci_dev_unlock(hdev);
5973         return err;
5974 }
5975
5976 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
5977                            void *data, u16 len)
5978 {
5979         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
5980                                         data, len);
5981 }
5982
5983 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
5984                                    void *data, u16 len)
5985 {
5986         return start_discovery_internal(sk, hdev,
5987                                         MGMT_OP_START_LIMITED_DISCOVERY,
5988                                         data, len);
5989 }
5990
5991 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
5992                                    void *data, u16 len)
5993 {
5994         struct mgmt_cp_start_service_discovery *cp = data;
5995         struct mgmt_pending_cmd *cmd;
5996         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
5997         u16 uuid_count, expected_len;
5998         u8 status;
5999         int err;
6000
6001         bt_dev_dbg(hdev, "sock %p", sk);
6002
6003         hci_dev_lock(hdev);
6004
6005         if (!hdev_is_powered(hdev)) {
6006                 err = mgmt_cmd_complete(sk, hdev->id,
6007                                         MGMT_OP_START_SERVICE_DISCOVERY,
6008                                         MGMT_STATUS_NOT_POWERED,
6009                                         &cp->type, sizeof(cp->type));
6010                 goto failed;
6011         }
6012
6013         if (hdev->discovery.state != DISCOVERY_STOPPED ||
6014             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
6015                 err = mgmt_cmd_complete(sk, hdev->id,
6016                                         MGMT_OP_START_SERVICE_DISCOVERY,
6017                                         MGMT_STATUS_BUSY, &cp->type,
6018                                         sizeof(cp->type));
6019                 goto failed;
6020         }
6021
6022         if (hdev->discovery_paused) {
6023                 err = mgmt_cmd_complete(sk, hdev->id,
6024                                         MGMT_OP_START_SERVICE_DISCOVERY,
6025                                         MGMT_STATUS_BUSY, &cp->type,
6026                                         sizeof(cp->type));
6027                 goto failed;
6028         }
6029
6030         uuid_count = __le16_to_cpu(cp->uuid_count);
6031         if (uuid_count > max_uuid_count) {
6032                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
6033                            uuid_count);
6034                 err = mgmt_cmd_complete(sk, hdev->id,
6035                                         MGMT_OP_START_SERVICE_DISCOVERY,
6036                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
6037                                         sizeof(cp->type));
6038                 goto failed;
6039         }
6040
6041         expected_len = sizeof(*cp) + uuid_count * 16;
6042         if (expected_len != len) {
6043                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
6044                            expected_len, len);
6045                 err = mgmt_cmd_complete(sk, hdev->id,
6046                                         MGMT_OP_START_SERVICE_DISCOVERY,
6047                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
6048                                         sizeof(cp->type));
6049                 goto failed;
6050         }
6051
6052         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
6053                 err = mgmt_cmd_complete(sk, hdev->id,
6054                                         MGMT_OP_START_SERVICE_DISCOVERY,
6055                                         status, &cp->type, sizeof(cp->type));
6056                 goto failed;
6057         }
6058
6059         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
6060                                hdev, data, len);
6061         if (!cmd) {
6062                 err = -ENOMEM;
6063                 goto failed;
6064         }
6065
6066         /* Clear the discovery filter first to free any previously
6067          * allocated memory for the UUID list.
6068          */
6069         hci_discovery_filter_clear(hdev);
6070
6071         hdev->discovery.result_filtering = true;
6072         hdev->discovery.type = cp->type;
6073         hdev->discovery.rssi = cp->rssi;
6074         hdev->discovery.uuid_count = uuid_count;
6075
6076         if (uuid_count > 0) {
6077                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
6078                                                 GFP_KERNEL);
6079                 if (!hdev->discovery.uuids) {
6080                         err = mgmt_cmd_complete(sk, hdev->id,
6081                                                 MGMT_OP_START_SERVICE_DISCOVERY,
6082                                                 MGMT_STATUS_FAILED,
6083                                                 &cp->type, sizeof(cp->type));
6084                         mgmt_pending_remove(cmd);
6085                         goto failed;
6086                 }
6087         }
6088
6089         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
6090                                  start_discovery_complete);
6091         if (err < 0) {
6092                 mgmt_pending_remove(cmd);
6093                 goto failed;
6094         }
6095
6096         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
6097
6098 failed:
6099         hci_dev_unlock(hdev);
6100         return err;
6101 }
6102
6103 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
6104 {
6105         struct mgmt_pending_cmd *cmd;
6106
6107         bt_dev_dbg(hdev, "status %u", status);
6108
6109         hci_dev_lock(hdev);
6110
6111         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6112         if (cmd) {
6113                 cmd->cmd_complete(cmd, mgmt_status(status));
6114                 mgmt_pending_remove(cmd);
6115         }
6116
6117         hci_dev_unlock(hdev);
6118 }
6119
6120 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
6121 {
6122         struct mgmt_pending_cmd *cmd = data;
6123
6124         if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
6125                 return;
6126
6127         bt_dev_dbg(hdev, "err %d", err);
6128
6129         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
6130                           cmd->param, 1);
6131         mgmt_pending_remove(cmd);
6132
6133         if (!err)
6134                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
6135 }
6136
6137 static int stop_discovery_sync(struct hci_dev *hdev, void *data)
6138 {
6139         return hci_stop_discovery_sync(hdev);
6140 }
6141
6142 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
6143                           u16 len)
6144 {
6145         struct mgmt_cp_stop_discovery *mgmt_cp = data;
6146         struct mgmt_pending_cmd *cmd;
6147         int err;
6148
6149         bt_dev_dbg(hdev, "sock %p", sk);
6150
6151         hci_dev_lock(hdev);
6152
6153         if (!hci_discovery_active(hdev)) {
6154                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6155                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
6156                                         sizeof(mgmt_cp->type));
6157                 goto unlock;
6158         }
6159
6160         if (hdev->discovery.type != mgmt_cp->type) {
6161                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6162                                         MGMT_STATUS_INVALID_PARAMS,
6163                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
6164                 goto unlock;
6165         }
6166
6167         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
6168         if (!cmd) {
6169                 err = -ENOMEM;
6170                 goto unlock;
6171         }
6172
6173         err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd,
6174                                  stop_discovery_complete);
6175         if (err < 0) {
6176                 mgmt_pending_remove(cmd);
6177                 goto unlock;
6178         }
6179
6180         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
6181
6182 unlock:
6183         hci_dev_unlock(hdev);
6184         return err;
6185 }
6186
6187 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
6188                         u16 len)
6189 {
6190         struct mgmt_cp_confirm_name *cp = data;
6191         struct inquiry_entry *e;
6192         int err;
6193
6194         bt_dev_dbg(hdev, "sock %p", sk);
6195
6196         hci_dev_lock(hdev);
6197
6198         if (!hci_discovery_active(hdev)) {
6199                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6200                                         MGMT_STATUS_FAILED, &cp->addr,
6201                                         sizeof(cp->addr));
6202                 goto failed;
6203         }
6204
6205         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
6206         if (!e) {
6207                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6208                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
6209                                         sizeof(cp->addr));
6210                 goto failed;
6211         }
6212
6213         if (cp->name_known) {
6214                 e->name_state = NAME_KNOWN;
6215                 list_del(&e->list);
6216         } else {
6217                 e->name_state = NAME_NEEDED;
6218                 hci_inquiry_cache_update_resolve(hdev, e);
6219         }
6220
6221         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
6222                                 &cp->addr, sizeof(cp->addr));
6223
6224 failed:
6225         hci_dev_unlock(hdev);
6226         return err;
6227 }
6228
6229 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
6230                         u16 len)
6231 {
6232         struct mgmt_cp_block_device *cp = data;
6233         u8 status;
6234         int err;
6235
6236         bt_dev_dbg(hdev, "sock %p", sk);
6237
6238         if (!bdaddr_type_is_valid(cp->addr.type))
6239                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
6240                                          MGMT_STATUS_INVALID_PARAMS,
6241                                          &cp->addr, sizeof(cp->addr));
6242
6243         hci_dev_lock(hdev);
6244
6245         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
6246                                   cp->addr.type);
6247         if (err < 0) {
6248                 status = MGMT_STATUS_FAILED;
6249                 goto done;
6250         }
6251
6252         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6253                    sk);
6254         status = MGMT_STATUS_SUCCESS;
6255
6256 done:
6257         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
6258                                 &cp->addr, sizeof(cp->addr));
6259
6260         hci_dev_unlock(hdev);
6261
6262         return err;
6263 }
6264
6265 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
6266                           u16 len)
6267 {
6268         struct mgmt_cp_unblock_device *cp = data;
6269         u8 status;
6270         int err;
6271
6272         bt_dev_dbg(hdev, "sock %p", sk);
6273
6274         if (!bdaddr_type_is_valid(cp->addr.type))
6275                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
6276                                          MGMT_STATUS_INVALID_PARAMS,
6277                                          &cp->addr, sizeof(cp->addr));
6278
6279         hci_dev_lock(hdev);
6280
6281         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
6282                                   cp->addr.type);
6283         if (err < 0) {
6284                 status = MGMT_STATUS_INVALID_PARAMS;
6285                 goto done;
6286         }
6287
6288         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6289                    sk);
6290         status = MGMT_STATUS_SUCCESS;
6291
6292 done:
6293         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
6294                                 &cp->addr, sizeof(cp->addr));
6295
6296         hci_dev_unlock(hdev);
6297
6298         return err;
6299 }
6300
6301 static int set_device_id_sync(struct hci_dev *hdev, void *data)
6302 {
6303         return hci_update_eir_sync(hdev);
6304 }
6305
6306 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
6307                          u16 len)
6308 {
6309         struct mgmt_cp_set_device_id *cp = data;
6310         int err;
6311         __u16 source;
6312
6313         bt_dev_dbg(hdev, "sock %p", sk);
6314
6315         source = __le16_to_cpu(cp->source);
6316
6317         if (source > 0x0002)
6318                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
6319                                        MGMT_STATUS_INVALID_PARAMS);
6320
6321         hci_dev_lock(hdev);
6322
6323         hdev->devid_source = source;
6324         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
6325         hdev->devid_product = __le16_to_cpu(cp->product);
6326         hdev->devid_version = __le16_to_cpu(cp->version);
6327
6328         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
6329                                 NULL, 0);
6330
6331         hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL);
6332
6333         hci_dev_unlock(hdev);
6334
6335         return err;
6336 }
6337
6338 static void enable_advertising_instance(struct hci_dev *hdev, int err)
6339 {
6340         if (err)
6341                 bt_dev_err(hdev, "failed to re-configure advertising %d", err);
6342         else
6343                 bt_dev_dbg(hdev, "status %d", err);
6344 }
6345
6346 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)
6347 {
6348         struct cmd_lookup match = { NULL, hdev };
6349         u8 instance;
6350         struct adv_info *adv_instance;
6351         u8 status = mgmt_status(err);
6352
6353         if (status) {
6354                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
6355                                      cmd_status_rsp, &status);
6356                 return;
6357         }
6358
6359         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
6360                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
6361         else
6362                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
6363
6364         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
6365                              &match);
6366
6367         new_settings(hdev, match.sk);
6368
6369         if (match.sk)
6370                 sock_put(match.sk);
6371
6372         /* If "Set Advertising" was just disabled and instance advertising was
6373          * set up earlier, then re-enable multi-instance advertising.
6374          */
6375         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6376             list_empty(&hdev->adv_instances))
6377                 return;
6378
6379         instance = hdev->cur_adv_instance;
6380         if (!instance) {
6381                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
6382                                                         struct adv_info, list);
6383                 if (!adv_instance)
6384                         return;
6385
6386                 instance = adv_instance->instance;
6387         }
6388
6389         err = hci_schedule_adv_instance_sync(hdev, instance, true);
6390
6391         enable_advertising_instance(hdev, err);
6392 }
6393
6394 static int set_adv_sync(struct hci_dev *hdev, void *data)
6395 {
6396         struct mgmt_pending_cmd *cmd = data;
6397         struct mgmt_mode *cp = cmd->param;
6398         u8 val = !!cp->val;
6399
6400         if (cp->val == 0x02)
6401                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6402         else
6403                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6404
6405         cancel_adv_timeout(hdev);
6406
6407         if (val) {
6408                 /* Switch to instance "0" for the Set Advertising setting.
6409                  * We cannot use update_[adv|scan_rsp]_data() here as the
6410                  * HCI_ADVERTISING flag is not yet set.
6411                  */
6412                 hdev->cur_adv_instance = 0x00;
6413
6414                 if (ext_adv_capable(hdev)) {
6415                         hci_start_ext_adv_sync(hdev, 0x00);
6416                 } else {
6417                         hci_update_adv_data_sync(hdev, 0x00);
6418                         hci_update_scan_rsp_data_sync(hdev, 0x00);
6419                         hci_enable_advertising_sync(hdev);
6420                 }
6421         } else {
6422                 hci_disable_advertising_sync(hdev);
6423         }
6424
6425         return 0;
6426 }
6427
6428 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
6429                            u16 len)
6430 {
6431         struct mgmt_mode *cp = data;
6432         struct mgmt_pending_cmd *cmd;
6433         u8 val, status;
6434         int err;
6435
6436         bt_dev_dbg(hdev, "sock %p", sk);
6437
6438         status = mgmt_le_support(hdev);
6439         if (status)
6440                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6441                                        status);
6442
6443         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6444                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6445                                        MGMT_STATUS_INVALID_PARAMS);
6446
6447         if (hdev->advertising_paused)
6448                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6449                                        MGMT_STATUS_BUSY);
6450
6451         hci_dev_lock(hdev);
6452
6453         val = !!cp->val;
6454
6455         /* The following conditions are ones which mean that we should
6456          * not do any HCI communication but directly send a mgmt
6457          * response to user space (after toggling the flag if
6458          * necessary).
6459          */
6460         if (!hdev_is_powered(hdev) ||
6461             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
6462              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
6463             hci_dev_test_flag(hdev, HCI_MESH) ||
6464             hci_conn_num(hdev, LE_LINK) > 0 ||
6465             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6466              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
6467                 bool changed;
6468
6469                 if (cp->val) {
6470                         hdev->cur_adv_instance = 0x00;
6471                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
6472                         if (cp->val == 0x02)
6473                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6474                         else
6475                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6476                 } else {
6477                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
6478                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6479                 }
6480
6481                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
6482                 if (err < 0)
6483                         goto unlock;
6484
6485                 if (changed)
6486                         err = new_settings(hdev, sk);
6487
6488                 goto unlock;
6489         }
6490
6491         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
6492             pending_find(MGMT_OP_SET_LE, hdev)) {
6493                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6494                                       MGMT_STATUS_BUSY);
6495                 goto unlock;
6496         }
6497
6498         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
6499         if (!cmd)
6500                 err = -ENOMEM;
6501         else
6502                 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd,
6503                                          set_advertising_complete);
6504
6505         if (err < 0 && cmd)
6506                 mgmt_pending_remove(cmd);
6507
6508 unlock:
6509         hci_dev_unlock(hdev);
6510         return err;
6511 }
6512
6513 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
6514                               void *data, u16 len)
6515 {
6516         struct mgmt_cp_set_static_address *cp = data;
6517         int err;
6518
6519         bt_dev_dbg(hdev, "sock %p", sk);
6520
6521         if (!lmp_le_capable(hdev))
6522                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6523                                        MGMT_STATUS_NOT_SUPPORTED);
6524
6525         if (hdev_is_powered(hdev))
6526                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6527                                        MGMT_STATUS_REJECTED);
6528
6529         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
6530                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
6531                         return mgmt_cmd_status(sk, hdev->id,
6532                                                MGMT_OP_SET_STATIC_ADDRESS,
6533                                                MGMT_STATUS_INVALID_PARAMS);
6534
6535                 /* Two most significant bits shall be set */
6536                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
6537                         return mgmt_cmd_status(sk, hdev->id,
6538                                                MGMT_OP_SET_STATIC_ADDRESS,
6539                                                MGMT_STATUS_INVALID_PARAMS);
6540         }
6541
6542         hci_dev_lock(hdev);
6543
6544         bacpy(&hdev->static_addr, &cp->bdaddr);
6545
6546         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
6547         if (err < 0)
6548                 goto unlock;
6549
6550         err = new_settings(hdev, sk);
6551
6552 unlock:
6553         hci_dev_unlock(hdev);
6554         return err;
6555 }
6556
6557 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
6558                            void *data, u16 len)
6559 {
6560         struct mgmt_cp_set_scan_params *cp = data;
6561         __u16 interval, window;
6562         int err;
6563
6564         bt_dev_dbg(hdev, "sock %p", sk);
6565
6566         if (!lmp_le_capable(hdev))
6567                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6568                                        MGMT_STATUS_NOT_SUPPORTED);
6569
6570         interval = __le16_to_cpu(cp->interval);
6571
6572         if (interval < 0x0004 || interval > 0x4000)
6573                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6574                                        MGMT_STATUS_INVALID_PARAMS);
6575
6576         window = __le16_to_cpu(cp->window);
6577
6578         if (window < 0x0004 || window > 0x4000)
6579                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6580                                        MGMT_STATUS_INVALID_PARAMS);
6581
6582         if (window > interval)
6583                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6584                                        MGMT_STATUS_INVALID_PARAMS);
6585
6586         hci_dev_lock(hdev);
6587
6588         hdev->le_scan_interval = interval;
6589         hdev->le_scan_window = window;
6590
6591         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
6592                                 NULL, 0);
6593
6594         /* If background scan is running, restart it so new parameters are
6595          * loaded.
6596          */
6597         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6598             hdev->discovery.state == DISCOVERY_STOPPED)
6599                 hci_update_passive_scan(hdev);
6600
6601         hci_dev_unlock(hdev);
6602
6603         return err;
6604 }
6605
6606 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err)
6607 {
6608         struct mgmt_pending_cmd *cmd = data;
6609
6610         bt_dev_dbg(hdev, "err %d", err);
6611
6612         if (err) {
6613                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6614                                 mgmt_status(err));
6615         } else {
6616                 struct mgmt_mode *cp = cmd->param;
6617
6618                 if (cp->val)
6619                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
6620                 else
6621                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6622
6623                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6624                 new_settings(hdev, cmd->sk);
6625         }
6626
6627         mgmt_pending_free(cmd);
6628 }
6629
6630 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data)
6631 {
6632         struct mgmt_pending_cmd *cmd = data;
6633         struct mgmt_mode *cp = cmd->param;
6634
6635         return hci_write_fast_connectable_sync(hdev, cp->val);
6636 }
6637
6638 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
6639                                 void *data, u16 len)
6640 {
6641         struct mgmt_mode *cp = data;
6642         struct mgmt_pending_cmd *cmd;
6643         int err;
6644
6645         bt_dev_dbg(hdev, "sock %p", sk);
6646
6647         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
6648             hdev->hci_ver < BLUETOOTH_VER_1_2)
6649                 return mgmt_cmd_status(sk, hdev->id,
6650                                        MGMT_OP_SET_FAST_CONNECTABLE,
6651                                        MGMT_STATUS_NOT_SUPPORTED);
6652
6653         if (cp->val != 0x00 && cp->val != 0x01)
6654                 return mgmt_cmd_status(sk, hdev->id,
6655                                        MGMT_OP_SET_FAST_CONNECTABLE,
6656                                        MGMT_STATUS_INVALID_PARAMS);
6657
6658         hci_dev_lock(hdev);
6659
6660         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
6661                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6662                 goto unlock;
6663         }
6664
6665         if (!hdev_is_powered(hdev)) {
6666                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
6667                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6668                 new_settings(hdev, sk);
6669                 goto unlock;
6670         }
6671
6672         cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data,
6673                                len);
6674         if (!cmd)
6675                 err = -ENOMEM;
6676         else
6677                 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd,
6678                                          fast_connectable_complete);
6679
6680         if (err < 0) {
6681                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6682                                 MGMT_STATUS_FAILED);
6683
6684                 if (cmd)
6685                         mgmt_pending_free(cmd);
6686         }
6687
6688 unlock:
6689         hci_dev_unlock(hdev);
6690
6691         return err;
6692 }
6693
6694 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err)
6695 {
6696         struct mgmt_pending_cmd *cmd = data;
6697
6698         bt_dev_dbg(hdev, "err %d", err);
6699
6700         if (err) {
6701                 u8 mgmt_err = mgmt_status(err);
6702
6703                 /* We need to restore the flag if related HCI commands
6704                  * failed.
6705                  */
6706                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
6707
6708                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6709         } else {
6710                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
6711                 new_settings(hdev, cmd->sk);
6712         }
6713
6714         mgmt_pending_free(cmd);
6715 }
6716
6717 static int set_bredr_sync(struct hci_dev *hdev, void *data)
6718 {
6719         int status;
6720
6721         status = hci_write_fast_connectable_sync(hdev, false);
6722
6723         if (!status)
6724                 status = hci_update_scan_sync(hdev);
6725
6726         /* Since only the advertising data flags will change, there
6727          * is no need to update the scan response data.
6728          */
6729         if (!status)
6730                 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance);
6731
6732         return status;
6733 }
6734
6735 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6736 {
6737         struct mgmt_mode *cp = data;
6738         struct mgmt_pending_cmd *cmd;
6739         int err;
6740
6741         bt_dev_dbg(hdev, "sock %p", sk);
6742
6743         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
6744                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6745                                        MGMT_STATUS_NOT_SUPPORTED);
6746
6747         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6748                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6749                                        MGMT_STATUS_REJECTED);
6750
6751         if (cp->val != 0x00 && cp->val != 0x01)
6752                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6753                                        MGMT_STATUS_INVALID_PARAMS);
6754
6755         hci_dev_lock(hdev);
6756
6757         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6758                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6759                 goto unlock;
6760         }
6761
6762         if (!hdev_is_powered(hdev)) {
6763                 if (!cp->val) {
6764                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
6765                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
6766                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
6767                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6768                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
6769                 }
6770
6771                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
6772
6773                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6774                 if (err < 0)
6775                         goto unlock;
6776
6777                 err = new_settings(hdev, sk);
6778                 goto unlock;
6779         }
6780
6781         /* Reject disabling when powered on */
6782         if (!cp->val) {
6783                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6784                                       MGMT_STATUS_REJECTED);
6785                 goto unlock;
6786         } else {
6787                 /* When configuring a dual-mode controller to operate
6788                  * with LE only and using a static address, then switching
6789                  * BR/EDR back on is not allowed.
6790                  *
6791                  * Dual-mode controllers shall operate with the public
6792                  * address as its identity address for BR/EDR and LE. So
6793                  * reject the attempt to create an invalid configuration.
6794                  *
6795                  * The same restrictions applies when secure connections
6796                  * has been enabled. For BR/EDR this is a controller feature
6797                  * while for LE it is a host stack feature. This means that
6798                  * switching BR/EDR back on when secure connections has been
6799                  * enabled is not a supported transaction.
