net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #ifdef TIZEN_BT
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #include <net/bluetooth/sco.h>
  38 #endif
  39
  40 #include "hci_request.h"
  41 #include "smp.h"
  42 #include "mgmt_util.h"
  43 #include "mgmt_config.h"
  44 #include "msft.h"
  45
  46 #define MGMT_VERSION    1
  47 #define MGMT_REVISION   21
  48
  49 static const u16 mgmt_commands[] = {
  50         MGMT_OP_READ_INDEX_LIST,
  51         MGMT_OP_READ_INFO,
  52         MGMT_OP_SET_POWERED,
  53         MGMT_OP_SET_DISCOVERABLE,
  54         MGMT_OP_SET_CONNECTABLE,
  55         MGMT_OP_SET_FAST_CONNECTABLE,
  56         MGMT_OP_SET_BONDABLE,
  57         MGMT_OP_SET_LINK_SECURITY,
  58         MGMT_OP_SET_SSP,
  59         MGMT_OP_SET_HS,
  60         MGMT_OP_SET_LE,
  61         MGMT_OP_SET_DEV_CLASS,
  62         MGMT_OP_SET_LOCAL_NAME,
  63         MGMT_OP_ADD_UUID,
  64         MGMT_OP_REMOVE_UUID,
  65         MGMT_OP_LOAD_LINK_KEYS,
  66         MGMT_OP_LOAD_LONG_TERM_KEYS,
  67         MGMT_OP_DISCONNECT,
  68         MGMT_OP_GET_CONNECTIONS,
  69         MGMT_OP_PIN_CODE_REPLY,
  70         MGMT_OP_PIN_CODE_NEG_REPLY,
  71         MGMT_OP_SET_IO_CAPABILITY,
  72         MGMT_OP_PAIR_DEVICE,
  73         MGMT_OP_CANCEL_PAIR_DEVICE,
  74         MGMT_OP_UNPAIR_DEVICE,
  75         MGMT_OP_USER_CONFIRM_REPLY,
  76         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  77         MGMT_OP_USER_PASSKEY_REPLY,
  78         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  79         MGMT_OP_READ_LOCAL_OOB_DATA,
  80         MGMT_OP_ADD_REMOTE_OOB_DATA,
  81         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  82         MGMT_OP_START_DISCOVERY,
  83         MGMT_OP_STOP_DISCOVERY,
  84         MGMT_OP_CONFIRM_NAME,
  85         MGMT_OP_BLOCK_DEVICE,
  86         MGMT_OP_UNBLOCK_DEVICE,
  87         MGMT_OP_SET_DEVICE_ID,
  88         MGMT_OP_SET_ADVERTISING,
  89         MGMT_OP_SET_BREDR,
  90         MGMT_OP_SET_STATIC_ADDRESS,
  91         MGMT_OP_SET_SCAN_PARAMS,
  92         MGMT_OP_SET_SECURE_CONN,
  93         MGMT_OP_SET_DEBUG_KEYS,
  94         MGMT_OP_SET_PRIVACY,
  95         MGMT_OP_LOAD_IRKS,
  96         MGMT_OP_GET_CONN_INFO,
  97         MGMT_OP_GET_CLOCK_INFO,
  98         MGMT_OP_ADD_DEVICE,
  99         MGMT_OP_REMOVE_DEVICE,
 100         MGMT_OP_LOAD_CONN_PARAM,
 101         MGMT_OP_READ_UNCONF_INDEX_LIST,
 102         MGMT_OP_READ_CONFIG_INFO,
 103         MGMT_OP_SET_EXTERNAL_CONFIG,
 104         MGMT_OP_SET_PUBLIC_ADDRESS,
 105         MGMT_OP_START_SERVICE_DISCOVERY,
 106         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 107         MGMT_OP_READ_EXT_INDEX_LIST,
 108         MGMT_OP_READ_ADV_FEATURES,
 109         MGMT_OP_ADD_ADVERTISING,
 110         MGMT_OP_REMOVE_ADVERTISING,
 111         MGMT_OP_GET_ADV_SIZE_INFO,
 112         MGMT_OP_START_LIMITED_DISCOVERY,
 113         MGMT_OP_READ_EXT_INFO,
 114         MGMT_OP_SET_APPEARANCE,
 115         MGMT_OP_GET_PHY_CONFIGURATION,
 116         MGMT_OP_SET_PHY_CONFIGURATION,
 117         MGMT_OP_SET_BLOCKED_KEYS,
 118         MGMT_OP_SET_WIDEBAND_SPEECH,
 119         MGMT_OP_READ_CONTROLLER_CAP,
 120         MGMT_OP_READ_EXP_FEATURES_INFO,