6800                  */
6801                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6802                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
6803                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
6804                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6805                                               MGMT_STATUS_REJECTED);
6806                         goto unlock;
6807                 }
6808         }
6809
6810         cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len);
6811         if (!cmd)
6812                 err = -ENOMEM;
6813         else
6814                 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd,
6815                                          set_bredr_complete);
6816
6817         if (err < 0) {
6818                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6819                                 MGMT_STATUS_FAILED);
6820                 if (cmd)
6821                         mgmt_pending_free(cmd);
6822
6823                 goto unlock;
6824         }
6825
6826         /* We need to flip the bit already here so that
6827          * hci_req_update_adv_data generates the correct flags.
6828          */
6829         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
6830
6831 unlock:
6832         hci_dev_unlock(hdev);
6833         return err;
6834 }
6835
6836 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err)
6837 {
6838         struct mgmt_pending_cmd *cmd = data;
6839         struct mgmt_mode *cp;
6840
6841         bt_dev_dbg(hdev, "err %d", err);
6842
6843         if (err) {
6844                 u8 mgmt_err = mgmt_status(err);
6845
6846                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6847                 goto done;
6848         }
6849
6850         cp = cmd->param;
6851
6852         switch (cp->val) {
6853         case 0x00:
6854                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
6855                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6856                 break;
6857         case 0x01:
6858                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6859                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6860                 break;
6861         case 0x02:
6862                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6863                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6864                 break;
6865         }
6866
6867         send_settings_rsp(cmd->sk, cmd->opcode, hdev);
6868         new_settings(hdev, cmd->sk);
6869
6870 done:
6871         mgmt_pending_free(cmd);
6872 }
6873
6874 static int set_secure_conn_sync(struct hci_dev *hdev, void *data)
6875 {
6876         struct mgmt_pending_cmd *cmd = data;
6877         struct mgmt_mode *cp = cmd->param;
6878         u8 val = !!cp->val;
6879
6880         /* Force write of val */
6881         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6882
6883         return hci_write_sc_support_sync(hdev, val);
6884 }
6885
6886 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
6887                            void *data, u16 len)
6888 {
6889         struct mgmt_mode *cp = data;
6890         struct mgmt_pending_cmd *cmd;
6891         u8 val;
6892         int err;
6893
6894         bt_dev_dbg(hdev, "sock %p", sk);
6895
6896         if (!lmp_sc_capable(hdev) &&
6897             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6898                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6899                                        MGMT_STATUS_NOT_SUPPORTED);
6900
6901         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6902             lmp_sc_capable(hdev) &&
6903             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
6904                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6905                                        MGMT_STATUS_REJECTED);
6906
6907         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6908                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6909                                        MGMT_STATUS_INVALID_PARAMS);
6910
6911         hci_dev_lock(hdev);
6912
6913         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
6914             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6915                 bool changed;
6916
6917                 if (cp->val) {
6918                         changed = !hci_dev_test_and_set_flag(hdev,
6919                                                              HCI_SC_ENABLED);
6920                         if (cp->val == 0x02)
6921                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6922                         else
6923                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6924                 } else {
6925                         changed = hci_dev_test_and_clear_flag(hdev,
6926                                                               HCI_SC_ENABLED);
6927                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6928                 }
6929
6930                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6931                 if (err < 0)
6932                         goto failed;
6933
6934                 if (changed)
6935                         err = new_settings(hdev, sk);
6936
6937                 goto failed;
6938         }
6939
6940         val = !!cp->val;
6941
6942         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6943             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6944                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6945                 goto failed;
6946         }
6947
6948         cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
6949         if (!cmd)
6950                 err = -ENOMEM;
6951         else
6952                 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd,
6953                                          set_secure_conn_complete);
6954
6955         if (err < 0) {
6956                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6957                                 MGMT_STATUS_FAILED);
6958                 if (cmd)
6959                         mgmt_pending_free(cmd);
6960         }
6961
6962 failed:
6963         hci_dev_unlock(hdev);
6964         return err;
6965 }
6966
6967 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
6968                           void *data, u16 len)
6969 {
6970         struct mgmt_mode *cp = data;
6971         bool changed, use_changed;
6972         int err;
6973
6974         bt_dev_dbg(hdev, "sock %p", sk);
6975
6976         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6977                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
6978                                        MGMT_STATUS_INVALID_PARAMS);
6979
6980         hci_dev_lock(hdev);
6981
6982         if (cp->val)
6983                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6984         else
6985                 changed = hci_dev_test_and_clear_flag(hdev,
6986                                                       HCI_KEEP_DEBUG_KEYS);
6987
6988         if (cp->val == 0x02)
6989                 use_changed = !hci_dev_test_and_set_flag(hdev,
6990                                                          HCI_USE_DEBUG_KEYS);
6991         else
6992                 use_changed = hci_dev_test_and_clear_flag(hdev,
6993                                                           HCI_USE_DEBUG_KEYS);
6994
6995         if (hdev_is_powered(hdev) && use_changed &&
6996             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6997                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6998                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6999                              sizeof(mode), &mode);
7000         }
7001
7002         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
7003         if (err < 0)
7004                 goto unlock;
7005
7006         if (changed)
7007                 err = new_settings(hdev, sk);
7008
7009 unlock:
7010         hci_dev_unlock(hdev);
7011         return err;
7012 }
7013
7014 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7015                        u16 len)
7016 {
7017         struct mgmt_cp_set_privacy *cp = cp_data;
7018         bool changed;
7019         int err;
7020
7021         bt_dev_dbg(hdev, "sock %p", sk);
7022
7023         if (!lmp_le_capable(hdev))
7024                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7025                                        MGMT_STATUS_NOT_SUPPORTED);
7026
7027         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
7028                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7029                                        MGMT_STATUS_INVALID_PARAMS);
7030
7031         if (hdev_is_powered(hdev))
7032                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7033                                        MGMT_STATUS_REJECTED);
7034
7035         hci_dev_lock(hdev);
7036
7037         /* If user space supports this command it is also expected to
7038          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
7039          */
7040         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7041
7042         if (cp->privacy) {
7043                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
7044                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
7045                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
7046                 hci_adv_instances_set_rpa_expired(hdev, true);
7047                 if (cp->privacy == 0x02)
7048                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
7049                 else
7050                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7051         } else {
7052                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
7053                 memset(hdev->irk, 0, sizeof(hdev->irk));
7054                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
7055                 hci_adv_instances_set_rpa_expired(hdev, false);
7056                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7057         }
7058
7059         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
7060         if (err < 0)
7061                 goto unlock;
7062
7063         if (changed)
7064                 err = new_settings(hdev, sk);
7065
7066 unlock:
7067         hci_dev_unlock(hdev);
7068         return err;
7069 }
7070
7071 static bool irk_is_valid(struct mgmt_irk_info *irk)
7072 {
7073         switch (irk->addr.type) {
7074         case BDADDR_LE_PUBLIC:
7075                 return true;
7076
7077         case BDADDR_LE_RANDOM:
7078                 /* Two most significant bits shall be set */
7079                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7080                         return false;
7081                 return true;
7082         }
7083
7084         return false;
7085 }
7086
7087 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7088                      u16 len)
7089 {
7090         struct mgmt_cp_load_irks *cp = cp_data;
7091         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
7092                                    sizeof(struct mgmt_irk_info));
7093         u16 irk_count, expected_len;
7094         int i, err;
7095
7096         bt_dev_dbg(hdev, "sock %p", sk);
7097
7098         if (!lmp_le_capable(hdev))
7099                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7100                                        MGMT_STATUS_NOT_SUPPORTED);
7101
7102         irk_count = __le16_to_cpu(cp->irk_count);
7103         if (irk_count > max_irk_count) {
7104                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
7105                            irk_count);
7106                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7107                                        MGMT_STATUS_INVALID_PARAMS);
7108         }
7109
7110         expected_len = struct_size(cp, irks, irk_count);
7111         if (expected_len != len) {
7112                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
7113                            expected_len, len);
7114                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7115                                        MGMT_STATUS_INVALID_PARAMS);
7116         }
7117
7118         bt_dev_dbg(hdev, "irk_count %u", irk_count);
7119
7120         for (i = 0; i < irk_count; i++) {
7121                 struct mgmt_irk_info *key = &cp->irks[i];
7122
7123                 if (!irk_is_valid(key))
7124                         return mgmt_cmd_status(sk, hdev->id,
7125                                                MGMT_OP_LOAD_IRKS,
7126                                                MGMT_STATUS_INVALID_PARAMS);
7127         }
7128
7129         hci_dev_lock(hdev);
7130
7131         hci_smp_irks_clear(hdev);
7132
7133         for (i = 0; i < irk_count; i++) {
7134                 struct mgmt_irk_info *irk = &cp->irks[i];
7135
7136                 if (hci_is_blocked_key(hdev,
7137                                        HCI_BLOCKED_KEY_TYPE_IRK,
7138                                        irk->val)) {
7139                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
7140                                     &irk->addr.bdaddr);
7141                         continue;
7142                 }
7143
7144                 hci_add_irk(hdev, &irk->addr.bdaddr,
7145                             le_addr_type(irk->addr.type), irk->val,
7146                             BDADDR_ANY);
7147         }
7148
7149         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7150
7151         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
7152
7153         hci_dev_unlock(hdev);
7154
7155         return err;
7156 }
7157
7158 #ifdef TIZEN_BT
7159 static int set_advertising_params(struct sock *sk, struct hci_dev *hdev,
7160                         void *data, u16 len)
7161 {
7162         struct mgmt_cp_set_advertising_params *cp = data;
7163         __u16 min_interval;
7164         __u16 max_interval;
7165         int err;
7166
7167         BT_DBG("%s", hdev->name);
7168
7169         if (!lmp_le_capable(hdev))
7170                 return mgmt_cmd_status(sk, hdev->id,
7171                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7172                                 MGMT_STATUS_NOT_SUPPORTED);
7173
7174         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7175                 return mgmt_cmd_status(sk, hdev->id,
7176                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7177                                 MGMT_STATUS_BUSY);
7178
7179         min_interval = __le16_to_cpu(cp->interval_min);
7180         max_interval = __le16_to_cpu(cp->interval_max);
7181
7182         if (min_interval > max_interval ||
7183             min_interval < 0x0020 || max_interval > 0x4000)
7184                 return mgmt_cmd_status(sk, hdev->id,
7185                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7186                                 MGMT_STATUS_INVALID_PARAMS);
7187
7188         hci_dev_lock(hdev);
7189
7190         hdev->le_adv_min_interval = min_interval;
7191         hdev->le_adv_max_interval = max_interval;
7192         hdev->adv_filter_policy = cp->filter_policy;
7193         hdev->adv_type = cp->type;
7194
7195         err = mgmt_cmd_complete(sk, hdev->id,
7196                         MGMT_OP_SET_ADVERTISING_PARAMS, 0, NULL, 0);
7197
7198         hci_dev_unlock(hdev);
7199
7200         return err;
7201 }
7202
7203 static void set_advertising_data_complete(struct hci_dev *hdev,
7204                         u8 status, u16 opcode)
7205 {
7206         struct mgmt_cp_set_advertising_data *cp;
7207         struct mgmt_pending_cmd *cmd;
7208
7209         BT_DBG("status 0x%02x", status);
7210
7211         hci_dev_lock(hdev);
7212
7213         cmd = pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev);
7214         if (!cmd)
7215                 goto unlock;
7216
7217         cp = cmd->param;
7218
7219         if (status)
7220                 mgmt_cmd_status(cmd->sk, hdev->id,
7221                                 MGMT_OP_SET_ADVERTISING_DATA,
7222                                 mgmt_status(status));
7223         else
7224                 mgmt_cmd_complete(cmd->sk, hdev->id,
7225                                 MGMT_OP_SET_ADVERTISING_DATA, 0,
7226                                 cp, sizeof(*cp));
7227
7228         mgmt_pending_remove(cmd);
7229
7230 unlock:
7231         hci_dev_unlock(hdev);
7232 }
7233
7234 static int set_advertising_data(struct sock *sk, struct hci_dev *hdev,
7235                         void *data, u16 len)
7236 {
7237         struct mgmt_pending_cmd *cmd;
7238         struct hci_request req;
7239         struct mgmt_cp_set_advertising_data *cp = data;
7240         struct hci_cp_le_set_adv_data adv;
7241         int err;
7242
7243         BT_DBG("%s", hdev->name);
7244
7245         if (!lmp_le_capable(hdev)) {
7246                 return mgmt_cmd_status(sk, hdev->id,
7247                                 MGMT_OP_SET_ADVERTISING_DATA,
7248                                 MGMT_STATUS_NOT_SUPPORTED);
7249         }
7250
7251         hci_dev_lock(hdev);
7252
7253         if (pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev)) {
7254                 err = mgmt_cmd_status(sk, hdev->id,
7255                                 MGMT_OP_SET_ADVERTISING_DATA,
7256                                 MGMT_STATUS_BUSY);
7257                 goto unlocked;
7258         }
7259
7260         if (len > HCI_MAX_AD_LENGTH) {
7261                 err = mgmt_cmd_status(sk, hdev->id,
7262                                 MGMT_OP_SET_ADVERTISING_DATA,
7263                                 MGMT_STATUS_INVALID_PARAMS);
7264                 goto unlocked;
7265         }
7266
7267         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING_DATA,
7268                                hdev, data, len);
7269         if (!cmd) {
7270                 err = -ENOMEM;
7271                 goto unlocked;
7272         }
7273
7274         hci_req_init(&req, hdev);
7275
7276         memset(&adv, 0, sizeof(adv));
7277         memcpy(adv.data, cp->data, len);
7278         adv.length = len;
7279
7280         hci_req_add(&req, HCI_OP_LE_SET_ADV_DATA, sizeof(adv), &adv);
7281
7282         err = hci_req_run(&req, set_advertising_data_complete);
7283         if (err < 0)
7284                 mgmt_pending_remove(cmd);
7285
7286 unlocked:
7287         hci_dev_unlock(hdev);
7288
7289         return err;
7290 }
7291
7292 /* Adv White List feature */
7293 static void add_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7294 {
7295         struct mgmt_cp_add_dev_white_list *cp;
7296         struct mgmt_pending_cmd *cmd;
7297
7298         BT_DBG("status 0x%02x", status);
7299
7300         hci_dev_lock(hdev);
7301
7302         cmd = pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev);
7303         if (!cmd)
7304                 goto unlock;
7305
7306         cp = cmd->param;
7307
7308         if (status)
7309                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7310                            mgmt_status(status));
7311         else
7312                 mgmt_cmd_complete(cmd->sk, hdev->id,
7313                                 MGMT_OP_ADD_DEV_WHITE_LIST, 0, cp, sizeof(*cp));
7314
7315         mgmt_pending_remove(cmd);
7316
7317 unlock:
7318         hci_dev_unlock(hdev);
7319 }
7320
7321 static int add_white_list(struct sock *sk, struct hci_dev *hdev,
7322                            void *data, u16 len)
7323 {
7324         struct mgmt_pending_cmd *cmd;
7325         struct mgmt_cp_add_dev_white_list *cp = data;
7326         struct hci_request req;
7327         int err;
7328
7329         BT_DBG("%s", hdev->name);
7330
7331         if (!lmp_le_capable(hdev))
7332                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7333                                   MGMT_STATUS_NOT_SUPPORTED);
7334
7335         if (!hdev_is_powered(hdev))
7336                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7337                                   MGMT_STATUS_REJECTED);
7338
7339         hci_dev_lock(hdev);
7340
7341         if (pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev)) {
7342                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7343                                 MGMT_STATUS_BUSY);
7344                 goto unlocked;
7345         }
7346
7347         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEV_WHITE_LIST, hdev, data, len);
7348         if (!cmd) {
7349                 err = -ENOMEM;
7350                 goto unlocked;
7351         }
7352
7353         hci_req_init(&req, hdev);
7354
7355         hci_req_add(&req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(*cp), cp);
7356
7357         err = hci_req_run(&req, add_white_list_complete);
7358         if (err < 0) {
7359                 mgmt_pending_remove(cmd);
7360                 goto unlocked;
7361         }
7362
7363 unlocked:
7364         hci_dev_unlock(hdev);
7365
7366         return err;
7367 }
7368
7369 static void remove_from_white_list_complete(struct hci_dev *hdev,
7370                         u8 status, u16 opcode)
7371 {
7372         struct mgmt_cp_remove_dev_from_white_list *cp;
7373         struct mgmt_pending_cmd *cmd;
7374
7375         BT_DBG("status 0x%02x", status);
7376
7377         hci_dev_lock(hdev);
7378
7379         cmd = pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev);
7380         if (!cmd)
7381                 goto unlock;
7382
7383         cp = cmd->param;
7384
7385         if (status)
7386                 mgmt_cmd_status(cmd->sk, hdev->id,
7387                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7388                         mgmt_status(status));
7389         else
7390                 mgmt_cmd_complete(cmd->sk, hdev->id,
7391                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, 0,
7392                         cp, sizeof(*cp));
7393
7394         mgmt_pending_remove(cmd);
7395
7396 unlock:
7397         hci_dev_unlock(hdev);
7398 }
7399
7400 static int remove_from_white_list(struct sock *sk, struct hci_dev *hdev,
7401                            void *data, u16 len)
7402 {
7403         struct mgmt_pending_cmd *cmd;
7404         struct mgmt_cp_remove_dev_from_white_list *cp = data;
7405         struct hci_request req;
7406         int err;
7407
7408         BT_DBG("%s", hdev->name);
7409
7410         if (!lmp_le_capable(hdev))
7411                 return mgmt_cmd_status(sk, hdev->id,
7412                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7413                                 MGMT_STATUS_NOT_SUPPORTED);
7414
7415         if (!hdev_is_powered(hdev))
7416                 return mgmt_cmd_status(sk, hdev->id,
7417                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7418                                 MGMT_STATUS_REJECTED);
7419
7420         hci_dev_lock(hdev);
7421
7422         if (pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev)) {
7423                 err = mgmt_cmd_status(sk, hdev->id,
7424                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7425                                 MGMT_STATUS_BUSY);
7426                 goto unlocked;
7427         }
7428
7429         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7430                                 hdev, data, len);
7431         if (!cmd) {
7432                 err = -ENOMEM;
7433                 goto unlocked;
7434         }
7435
7436         hci_req_init(&req, hdev);
7437
7438         hci_req_add(&req, HCI_OP_LE_DEL_FROM_WHITE_LIST, sizeof(*cp), cp);
7439
7440         err = hci_req_run(&req, remove_from_white_list_complete);
7441         if (err < 0) {
7442                 mgmt_pending_remove(cmd);
7443                 goto unlocked;
7444         }
7445
7446 unlocked:
7447         hci_dev_unlock(hdev);
7448
7449         return err;
7450 }
7451
7452 static void clear_white_list_complete(struct hci_dev *hdev, u8 status,
7453                         u16 opcode)
7454 {
7455         struct mgmt_pending_cmd *cmd;
7456
7457         BT_DBG("status 0x%02x", status);
7458
7459         hci_dev_lock(hdev);
7460
7461         cmd = pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev);
7462         if (!cmd)
7463                 goto unlock;
7464
7465         if (status)
7466                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
7467                            mgmt_status(status));
7468         else
7469                 mgmt_cmd_complete(cmd->sk, hdev->id,
7470                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7471                                 0, NULL, 0);
7472
7473         mgmt_pending_remove(cmd);
7474
7475 unlock:
7476         hci_dev_unlock(hdev);
7477 }
7478
7479 static int clear_white_list(struct sock *sk, struct hci_dev *hdev,
7480                            void *data, u16 len)
7481 {
7482         struct mgmt_pending_cmd *cmd;
7483         struct hci_request req;
7484         int err;
7485
7486         BT_DBG("%s", hdev->name);
7487
7488         if (!lmp_le_capable(hdev))
7489                 return mgmt_cmd_status(sk, hdev->id,
7490                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7491                                 MGMT_STATUS_NOT_SUPPORTED);
7492
7493         if (!hdev_is_powered(hdev))
7494                 return mgmt_cmd_status(sk, hdev->id,
7495                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7496                                 MGMT_STATUS_REJECTED);
7497
7498         hci_dev_lock(hdev);
7499
7500         if (pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev)) {
7501                 err = mgmt_cmd_status(sk, hdev->id,
7502                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7503                                 MGMT_STATUS_BUSY);
7504                 goto unlocked;
7505         }
7506
7507         cmd = mgmt_pending_add(sk, MGMT_OP_CLEAR_DEV_WHITE_LIST,
7508                                 hdev, NULL, 0);
7509         if (!cmd) {
7510                 err = -ENOMEM;
7511                 goto unlocked;
7512         }
7513
7514         hci_req_init(&req, hdev);
7515
7516         hci_req_add(&req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
7517
7518         err = hci_req_run(&req, clear_white_list_complete);
7519         if (err < 0) {
7520                 mgmt_pending_remove(cmd);
7521                 goto unlocked;
7522         }
7523
7524 unlocked:
7525         hci_dev_unlock(hdev);
7526
7527         return err;
7528 }
7529
7530 static void set_scan_rsp_data_complete(struct hci_dev *hdev, u8 status,
7531                         u16 opcode)
7532 {
7533         struct mgmt_cp_set_scan_rsp_data *cp;
7534         struct mgmt_pending_cmd *cmd;
7535
7536         BT_DBG("status 0x%02x", status);
7537
7538         hci_dev_lock(hdev);
7539
7540         cmd = pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev);
7541         if (!cmd)
7542                 goto unlock;
7543
7544         cp = cmd->param;
7545
7546         if (status)
7547                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7548                                 mgmt_status(status));
7549         else
7550                 mgmt_cmd_complete(cmd->sk, hdev->id,
7551                                 MGMT_OP_SET_SCAN_RSP_DATA, 0,
7552                                 cp, sizeof(*cp));
7553
7554         mgmt_pending_remove(cmd);
7555
7556 unlock:
7557         hci_dev_unlock(hdev);
7558 }
7559
7560 static int set_scan_rsp_data(struct sock *sk, struct hci_dev *hdev, void *data,
7561                         u16 len)
7562 {
7563         struct mgmt_pending_cmd *cmd;
7564         struct hci_request req;
7565         struct mgmt_cp_set_scan_rsp_data *cp = data;
7566         struct hci_cp_le_set_scan_rsp_data rsp;
7567         int err;
7568
7569         BT_DBG("%s", hdev->name);
7570
7571         if (!lmp_le_capable(hdev))
7572                 return mgmt_cmd_status(sk, hdev->id,
7573                                 MGMT_OP_SET_SCAN_RSP_DATA,
7574                                 MGMT_STATUS_NOT_SUPPORTED);
7575
7576         hci_dev_lock(hdev);
7577
7578         if (pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev)) {
7579                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7580                                 MGMT_STATUS_BUSY);
7581                 goto unlocked;
7582         }
7583
7584         if (len > HCI_MAX_AD_LENGTH) {
7585                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7586                                 MGMT_STATUS_INVALID_PARAMS);
7587                 goto unlocked;
7588         }
7589
7590         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SCAN_RSP_DATA, hdev, data, len);
7591         if (!cmd) {
7592                 err = -ENOMEM;
7593                 goto unlocked;
7594         }
7595
7596         hci_req_init(&req, hdev);
7597
7598         memset(&rsp, 0, sizeof(rsp));
7599         memcpy(rsp.data, cp->data, len);
7600         rsp.length = len;
7601
7602         hci_req_add(&req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(rsp), &rsp);
7603
7604         err = hci_req_run(&req, set_scan_rsp_data_complete);
7605         if (err < 0)
7606                 mgmt_pending_remove(cmd);
7607
7608 unlocked:
7609         hci_dev_unlock(hdev);
7610
7611         return err;
7612 }
7613
7614 static void set_rssi_threshold_complete(struct hci_dev *hdev,
7615                         u8 status, u16 opcode)
7616 {
7617         struct mgmt_pending_cmd *cmd;
7618
7619         BT_DBG("status 0x%02x", status);
7620
7621         hci_dev_lock(hdev);
7622
7623         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7624         if (!cmd)
7625                 goto unlock;
7626
7627         if (status)
7628                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7629                                 mgmt_status(status));
7630         else
7631                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
7632                                 NULL, 0);
7633
7634         mgmt_pending_remove(cmd);
7635
7636 unlock:
7637         hci_dev_unlock(hdev);
7638 }
7639
7640 static void set_rssi_disable_complete(struct hci_dev *hdev,
7641                         u8 status, u16 opcode)
7642 {
7643         struct mgmt_pending_cmd *cmd;
7644
7645         BT_DBG("status 0x%02x", status);
7646
7647         hci_dev_lock(hdev);
7648
7649         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7650         if (!cmd)
7651                 goto unlock;
7652
7653         if (status)
7654                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7655                                 mgmt_status(status));
7656         else
7657                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7658                                 0, NULL, 0);
7659
7660         mgmt_pending_remove(cmd);
7661
7662 unlock:
7663         hci_dev_unlock(hdev);
7664 }
7665
7666 int mgmt_set_rssi_threshold(struct sock *sk, struct hci_dev *hdev,
7667                 void *data, u16 len)
7668 {
7669         int err = 0;
7670         struct hci_cp_set_rssi_threshold th = { 0, };
7671         struct mgmt_cp_set_enable_rssi *cp = data;
7672         struct hci_conn *conn;
7673         struct mgmt_pending_cmd *cmd;
7674         struct hci_request req;
7675         __u8 dest_type;
7676
7677         hci_dev_lock(hdev);
7678
7679         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7680         if (!cmd) {
7681                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7682                                 MGMT_STATUS_FAILED);
7683                 goto unlocked;
7684         }
7685
7686         if (!lmp_le_capable(hdev)) {
7687                 mgmt_pending_remove(cmd);
7688                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7689                                 MGMT_STATUS_NOT_SUPPORTED);
7690                 goto unlocked;
7691         }
7692
7693         if (!hdev_is_powered(hdev)) {
7694                 BT_DBG("%s", hdev->name);
7695                 mgmt_pending_remove(cmd);
7696                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7697                                 MGMT_STATUS_NOT_POWERED);
7698                 goto unlocked;
7699         }
7700
7701         if (cp->link_type == 0x01)
7702                 dest_type = LE_LINK;
7703         else
7704                 dest_type = ACL_LINK;
7705
7706         /* Get LE/ACL link handle info */
7707         conn = hci_conn_hash_lookup_ba(hdev,
7708                         dest_type, &cp->bdaddr);
7709
7710         if (!conn) {
7711                 err = mgmt_cmd_complete(sk, hdev->id,
7712                                 MGMT_OP_SET_RSSI_ENABLE, 1, NULL, 0);
7713                 mgmt_pending_remove(cmd);
7714                 goto unlocked;
7715         }
7716
7717         hci_req_init(&req, hdev);
7718
7719         th.hci_le_ext_opcode = 0x0B;
7720         th.mode = 0x01;
7721         th.conn_handle = conn->handle;
7722         th.alert_mask = 0x07;
7723         th.low_th = cp->low_th;
7724         th.in_range_th = cp->in_range_th;
7725         th.high_th = cp->high_th;
7726
7727         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
7728         err = hci_req_run(&req, set_rssi_threshold_complete);
7729
7730         if (err < 0) {
7731                 mgmt_pending_remove(cmd);
7732                 BT_ERR("Error in requesting hci_req_run");
7733                 goto unlocked;
7734         }
7735
7736 unlocked:
7737         hci_dev_unlock(hdev);
7738         return err;
7739 }
7740
7741 void mgmt_rssi_enable_success(struct sock *sk, struct hci_dev *hdev,
7742                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
7743 {
7744         struct mgmt_cc_rsp_enable_rssi mgmt_rp = { 0, };
7745         struct mgmt_cp_set_enable_rssi *cp = data;
7746         struct mgmt_pending_cmd *cmd;
7747
7748         if (!cp || !rp)
7749                 goto remove_cmd;
7750
7751         mgmt_rp.status = rp->status;
7752         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
7753         mgmt_rp.bt_address = cp->bdaddr;
7754         mgmt_rp.link_type = cp->link_type;
7755
7756         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7757                         MGMT_STATUS_SUCCESS, &mgmt_rp,
7758                         sizeof(struct mgmt_cc_rsp_enable_rssi));
7759
7760         mgmt_event(MGMT_EV_RSSI_ENABLED, hdev, &mgmt_rp,
7761                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
7762
7763         hci_conn_rssi_unset_all(hdev, mgmt_rp.link_type);
7764         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
7765                         &mgmt_rp.bt_address, true);
7766
7767 remove_cmd:
7768         hci_dev_lock(hdev);
7769         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7770         if (cmd)
7771                 mgmt_pending_remove(cmd);
7772
7773         hci_dev_unlock(hdev);
7774 }
7775
7776 void mgmt_rssi_disable_success(struct sock *sk, struct hci_dev *hdev,
7777                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
7778 {
7779         struct mgmt_cc_rp_disable_rssi mgmt_rp = { 0, };
7780         struct mgmt_cp_disable_rssi *cp = data;
7781         struct mgmt_pending_cmd *cmd;
7782
7783         if (!cp || !rp)
7784                 goto remove_cmd;
7785
7786         mgmt_rp.status = rp->status;
7787         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
7788         mgmt_rp.bt_address = cp->bdaddr;
7789         mgmt_rp.link_type = cp->link_type;
7790
7791         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7792                         MGMT_STATUS_SUCCESS, &mgmt_rp,
7793                         sizeof(struct mgmt_cc_rsp_enable_rssi));
7794
7795         mgmt_event(MGMT_EV_RSSI_DISABLED, hdev, &mgmt_rp,
7796                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
7797
7798         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
7799                         &mgmt_rp.bt_address, false);
7800
7801 remove_cmd:
7802         hci_dev_lock(hdev);
7803         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7804         if (cmd)
7805                 mgmt_pending_remove(cmd);
7806
7807         hci_dev_unlock(hdev);
7808 }
7809
7810 static int mgmt_set_disable_rssi(struct sock *sk, struct hci_dev *hdev,
7811                 void *data, u16 len)
7812 {
7813         struct mgmt_pending_cmd *cmd;
7814         struct hci_request req;
7815         struct hci_cp_set_enable_rssi cp_en = { 0, };
7816         int err;
7817
7818         BT_DBG("Set Disable RSSI.");
7819
7820         cp_en.hci_le_ext_opcode = 0x01;
7821         cp_en.le_enable_cs_Features = 0x00;
7822         cp_en.data[0] = 0x00;
7823         cp_en.data[1] = 0x00;
7824         cp_en.data[2] = 0x00;
7825
7826         hci_dev_lock(hdev);
7827
7828         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7829         if (!cmd) {
7830                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7831                                 MGMT_STATUS_FAILED);
7832                 goto unlocked;
7833         }
7834
7835         if (!lmp_le_capable(hdev)) {
7836                 mgmt_pending_remove(cmd);
7837                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7838                                 MGMT_STATUS_NOT_SUPPORTED);
7839                 goto unlocked;
7840         }
7841
7842         if (!hdev_is_powered(hdev)) {
7843                 BT_DBG("%s", hdev->name);
7844                 mgmt_pending_remove(cmd);
7845                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7846                                 MGMT_STATUS_NOT_POWERED);
7847                 goto unlocked;
7848         }
7849
7850         hci_req_init(&req, hdev);
7851
7852         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
7853                         sizeof(struct hci_cp_set_enable_rssi),
7854                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
7855                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
7856
7857         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
7858         err = hci_req_run(&req, set_rssi_disable_complete);
7859
7860         if (err < 0) {
7861                 mgmt_pending_remove(cmd);
7862                 BT_ERR("Error in requesting hci_req_run");
7863                 goto unlocked;
7864         }
7865
7866 unlocked:
7867         hci_dev_unlock(hdev);
7868         return err;
7869 }
7870
7871 void mgmt_enable_rssi_cc(struct hci_dev *hdev, void *response, u8 status)
7872 {
7873         struct hci_cc_rsp_enable_rssi *rp = response;
7874         struct mgmt_pending_cmd *cmd_enable = NULL;
7875         struct mgmt_pending_cmd *cmd_disable = NULL;
7876         struct mgmt_cp_set_enable_rssi *cp_en;
7877         struct mgmt_cp_disable_rssi *cp_dis;
7878
7879         hci_dev_lock(hdev);
7880         cmd_enable = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7881         cmd_disable = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7882         hci_dev_unlock(hdev);
7883
7884         if (cmd_enable)
7885                 BT_DBG("Enable Request");
7886
7887         if (cmd_disable)
7888                 BT_DBG("Disable Request");
7889
7890         if (cmd_enable) {
7891                 cp_en = cmd_enable->param;
7892
7893                 if (status != 0x00)
7894                         return;
7895
7896                 switch (rp->le_ext_opcode) {
7897                 case 0x01:
7898                         BT_DBG("RSSI enabled.. Setting Threshold...");
7899                         mgmt_set_rssi_threshold(cmd_enable->sk, hdev,
7900                                         cp_en, sizeof(*cp_en));
7901                         break;
7902
7903                 case 0x0B:
7904                         BT_DBG("Sending RSSI enable success");
7905                         mgmt_rssi_enable_success(cmd_enable->sk, hdev,
7906                                         cp_en, rp, rp->status);
7907                         break;
7908                 }
7909
7910         } else if (cmd_disable) {
7911                 cp_dis = cmd_disable->param;
7912
7913                 if (status != 0x00)
7914                         return;
7915
7916                 switch (rp->le_ext_opcode) {
7917                 case 0x01:
7918                         BT_DBG("Sending RSSI disable success");
7919                         mgmt_rssi_disable_success(cmd_disable->sk, hdev,
7920                                         cp_dis, rp, rp->status);
7921                         break;
7922
7923                 case 0x0B:
7924                         /*
7925                          * Only unset RSSI Threshold values for the Link if
7926                          * RSSI is monitored for other BREDR or LE Links
7927                          */
7928                         if (hci_conn_hash_lookup_rssi_count(hdev) > 1) {
7929                                 BT_DBG("Unset Threshold. Other links being monitored");
7930                                 mgmt_rssi_disable_success(cmd_disable->sk, hdev,
7931                                                 cp_dis, rp, rp->status);
7932                         } else {
7933                                 BT_DBG("Unset Threshold. Disabling...");
7934                                 mgmt_set_disable_rssi(cmd_disable->sk, hdev,
7935                                                 cp_dis, sizeof(*cp_dis));
7936                         }
7937                         break;
7938                 }
7939         }
7940 }
7941
7942 static void set_rssi_enable_complete(struct hci_dev *hdev, u8 status,
7943                 u16 opcode)
7944 {
7945         struct mgmt_pending_cmd *cmd;
7946
7947         BT_DBG("status 0x%02x", status);
7948
7949         hci_dev_lock(hdev);
7950
7951         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7952         if (!cmd)
7953                 goto unlock;
7954
7955         if (status)
7956                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7957                                 mgmt_status(status));
7958         else
7959                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
7960                                 NULL, 0);
7961
7962         mgmt_pending_remove(cmd);
7963
7964 unlock:
7965         hci_dev_unlock(hdev);
7966 }
7967
7968 static int set_enable_rssi(struct sock *sk, struct hci_dev *hdev,
7969                 void *data, u16 len)
7970 {
7971         struct mgmt_pending_cmd *cmd;
7972         struct hci_request req;
7973         struct mgmt_cp_set_enable_rssi *cp = data;
7974         struct hci_cp_set_enable_rssi cp_en = { 0, };
7975         int err;
7976
7977         BT_DBG("Set Enable RSSI.");
7978
7979         cp_en.hci_le_ext_opcode = 0x01;
7980         cp_en.le_enable_cs_Features = 0x04;
7981         cp_en.data[0] = 0x00;
7982         cp_en.data[1] = 0x00;
7983         cp_en.data[2] = 0x00;
7984
7985         hci_dev_lock(hdev);
7986
7987         if (!lmp_le_capable(hdev)) {
7988                 err =  mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7989                                 MGMT_STATUS_NOT_SUPPORTED);
7990                 goto unlocked;
7991         }
7992
7993         if (!hdev_is_powered(hdev)) {
7994                 BT_DBG("%s", hdev->name);
7995                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7996                                 MGMT_STATUS_NOT_POWERED);
7997                 goto unlocked;
7998         }
7999
8000         if (pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev)) {
8001                 BT_DBG("%s", hdev->name);
8002                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
8003                                 MGMT_STATUS_BUSY);
8004                 goto unlocked;
8005         }
8006
8007         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_ENABLE, hdev, cp,
8008                         sizeof(*cp));
8009         if (!cmd) {
8010                 BT_DBG("%s", hdev->name);
8011                 err = -ENOMEM;
8012                 goto unlocked;
8013         }
8014
8015         /* If RSSI is already enabled directly set Threshold values */
8016         if (hci_conn_hash_lookup_rssi_count(hdev) > 0) {
8017                 hci_dev_unlock(hdev);
8018                 BT_DBG("RSSI Enabled. Directly set Threshold");
8019                 err = mgmt_set_rssi_threshold(sk, hdev, cp, sizeof(*cp));
8020                 return err;
8021         }
8022
8023         hci_req_init(&req, hdev);
8024
8025         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
8026                         sizeof(struct hci_cp_set_enable_rssi),
8027                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
8028                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
8029
8030         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
8031         err = hci_req_run(&req, set_rssi_enable_complete);
8032
8033         if (err < 0) {
8034                 mgmt_pending_remove(cmd);
8035                 BT_ERR("Error in requesting hci_req_run");
8036                 goto unlocked;
8037         }
8038
8039 unlocked:
8040         hci_dev_unlock(hdev);
8041
8042         return err;
8043 }
8044
8045 static void get_raw_rssi_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8046 {
8047         struct mgmt_pending_cmd *cmd;
8048
8049         BT_DBG("status 0x%02x", status);
8050
8051         hci_dev_lock(hdev);
8052
8053         cmd = pending_find(MGMT_OP_GET_RAW_RSSI, hdev);
8054         if (!cmd)
8055                 goto unlock;
8056
8057         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8058                         MGMT_STATUS_SUCCESS, &status, 1);
8059
8060         mgmt_pending_remove(cmd);
8061
8062 unlock:
8063         hci_dev_unlock(hdev);
8064 }
8065
8066 static int get_raw_rssi(struct sock *sk, struct hci_dev *hdev, void *data,
8067                         u16 len)
8068 {
8069         struct mgmt_pending_cmd *cmd;
8070         struct hci_request req;
8071         struct mgmt_cp_get_raw_rssi *cp = data;
8072         struct hci_cp_get_raw_rssi hci_cp;
8073
8074         struct hci_conn *conn;
8075         int err;
8076         __u8 dest_type;
8077
8078         BT_DBG("Get Raw RSSI.");
8079
8080         hci_dev_lock(hdev);
8081
8082         if (!lmp_le_capable(hdev)) {
8083                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8084                                 MGMT_STATUS_NOT_SUPPORTED);
8085                 goto unlocked;
8086         }
8087
8088         if (cp->link_type == 0x01)
8089                 dest_type = LE_LINK;
8090         else
8091                 dest_type = ACL_LINK;
8092
8093         /* Get LE/BREDR link handle info */
8094         conn = hci_conn_hash_lookup_ba(hdev,
8095                         dest_type, &cp->bt_address);
8096         if (!conn) {
8097                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8098                                                    MGMT_STATUS_NOT_CONNECTED);
8099                 goto unlocked;
8100         }
8101         hci_cp.conn_handle = conn->handle;
8102
8103         if (!hdev_is_powered(hdev)) {
8104                 BT_DBG("%s", hdev->name);
8105                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8106                                 MGMT_STATUS_NOT_POWERED);
8107                 goto unlocked;
8108         }
8109
8110         if (pending_find(MGMT_OP_GET_RAW_RSSI, hdev)) {
8111                 BT_DBG("%s", hdev->name);
8112                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8113                                 MGMT_STATUS_BUSY);
8114                 goto unlocked;
8115         }
8116
8117         cmd = mgmt_pending_add(sk, MGMT_OP_GET_RAW_RSSI, hdev, data, len);
8118         if (!cmd) {
8119                 BT_DBG("%s", hdev->name);
8120                 err = -ENOMEM;
8121                 goto unlocked;
8122         }
8123
8124         hci_req_init(&req, hdev);
8125
8126         BT_DBG("Connection Handle [%d]", hci_cp.conn_handle);
8127         hci_req_add(&req, HCI_OP_GET_RAW_RSSI, sizeof(hci_cp), &hci_cp);
8128         err = hci_req_run(&req, get_raw_rssi_complete);
8129
8130         if (err < 0) {
8131                 mgmt_pending_remove(cmd);
8132                 BT_ERR("Error in requesting hci_req_run");
8133         }
8134
8135 unlocked:
8136         hci_dev_unlock(hdev);
8137
8138         return err;
8139 }
8140
8141 void mgmt_raw_rssi_response(struct hci_dev *hdev,
8142                 struct hci_cc_rp_get_raw_rssi *rp, int success)
8143 {
8144         struct mgmt_cc_rp_get_raw_rssi mgmt_rp = { 0, };
8145         struct hci_conn *conn;
8146
8147         mgmt_rp.status = rp->status;
8148         mgmt_rp.rssi_dbm = rp->rssi_dbm;
8149
8150         conn = hci_conn_hash_lookup_handle(hdev, rp->conn_handle);
8151         if (!conn)
8152                 return;
8153
8154         bacpy(&mgmt_rp.bt_address, &conn->dst);
8155         if (conn->type == LE_LINK)
8156                 mgmt_rp.link_type = 0x01;
8157         else
8158                 mgmt_rp.link_type = 0x00;
8159
8160         mgmt_event(MGMT_EV_RAW_RSSI, hdev, &mgmt_rp,
8161                         sizeof(struct mgmt_cc_rp_get_raw_rssi), NULL);
8162 }
8163
8164 static void set_disable_threshold_complete(struct hci_dev *hdev,
8165                         u8 status, u16 opcode)
8166 {
8167         struct mgmt_pending_cmd *cmd;
8168
8169         BT_DBG("status 0x%02x", status);
8170
8171         hci_dev_lock(hdev);
8172
8173         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
8174         if (!cmd)
8175                 goto unlock;
8176
8177         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8178                         MGMT_STATUS_SUCCESS, &status, 1);
8179
8180         mgmt_pending_remove(cmd);
8181
8182 unlock:
8183         hci_dev_unlock(hdev);
8184 }
8185
8186 /** Removes monitoring for a link*/
8187 static int set_disable_threshold(struct sock *sk, struct hci_dev *hdev,
8188                 void *data, u16 len)
8189 {
8190         int err = 0;
8191         struct hci_cp_set_rssi_threshold th = { 0, };
8192         struct mgmt_cp_disable_rssi *cp = data;
8193         struct hci_conn *conn;
8194         struct mgmt_pending_cmd *cmd;
8195         struct hci_request req;
8196         __u8 dest_type;
8197
8198         BT_DBG("Set Disable RSSI.");
8199
8200         hci_dev_lock(hdev);
8201
8202         if (!lmp_le_capable(hdev)) {
8203                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8204                                 MGMT_STATUS_NOT_SUPPORTED);
8205                 goto unlocked;
8206         }
8207
8208         /* Get LE/ACL link handle info*/
8209         if (cp->link_type == 0x01)
8210                 dest_type = LE_LINK;
8211         else
8212                 dest_type = ACL_LINK;
8213
8214         conn = hci_conn_hash_lookup_ba(hdev, dest_type, &cp->bdaddr);
8215         if (!conn) {
8216                 err = mgmt_cmd_complete(sk, hdev->id,
8217                                 MGMT_OP_SET_RSSI_DISABLE, 1, NULL, 0);
8218                 goto unlocked;
8219         }
8220
8221         th.hci_le_ext_opcode = 0x0B;
8222         th.mode = 0x01;
8223         th.conn_handle = conn->handle;
8224         th.alert_mask = 0x00;
8225         th.low_th = 0x00;
8226         th.in_range_th = 0x00;
8227         th.high_th = 0x00;
8228
8229         if (!hdev_is_powered(hdev)) {
8230                 BT_DBG("%s", hdev->name);
8231                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8232                                 0, data, len);
8233                 goto unlocked;
8234         }
8235
8236         if (pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev)) {
8237                 BT_DBG("%s", hdev->name);
8238                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8239                                 MGMT_STATUS_BUSY);
8240                 goto unlocked;
8241         }
8242
8243         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_DISABLE, hdev, cp,
8244                         sizeof(*cp));
8245         if (!cmd) {
8246                 BT_DBG("%s", hdev->name);
8247                 err = -ENOMEM;
8248                 goto unlocked;
8249         }
8250
8251         hci_req_init(&req, hdev);
8252
8253         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
8254         err = hci_req_run(&req, set_disable_threshold_complete);
8255         if (err < 0) {
8256                 mgmt_pending_remove(cmd);
8257                 BT_ERR("Error in requesting hci_req_run");
8258                 goto unlocked;
8259         }
8260
8261 unlocked:
8262         hci_dev_unlock(hdev);
8263
8264         return err;
8265 }
8266
8267 void mgmt_rssi_alert_evt(struct hci_dev *hdev, struct sk_buff *skb)
8268 {
8269         struct hci_ev_vendor_specific_rssi_alert *ev = (void *)skb->data;
8270         struct mgmt_ev_vendor_specific_rssi_alert mgmt_ev;
8271         struct hci_conn *conn;
8272
8273         BT_DBG("RSSI alert [%2.2X %2.2X %2.2X]",
8274                         ev->conn_handle, ev->alert_type, ev->rssi_dbm);
8275
8276         conn = hci_conn_hash_lookup_handle(hdev, ev->conn_handle);
8277
8278         if (!conn) {
8279                 BT_ERR("RSSI alert Error: Device not found for handle");
8280                 return;
8281         }
8282         bacpy(&mgmt_ev.bdaddr, &conn->dst);
8283
8284         if (conn->type == LE_LINK)
8285                 mgmt_ev.link_type = 0x01;
8286         else
8287                 mgmt_ev.link_type = 0x00;
8288
8289         mgmt_ev.alert_type = ev->alert_type;
8290         mgmt_ev.rssi_dbm = ev->rssi_dbm;
8291
8292         mgmt_event(MGMT_EV_RSSI_ALERT, hdev, &mgmt_ev,
8293                         sizeof(struct mgmt_ev_vendor_specific_rssi_alert),
8294                         NULL);
8295 }
8296
8297 static int mgmt_start_le_discovery_failed(struct hci_dev *hdev, u8 status)
8298 {
8299         struct mgmt_pending_cmd *cmd;
8300         u8 type;
8301         int err;
8302
8303         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
8304
8305         cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
8306         if (!cmd)
8307                 return -ENOENT;
8308
8309         type = hdev->le_discovery.type;
8310
8311         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
8312                                 mgmt_status(status), &type, sizeof(type));
8313         mgmt_pending_remove(cmd);
8314
8315         return err;
8316 }
8317
8318 static void start_le_discovery_complete(struct hci_dev *hdev, u8 status,
8319                 u16 opcode)
8320 {
8321         unsigned long timeout = 0;
8322
8323         BT_DBG("status %d", status);
8324
8325         if (status) {
8326                 hci_dev_lock(hdev);
8327                 mgmt_start_le_discovery_failed(hdev, status);
8328                 hci_dev_unlock(hdev);
8329                 return;
8330         }
8331
8332         hci_dev_lock(hdev);
8333         hci_le_discovery_set_state(hdev, DISCOVERY_FINDING);
8334         hci_dev_unlock(hdev);
8335
8336         if (hdev->le_discovery.type != DISCOV_TYPE_LE)
8337                 BT_ERR("Invalid discovery type %d", hdev->le_discovery.type);
8338
8339         if (!timeout)
8340                 return;
8341
8342         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
8343 }
8344
8345 static int start_le_discovery(struct sock *sk, struct hci_dev *hdev,
8346                 void *data, u16 len)
8347 {
8348         struct mgmt_cp_start_le_discovery *cp = data;
8349         struct mgmt_pending_cmd *cmd;
8350         struct hci_cp_le_set_scan_param param_cp;
8351         struct hci_cp_le_set_scan_enable enable_cp;
8352         struct hci_request req;
8353         u8 status, own_addr_type;
8354         int err;
8355
8356         BT_DBG("%s", hdev->name);
8357
8358         if (!hdev_is_powered(hdev)) {
8359                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8360                                 MGMT_STATUS_NOT_POWERED);
8361                 goto unlock;
8362         }
8363
8364         if (hdev->le_discovery.state != DISCOVERY_STOPPED) {
8365                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8366                                 MGMT_STATUS_BUSY);
8367                 goto unlock;
8368         }
8369
8370         if (cp->type != DISCOV_TYPE_LE) {
8371                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8372                                 MGMT_STATUS_INVALID_PARAMS);
8373                 goto unlock;
8374         }
8375
8376         cmd = mgmt_pending_add(sk, MGMT_OP_START_LE_DISCOVERY, hdev, NULL, 0);
8377         if (!cmd) {
8378                 err = -ENOMEM;
8379                 goto unlock;
8380         }
8381
8382         hdev->le_discovery.type = cp->type;
8383
8384         hci_req_init(&req, hdev);
8385
8386         status = mgmt_le_support(hdev);
8387         if (status) {
8388                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8389                                 status);
8390                 mgmt_pending_remove(cmd);
8391                 goto unlock;
8392         }
8393
8394         /* If controller is scanning, it means the background scanning
8395          * is running. Thus, we should temporarily stop it in order to
8396          * set the discovery scanning parameters.
8397          */
8398         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
8399                 hci_req_add_le_scan_disable(&req, false);
8400
8401         memset(&param_cp, 0, sizeof(param_cp));
8402
8403         /* All active scans will be done with either a resolvable
8404          * private address (when privacy feature has been enabled)
8405          * or unresolvable private address.
8406          */
8407         err = hci_update_random_address_sync(hdev, true, hci_dev_test_flag(hdev, HCI_PRIVACY), &own_addr_type);
8408         if (err < 0) {
8409                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8410                                 MGMT_STATUS_FAILED);
8411                 mgmt_pending_remove(cmd);
8412                 goto unlock;
8413         }
8414
8415         param_cp.type = hdev->le_scan_type;
8416         param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
8417         param_cp.window = cpu_to_le16(hdev->le_scan_window);
8418         param_cp.own_address_type = own_addr_type;
8419         hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
8420                     &param_cp);
8421
8422         memset(&enable_cp, 0, sizeof(enable_cp));
8423         enable_cp.enable = LE_SCAN_ENABLE;
8424         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
8425
8426         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
8427                     &enable_cp);
8428
8429         err = hci_req_run(&req, start_le_discovery_complete);
8430         if (err < 0)
8431                 mgmt_pending_remove(cmd);
8432         else
8433                 hci_le_discovery_set_state(hdev, DISCOVERY_STARTING);
8434
8435 unlock:
8436         return err;
8437 }
8438
8439 static int mgmt_stop_le_discovery_failed(struct hci_dev *hdev, u8 status)
8440 {
8441         struct mgmt_pending_cmd *cmd;
8442         int err;
8443
8444         cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
8445         if (!cmd)
8446                 return -ENOENT;
8447
8448         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
8449                                 mgmt_status(status), &hdev->le_discovery.type,
8450                                 sizeof(hdev->le_discovery.type));
8451         mgmt_pending_remove(cmd);
8452
8453         return err;
8454 }
8455
8456 static void stop_le_discovery_complete(struct hci_dev *hdev, u8 status,
8457                 u16 opcode)
8458 {
8459         BT_DBG("status %d", status);
8460
8461         hci_dev_lock(hdev);
8462
8463         if (status) {
8464                 mgmt_stop_le_discovery_failed(hdev, status);
8465                 goto unlock;
8466         }
8467
8468         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
8469
8470 unlock:
8471         hci_dev_unlock(hdev);
8472 }
8473
8474 static int stop_le_discovery(struct sock *sk, struct hci_dev *hdev,
8475                 void *data, u16 len)
8476 {
8477         struct mgmt_cp_stop_le_discovery *mgmt_cp = data;
8478         struct mgmt_pending_cmd *cmd;
8479         struct hci_request req;
8480         int err;
8481
8482         BT_DBG("%s", hdev->name);
8483
8484         hci_dev_lock(hdev);
8485
8486         if (!hci_le_discovery_active(hdev)) {
8487                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
8488                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
8489                                         sizeof(mgmt_cp->type));
8490                 goto unlock;
8491         }
8492
8493         if (hdev->le_discovery.type != mgmt_cp->type) {
8494                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
8495                                         MGMT_STATUS_INVALID_PARAMS,
8496                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
8497                 goto unlock;
8498         }
8499
8500         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_LE_DISCOVERY, hdev, NULL, 0);
8501         if (!cmd) {
8502                 err = -ENOMEM;
8503                 goto unlock;
8504         }
8505
8506         hci_req_init(&req, hdev);
8507
8508         if (hdev->le_discovery.state  != DISCOVERY_FINDING) {
8509                 BT_DBG("unknown le discovery state %u",
8510                                         hdev->le_discovery.state);
8511
8512                 mgmt_pending_remove(cmd);
8513                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
8514                                         MGMT_STATUS_FAILED, &mgmt_cp->type,
8515                                         sizeof(mgmt_cp->type));
8516                 goto unlock;
8517         }
8518
8519         cancel_delayed_work(&hdev->le_scan_disable);
8520         hci_req_add_le_scan_disable(&req, false);
8521
8522         err = hci_req_run(&req, stop_le_discovery_complete);
8523         if (err < 0)
8524                 mgmt_pending_remove(cmd);
8525         else
8526                 hci_le_discovery_set_state(hdev, DISCOVERY_STOPPING);
8527
8528 unlock:
8529         hci_dev_unlock(hdev);
8530         return err;
8531 }
8532
8533 /* Separate LE discovery */
8534 void mgmt_le_discovering(struct hci_dev *hdev, u8 discovering)
8535 {
8536         struct mgmt_ev_discovering ev;
8537         struct mgmt_pending_cmd *cmd;
8538
8539         BT_DBG("%s le discovering %u", hdev->name, discovering);
8540
8541         if (discovering)
8542                 cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
8543         else
8544                 cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
8545
8546         if (cmd) {
8547                 u8 type = hdev->le_discovery.type;
8548
8549                 mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
8550                                   sizeof(type));
8551                 mgmt_pending_remove(cmd);
8552         }
8553
8554         memset(&ev, 0, sizeof(ev));
8555         ev.type = hdev->le_discovery.type;
8556         ev.discovering = discovering;
8557
8558         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
8559 }
8560
8561 static int disable_le_auto_connect(struct sock *sk, struct hci_dev *hdev,
8562                         void *data, u16 len)
8563 {
8564         int err;
8565
8566         BT_DBG("%s", hdev->name);
8567
8568         hci_dev_lock(hdev);
8569
8570         err = hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
8571         if (err < 0)
8572                 BT_ERR("HCI_OP_LE_CREATE_CONN_CANCEL is failed");
8573
8574         hci_dev_unlock(hdev);
8575
8576         return err;
8577 }
8578
8579 static inline int check_le_conn_update_param(u16 min, u16 max, u16 latency,
8580                 u16 to_multiplier)
8581 {
8582         u16 max_latency;
8583
8584         if (min > max || min < 6 || max > 3200)
8585                 return -EINVAL;
8586
8587         if (to_multiplier < 10 || to_multiplier > 3200)
8588                 return -EINVAL;
8589
8590         if (max >= to_multiplier * 8)
8591                 return -EINVAL;
8592
8593         max_latency = (to_multiplier * 8 / max) - 1;
8594
8595         if (latency > 499 || latency > max_latency)
8596                 return -EINVAL;
8597
8598         return 0;
8599 }
8600
8601 static int le_conn_update(struct sock *sk, struct hci_dev *hdev, void *data,
8602                 u16 len)
8603 {
8604         struct mgmt_cp_le_conn_update *cp = data;
8605
8606         struct hci_conn *conn;
8607         u16 min, max, latency, supervision_timeout;
8608         int err = -1;
8609
8610         if (!hdev_is_powered(hdev))
8611                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
8612                                 MGMT_STATUS_NOT_POWERED);
8613
8614         min = __le16_to_cpu(cp->conn_interval_min);
8615         max = __le16_to_cpu(cp->conn_interval_max);
8616         latency = __le16_to_cpu(cp->conn_latency);
8617         supervision_timeout = __le16_to_cpu(cp->supervision_timeout);
8618
8619         BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x supervision_timeout: 0x%4.4x",
8620                         min, max, latency, supervision_timeout);
8621
8622         err = check_le_conn_update_param(min, max, latency,
8623                         supervision_timeout);
8624
8625         if (err < 0)
8626                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
8627                                 MGMT_STATUS_INVALID_PARAMS);
8628
8629         hci_dev_lock(hdev);
8630
8631         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
8632         if (!conn) {
8633                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
8634                                 MGMT_STATUS_NOT_CONNECTED);
8635                 hci_dev_unlock(hdev);
8636                 return err;
8637         }
8638
8639         hci_dev_unlock(hdev);
8640
8641         hci_le_conn_update(conn, min, max, latency, supervision_timeout);
8642
8643         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE, 0,
8644                                  NULL, 0);
8645 }
8646 #endif /* TIZEN_BT */
8647
8648 static bool ltk_is_valid(struct mgmt_ltk_info *key)
8649 {
8650         if (key->initiator != 0x00 && key->initiator != 0x01)
8651                 return false;
8652
8653         switch (key->addr.type) {
8654         case BDADDR_LE_PUBLIC:
8655                 return true;
8656
8657         case BDADDR_LE_RANDOM:
8658                 /* Two most significant bits shall be set */
8659                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
8660                         return false;
8661                 return true;
8662         }
8663
8664         return false;
8665 }
8666
8667 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
8668                                void *cp_data, u16 len)
8669 {
8670         struct mgmt_cp_load_long_term_keys *cp = cp_data;
8671         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
8672                                    sizeof(struct mgmt_ltk_info));
8673         u16 key_count, expected_len;
8674         int i, err;
8675
8676         bt_dev_dbg(hdev, "sock %p", sk);
8677
8678         if (!lmp_le_capable(hdev))
8679                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8680                                        MGMT_STATUS_NOT_SUPPORTED);
8681
8682         key_count = __le16_to_cpu(cp->key_count);
8683         if (key_count > max_key_count) {
8684                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
8685                            key_count);
8686                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8687                                        MGMT_STATUS_INVALID_PARAMS);
8688         }
8689
8690         expected_len = struct_size(cp, keys, key_count);
8691         if (expected_len != len) {
8692                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
8693                            expected_len, len);
8694                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8695                                        MGMT_STATUS_INVALID_PARAMS);
8696         }
8697
8698         bt_dev_dbg(hdev, "key_count %u", key_count);
8699
8700         for (i = 0; i < key_count; i++) {
8701                 struct mgmt_ltk_info *key = &cp->keys[i];
8702
8703                 if (!ltk_is_valid(key))
8704                         return mgmt_cmd_status(sk, hdev->id,
8705                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
8706                                                MGMT_STATUS_INVALID_PARAMS);
8707         }
8708
8709         hci_dev_lock(hdev);
8710
8711         hci_smp_ltks_clear(hdev);
8712
8713         for (i = 0; i < key_count; i++) {
8714                 struct mgmt_ltk_info *key = &cp->keys[i];
8715                 u8 type, authenticated;
8716
8717                 if (hci_is_blocked_key(hdev,
8718                                        HCI_BLOCKED_KEY_TYPE_LTK,
8719                                        key->val)) {
8720                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
8721                                     &key->addr.bdaddr);
8722                         continue;
8723                 }
8724
8725                 switch (key->type) {
8726                 case MGMT_LTK_UNAUTHENTICATED:
8727                         authenticated = 0x00;
8728                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
8729                         break;
8730                 case MGMT_LTK_AUTHENTICATED:
8731                         authenticated = 0x01;
8732                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
8733                         break;
8734                 case MGMT_LTK_P256_UNAUTH:
8735                         authenticated = 0x00;
8736                         type = SMP_LTK_P256;
8737                         break;
8738                 case MGMT_LTK_P256_AUTH:
8739                         authenticated = 0x01;
8740                         type = SMP_LTK_P256;
8741                         break;
8742                 case MGMT_LTK_P256_DEBUG:
8743                         authenticated = 0x00;
8744                         type = SMP_LTK_P256_DEBUG;
8745                         fallthrough;
8746                 default:
8747                         continue;
8748                 }
8749
8750                 hci_add_ltk(hdev, &key->addr.bdaddr,
8751                             le_addr_type(key->addr.type), type, authenticated,
8752                             key->val, key->enc_size, key->ediv, key->rand);
8753         }
8754
8755         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
8756                            NULL, 0);
8757
8758         hci_dev_unlock(hdev);
8759
8760         return err;
8761 }
8762
8763 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err)
8764 {
8765         struct mgmt_pending_cmd *cmd = data;
8766         struct hci_conn *conn = cmd->user_data;
8767         struct mgmt_cp_get_conn_info *cp = cmd->param;
8768         struct mgmt_rp_get_conn_info rp;
8769         u8 status;
8770
8771         bt_dev_dbg(hdev, "err %d", err);
8772
8773         memcpy(&rp.addr, &cp->addr.bdaddr, sizeof(rp.addr));
8774
8775         status = mgmt_status(err);
8776         if (status == MGMT_STATUS_SUCCESS) {
8777                 rp.rssi = conn->rssi;
8778                 rp.tx_power = conn->tx_power;
8779                 rp.max_tx_power = conn->max_tx_power;
8780         } else {
8781                 rp.rssi = HCI_RSSI_INVALID;
8782                 rp.tx_power = HCI_TX_POWER_INVALID;
8783                 rp.max_tx_power = HCI_TX_POWER_INVALID;
8784         }
8785
8786         mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
8787                           &rp, sizeof(rp));
8788
8789         mgmt_pending_free(cmd);
8790 }
8791
8792 static int get_conn_info_sync(struct hci_dev *hdev, void *data)
8793 {
8794         struct mgmt_pending_cmd *cmd = data;
8795         struct mgmt_cp_get_conn_info *cp = cmd->param;
8796         struct hci_conn *conn;
8797         int err;
8798         __le16   handle;
8799
8800         /* Make sure we are still connected */
8801         if (cp->addr.type == BDADDR_BREDR)
8802                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8803                                                &cp->addr.bdaddr);
8804         else
8805                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
8806
8807         if (!conn || conn->state != BT_CONNECTED)
8808                 return MGMT_STATUS_NOT_CONNECTED;
8809
8810         cmd->user_data = conn;
8811         handle = cpu_to_le16(conn->handle);
8812
8813         /* Refresh RSSI each time */
8814         err = hci_read_rssi_sync(hdev, handle);
8815
8816         /* For LE links TX power does not change thus we don't need to
8817          * query for it once value is known.
8818          */
8819         if (!err && (!bdaddr_type_is_le(cp->addr.type) ||
8820                      conn->tx_power == HCI_TX_POWER_INVALID))
8821                 err = hci_read_tx_power_sync(hdev, handle, 0x00);
8822
8823         /* Max TX power needs to be read only once per connection */
8824         if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID)
8825                 err = hci_read_tx_power_sync(hdev, handle, 0x01);
8826
8827         return err;
8828 }
8829
8830 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
8831                          u16 len)
8832 {
8833         struct mgmt_cp_get_conn_info *cp = data;
8834         struct mgmt_rp_get_conn_info rp;
8835         struct hci_conn *conn;
8836         unsigned long conn_info_age;
8837         int err = 0;
8838
8839         bt_dev_dbg(hdev, "sock %p", sk);
8840
8841         memset(&rp, 0, sizeof(rp));
8842         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8843         rp.addr.type = cp->addr.type;
8844
8845         if (!bdaddr_type_is_valid(cp->addr.type))
8846                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8847                                          MGMT_STATUS_INVALID_PARAMS,
8848                                          &rp, sizeof(rp));
8849
8850         hci_dev_lock(hdev);
8851
8852         if (!hdev_is_powered(hdev)) {
8853                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8854                                         MGMT_STATUS_NOT_POWERED, &rp,
8855                                         sizeof(rp));
8856                 goto unlock;
8857         }
8858
8859         if (cp->addr.type == BDADDR_BREDR)
8860                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8861                                                &cp->addr.bdaddr);
8862         else
8863                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
8864
8865         if (!conn || conn->state != BT_CONNECTED) {
8866                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8867                                         MGMT_STATUS_NOT_CONNECTED, &rp,
8868                                         sizeof(rp));
8869                 goto unlock;
8870         }
8871
8872         /* To avoid client trying to guess when to poll again for information we
8873          * calculate conn info age as random value between min/max set in hdev.
8874          */
8875         conn_info_age = hdev->conn_info_min_age +
8876                         prandom_u32_max(hdev->conn_info_max_age -
8877                                         hdev->conn_info_min_age);
8878
8879         /* Query controller to refresh cached values if they are too old or were
8880          * never read.
8881          */
8882         if (time_after(jiffies, conn->conn_info_timestamp +
8883                        msecs_to_jiffies(conn_info_age)) ||
8884             !conn->conn_info_timestamp) {
8885                 struct mgmt_pending_cmd *cmd;
8886
8887                 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data,
8888                                        len);
8889                 if (!cmd) {
8890                         err = -ENOMEM;
8891                 } else {
8892                         err = hci_cmd_sync_queue(hdev, get_conn_info_sync,
8893                                                  cmd, get_conn_info_complete);
8894                 }
8895
8896                 if (err < 0) {
8897                         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8898                                           MGMT_STATUS_FAILED, &rp, sizeof(rp));
8899
8900                         if (cmd)
8901                                 mgmt_pending_free(cmd);
8902
8903                         goto unlock;
8904                 }
8905
8906                 conn->conn_info_timestamp = jiffies;
8907         } else {
8908                 /* Cache is valid, just reply with values cached in hci_conn */
8909                 rp.rssi = conn->rssi;
8910                 rp.tx_power = conn->tx_power;
8911                 rp.max_tx_power = conn->max_tx_power;
8912
8913                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8914                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8915         }
8916
8917 unlock:
8918         hci_dev_unlock(hdev);
8919         return err;
8920 }
8921
8922 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err)
8923 {
8924         struct mgmt_pending_cmd *cmd = data;
8925         struct mgmt_cp_get_clock_info *cp = cmd->param;
8926         struct mgmt_rp_get_clock_info rp;
8927         struct hci_conn *conn = cmd->user_data;
8928         u8 status = mgmt_status(err);
8929
8930         bt_dev_dbg(hdev, "err %d", err);
8931
8932         memset(&rp, 0, sizeof(rp));
8933         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8934         rp.addr.type = cp->addr.type;
8935
8936         if (err)
8937                 goto complete;
8938
8939         rp.local_clock = cpu_to_le32(hdev->clock);
8940
8941         if (conn) {
8942                 rp.piconet_clock = cpu_to_le32(conn->clock);
8943                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
8944         }
8945
8946 complete:
8947         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
8948                           sizeof(rp));
8949
8950         mgmt_pending_free(cmd);
8951 }
8952
8953 static int get_clock_info_sync(struct hci_dev *hdev, void *data)
8954 {
8955         struct mgmt_pending_cmd *cmd = data;
8956         struct mgmt_cp_get_clock_info *cp = cmd->param;
8957         struct hci_cp_read_clock hci_cp;
8958         struct hci_conn *conn;
8959
8960         memset(&hci_cp, 0, sizeof(hci_cp));
8961         hci_read_clock_sync(hdev, &hci_cp);
8962
8963         /* Make sure connection still exists */
8964         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
8965         if (!conn || conn->state != BT_CONNECTED)
8966                 return MGMT_STATUS_NOT_CONNECTED;
8967
8968         cmd->user_data = conn;
8969         hci_cp.handle = cpu_to_le16(conn->handle);
8970         hci_cp.which = 0x01; /* Piconet clock */
8971
8972         return hci_read_clock_sync(hdev, &hci_cp);
8973 }
8974
8975 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
8976                                                                 u16 len)
8977 {
8978         struct mgmt_cp_get_clock_info *cp = data;
8979         struct mgmt_rp_get_clock_info rp;
8980         struct mgmt_pending_cmd *cmd;
8981         struct hci_conn *conn;
8982         int err;
8983
8984         bt_dev_dbg(hdev, "sock %p", sk);
8985
8986         memset(&rp, 0, sizeof(rp));
8987         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8988         rp.addr.type = cp->addr.type;
8989
8990         if (cp->addr.type != BDADDR_BREDR)
8991                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8992                                          MGMT_STATUS_INVALID_PARAMS,
8993                                          &rp, sizeof(rp));
8994
8995         hci_dev_lock(hdev);
8996
8997         if (!hdev_is_powered(hdev)) {
8998                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8999                                         MGMT_STATUS_NOT_POWERED, &rp,
9000                                         sizeof(rp));
9001                 goto unlock;
9002         }
9003
9004         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
9005                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
9006                                                &cp->addr.bdaddr);
9007                 if (!conn || conn->state != BT_CONNECTED) {
9008                         err = mgmt_cmd_complete(sk, hdev->id,
9009                                                 MGMT_OP_GET_CLOCK_INFO,
9010                                                 MGMT_STATUS_NOT_CONNECTED,
9011                                                 &rp, sizeof(rp));
9012                         goto unlock;
9013                 }
9014         } else {
9015                 conn = NULL;
9016         }
9017
9018         cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
9019         if (!cmd)
9020                 err = -ENOMEM;
9021         else
9022                 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd,
9023                                          get_clock_info_complete);
9024
9025         if (err < 0) {
9026                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
9027                                         MGMT_STATUS_FAILED, &rp, sizeof(rp));
9028
9029                 if (cmd)
9030                         mgmt_pending_free(cmd);
9031         }
9032
9033
9034 unlock:
9035         hci_dev_unlock(hdev);
9036         return err;
9037 }
9038
9039 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
9040 {
9041         struct hci_conn *conn;
9042
9043         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
9044         if (!conn)
9045                 return false;
9046
9047         if (conn->dst_type != type)
9048                 return false;
9049
9050         if (conn->state != BT_CONNECTED)
9051                 return false;
9052
9053         return true;
9054 }
9055
9056 /* This function requires the caller holds hdev->lock */
9057 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
9058                                u8 addr_type, u8 auto_connect)
9059 {
9060         struct hci_conn_params *params;
9061
9062         params = hci_conn_params_add(hdev, addr, addr_type);
9063         if (!params)
9064                 return -EIO;
9065
9066         if (params->auto_connect == auto_connect)
9067                 return 0;
9068
9069         list_del_init(&params->action);
9070
9071         switch (auto_connect) {
9072         case HCI_AUTO_CONN_DISABLED:
9073         case HCI_AUTO_CONN_LINK_LOSS:
9074                 /* If auto connect is being disabled when we're trying to
9075                  * connect to device, keep connecting.
9076                  */
9077                 if (params->explicit_connect)
9078                         list_add(&params->action, &hdev->pend_le_conns);
9079                 break;
9080         case HCI_AUTO_CONN_REPORT:
9081                 if (params->explicit_connect)
9082                         list_add(&params->action, &hdev->pend_le_conns);
9083                 else
9084                         list_add(&params->action, &hdev->pend_le_reports);
9085                 break;
9086         case HCI_AUTO_CONN_DIRECT:
9087         case HCI_AUTO_CONN_ALWAYS:
9088                 if (!is_connected(hdev, addr, addr_type))
9089                         list_add(&params->action, &hdev->pend_le_conns);
9090                 break;
9091         }
9092
9093         params->auto_connect = auto_connect;
9094
9095         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
9096                    addr, addr_type, auto_connect);
9097
9098         return 0;
9099 }
9100
9101 static void device_added(struct sock *sk, struct hci_dev *hdev,
9102                          bdaddr_t *bdaddr, u8 type, u8 action)
9103 {
9104         struct mgmt_ev_device_added ev;
9105
9106         bacpy(&ev.addr.bdaddr, bdaddr);
9107         ev.addr.type = type;
9108         ev.action = action;
9109
9110         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
9111 }
9112
9113 static int add_device_sync(struct hci_dev *hdev, void *data)
9114 {
9115         return hci_update_passive_scan_sync(hdev);
9116 }
9117
9118 static int add_device(struct sock *sk, struct hci_dev *hdev,
9119                       void *data, u16 len)
9120 {
9121         struct mgmt_cp_add_device *cp = data;
9122         u8 auto_conn, addr_type;
9123         struct hci_conn_params *params;
9124         int err;
9125         u32 current_flags = 0;
9126         u32 supported_flags;
9127
9128         bt_dev_dbg(hdev, "sock %p", sk);
9129
9130         if (!bdaddr_type_is_valid(cp->addr.type) ||
9131             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
9132                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9133                                          MGMT_STATUS_INVALID_PARAMS,
9134                                          &cp->addr, sizeof(cp->addr));
9135
9136         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
9137                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9138                                          MGMT_STATUS_INVALID_PARAMS,
9139                                          &cp->addr, sizeof(cp->addr));
9140
9141         hci_dev_lock(hdev);
9142
9143         if (cp->addr.type == BDADDR_BREDR) {
9144                 /* Only incoming connections action is supported for now */
9145                 if (cp->action != 0x01) {
9146                         err = mgmt_cmd_complete(sk, hdev->id,
9147                                                 MGMT_OP_ADD_DEVICE,
9148                                                 MGMT_STATUS_INVALID_PARAMS,
9149                                                 &cp->addr, sizeof(cp->addr));
9150                         goto unlock;
9151                 }
9152
9153                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
9154                                                      &cp->addr.bdaddr,
9155                                                      cp->addr.type, 0);
9156                 if (err)
9157                         goto unlock;
9158
9159                 hci_update_scan(hdev);
9160
9161                 goto added;
9162         }
9163
9164         addr_type = le_addr_type(cp->addr.type);
9165
9166         if (cp->action == 0x02)
9167                 auto_conn = HCI_AUTO_CONN_ALWAYS;
9168         else if (cp->action == 0x01)
9169                 auto_conn = HCI_AUTO_CONN_DIRECT;
9170         else
9171                 auto_conn = HCI_AUTO_CONN_REPORT;
9172
9173         /* Kernel internally uses conn_params with resolvable private
9174          * address, but Add Device allows only identity addresses.
9175          * Make sure it is enforced before calling
9176          * hci_conn_params_lookup.
9177          */
9178         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
9179                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9180                                         MGMT_STATUS_INVALID_PARAMS,
9181                                         &cp->addr, sizeof(cp->addr));
9182                 goto unlock;
9183         }
9184
9185         /* If the connection parameters don't exist for this device,
9186          * they will be created and configured with defaults.
9187          */
9188         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
9189                                 auto_conn) < 0) {
9190                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9191                                         MGMT_STATUS_FAILED, &cp->addr,
9192                                         sizeof(cp->addr));
9193                 goto unlock;
9194         } else {
9195                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
9196                                                 addr_type);
9197                 if (params)
9198                         current_flags = params->flags;
9199         }
9200
9201         err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL);
9202         if (err < 0)
9203                 goto unlock;
9204
9205 added:
9206         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
9207         supported_flags = hdev->conn_flags;
9208         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
9209                              supported_flags, current_flags);
9210
9211         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9212                                 MGMT_STATUS_SUCCESS, &cp->addr,
9213                                 sizeof(cp->addr));
9214
9215 unlock:
9216         hci_dev_unlock(hdev);
9217         return err;
9218 }
9219
9220 static void device_removed(struct sock *sk, struct hci_dev *hdev,
9221                            bdaddr_t *bdaddr, u8 type)
9222 {
9223         struct mgmt_ev_device_removed ev;
9224
9225         bacpy(&ev.addr.bdaddr, bdaddr);
9226         ev.addr.type = type;
9227
9228         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
9229 }
9230
9231 static int remove_device_sync(struct hci_dev *hdev, void *data)
9232 {
9233         return hci_update_passive_scan_sync(hdev);
9234 }
9235
9236 static int remove_device(struct sock *sk, struct hci_dev *hdev,
9237                          void *data, u16 len)
9238 {
9239         struct mgmt_cp_remove_device *cp = data;
9240         int err;
9241
9242         bt_dev_dbg(hdev, "sock %p", sk);
9243
9244         hci_dev_lock(hdev);
9245
9246         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
9247                 struct hci_conn_params *params;
9248                 u8 addr_type;
9249
9250                 if (!bdaddr_type_is_valid(cp->addr.type)) {
9251                         err = mgmt_cmd_complete(sk, hdev->id,
9252                                                 MGMT_OP_REMOVE_DEVICE,
9253                                                 MGMT_STATUS_INVALID_PARAMS,
9254                                                 &cp->addr, sizeof(cp->addr));
9255                         goto unlock;
9256                 }
9257
9258                 if (cp->addr.type == BDADDR_BREDR) {
9259                         err = hci_bdaddr_list_del(&hdev->accept_list,
9260                                                   &cp->addr.bdaddr,
9261                                                   cp->addr.type);
9262                         if (err) {
9263                                 err = mgmt_cmd_complete(sk, hdev->id,
9264                                                         MGMT_OP_REMOVE_DEVICE,
9265                                                         MGMT_STATUS_INVALID_PARAMS,
9266                                                         &cp->addr,
9267                                                         sizeof(cp->addr));
9268                                 goto unlock;
9269                         }
9270
9271                         hci_update_scan(hdev);
9272
9273                         device_removed(sk, hdev, &cp->addr.bdaddr,
9274                                        cp->addr.type);
9275                         goto complete;
9276                 }
9277
9278                 addr_type = le_addr_type(cp->addr.type);
9279
9280                 /* Kernel internally uses conn_params with resolvable private
9281                  * address, but Remove Device allows only identity addresses.
9282                  * Make sure it is enforced before calling
9283                  * hci_conn_params_lookup.
9284                  */
9285                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
9286                         err = mgmt_cmd_complete(sk, hdev->id,
9287                                                 MGMT_OP_REMOVE_DEVICE,
9288                                                 MGMT_STATUS_INVALID_PARAMS,
9289                                                 &cp->addr, sizeof(cp->addr));
9290                         goto unlock;
9291                 }
9292
9293                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
9294                                                 addr_type);
9295                 if (!params) {
9296                         err = mgmt_cmd_complete(sk, hdev->id,
9297                                                 MGMT_OP_REMOVE_DEVICE,
9298                                                 MGMT_STATUS_INVALID_PARAMS,
9299                                                 &cp->addr, sizeof(cp->addr));
9300                         goto unlock;
9301                 }
9302
9303                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
9304                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
9305                         err = mgmt_cmd_complete(sk, hdev->id,
9306                                                 MGMT_OP_REMOVE_DEVICE,
9307                                                 MGMT_STATUS_INVALID_PARAMS,
9308                                                 &cp->addr, sizeof(cp->addr));
9309                         goto unlock;
9310                 }
9311
9312                 list_del(&params->action);
9313                 list_del(&params->list);
9314                 kfree(params);
9315
9316                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
9317         } else {
9318                 struct hci_conn_params *p, *tmp;
9319                 struct bdaddr_list *b, *btmp;
9320
9321                 if (cp->addr.type) {
9322                         err = mgmt_cmd_complete(sk, hdev->id,
9323                                                 MGMT_OP_REMOVE_DEVICE,
9324                                                 MGMT_STATUS_INVALID_PARAMS,
9325                                                 &cp->addr, sizeof(cp->addr));
9326                         goto unlock;
9327                 }
9328
9329                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
9330                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
9331                         list_del(&b->list);
9332                         kfree(b);
9333                 }
9334
9335                 hci_update_scan(hdev);
9336
9337                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
9338                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
9339                                 continue;
9340                         device_removed(sk, hdev, &p->addr, p->addr_type);
9341                         if (p->explicit_connect) {
9342                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
9343                                 continue;
9344                         }
9345                         list_del(&p->action);
9346                         list_del(&p->list);
9347                         kfree(p);
9348                 }
9349
9350                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
9351         }
9352
9353         hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL);
9354
9355 complete:
9356         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
9357                                 MGMT_STATUS_SUCCESS, &cp->addr,
9358                                 sizeof(cp->addr));
9359 unlock:
9360         hci_dev_unlock(hdev);
9361         return err;
9362 }
9363
9364 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
9365                            u16 len)
9366 {
9367         struct mgmt_cp_load_conn_param *cp = data;
9368         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
9369                                      sizeof(struct mgmt_conn_param));
9370         u16 param_count, expected_len;
9371         int i;
9372
9373         if (!lmp_le_capable(hdev))
9374                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9375                                        MGMT_STATUS_NOT_SUPPORTED);
9376
9377         param_count = __le16_to_cpu(cp->param_count);
9378         if (param_count > max_param_count) {
9379                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
9380                            param_count);
9381                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9382                                        MGMT_STATUS_INVALID_PARAMS);
9383         }
9384
9385         expected_len = struct_size(cp, params, param_count);
9386         if (expected_len != len) {
9387                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
9388                            expected_len, len);
9389                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9390                                        MGMT_STATUS_INVALID_PARAMS);
9391         }
9392
9393         bt_dev_dbg(hdev, "param_count %u", param_count);
9394
9395         hci_dev_lock(hdev);
9396
9397         hci_conn_params_clear_disabled(hdev);
9398
9399         for (i = 0; i < param_count; i++) {
9400                 struct mgmt_conn_param *param = &cp->params[i];
9401                 struct hci_conn_params *hci_param;
9402                 u16 min, max, latency, timeout;
9403                 u8 addr_type;
9404
9405                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
9406                            param->addr.type);
9407
9408                 if (param->addr.type == BDADDR_LE_PUBLIC) {
9409                         addr_type = ADDR_LE_DEV_PUBLIC;
9410                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
9411                         addr_type = ADDR_LE_DEV_RANDOM;
9412                 } else {
9413                         bt_dev_err(hdev, "ignoring invalid connection parameters");
9414                         continue;
9415                 }
9416
9417                 min = le16_to_cpu(param->min_interval);
9418                 max = le16_to_cpu(param->max_interval);
9419                 latency = le16_to_cpu(param->latency);
9420                 timeout = le16_to_cpu(param->timeout);
9421
9422                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
9423                            min, max, latency, timeout);
9424
9425                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
9426                         bt_dev_err(hdev, "ignoring invalid connection parameters");
9427                         continue;
9428                 }
9429
9430                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
9431                                                 addr_type);
9432                 if (!hci_param) {
9433                         bt_dev_err(hdev, "failed to add connection parameters");
9434                         continue;
9435                 }
9436
9437                 hci_param->conn_min_interval = min;
9438                 hci_param->conn_max_interval = max;
9439                 hci_param->conn_latency = latency;
9440                 hci_param->supervision_timeout = timeout;
9441         }
9442
9443         hci_dev_unlock(hdev);
9444
9445         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
9446                                  NULL, 0);
9447 }
9448
9449 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
9450                                void *data, u16 len)
9451 {
9452         struct mgmt_cp_set_external_config *cp = data;
9453         bool changed;
9454         int err;
9455
9456         bt_dev_dbg(hdev, "sock %p", sk);
9457
9458         if (hdev_is_powered(hdev))
9459                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9460                                        MGMT_STATUS_REJECTED);
9461
9462         if (cp->config != 0x00 && cp->config != 0x01)
9463                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9464                                          MGMT_STATUS_INVALID_PARAMS);
9465
9466         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
9467                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9468                                        MGMT_STATUS_NOT_SUPPORTED);
9469
9470         hci_dev_lock(hdev);
9471
9472         if (cp->config)
9473                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
9474         else
9475                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
9476
9477         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
9478         if (err < 0)
9479                 goto unlock;
9480
9481         if (!changed)
9482                 goto unlock;
9483
9484         err = new_options(hdev, sk);
9485
9486         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
9487                 mgmt_index_removed(hdev);
9488
9489                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
9490                         hci_dev_set_flag(hdev, HCI_CONFIG);
9491                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9492
9493                         queue_work(hdev->req_workqueue, &hdev->power_on);
9494                 } else {
9495                         set_bit(HCI_RAW, &hdev->flags);
9496                         mgmt_index_added(hdev);
9497                 }
9498         }
9499
9500 unlock:
9501         hci_dev_unlock(hdev);
9502         return err;
9503 }
9504
9505 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
9506                               void *data, u16 len)
9507 {
9508         struct mgmt_cp_set_public_address *cp = data;
9509         bool changed;
9510         int err;
9511
9512         bt_dev_dbg(hdev, "sock %p", sk);
9513
9514         if (hdev_is_powered(hdev))
9515                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9516                                        MGMT_STATUS_REJECTED);
9517
9518         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
9519                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9520                                        MGMT_STATUS_INVALID_PARAMS);
9521
9522         if (!hdev->set_bdaddr)
9523                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9524                                        MGMT_STATUS_NOT_SUPPORTED);
9525
9526         hci_dev_lock(hdev);
9527
9528         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
9529         bacpy(&hdev->public_addr, &cp->bdaddr);
9530
9531         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
9532         if (err < 0)
9533                 goto unlock;
9534
9535         if (!changed)
9536                 goto unlock;
9537
9538         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
9539                 err = new_options(hdev, sk);
9540
9541         if (is_configured(hdev)) {
9542                 mgmt_index_removed(hdev);
9543
9544                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
9545
9546                 hci_dev_set_flag(hdev, HCI_CONFIG);
9547                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9548
9549                 queue_work(hdev->req_workqueue, &hdev->power_on);
9550         }
9551
9552 unlock:
9553         hci_dev_unlock(hdev);
9554         return err;
9555 }
9556
9557 #ifdef TIZEN_BT
9558 int mgmt_device_name_update(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name,
9559                             u8 name_len)
9560 {
9561         char buf[512];
9562         struct mgmt_ev_device_name_update *ev = (void *)buf;
9563         u16 eir_len = 0;
9564
9565         if (name_len <= 0)
9566                 return -EINVAL;
9567
9568         bacpy(&ev->addr.bdaddr, bdaddr);
9569         ev->addr.type = BDADDR_BREDR;
9570
9571         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
9572                                   name_len);
9573
9574         ev->eir_len = cpu_to_le16(eir_len);
9575
9576         return mgmt_event(MGMT_EV_DEVICE_NAME_UPDATE, hdev, buf,
9577                           sizeof(*ev) + eir_len, NULL);
9578 }
9579
9580 int mgmt_le_conn_update_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
9581                                u8 link_type, u8 addr_type, u8 status)
9582 {
9583         struct mgmt_ev_conn_update_failed ev;
9584
9585         bacpy(&ev.addr.bdaddr, bdaddr);
9586         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9587         ev.status = status;
9588
9589         return mgmt_event(MGMT_EV_CONN_UPDATE_FAILED, hdev,
9590                                 &ev, sizeof(ev), NULL);
9591 }
9592
9593 int mgmt_le_conn_updated(struct hci_dev *hdev, bdaddr_t *bdaddr,
9594                          u8 link_type, u8 addr_type, u16 conn_interval,
9595                          u16 conn_latency, u16 supervision_timeout)
9596 {
9597         struct mgmt_ev_conn_updated ev;
9598
9599         bacpy(&ev.addr.bdaddr, bdaddr);
9600         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9601         ev.conn_interval = cpu_to_le16(conn_interval);
9602         ev.conn_latency = cpu_to_le16(conn_latency);
9603         ev.supervision_timeout = cpu_to_le16(supervision_timeout);
9604
9605         return mgmt_event(MGMT_EV_CONN_UPDATED, hdev,
9606                                 &ev, sizeof(ev), NULL);
9607 }
9608 #endif
9609
9610 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
9611                                              int err)
9612 {
9613         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
9614         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
9615         u8 *h192, *r192, *h256, *r256;
9616         struct mgmt_pending_cmd *cmd = data;
9617         struct sk_buff *skb = cmd->skb;
9618         u8 status = mgmt_status(err);
9619         u16 eir_len;
9620
9621         if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
9622                 return;
9623
9624         if (!status) {
9625                 if (!skb)
9626                         status = MGMT_STATUS_FAILED;
9627                 else if (IS_ERR(skb))
9628                         status = mgmt_status(PTR_ERR(skb));
9629                 else
9630                         status = mgmt_status(skb->data[0]);
9631         }
9632
9633         bt_dev_dbg(hdev, "status %u", status);
9634
9635         mgmt_cp = cmd->param;
9636
9637         if (status) {
9638                 status = mgmt_status(status);
9639                 eir_len = 0;
9640
9641                 h192 = NULL;
9642                 r192 = NULL;
9643                 h256 = NULL;
9644                 r256 = NULL;
9645         } else if (!bredr_sc_enabled(hdev)) {
9646                 struct hci_rp_read_local_oob_data *rp;
9647
9648                 if (skb->len != sizeof(*rp)) {
9649                         status = MGMT_STATUS_FAILED;
9650                         eir_len = 0;
9651                 } else {
9652                         status = MGMT_STATUS_SUCCESS;
9653                         rp = (void *)skb->data;
9654
9655                         eir_len = 5 + 18 + 18;
9656                         h192 = rp->hash;
9657                         r192 = rp->rand;
9658                         h256 = NULL;
9659                         r256 = NULL;
9660                 }
9661         } else {
9662                 struct hci_rp_read_local_oob_ext_data *rp;
9663
9664                 if (skb->len != sizeof(*rp)) {
9665                         status = MGMT_STATUS_FAILED;
9666                         eir_len = 0;
9667                 } else {
9668                         status = MGMT_STATUS_SUCCESS;
9669                         rp = (void *)skb->data;
9670
9671                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
9672                                 eir_len = 5 + 18 + 18;
9673                                 h192 = NULL;
9674                                 r192 = NULL;
9675                         } else {
9676                                 eir_len = 5 + 18 + 18 + 18 + 18;
9677                                 h192 = rp->hash192;
9678                                 r192 = rp->rand192;
9679                         }
9680
9681                         h256 = rp->hash256;
9682                         r256 = rp->rand256;
9683                 }
9684         }
9685
9686         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
9687         if (!mgmt_rp)
9688                 goto done;
9689
9690         if (eir_len == 0)
9691                 goto send_rsp;
9692
9693         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
9694                                   hdev->dev_class, 3);
9695
9696         if (h192 && r192) {
9697                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9698                                           EIR_SSP_HASH_C192, h192, 16);
9699                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9700                                           EIR_SSP_RAND_R192, r192, 16);
9701         }
9702
9703         if (h256 && r256) {
9704                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9705                                           EIR_SSP_HASH_C256, h256, 16);
9706                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9707                                           EIR_SSP_RAND_R256, r256, 16);
9708         }
9709
9710 send_rsp:
9711         mgmt_rp->type = mgmt_cp->type;
9712         mgmt_rp->eir_len = cpu_to_le16(eir_len);
9713
9714         err = mgmt_cmd_complete(cmd->sk, hdev->id,
9715                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
9716                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
9717         if (err < 0 || status)
9718                 goto done;
9719
9720         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
9721
9722         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9723                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
9724                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
9725 done:
9726         if (skb && !IS_ERR(skb))
9727                 kfree_skb(skb);
9728
9729         kfree(mgmt_rp);
9730         mgmt_pending_remove(cmd);
9731 }
9732
9733 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
9734                                   struct mgmt_cp_read_local_oob_ext_data *cp)
9735 {
9736         struct mgmt_pending_cmd *cmd;
9737         int err;
9738
9739         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
9740                                cp, sizeof(*cp));
9741         if (!cmd)
9742                 return -ENOMEM;
9743
9744         err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
9745                                  read_local_oob_ext_data_complete);
9746
9747         if (err < 0) {
9748                 mgmt_pending_remove(cmd);
9749                 return err;
9750         }
9751
9752         return 0;
9753 }
9754
9755 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
9756                                    void *data, u16 data_len)
9757 {
9758         struct mgmt_cp_read_local_oob_ext_data *cp = data;
9759         struct mgmt_rp_read_local_oob_ext_data *rp;
9760         size_t rp_len;
9761         u16 eir_len;
9762         u8 status, flags, role, addr[7], hash[16], rand[16];
9763         int err;
9764
9765         bt_dev_dbg(hdev, "sock %p", sk);
9766
9767         if (hdev_is_powered(hdev)) {
9768                 switch (cp->type) {
9769                 case BIT(BDADDR_BREDR):
9770                         status = mgmt_bredr_support(hdev);
9771                         if (status)
9772                                 eir_len = 0;
9773                         else
9774                                 eir_len = 5;
9775                         break;
9776                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9777                         status = mgmt_le_support(hdev);
9778                         if (status)
9779                                 eir_len = 0;
9780                         else
9781                                 eir_len = 9 + 3 + 18 + 18 + 3;
9782                         break;
9783                 default:
9784                         status = MGMT_STATUS_INVALID_PARAMS;
9785                         eir_len = 0;
9786                         break;
9787                 }
9788         } else {
9789                 status = MGMT_STATUS_NOT_POWERED;
9790                 eir_len = 0;
9791         }
9792
9793         rp_len = sizeof(*rp) + eir_len;
9794         rp = kmalloc(rp_len, GFP_ATOMIC);
9795         if (!rp)
9796                 return -ENOMEM;
9797
9798         if (!status && !lmp_ssp_capable(hdev)) {
9799                 status = MGMT_STATUS_NOT_SUPPORTED;
9800                 eir_len = 0;
9801         }
9802
9803         if (status)
9804                 goto complete;
9805
9806         hci_dev_lock(hdev);
9807
9808         eir_len = 0;
9809         switch (cp->type) {
9810         case BIT(BDADDR_BREDR):
9811                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
9812                         err = read_local_ssp_oob_req(hdev, sk, cp);
9813                         hci_dev_unlock(hdev);
9814                         if (!err)
9815                                 goto done;
9816
9817                         status = MGMT_STATUS_FAILED;
9818                         goto complete;
9819                 } else {
9820                         eir_len = eir_append_data(rp->eir, eir_len,
9821                                                   EIR_CLASS_OF_DEV,
9822                                                   hdev->dev_class, 3);
9823                 }
9824                 break;
9825         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9826                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
9827                     smp_generate_oob(hdev, hash, rand) < 0) {
9828                         hci_dev_unlock(hdev);
9829                         status = MGMT_STATUS_FAILED;
9830                         goto complete;
9831                 }
9832
9833                 /* This should return the active RPA, but since the RPA
9834                  * is only programmed on demand, it is really hard to fill
9835                  * this in at the moment. For now disallow retrieving
9836                  * local out-of-band data when privacy is in use.
9837                  *
9838                  * Returning the identity address will not help here since
9839                  * pairing happens before the identity resolving key is
9840                  * known and thus the connection establishment happens
9841                  * based on the RPA and not the identity address.
9842                  */
9843                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
9844                         hci_dev_unlock(hdev);
9845                         status = MGMT_STATUS_REJECTED;
9846                         goto complete;
9847                 }
9848
9849                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
9850                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
9851                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
9852                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
9853                         memcpy(addr, &hdev->static_addr, 6);
9854                         addr[6] = 0x01;
9855                 } else {
9856                         memcpy(addr, &hdev->bdaddr, 6);
9857                         addr[6] = 0x00;
9858                 }
9859
9860                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
9861                                           addr, sizeof(addr));
9862
9863                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
9864                         role = 0x02;
9865                 else
9866                         role = 0x01;
9867
9868                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
9869                                           &role, sizeof(role));
9870
9871                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
9872                         eir_len = eir_append_data(rp->eir, eir_len,
9873                                                   EIR_LE_SC_CONFIRM,
9874                                                   hash, sizeof(hash));
9875
9876                         eir_len = eir_append_data(rp->eir, eir_len,
9877                                                   EIR_LE_SC_RANDOM,
9878                                                   rand, sizeof(rand));
9879                 }
9880
9881                 flags = mgmt_get_adv_discov_flags(hdev);
9882
9883                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
9884                         flags |= LE_AD_NO_BREDR;
9885
9886                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
9887                                           &flags, sizeof(flags));
9888                 break;
9889         }
9890
9891         hci_dev_unlock(hdev);
9892
9893         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
9894
9895         status = MGMT_STATUS_SUCCESS;
9896
9897 complete:
9898         rp->type = cp->type;
9899         rp->eir_len = cpu_to_le16(eir_len);
9900
9901         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
9902                                 status, rp, sizeof(*rp) + eir_len);
9903         if (err < 0 || status)
9904                 goto done;
9905
9906         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9907                                  rp, sizeof(*rp) + eir_len,
9908                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
9909
9910 done:
9911         kfree(rp);
9912
9913         return err;
9914 }
9915
9916 static u32 get_supported_adv_flags(struct hci_dev *hdev)
9917 {
9918         u32 flags = 0;
9919
9920         flags |= MGMT_ADV_FLAG_CONNECTABLE;
9921         flags |= MGMT_ADV_FLAG_DISCOV;
9922         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
9923         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
9924         flags |= MGMT_ADV_FLAG_APPEARANCE;
9925         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
9926         flags |= MGMT_ADV_PARAM_DURATION;
9927         flags |= MGMT_ADV_PARAM_TIMEOUT;
9928         flags |= MGMT_ADV_PARAM_INTERVALS;
9929         flags |= MGMT_ADV_PARAM_TX_POWER;
9930         flags |= MGMT_ADV_PARAM_SCAN_RSP;
9931
9932         /* In extended adv TX_POWER returned from Set Adv Param
9933          * will be always valid.
9934          */
9935         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev))
9936                 flags |= MGMT_ADV_FLAG_TX_POWER;
9937
9938         if (ext_adv_capable(hdev)) {
9939                 flags |= MGMT_ADV_FLAG_SEC_1M;
9940                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
9941                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
9942
9943                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
9944                         flags |= MGMT_ADV_FLAG_SEC_2M;
9945
9946                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
9947                         flags |= MGMT_ADV_FLAG_SEC_CODED;
9948         }
9949
9950         return flags;
9951 }
9952
9953 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
9954                              void *data, u16 data_len)
9955 {
9956         struct mgmt_rp_read_adv_features *rp;
9957         size_t rp_len;
9958         int err;
9959         struct adv_info *adv_instance;
9960         u32 supported_flags;
9961         u8 *instance;
9962
9963         bt_dev_dbg(hdev, "sock %p", sk);
9964
9965         if (!lmp_le_capable(hdev))
9966                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9967                                        MGMT_STATUS_REJECTED);
9968
9969         hci_dev_lock(hdev);
9970
9971         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
9972         rp = kmalloc(rp_len, GFP_ATOMIC);
9973         if (!rp) {
9974                 hci_dev_unlock(hdev);
9975                 return -ENOMEM;
9976         }
9977
9978         supported_flags = get_supported_adv_flags(hdev);
9979
9980         rp->supported_flags = cpu_to_le32(supported_flags);
9981         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
9982         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
9983         rp->max_instances = hdev->le_num_of_adv_sets;
9984         rp->num_instances = hdev->adv_instance_cnt;
9985
9986         instance = rp->instance;
9987         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
9988                 /* Only instances 1-le_num_of_adv_sets are externally visible */
9989                 if (adv_instance->instance <= hdev->adv_instance_cnt) {
9990                         *instance = adv_instance->instance;
9991                         instance++;
9992                 } else {
9993                         rp->num_instances--;
9994                         rp_len--;
9995                 }
9996         }
9997
9998         hci_dev_unlock(hdev);
9999
10000         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
10001                                 MGMT_STATUS_SUCCESS, rp, rp_len);
10002
10003         kfree(rp);
10004
10005         return err;
10006 }
10007
10008 static u8 calculate_name_len(struct hci_dev *hdev)
10009 {
10010         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
10011
10012         return eir_append_local_name(hdev, buf, 0);
10013 }
10014
10015 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
10016                            bool is_adv_data)
10017 {
10018         u8 max_len = HCI_MAX_AD_LENGTH;
10019
10020         if (is_adv_data) {
10021                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
10022                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
10023                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
10024                         max_len -= 3;
10025
10026                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
10027                         max_len -= 3;
10028         } else {
10029                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
10030                         max_len -= calculate_name_len(hdev);
10031
10032                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
10033                         max_len -= 4;
10034         }
10035
10036         return max_len;
10037 }
10038
10039 static bool flags_managed(u32 adv_flags)
10040 {
10041         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
10042                             MGMT_ADV_FLAG_LIMITED_DISCOV |
10043                             MGMT_ADV_FLAG_MANAGED_FLAGS);
10044 }
10045
10046 static bool tx_power_managed(u32 adv_flags)
10047 {
10048         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
10049 }
10050
10051 static bool name_managed(u32 adv_flags)
10052 {
10053         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
10054 }
10055
10056 static bool appearance_managed(u32 adv_flags)
10057 {
10058         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
10059 }
10060
10061 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
10062                               u8 len, bool is_adv_data)
10063 {
10064         int i, cur_len;
10065         u8 max_len;
10066
10067         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
10068
10069         if (len > max_len)
10070                 return false;
10071
10072         /* Make sure that the data is correctly formatted. */
10073         for (i = 0; i < len; i += (cur_len + 1)) {
10074                 cur_len = data[i];
10075
10076                 if (!cur_len)
10077                         continue;
10078
10079                 if (data[i + 1] == EIR_FLAGS &&
10080                     (!is_adv_data || flags_managed(adv_flags)))
10081                         return false;
10082
10083                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
10084                         return false;
10085
10086                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
10087                         return false;
10088
10089                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
10090                         return false;
10091
10092                 if (data[i + 1] == EIR_APPEARANCE &&
10093                     appearance_managed(adv_flags))
10094                         return false;
10095
10096                 /* If the current field length would exceed the total data
10097                  * length, then it's invalid.
10098                  */
10099                 if (i + cur_len >= len)
10100                         return false;
10101         }
10102
10103         return true;
10104 }
10105
10106 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
10107 {
10108         u32 supported_flags, phy_flags;
10109
10110         /* The current implementation only supports a subset of the specified
10111          * flags. Also need to check mutual exclusiveness of sec flags.
10112          */
10113         supported_flags = get_supported_adv_flags(hdev);
10114         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
10115         if (adv_flags & ~supported_flags ||
10116             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
10117                 return false;
10118
10119         return true;
10120 }
10121
10122 static bool adv_busy(struct hci_dev *hdev)
10123 {
10124         return pending_find(MGMT_OP_SET_LE, hdev);
10125 }
10126
10127 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance,
10128                              int err)
10129 {
10130         struct adv_info *adv, *n;
10131
10132         bt_dev_dbg(hdev, "err %d", err);
10133
10134         hci_dev_lock(hdev);
10135
10136         list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
10137                 u8 instance;
10138
10139                 if (!adv->pending)
10140                         continue;
10141
10142                 if (!err) {
10143                         adv->pending = false;
10144                         continue;
10145                 }
10146
10147                 instance = adv->instance;
10148
10149                 if (hdev->cur_adv_instance == instance)
10150                         cancel_adv_timeout(hdev);
10151
10152                 hci_remove_adv_instance(hdev, instance);
10153                 mgmt_advertising_removed(sk, hdev, instance);
10154         }
10155
10156         hci_dev_unlock(hdev);
10157 }
10158
10159 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err)
10160 {
10161         struct mgmt_pending_cmd *cmd = data;
10162         struct mgmt_cp_add_advertising *cp = cmd->param;
10163         struct mgmt_rp_add_advertising rp;
10164
10165         memset(&rp, 0, sizeof(rp));
10166
10167         rp.instance = cp->instance;
10168
10169         if (err)
10170                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
10171                                 mgmt_status(err));
10172         else
10173                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
10174                                   mgmt_status(err), &rp, sizeof(rp));
10175
10176         add_adv_complete(hdev, cmd->sk, cp->instance, err);
10177
10178         mgmt_pending_free(cmd);
10179 }
10180
10181 static int add_advertising_sync(struct hci_dev *hdev, void *data)
10182 {
10183         struct mgmt_pending_cmd *cmd = data;
10184         struct mgmt_cp_add_advertising *cp = cmd->param;
10185
10186         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
10187 }
10188
10189 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
10190                            void *data, u16 data_len)
10191 {
10192         struct mgmt_cp_add_advertising *cp = data;
10193         struct mgmt_rp_add_advertising rp;
10194         u32 flags;
10195         u8 status;
10196         u16 timeout, duration;
10197         unsigned int prev_instance_cnt;
10198         u8 schedule_instance = 0;
10199         struct adv_info *adv, *next_instance;
10200         int err;
10201         struct mgmt_pending_cmd *cmd;
10202
10203         bt_dev_dbg(hdev, "sock %p", sk);
10204
10205         status = mgmt_le_support(hdev);
10206         if (status)
10207                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10208                                        status);
10209
10210         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10211                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10212                                        MGMT_STATUS_INVALID_PARAMS);
10213
10214         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
10215                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10216                                        MGMT_STATUS_INVALID_PARAMS);
10217
10218         flags = __le32_to_cpu(cp->flags);
10219         timeout = __le16_to_cpu(cp->timeout);
10220         duration = __le16_to_cpu(cp->duration);
10221
10222         if (!requested_adv_flags_are_valid(hdev, flags))
10223                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10224                                        MGMT_STATUS_INVALID_PARAMS);
10225
10226         hci_dev_lock(hdev);
10227
10228         if (timeout && !hdev_is_powered(hdev)) {
10229                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10230                                       MGMT_STATUS_REJECTED);
10231                 goto unlock;
10232         }
10233
10234         if (adv_busy(hdev)) {
10235                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10236                                       MGMT_STATUS_BUSY);
10237                 goto unlock;
10238         }
10239
10240         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
10241             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
10242                                cp->scan_rsp_len, false)) {
10243                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10244                                       MGMT_STATUS_INVALID_PARAMS);
10245                 goto unlock;
10246         }
10247
10248         prev_instance_cnt = hdev->adv_instance_cnt;
10249
10250         adv = hci_add_adv_instance(hdev, cp->instance, flags,
10251                                    cp->adv_data_len, cp->data,
10252                                    cp->scan_rsp_len,
10253                                    cp->data + cp->adv_data_len,
10254                                    timeout, duration,
10255                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
10256                                    hdev->le_adv_min_interval,
10257                                    hdev->le_adv_max_interval, 0);
10258         if (IS_ERR(adv)) {
10259                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10260                                       MGMT_STATUS_FAILED);
10261                 goto unlock;
10262         }
10263
10264         /* Only trigger an advertising added event if a new instance was
10265          * actually added.
10266          */
10267         if (hdev->adv_instance_cnt > prev_instance_cnt)
10268                 mgmt_advertising_added(sk, hdev, cp->instance);
10269
10270         if (hdev->cur_adv_instance == cp->instance) {
10271                 /* If the currently advertised instance is being changed then
10272                  * cancel the current advertising and schedule the next
10273                  * instance. If there is only one instance then the overridden
10274                  * advertising data will be visible right away.
10275                  */
10276                 cancel_adv_timeout(hdev);
10277
10278                 next_instance = hci_get_next_instance(hdev, cp->instance);
10279                 if (next_instance)
10280                         schedule_instance = next_instance->instance;
10281         } else if (!hdev->adv_instance_timeout) {
10282                 /* Immediately advertise the new instance if no other
10283                  * instance is currently being advertised.
10284                  */
10285                 schedule_instance = cp->instance;
10286         }
10287
10288         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
10289          * there is no instance to be advertised then we have no HCI
10290          * communication to make. Simply return.
10291          */
10292         if (!hdev_is_powered(hdev) ||
10293             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
10294             !schedule_instance) {
10295                 rp.instance = cp->instance;
10296                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10297                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10298                 goto unlock;
10299         }
10300
10301         /* We're good to go, update advertising data, parameters, and start
10302          * advertising.
10303          */
10304         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
10305                                data_len);
10306         if (!cmd) {
10307                 err = -ENOMEM;
10308                 goto unlock;
10309         }
10310
10311         cp->instance = schedule_instance;
10312
10313         err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd,
10314                                  add_advertising_complete);
10315         if (err < 0)
10316                 mgmt_pending_free(cmd);
10317
10318 unlock:
10319         hci_dev_unlock(hdev);
10320
10321         return err;
10322 }
10323
10324 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data,
10325                                         int err)
10326 {
10327         struct mgmt_pending_cmd *cmd = data;
10328         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
10329         struct mgmt_rp_add_ext_adv_params rp;
10330         struct adv_info *adv;
10331         u32 flags;
10332
10333         BT_DBG("%s", hdev->name);
10334
10335         hci_dev_lock(hdev);
10336
10337         adv = hci_find_adv_instance(hdev, cp->instance);
10338         if (!adv)
10339                 goto unlock;
10340
10341         rp.instance = cp->instance;
10342         rp.tx_power = adv->tx_power;
10343
10344         /* While we're at it, inform userspace of the available space for this
10345          * advertisement, given the flags that will be used.
10346          */
10347         flags = __le32_to_cpu(cp->flags);
10348         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10349         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10350
10351         if (err) {
10352                 /* If this advertisement was previously advertising and we
10353                  * failed to update it, we signal that it has been removed and
10354                  * delete its structure
10355                  */
10356                 if (!adv->pending)
10357                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
10358
10359                 hci_remove_adv_instance(hdev, cp->instance);
10360
10361                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
10362                                 mgmt_status(err));
10363         } else {
10364                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
10365                                   mgmt_status(err), &rp, sizeof(rp));
10366         }
10367
10368 unlock:
10369         if (cmd)
10370                 mgmt_pending_free(cmd);
10371
10372         hci_dev_unlock(hdev);
10373 }
10374
10375 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data)
10376 {
10377         struct mgmt_pending_cmd *cmd = data;
10378         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
10379
10380         return hci_setup_ext_adv_instance_sync(hdev, cp->instance);
10381 }
10382
10383 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
10384                               void *data, u16 data_len)
10385 {
10386         struct mgmt_cp_add_ext_adv_params *cp = data;
10387         struct mgmt_rp_add_ext_adv_params rp;
10388         struct mgmt_pending_cmd *cmd = NULL;
10389         struct adv_info *adv;
10390         u32 flags, min_interval, max_interval;
10391         u16 timeout, duration;
10392         u8 status;
10393         s8 tx_power;
10394         int err;
10395
10396         BT_DBG("%s", hdev->name);
10397
10398         status = mgmt_le_support(hdev);
10399         if (status)
10400                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10401                                        status);
10402
10403         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10404                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10405                                        MGMT_STATUS_INVALID_PARAMS);
10406
10407         /* The purpose of breaking add_advertising into two separate MGMT calls
10408          * for params and data is to allow more parameters to be added to this
10409          * structure in the future. For this reason, we verify that we have the
10410          * bare minimum structure we know of when the interface was defined. Any
10411          * extra parameters we don't know about will be ignored in this request.
10412          */
10413         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
10414                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10415                                        MGMT_STATUS_INVALID_PARAMS);
10416
10417         flags = __le32_to_cpu(cp->flags);
10418
10419         if (!requested_adv_flags_are_valid(hdev, flags))
10420                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10421                                        MGMT_STATUS_INVALID_PARAMS);
10422
10423         hci_dev_lock(hdev);
10424
10425         /* In new interface, we require that we are powered to register */
10426         if (!hdev_is_powered(hdev)) {
10427                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10428                                       MGMT_STATUS_REJECTED);
10429                 goto unlock;
10430         }
10431
10432         if (adv_busy(hdev)) {
10433                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10434                                       MGMT_STATUS_BUSY);
10435                 goto unlock;
10436         }
10437
10438         /* Parse defined parameters from request, use defaults otherwise */
10439         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
10440                   __le16_to_cpu(cp->timeout) : 0;
10441
10442         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
10443                    __le16_to_cpu(cp->duration) :
10444                    hdev->def_multi_adv_rotation_duration;
10445
10446         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
10447                        __le32_to_cpu(cp->min_interval) :
10448                        hdev->le_adv_min_interval;
10449
10450         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
10451                        __le32_to_cpu(cp->max_interval) :
10452                        hdev->le_adv_max_interval;
10453
10454         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
10455                    cp->tx_power :
10456                    HCI_ADV_TX_POWER_NO_PREFERENCE;
10457
10458         /* Create advertising instance with no advertising or response data */
10459         adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL,
10460                                    timeout, duration, tx_power, min_interval,
10461                                    max_interval, 0);
10462
10463         if (IS_ERR(adv)) {
10464                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10465                                       MGMT_STATUS_FAILED);
10466                 goto unlock;
10467         }
10468
10469         /* Submit request for advertising params if ext adv available */
10470         if (ext_adv_capable(hdev)) {
10471                 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev,
10472                                        data, data_len);
10473                 if (!cmd) {
10474                         err = -ENOMEM;
10475                         hci_remove_adv_instance(hdev, cp->instance);
10476                         goto unlock;
10477                 }
10478
10479                 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd,
10480                                          add_ext_adv_params_complete);
10481                 if (err < 0)
10482                         mgmt_pending_free(cmd);
10483         } else {
10484                 rp.instance = cp->instance;
10485                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
10486                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10487                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10488                 err = mgmt_cmd_complete(sk, hdev->id,
10489                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
10490                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10491         }
10492
10493 unlock:
10494         hci_dev_unlock(hdev);
10495
10496         return err;
10497 }
10498
10499 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err)
10500 {
10501         struct mgmt_pending_cmd *cmd = data;
10502         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
10503         struct mgmt_rp_add_advertising rp;
10504
10505         add_adv_complete(hdev, cmd->sk, cp->instance, err);
10506
10507         memset(&rp, 0, sizeof(rp));
10508
10509         rp.instance = cp->instance;
10510
10511         if (err)
10512                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
10513                                 mgmt_status(err));
10514         else
10515                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
10516                                   mgmt_status(err), &rp, sizeof(rp));
10517
10518         mgmt_pending_free(cmd);
10519 }
10520
10521 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data)
10522 {
10523         struct mgmt_pending_cmd *cmd = data;
10524         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
10525         int err;
10526
10527         if (ext_adv_capable(hdev)) {
10528                 err = hci_update_adv_data_sync(hdev, cp->instance);
10529                 if (err)
10530                         return err;
10531
10532                 err = hci_update_scan_rsp_data_sync(hdev, cp->instance);
10533                 if (err)
10534                         return err;
10535
10536                 return hci_enable_ext_advertising_sync(hdev, cp->instance);
10537         }
10538
10539         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
10540 }
10541
10542 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
10543                             u16 data_len)
10544 {
10545         struct mgmt_cp_add_ext_adv_data *cp = data;
10546         struct mgmt_rp_add_ext_adv_data rp;
10547         u8 schedule_instance = 0;
10548         struct adv_info *next_instance;
10549         struct adv_info *adv_instance;
10550         int err = 0;
10551         struct mgmt_pending_cmd *cmd;
10552
10553         BT_DBG("%s", hdev->name);
10554
10555         hci_dev_lock(hdev);
10556
10557         adv_instance = hci_find_adv_instance(hdev, cp->instance);
10558
10559         if (!adv_instance) {
10560                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10561                                       MGMT_STATUS_INVALID_PARAMS);
10562                 goto unlock;
10563         }
10564
10565         /* In new interface, we require that we are powered to register */
10566         if (!hdev_is_powered(hdev)) {
10567                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10568                                       MGMT_STATUS_REJECTED);
10569                 goto clear_new_instance;
10570         }
10571
10572         if (adv_busy(hdev)) {
10573                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10574                                       MGMT_STATUS_BUSY);
10575                 goto clear_new_instance;
10576         }
10577
10578         /* Validate new data */
10579         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
10580                                cp->adv_data_len, true) ||
10581             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
10582                                cp->adv_data_len, cp->scan_rsp_len, false)) {
10583                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10584                                       MGMT_STATUS_INVALID_PARAMS);
10585                 goto clear_new_instance;
10586         }
10587
10588         /* Set the data in the advertising instance */
10589         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
10590                                   cp->data, cp->scan_rsp_len,
10591                                   cp->data + cp->adv_data_len);
10592
10593         /* If using software rotation, determine next instance to use */
10594         if (hdev->cur_adv_instance == cp->instance) {
10595                 /* If the currently advertised instance is being changed
10596                  * then cancel the current advertising and schedule the
10597                  * next instance. If there is only one instance then the
10598                  * overridden advertising data will be visible right
10599                  * away
10600                  */
10601                 cancel_adv_timeout(hdev);
10602
10603                 next_instance = hci_get_next_instance(hdev, cp->instance);
10604                 if (next_instance)
10605                         schedule_instance = next_instance->instance;
10606         } else if (!hdev->adv_instance_timeout) {
10607                 /* Immediately advertise the new instance if no other
10608                  * instance is currently being advertised.
10609                  */
10610                 schedule_instance = cp->instance;
10611         }
10612
10613         /* If the HCI_ADVERTISING flag is set or there is no instance to
10614          * be advertised then we have no HCI communication to make.
10615          * Simply return.
10616          */
10617         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) {
10618                 if (adv_instance->pending) {
10619                         mgmt_advertising_added(sk, hdev, cp->instance);
10620                         adv_instance->pending = false;
10621                 }
10622                 rp.instance = cp->instance;
10623                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10624                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10625                 goto unlock;
10626         }
10627
10628         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
10629                                data_len);
10630         if (!cmd) {
10631                 err = -ENOMEM;
10632                 goto clear_new_instance;
10633         }
10634
10635         err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd,
10636                                  add_ext_adv_data_complete);
10637         if (err < 0) {
10638                 mgmt_pending_free(cmd);
10639                 goto clear_new_instance;
10640         }
10641
10642         /* We were successful in updating data, so trigger advertising_added
10643          * event if this is an instance that wasn't previously advertising. If
10644          * a failure occurs in the requests we initiated, we will remove the
10645          * instance again in add_advertising_complete
10646          */
10647         if (adv_instance->pending)
10648                 mgmt_advertising_added(sk, hdev, cp->instance);
10649
10650         goto unlock;
10651
10652 clear_new_instance:
10653         hci_remove_adv_instance(hdev, cp->instance);
10654
10655 unlock:
10656         hci_dev_unlock(hdev);
10657
10658         return err;
10659 }
10660
10661 static void remove_advertising_complete(struct hci_dev *hdev, void *data,
10662                                         int err)
10663 {
10664         struct mgmt_pending_cmd *cmd = data;
10665         struct mgmt_cp_remove_advertising *cp = cmd->param;
10666         struct mgmt_rp_remove_advertising rp;
10667
10668         bt_dev_dbg(hdev, "err %d", err);
10669
10670         memset(&rp, 0, sizeof(rp));
10671         rp.instance = cp->instance;
10672
10673         if (err)
10674                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
10675                                 mgmt_status(err));
10676         else
10677                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
10678                                   MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10679
10680         mgmt_pending_free(cmd);
10681 }
10682
10683 static int remove_advertising_sync(struct hci_dev *hdev, void *data)
10684 {
10685         struct mgmt_pending_cmd *cmd = data;
10686         struct mgmt_cp_remove_advertising *cp = cmd->param;
10687         int err;
10688
10689         err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true);
10690         if (err)
10691                 return err;
10692
10693         if (list_empty(&hdev->adv_instances))
10694                 err = hci_disable_advertising_sync(hdev);
10695
10696         return err;
10697 }
10698
10699 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
10700                               void *data, u16 data_len)
10701 {
10702         struct mgmt_cp_remove_advertising *cp = data;
10703         struct mgmt_pending_cmd *cmd;
10704         int err;
10705
10706         bt_dev_dbg(hdev, "sock %p", sk);
10707
10708         hci_dev_lock(hdev);
10709
10710         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
10711                 err = mgmt_cmd_status(sk, hdev->id,
10712                                       MGMT_OP_REMOVE_ADVERTISING,
10713                                       MGMT_STATUS_INVALID_PARAMS);
10714                 goto unlock;
10715         }
10716
10717         if (pending_find(MGMT_OP_SET_LE, hdev)) {
10718                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10719                                       MGMT_STATUS_BUSY);
10720                 goto unlock;
10721         }
10722
10723         if (list_empty(&hdev->adv_instances)) {
10724                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10725                                       MGMT_STATUS_INVALID_PARAMS);
10726                 goto unlock;
10727         }
10728
10729         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
10730                                data_len);
10731         if (!cmd) {
10732                 err = -ENOMEM;
10733                 goto unlock;
10734         }
10735
10736         err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd,
10737                                  remove_advertising_complete);
10738         if (err < 0)
10739                 mgmt_pending_free(cmd);
10740
10741 unlock:
10742         hci_dev_unlock(hdev);
10743
10744         return err;
10745 }
10746
10747 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
10748                              void *data, u16 data_len)
10749 {
10750         struct mgmt_cp_get_adv_size_info *cp = data;
10751         struct mgmt_rp_get_adv_size_info rp;
10752         u32 flags, supported_flags;
10753
10754         bt_dev_dbg(hdev, "sock %p", sk);
10755
10756         if (!lmp_le_capable(hdev))
10757                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10758                                        MGMT_STATUS_REJECTED);
10759
10760         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10761                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10762                                        MGMT_STATUS_INVALID_PARAMS);
10763
10764         flags = __le32_to_cpu(cp->flags);
10765
10766         /* The current implementation only supports a subset of the specified
10767          * flags.
10768          */
10769         supported_flags = get_supported_adv_flags(hdev);
10770         if (flags & ~supported_flags)
10771                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10772                                        MGMT_STATUS_INVALID_PARAMS);
10773
10774         rp.instance = cp->instance;
10775         rp.flags = cp->flags;
10776         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10777         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10778
10779         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10780                                  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10781 }
10782
10783 static const struct hci_mgmt_handler mgmt_handlers[] = {
10784         { NULL }, /* 0x0000 (no command) */
10785         { read_version,            MGMT_READ_VERSION_SIZE,
10786                                                 HCI_MGMT_NO_HDEV |
10787                                                 HCI_MGMT_UNTRUSTED },
10788         { read_commands,           MGMT_READ_COMMANDS_SIZE,
10789                                                 HCI_MGMT_NO_HDEV |
10790                                                 HCI_MGMT_UNTRUSTED },
10791         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
10792                                                 HCI_MGMT_NO_HDEV |
10793                                                 HCI_MGMT_UNTRUSTED },
10794         { read_controller_info,    MGMT_READ_INFO_SIZE,
10795                                                 HCI_MGMT_UNTRUSTED },
10796         { set_powered,             MGMT_SETTING_SIZE },
10797         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
10798         { set_connectable,         MGMT_SETTING_SIZE },
10799         { set_fast_connectable,    MGMT_SETTING_SIZE },
10800         { set_bondable,            MGMT_SETTING_SIZE },
10801         { set_link_security,       MGMT_SETTING_SIZE },
10802         { set_ssp,                 MGMT_SETTING_SIZE },
10803         { set_hs,                  MGMT_SETTING_SIZE },
10804         { set_le,                  MGMT_SETTING_SIZE },
10805         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
10806         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
10807         { add_uuid,                MGMT_ADD_UUID_SIZE },
10808         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
10809         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
10810                                                 HCI_MGMT_VAR_LEN },
10811         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
10812                                                 HCI_MGMT_VAR_LEN },
10813         { disconnect,              MGMT_DISCONNECT_SIZE },
10814         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
10815         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
10816         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
10817         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
10818         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
10819         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
10820         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
10821         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
10822         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
10823         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
10824         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
10825         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
10826         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
10827                                                 HCI_MGMT_VAR_LEN },
10828         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
10829         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
10830         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
10831         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
10832         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
10833         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
10834         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
10835         { set_advertising,         MGMT_SETTING_SIZE },
10836         { set_bredr,               MGMT_SETTING_SIZE },
10837         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
10838         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
10839         { set_secure_conn,         MGMT_SETTING_SIZE },
10840         { set_debug_keys,          MGMT_SETTING_SIZE },
10841         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
10842         { load_irks,               MGMT_LOAD_IRKS_SIZE,
10843                                                 HCI_MGMT_VAR_LEN },
10844         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
10845         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
10846         { add_device,              MGMT_ADD_DEVICE_SIZE },
10847         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
10848         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
10849                                                 HCI_MGMT_VAR_LEN },
10850         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
10851                                                 HCI_MGMT_NO_HDEV |
10852                                                 HCI_MGMT_UNTRUSTED },
10853         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
10854                                                 HCI_MGMT_UNCONFIGURED |
10855                                                 HCI_MGMT_UNTRUSTED },
10856         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
10857                                                 HCI_MGMT_UNCONFIGURED },
10858         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
10859                                                 HCI_MGMT_UNCONFIGURED },
10860         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
10861                                                 HCI_MGMT_VAR_LEN },
10862         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
10863         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
10864                                                 HCI_MGMT_NO_HDEV |
10865                                                 HCI_MGMT_UNTRUSTED },
10866         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
10867         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
10868                                                 HCI_MGMT_VAR_LEN },
10869         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
10870         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
10871         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
10872         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
10873                                                 HCI_MGMT_UNTRUSTED },
10874         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
10875         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
10876         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
10877         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
10878                                                 HCI_MGMT_VAR_LEN },
10879         { set_wideband_speech,     MGMT_SETTING_SIZE },
10880         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
10881                                                 HCI_MGMT_UNTRUSTED },
10882         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
10883                                                 HCI_MGMT_UNTRUSTED |
10884                                                 HCI_MGMT_HDEV_OPTIONAL },
10885         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
10886                                                 HCI_MGMT_VAR_LEN |
10887                                                 HCI_MGMT_HDEV_OPTIONAL },
10888         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
10889                                                 HCI_MGMT_UNTRUSTED },
10890         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
10891                                                 HCI_MGMT_VAR_LEN },
10892         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
10893                                                 HCI_MGMT_UNTRUSTED },
10894         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
10895                                                 HCI_MGMT_VAR_LEN },
10896         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
10897         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
10898         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
10899         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
10900                                                 HCI_MGMT_VAR_LEN },
10901         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
10902         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
10903                                                 HCI_MGMT_VAR_LEN },
10904         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
10905                                                 HCI_MGMT_VAR_LEN },
10906         { add_adv_patterns_monitor_rssi,
10907                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
10908                                                 HCI_MGMT_VAR_LEN },
10909         { set_mesh,                MGMT_SET_MESH_RECEIVER_SIZE,
10910                                                 HCI_MGMT_VAR_LEN },
10911         { mesh_features,           MGMT_MESH_READ_FEATURES_SIZE },
10912         { mesh_send,               MGMT_MESH_SEND_SIZE,
10913                                                 HCI_MGMT_VAR_LEN },
10914         { mesh_send_cancel,        MGMT_MESH_SEND_CANCEL_SIZE },
10915 };
10916
10917 #ifdef TIZEN_BT
10918 static const struct hci_mgmt_handler tizen_mgmt_handlers[] = {
10919         { NULL }, /* 0x0000 (no command) */
10920         { set_advertising_params,  MGMT_SET_ADVERTISING_PARAMS_SIZE },
10921         { set_advertising_data,    MGMT_SET_ADV_MIN_APP_DATA_SIZE,
10922                                                 HCI_MGMT_VAR_LEN },
10923         { set_scan_rsp_data,       MGMT_SET_SCAN_RSP_MIN_APP_DATA_SIZE,
10924                                                 HCI_MGMT_VAR_LEN },
10925         { add_white_list,          MGMT_ADD_DEV_WHITE_LIST_SIZE },
10926         { remove_from_white_list,  MGMT_REMOVE_DEV_FROM_WHITE_LIST_SIZE },
10927         { clear_white_list,        MGMT_OP_CLEAR_DEV_WHITE_LIST_SIZE },
10928         { set_enable_rssi,         MGMT_SET_RSSI_ENABLE_SIZE },
10929         { get_raw_rssi,            MGMT_GET_RAW_RSSI_SIZE },
10930         { set_disable_threshold,   MGMT_SET_RSSI_DISABLE_SIZE },
10931         { start_le_discovery,      MGMT_START_LE_DISCOVERY_SIZE },
10932         { stop_le_discovery,       MGMT_STOP_LE_DISCOVERY_SIZE },
10933         { disable_le_auto_connect, MGMT_DISABLE_LE_AUTO_CONNECT_SIZE },
10934         { le_conn_update,          MGMT_LE_CONN_UPDATE_SIZE },
10935 };
10936 #endif
10937
10938 void mgmt_index_added(struct hci_dev *hdev)
10939 {
10940         struct mgmt_ev_ext_index ev;
10941
10942         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10943                 return;
10944
10945         switch (hdev->dev_type) {
10946         case HCI_PRIMARY:
10947                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10948                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
10949                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10950                         ev.type = 0x01;
10951                 } else {
10952                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
10953                                          HCI_MGMT_INDEX_EVENTS);
10954                         ev.type = 0x00;
10955                 }
10956                 break;
10957         case HCI_AMP:
10958                 ev.type = 0x02;
10959                 break;
10960         default:
10961                 return;
10962         }
10963
10964         ev.bus = hdev->bus;
10965
10966         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
10967                          HCI_MGMT_EXT_INDEX_EVENTS);
10968 }
10969
10970 void mgmt_index_removed(struct hci_dev *hdev)
10971 {
10972         struct mgmt_ev_ext_index ev;
10973         u8 status = MGMT_STATUS_INVALID_INDEX;
10974
10975         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10976                 return;
10977
10978         switch (hdev->dev_type) {
10979         case HCI_PRIMARY:
10980                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
10981
10982                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10983                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
10984                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10985                         ev.type = 0x01;
10986                 } else {
10987                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
10988                                          HCI_MGMT_INDEX_EVENTS);
10989                         ev.type = 0x00;
10990                 }
10991                 break;
10992         case HCI_AMP:
10993                 ev.type = 0x02;
10994                 break;
10995         default:
10996                 return;
10997         }
10998
10999         ev.bus = hdev->bus;
11000
11001         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
11002                          HCI_MGMT_EXT_INDEX_EVENTS);
11003
11004         /* Cancel any remaining timed work */
11005         if (!hci_dev_test_flag(hdev, HCI_MGMT))
11006                 return;
11007         cancel_delayed_work_sync(&hdev->discov_off);
11008         cancel_delayed_work_sync(&hdev->service_cache);
11009         cancel_delayed_work_sync(&hdev->rpa_expired);
11010 }
11011
11012 void mgmt_power_on(struct hci_dev *hdev, int err)
11013 {
11014         struct cmd_lookup match = { NULL, hdev };
11015
11016         bt_dev_dbg(hdev, "err %d", err);
11017
11018         hci_dev_lock(hdev);
11019
11020         if (!err) {
11021                 restart_le_actions(hdev);
11022                 hci_update_passive_scan(hdev);
11023         }
11024
11025         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
11026
11027         new_settings(hdev, match.sk);
11028
11029         if (match.sk)
11030                 sock_put(match.sk);
11031
11032         hci_dev_unlock(hdev);
11033 }
11034
11035 void __mgmt_power_off(struct hci_dev *hdev)
11036 {
11037         struct cmd_lookup match = { NULL, hdev };
11038         u8 status, zero_cod[] = { 0, 0, 0 };
11039
11040         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
11041
11042         /* If the power off is because of hdev unregistration let
11043          * use the appropriate INVALID_INDEX status. Otherwise use
11044          * NOT_POWERED. We cover both scenarios here since later in
11045          * mgmt_index_removed() any hci_conn callbacks will have already
11046          * been triggered, potentially causing misleading DISCONNECTED
11047          * status responses.
11048          */
11049         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
11050                 status = MGMT_STATUS_INVALID_INDEX;
11051         else
11052                 status = MGMT_STATUS_NOT_POWERED;
11053
11054         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
11055
11056         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
11057                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
11058                                    zero_cod, sizeof(zero_cod),
11059                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
11060                 ext_info_changed(hdev, NULL);
11061         }
11062
11063         new_settings(hdev, match.sk);
11064
11065         if (match.sk)
11066                 sock_put(match.sk);
11067 }
11068
11069 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
11070 {
11071         struct mgmt_pending_cmd *cmd;
11072         u8 status;
11073
11074         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
11075         if (!cmd)
11076                 return;
11077
11078         if (err == -ERFKILL)
11079                 status = MGMT_STATUS_RFKILLED;
11080         else
11081                 status = MGMT_STATUS_FAILED;
11082
11083         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
11084
11085         mgmt_pending_remove(cmd);
11086 }
11087
11088 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
11089                        bool persistent)
11090 {
11091         struct mgmt_ev_new_link_key ev;
11092
11093         memset(&ev, 0, sizeof(ev));
11094
11095         ev.store_hint = persistent;
11096         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
11097         ev.key.addr.type = BDADDR_BREDR;
11098         ev.key.type = key->type;
11099         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
11100         ev.key.pin_len = key->pin_len;
11101
11102         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
11103 }
11104
11105 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
11106 {
11107         switch (ltk->type) {
11108         case SMP_LTK:
11109         case SMP_LTK_RESPONDER:
11110                 if (ltk->authenticated)
11111                         return MGMT_LTK_AUTHENTICATED;
11112                 return MGMT_LTK_UNAUTHENTICATED;
11113         case SMP_LTK_P256:
11114                 if (ltk->authenticated)
11115                         return MGMT_LTK_P256_AUTH;
11116                 return MGMT_LTK_P256_UNAUTH;
11117         case SMP_LTK_P256_DEBUG:
11118                 return MGMT_LTK_P256_DEBUG;
11119         }
11120
11121         return MGMT_LTK_UNAUTHENTICATED;
11122 }
11123
11124 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
11125 {
11126         struct mgmt_ev_new_long_term_key ev;
11127
11128         memset(&ev, 0, sizeof(ev));
11129
11130         /* Devices using resolvable or non-resolvable random addresses
11131          * without providing an identity resolving key don't require
11132          * to store long term keys. Their addresses will change the
11133          * next time around.
11134          *
11135          * Only when a remote device provides an identity address
11136          * make sure the long term key is stored. If the remote
11137          * identity is known, the long term keys are internally
11138          * mapped to the identity address. So allow static random
11139          * and public addresses here.
11140          */
11141         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
11142             (key->bdaddr.b[5] & 0xc0) != 0xc0)
11143                 ev.store_hint = 0x00;
11144         else
11145                 ev.store_hint = persistent;
11146
11147         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
11148         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
11149         ev.key.type = mgmt_ltk_type(key);
11150         ev.key.enc_size = key->enc_size;
11151         ev.key.ediv = key->ediv;
11152         ev.key.rand = key->rand;
11153
11154         if (key->type == SMP_LTK)
11155                 ev.key.initiator = 1;
11156
11157         /* Make sure we copy only the significant bytes based on the
11158          * encryption key size, and set the rest of the value to zeroes.
11159          */
11160         memcpy(ev.key.val, key->val, key->enc_size);
11161         memset(ev.key.val + key->enc_size, 0,
11162                sizeof(ev.key.val) - key->enc_size);
11163
11164         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
11165 }
11166
11167 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
11168 {
11169         struct mgmt_ev_new_irk ev;
11170
11171         memset(&ev, 0, sizeof(ev));
11172
11173         ev.store_hint = persistent;
11174
11175         bacpy(&ev.rpa, &irk->rpa);
11176         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
11177         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
11178         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
11179
11180         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
11181 }
11182
11183 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
11184                    bool persistent)
11185 {
11186         struct mgmt_ev_new_csrk ev;
11187
11188         memset(&ev, 0, sizeof(ev));
11189
11190         /* Devices using resolvable or non-resolvable random addresses
11191          * without providing an identity resolving key don't require
11192          * to store signature resolving keys. Their addresses will change
11193          * the next time around.
11194          *
11195          * Only when a remote device provides an identity address
11196          * make sure the signature resolving key is stored. So allow
11197          * static random and public addresses here.
11198          */
11199         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
11200             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
11201                 ev.store_hint = 0x00;
11202         else
11203                 ev.store_hint = persistent;
11204
11205         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
11206         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
11207         ev.key.type = csrk->type;
11208         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
11209
11210         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
11211 }
11212
11213 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
11214                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
11215                          u16 max_interval, u16 latency, u16 timeout)
11216 {
11217         struct mgmt_ev_new_conn_param ev;
11218
11219         if (!hci_is_identity_address(bdaddr, bdaddr_type))
11220                 return;
11221
11222         memset(&ev, 0, sizeof(ev));
11223         bacpy(&ev.addr.bdaddr, bdaddr);
11224         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
11225         ev.store_hint = store_hint;
11226         ev.min_interval = cpu_to_le16(min_interval);
11227         ev.max_interval = cpu_to_le16(max_interval);
11228         ev.latency = cpu_to_le16(latency);
11229         ev.timeout = cpu_to_le16(timeout);
11230
11231         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
11232 }
11233
11234 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
11235                            u8 *name, u8 name_len)
11236 {
11237         struct sk_buff *skb;
11238         struct mgmt_ev_device_connected *ev;
11239         u16 eir_len = 0;
11240         u32 flags = 0;
11241
11242         /* allocate buff for LE or BR/EDR adv */
11243         if (conn->le_adv_data_len > 0)
11244                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
11245                                      sizeof(*ev) + conn->le_adv_data_len);
11246         else
11247                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
11248                                      sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) +
11249                                      eir_precalc_len(sizeof(conn->dev_class)));
11250
11251         ev = skb_put(skb, sizeof(*ev));
11252         bacpy(&ev->addr.bdaddr, &conn->dst);
11253         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
11254
11255         if (conn->out)
11256                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
11257
11258         ev->flags = __cpu_to_le32(flags);
11259
11260         /* We must ensure that the EIR Data fields are ordered and
11261          * unique. Keep it simple for now and avoid the problem by not
11262          * adding any BR/EDR data to the LE adv.
11263          */
11264         if (conn->le_adv_data_len > 0) {
11265                 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len);
11266                 eir_len = conn->le_adv_data_len;
11267         } else {
11268                 if (name)
11269                         eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
11270
11271                 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class)))
11272                         eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV,
11273                                                     conn->dev_class, sizeof(conn->dev_class));
11274         }
11275
11276         ev->eir_len = cpu_to_le16(eir_len);
11277
11278         mgmt_event_skb(skb, NULL);
11279 }
11280
11281 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
11282 {
11283         struct sock **sk = data;
11284
11285         cmd->cmd_complete(cmd, 0);
11286
11287         *sk = cmd->sk;
11288         sock_hold(*sk);
11289
11290         mgmt_pending_remove(cmd);
11291 }
11292
11293 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
11294 {
11295         struct hci_dev *hdev = data;
11296         struct mgmt_cp_unpair_device *cp = cmd->param;
11297
11298         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
11299
11300         cmd->cmd_complete(cmd, 0);
11301         mgmt_pending_remove(cmd);
11302 }
11303
11304 bool mgmt_powering_down(struct hci_dev *hdev)
11305 {
11306         struct mgmt_pending_cmd *cmd;
11307         struct mgmt_mode *cp;
11308
11309         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
11310         if (!cmd)
11311                 return false;
11312
11313         cp = cmd->param;
11314         if (!cp->val)
11315                 return true;
11316
11317         return false;
11318 }
11319
11320 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
11321                               u8 link_type, u8 addr_type, u8 reason,
11322                               bool mgmt_connected)
11323 {
11324         struct mgmt_ev_device_disconnected ev;
11325         struct sock *sk = NULL;
11326
11327         /* The connection is still in hci_conn_hash so test for 1
11328          * instead of 0 to know if this is the last one.
11329          */
11330         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
11331                 cancel_delayed_work(&hdev->power_off);
11332                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
11333         }
11334
11335         if (!mgmt_connected)
11336                 return;
11337
11338         if (link_type != ACL_LINK && link_type != LE_LINK)
11339                 return;
11340
11341         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
11342
11343         bacpy(&ev.addr.bdaddr, bdaddr);
11344         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11345         ev.reason = reason;
11346
11347         /* Report disconnects due to suspend */
11348         if (hdev->suspended)
11349                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
11350
11351         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
11352
11353         if (sk)
11354                 sock_put(sk);
11355
11356         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
11357                              hdev);
11358 }
11359
11360 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
11361                             u8 link_type, u8 addr_type, u8 status)
11362 {
11363         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
11364         struct mgmt_cp_disconnect *cp;
11365         struct mgmt_pending_cmd *cmd;
11366
11367         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
11368                              hdev);
11369
11370         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
11371         if (!cmd)
11372                 return;
11373
11374         cp = cmd->param;
11375
11376         if (bacmp(bdaddr, &cp->addr.bdaddr))
11377                 return;
11378
11379         if (cp->addr.type != bdaddr_type)
11380                 return;
11381
11382         cmd->cmd_complete(cmd, mgmt_status(status));
11383         mgmt_pending_remove(cmd);
11384 }
11385
11386 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11387                          u8 addr_type, u8 status)
11388 {
11389         struct mgmt_ev_connect_failed ev;
11390
11391         /* The connection is still in hci_conn_hash so test for 1
11392          * instead of 0 to know if this is the last one.
11393          */
11394         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
11395                 cancel_delayed_work(&hdev->power_off);
11396                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
11397         }
11398
11399         bacpy(&ev.addr.bdaddr, bdaddr);
11400         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11401         ev.status = mgmt_status(status);
11402
11403         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
11404 }
11405
11406 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
11407 {
11408         struct mgmt_ev_pin_code_request ev;
11409
11410         bacpy(&ev.addr.bdaddr, bdaddr);
11411         ev.addr.type = BDADDR_BREDR;
11412         ev.secure = secure;
11413
11414         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
11415 }
11416
11417 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11418                                   u8 status)
11419 {
11420         struct mgmt_pending_cmd *cmd;
11421
11422         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
11423         if (!cmd)
11424                 return;
11425
11426         cmd->cmd_complete(cmd, mgmt_status(status));
11427         mgmt_pending_remove(cmd);
11428 }
11429
11430 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11431                                       u8 status)
11432 {
11433         struct mgmt_pending_cmd *cmd;
11434
11435         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
11436         if (!cmd)
11437                 return;
11438
11439         cmd->cmd_complete(cmd, mgmt_status(status));
11440         mgmt_pending_remove(cmd);
11441 }
11442
11443 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
11444                               u8 link_type, u8 addr_type, u32 value,
11445                               u8 confirm_hint)
11446 {
11447         struct mgmt_ev_user_confirm_request ev;
11448
11449         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11450
11451         bacpy(&ev.addr.bdaddr, bdaddr);
11452         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11453         ev.confirm_hint = confirm_hint;
11454         ev.value = cpu_to_le32(value);
11455
11456         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
11457                           NULL);
11458 }
11459
11460 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
11461                               u8 link_type, u8 addr_type)
11462 {
11463         struct mgmt_ev_user_passkey_request ev;
11464
11465         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11466
11467         bacpy(&ev.addr.bdaddr, bdaddr);
11468         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11469
11470         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
11471                           NULL);
11472 }
11473
11474 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11475                                       u8 link_type, u8 addr_type, u8 status,
11476                                       u8 opcode)
11477 {
11478         struct mgmt_pending_cmd *cmd;
11479
11480         cmd = pending_find(opcode, hdev);
11481         if (!cmd)
11482                 return -ENOENT;
11483
11484         cmd->cmd_complete(cmd, mgmt_status(status));
11485         mgmt_pending_remove(cmd);
11486
11487         return 0;
11488 }
11489
11490 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11491                                      u8 link_type, u8 addr_type, u8 status)
11492 {
11493         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11494                                           status, MGMT_OP_USER_CONFIRM_REPLY);
11495 }
11496
11497 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11498                                          u8 link_type, u8 addr_type, u8 status)
11499 {
11500         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11501                                           status,
11502                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
11503 }
11504
11505 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11506                                      u8 link_type, u8 addr_type, u8 status)
11507 {
11508         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11509                                           status, MGMT_OP_USER_PASSKEY_REPLY);
11510 }
11511
11512 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11513                                          u8 link_type, u8 addr_type, u8 status)
11514 {
11515         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11516                                           status,
11517                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
11518 }
11519
11520 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
11521                              u8 link_type, u8 addr_type, u32 passkey,
11522                              u8 entered)
11523 {
11524         struct mgmt_ev_passkey_notify ev;
11525
11526         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11527
11528         bacpy(&ev.addr.bdaddr, bdaddr);
11529         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11530         ev.passkey = __cpu_to_le32(passkey);
11531         ev.entered = entered;
11532
11533         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
11534 }
11535
11536 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
11537 {
11538         struct mgmt_ev_auth_failed ev;
11539         struct mgmt_pending_cmd *cmd;
11540         u8 status = mgmt_status(hci_status);
11541
11542         bacpy(&ev.addr.bdaddr, &conn->dst);
11543         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
11544         ev.status = status;
11545
11546         cmd = find_pairing(conn);
11547
11548         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
11549                     cmd ? cmd->sk : NULL);
11550
11551         if (cmd) {
11552                 cmd->cmd_complete(cmd, status);
11553                 mgmt_pending_remove(cmd);
11554         }
11555 }
11556
11557 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
11558 {
11559         struct cmd_lookup match = { NULL, hdev };
11560         bool changed;
11561
11562         if (status) {
11563                 u8 mgmt_err = mgmt_status(status);
11564                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
11565                                      cmd_status_rsp, &mgmt_err);
11566                 return;
11567         }
11568
11569         if (test_bit(HCI_AUTH, &hdev->flags))
11570                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
11571         else
11572                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
11573
11574         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
11575                              &match);
11576
11577         if (changed)
11578                 new_settings(hdev, match.sk);
11579
11580         if (match.sk)
11581                 sock_put(match.sk);
11582 }
11583
11584 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
11585 {
11586         struct cmd_lookup *match = data;
11587
11588         if (match->sk == NULL) {
11589                 match->sk = cmd->sk;
11590                 sock_hold(match->sk);
11591         }
11592 }
11593
11594 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
11595                                     u8 status)
11596 {
11597         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
11598
11599         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
11600         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
11601         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
11602
11603         if (!status) {
11604                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
11605                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
11606                 ext_info_changed(hdev, NULL);
11607         }
11608
11609         if (match.sk)
11610                 sock_put(match.sk);
11611 }
11612
11613 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
11614 {
11615         struct mgmt_cp_set_local_name ev;
11616         struct mgmt_pending_cmd *cmd;
11617
11618         if (status)
11619                 return;
11620
11621         memset(&ev, 0, sizeof(ev));
11622         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
11623         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
11624
11625         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
11626         if (!cmd) {
11627                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
11628
11629                 /* If this is a HCI command related to powering on the
11630                  * HCI dev don't send any mgmt signals.
11631                  */
11632                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
11633                         return;
11634         }
11635
11636         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
11637                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
11638         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
11639 }
11640
11641 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
11642 {
11643         int i;
11644
11645         for (i = 0; i < uuid_count; i++) {
11646                 if (!memcmp(uuid, uuids[i], 16))
11647                         return true;
11648         }
11649
11650         return false;
11651 }
11652
11653 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
11654 {
11655         u16 parsed = 0;
11656
11657         while (parsed < eir_len) {
11658                 u8 field_len = eir[0];
11659                 u8 uuid[16];
11660                 int i;
11661
11662                 if (field_len == 0)
11663                         break;
11664
11665                 if (eir_len - parsed < field_len + 1)
11666                         break;
11667
11668                 switch (eir[1]) {
11669                 case EIR_UUID16_ALL:
11670                 case EIR_UUID16_SOME:
11671                         for (i = 0; i + 3 <= field_len; i += 2) {
11672                                 memcpy(uuid, bluetooth_base_uuid, 16);
11673                                 uuid[13] = eir[i + 3];
11674                                 uuid[12] = eir[i + 2];
11675                                 if (has_uuid(uuid, uuid_count, uuids))
11676                                         return true;
11677                         }
11678                         break;
11679                 case EIR_UUID32_ALL:
11680                 case EIR_UUID32_SOME:
11681                         for (i = 0; i + 5 <= field_len; i += 4) {
11682                                 memcpy(uuid, bluetooth_base_uuid, 16);
11683                                 uuid[15] = eir[i + 5];
11684                                 uuid[14] = eir[i + 4];
11685                                 uuid[13] = eir[i + 3];
11686                                 uuid[12] = eir[i + 2];
11687                                 if (has_uuid(uuid, uuid_count, uuids))
11688                                         return true;
11689                         }
11690                         break;
11691                 case EIR_UUID128_ALL:
11692                 case EIR_UUID128_SOME:
11693                         for (i = 0; i + 17 <= field_len; i += 16) {
11694                                 memcpy(uuid, eir + i + 2, 16);
11695                                 if (has_uuid(uuid, uuid_count, uuids))
11696                                         return true;
11697                         }
11698                         break;
11699                 }
11700
11701                 parsed += field_len + 1;
11702                 eir += field_len + 1;
11703         }
11704
11705         return false;
11706 }
11707
11708 static void restart_le_scan(struct hci_dev *hdev)
11709 {
11710         /* If controller is not scanning we are done. */
11711         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
11712                 return;
11713
11714         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
11715                        hdev->discovery.scan_start +
11716                        hdev->discovery.scan_duration))
11717                 return;
11718
11719         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
11720                            DISCOV_LE_RESTART_DELAY);
11721 }
11722
11723 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
11724                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
11725 {
11726         /* If a RSSI threshold has been specified, and
11727          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
11728          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
11729          * is set, let it through for further processing, as we might need to
11730          * restart the scan.
11731          *
11732          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
11733          * the results are also dropped.
11734          */
11735         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11736             (rssi == HCI_RSSI_INVALID ||
11737             (rssi < hdev->discovery.rssi &&
11738              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
11739                 return  false;
11740
11741         if (hdev->discovery.uuid_count != 0) {
11742                 /* If a list of UUIDs is provided in filter, results with no
11743                  * matching UUID should be dropped.
11744                  */
11745                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
11746                                    hdev->discovery.uuids) &&
11747                     !eir_has_uuids(scan_rsp, scan_rsp_len,
11748                                    hdev->discovery.uuid_count,
11749                                    hdev->discovery.uuids))
11750                         return false;
11751         }
11752
11753         /* If duplicate filtering does not report RSSI changes, then restart
11754          * scanning to ensure updated result with updated RSSI values.
11755          */
11756         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
11757                 restart_le_scan(hdev);
11758
11759                 /* Validate RSSI value against the RSSI threshold once more. */
11760                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11761                     rssi < hdev->discovery.rssi)
11762                         return false;
11763         }
11764
11765         return true;
11766 }
11767
11768 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle,
11769                                   bdaddr_t *bdaddr, u8 addr_type)
11770 {
11771         struct mgmt_ev_adv_monitor_device_lost ev;
11772
11773         ev.monitor_handle = cpu_to_le16(handle);
11774         bacpy(&ev.addr.bdaddr, bdaddr);
11775         ev.addr.type = addr_type;
11776
11777         mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev),
11778                    NULL);
11779 }
11780
11781 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev,
11782                                                struct sk_buff *skb,
11783                                                struct sock *skip_sk,
11784                                                u16 handle)
11785 {
11786         struct sk_buff *advmon_skb;
11787         size_t advmon_skb_len;
11788         __le16 *monitor_handle;
11789
11790         if (!skb)
11791                 return;
11792
11793         advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) -
11794                           sizeof(struct mgmt_ev_device_found)) + skb->len;
11795         advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
11796                                     advmon_skb_len);
11797         if (!advmon_skb)
11798                 return;
11799
11800         /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except
11801          * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and
11802          * store monitor_handle of the matched monitor.
11803          */
11804         monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle));
11805         *monitor_handle = cpu_to_le16(handle);
11806         skb_put_data(advmon_skb, skb->data, skb->len);
11807
11808         mgmt_event_skb(advmon_skb, skip_sk);
11809 }
11810
11811 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev,
11812                                           bdaddr_t *bdaddr, bool report_device,
11813                                           struct sk_buff *skb,
11814                                           struct sock *skip_sk)
11815 {
11816         struct monitored_device *dev, *tmp;
11817         bool matched = false;
11818         bool notified = false;
11819
11820         /* We have received the Advertisement Report because:
11821          * 1. the kernel has initiated active discovery
11822          * 2. if not, we have pend_le_reports > 0 in which case we are doing
11823          *    passive scanning
11824          * 3. if none of the above is true, we have one or more active
11825          *    Advertisement Monitor
11826          *
11827          * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND
11828          * and report ONLY one advertisement per device for the matched Monitor
11829          * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
11830          *
11831          * For case 3, since we are not active scanning and all advertisements
11832          * received are due to a matched Advertisement Monitor, report all
11833          * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
11834          */
11835         if (report_device && !hdev->advmon_pend_notify) {
11836                 mgmt_event_skb(skb, skip_sk);
11837                 return;
11838         }
11839
11840         hdev->advmon_pend_notify = false;
11841
11842         list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) {
11843                 if (!bacmp(&dev->bdaddr, bdaddr)) {
11844                         matched = true;
11845
11846                         if (!dev->notified) {
11847                                 mgmt_send_adv_monitor_device_found(hdev, skb,
11848                                                                    skip_sk,
11849                                                                    dev->handle);
11850                                 notified = true;
11851                                 dev->notified = true;
11852                         }
11853                 }
11854
11855                 if (!dev->notified)
11856                         hdev->advmon_pend_notify = true;
11857         }
11858
11859         if (!report_device &&
11860             ((matched && !notified) || !msft_monitor_supported(hdev))) {
11861                 /* Handle 0 indicates that we are not active scanning and this
11862                  * is a subsequent advertisement report for an already matched
11863                  * Advertisement Monitor or the controller offloading support
11864                  * is not available.
11865                  */
11866                 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0);
11867         }
11868
11869         if (report_device)
11870                 mgmt_event_skb(skb, skip_sk);
11871         else
11872                 kfree_skb(skb);
11873 }
11874
11875 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr,
11876                               u8 addr_type, s8 rssi, u32 flags, u8 *eir,
11877                               u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
11878                               u64 instant)
11879 {
11880         struct sk_buff *skb;
11881         struct mgmt_ev_mesh_device_found *ev;
11882         int i, j;
11883
11884         if (!hdev->mesh_ad_types[0])
11885                 goto accepted;
11886
11887         /* Scan for requested AD types */
11888         if (eir_len > 0) {
11889                 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) {
11890                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
11891                                 if (!hdev->mesh_ad_types[j])
11892                                         break;
11893
11894                                 if (hdev->mesh_ad_types[j] == eir[i + 1])
11895                                         goto accepted;
11896                         }
11897                 }
11898         }
11899
11900         if (scan_rsp_len > 0) {
11901                 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) {
11902                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
11903                                 if (!hdev->mesh_ad_types[j])
11904                                         break;
11905
11906                                 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1])
11907                                         goto accepted;
11908                         }
11909                 }
11910         }
11911
11912         return;
11913
11914 accepted:
11915         skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND,
11916                              sizeof(*ev) + eir_len + scan_rsp_len);
11917         if (!skb)
11918                 return;
11919
11920         ev = skb_put(skb, sizeof(*ev));
11921
11922         bacpy(&ev->addr.bdaddr, bdaddr);
11923         ev->addr.type = link_to_bdaddr(LE_LINK, addr_type);
11924         ev->rssi = rssi;
11925         ev->flags = cpu_to_le32(flags);
11926         ev->instant = cpu_to_le64(instant);
11927
11928         if (eir_len > 0)
11929                 /* Copy EIR or advertising data into event */
11930                 skb_put_data(skb, eir, eir_len);
11931
11932         if (scan_rsp_len > 0)
11933                 /* Append scan response data to event */
11934                 skb_put_data(skb, scan_rsp, scan_rsp_len);
11935
11936         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
11937
11938         mgmt_event_skb(skb, NULL);
11939 }
11940
11941 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11942                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
11943                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
11944                        u64 instant)
11945 {
11946         struct sk_buff *skb;
11947         struct mgmt_ev_device_found *ev;
11948         bool report_device = hci_discovery_active(hdev);
11949
11950         if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK)
11951                 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags,
11952                                   eir, eir_len, scan_rsp, scan_rsp_len,
11953                                   instant);
11954
11955         /* Don't send events for a non-kernel initiated discovery. With
11956          * LE one exception is if we have pend_le_reports > 0 in which
11957          * case we're doing passive scanning and want these events.
11958          */
11959         if (!hci_discovery_active(hdev)) {
11960                 if (link_type == ACL_LINK)
11961                         return;
11962                 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports))
11963                         report_device = true;
11964                 else if (!hci_is_adv_monitoring(hdev))
11965                         return;
11966         }
11967
11968         if (hdev->discovery.result_filtering) {
11969                 /* We are using service discovery */
11970                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
11971                                      scan_rsp_len))
11972                         return;
11973         }
11974
11975         if (hdev->discovery.limited) {
11976                 /* Check for limited discoverable bit */
11977                 if (dev_class) {
11978                         if (!(dev_class[1] & 0x20))
11979                                 return;
11980                 } else {
11981                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
11982                         if (!flags || !(flags[0] & LE_AD_LIMITED))
11983                                 return;
11984                 }
11985         }
11986
11987         /* Allocate skb. The 5 extra bytes are for the potential CoD field */
11988         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
11989                              sizeof(*ev) + eir_len + scan_rsp_len + 5);
11990         if (!skb)
11991                 return;
11992
11993         ev = skb_put(skb, sizeof(*ev));
11994
11995         /* In case of device discovery with BR/EDR devices (pre 1.2), the
11996          * RSSI value was reported as 0 when not available. This behavior
11997          * is kept when using device discovery. This is required for full
11998          * backwards compatibility with the API.
11999          *
12000          * However when using service discovery, the value 127 will be
12001          * returned when the RSSI is not available.
12002          */
12003         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
12004             link_type == ACL_LINK)
12005                 rssi = 0;
12006
12007         bacpy(&ev->addr.bdaddr, bdaddr);
12008         ev->addr.type = link_to_bdaddr(link_type, addr_type);
12009         ev->rssi = rssi;
12010         ev->flags = cpu_to_le32(flags);
12011
12012         if (eir_len > 0)
12013                 /* Copy EIR or advertising data into event */
12014                 skb_put_data(skb, eir, eir_len);
12015
12016         if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) {
12017                 u8 eir_cod[5];
12018
12019                 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV,
12020                                            dev_class, 3);
12021                 skb_put_data(skb, eir_cod, sizeof(eir_cod));
12022         }
12023
12024         if (scan_rsp_len > 0)
12025                 /* Append scan response data to event */
12026                 skb_put_data(skb, scan_rsp, scan_rsp_len);
12027
12028         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
12029
12030         mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL);
12031 }
12032
12033 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
12034                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
12035 {
12036         struct sk_buff *skb;
12037         struct mgmt_ev_device_found *ev;
12038         u16 eir_len = 0;
12039         u32 flags = 0;
12040
12041         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
12042                              sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));
12043
12044         ev = skb_put(skb, sizeof(*ev));
12045         bacpy(&ev->addr.bdaddr, bdaddr);
12046         ev->addr.type = link_to_bdaddr(link_type, addr_type);
12047         ev->rssi = rssi;
12048
12049         if (name)
12050                 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
12051         else
12052                 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
12053
12054         ev->eir_len = cpu_to_le16(eir_len);
12055         ev->flags = cpu_to_le32(flags);
12056
12057         mgmt_event_skb(skb, NULL);
12058 }
12059
12060 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
12061 {
12062         struct mgmt_ev_discovering ev;
12063
12064         bt_dev_dbg(hdev, "discovering %u", discovering);
12065
12066         memset(&ev, 0, sizeof(ev));
12067         ev.type = hdev->discovery.type;
12068         ev.discovering = discovering;
12069
12070         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
12071 }
12072
12073 void mgmt_suspending(struct hci_dev *hdev, u8 state)
12074 {
12075         struct mgmt_ev_controller_suspend ev;
12076
12077         ev.suspend_state = state;
12078         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
12079 }
12080
12081 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
12082                    u8 addr_type)
12083 {
12084         struct mgmt_ev_controller_resume ev;
12085
12086         ev.wake_reason = reason;
12087         if (bdaddr) {
12088                 bacpy(&ev.addr.bdaddr, bdaddr);
12089                 ev.addr.type = addr_type;
12090         } else {
12091                 memset(&ev.addr, 0, sizeof(ev.addr));
12092         }
12093
12094         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
12095 }
12096
12097 static struct hci_mgmt_chan chan = {
12098         .channel        = HCI_CHANNEL_CONTROL,
12099         .handler_count  = ARRAY_SIZE(mgmt_handlers),
12100         .handlers       = mgmt_handlers,
12101 #ifdef TIZEN_BT
12102         .tizen_handler_count    = ARRAY_SIZE(tizen_mgmt_handlers),
12103         .tizen_handlers = tizen_mgmt_handlers,
12104 #endif
12105         .hdev_init      = mgmt_init_hdev,
12106 };
12107
12108 int mgmt_init(void)
12109 {
12110         return hci_mgmt_chan_register(&chan);
12111 }
12112
12113 void mgmt_exit(void)
12114 {
12115         hci_mgmt_chan_unregister(&chan);
12116 }
12117
12118 void mgmt_cleanup(struct sock *sk)
12119 {
12120         struct mgmt_mesh_tx *mesh_tx;
12121         struct hci_dev *hdev;
12122
12123         read_lock(&hci_dev_list_lock);
12124
12125         list_for_each_entry(hdev, &hci_dev_list, list) {
12126                 do {
12127                         mesh_tx = mgmt_mesh_next(hdev, sk);
12128
12129                         if (mesh_tx)
12130                                 mesh_send_complete(hdev, mesh_tx, true);
12131                 } while (mesh_tx);
12132         }
12133
12134         read_unlock(&hci_dev_list_lock);
12135 }