 121         MGMT_OP_SET_EXP_FEATURE,
 122         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 123         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 124         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 125         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 126         MGMT_OP_GET_DEVICE_FLAGS,
 127         MGMT_OP_SET_DEVICE_FLAGS,
 128         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 129         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 130         MGMT_OP_REMOVE_ADV_MONITOR,
 131         MGMT_OP_ADD_EXT_ADV_PARAMS,
 132         MGMT_OP_ADD_EXT_ADV_DATA,
 133         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 134 };
 135
 136 static const u16 mgmt_events[] = {
 137         MGMT_EV_CONTROLLER_ERROR,
 138         MGMT_EV_INDEX_ADDED,
 139         MGMT_EV_INDEX_REMOVED,
 140         MGMT_EV_NEW_SETTINGS,
 141         MGMT_EV_CLASS_OF_DEV_CHANGED,
 142         MGMT_EV_LOCAL_NAME_CHANGED,
 143         MGMT_EV_NEW_LINK_KEY,
 144         MGMT_EV_NEW_LONG_TERM_KEY,
 145         MGMT_EV_DEVICE_CONNECTED,
 146         MGMT_EV_DEVICE_DISCONNECTED,
 147         MGMT_EV_CONNECT_FAILED,
 148         MGMT_EV_PIN_CODE_REQUEST,
 149         MGMT_EV_USER_CONFIRM_REQUEST,
 150         MGMT_EV_USER_PASSKEY_REQUEST,
 151         MGMT_EV_AUTH_FAILED,
 152         MGMT_EV_DEVICE_FOUND,
 153         MGMT_EV_DISCOVERING,
 154         MGMT_EV_DEVICE_BLOCKED,
 155         MGMT_EV_DEVICE_UNBLOCKED,
 156         MGMT_EV_DEVICE_UNPAIRED,
 157         MGMT_EV_PASSKEY_NOTIFY,
 158         MGMT_EV_NEW_IRK,
 159         MGMT_EV_NEW_CSRK,
 160         MGMT_EV_DEVICE_ADDED,
 161         MGMT_EV_DEVICE_REMOVED,
 162         MGMT_EV_NEW_CONN_PARAM,
 163         MGMT_EV_UNCONF_INDEX_ADDED,
 164         MGMT_EV_UNCONF_INDEX_REMOVED,
 165         MGMT_EV_NEW_CONFIG_OPTIONS,
 166         MGMT_EV_EXT_INDEX_ADDED,
 167         MGMT_EV_EXT_INDEX_REMOVED,
 168         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 169         MGMT_EV_ADVERTISING_ADDED,
 170         MGMT_EV_ADVERTISING_REMOVED,
 171         MGMT_EV_EXT_INFO_CHANGED,
 172         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 173         MGMT_EV_EXP_FEATURE_CHANGED,
 174         MGMT_EV_DEVICE_FLAGS_CHANGED,
 175         MGMT_EV_ADV_MONITOR_ADDED,
 176         MGMT_EV_ADV_MONITOR_REMOVED,
 177         MGMT_EV_CONTROLLER_SUSPEND,
 178         MGMT_EV_CONTROLLER_RESUME,
 179 };
 180
 181 static const u16 mgmt_untrusted_commands[] = {
 182         MGMT_OP_READ_INDEX_LIST,
 183         MGMT_OP_READ_INFO,
 184         MGMT_OP_READ_UNCONF_INDEX_LIST,
 185         MGMT_OP_READ_CONFIG_INFO,
 186         MGMT_OP_READ_EXT_INDEX_LIST,
 187         MGMT_OP_READ_EXT_INFO,
 188         MGMT_OP_READ_CONTROLLER_CAP,
 189         MGMT_OP_READ_EXP_FEATURES_INFO,
 190         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 191         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 192 };
 193
 194 static const u16 mgmt_untrusted_events[] = {
 195         MGMT_EV_INDEX_ADDED,
 196         MGMT_EV_INDEX_REMOVED,
 197         MGMT_EV_NEW_SETTINGS,
 198         MGMT_EV_CLASS_OF_DEV_CHANGED,
 199         MGMT_EV_LOCAL_NAME_CHANGED,
 200         MGMT_EV_UNCONF_INDEX_ADDED,
 201         MGMT_EV_UNCONF_INDEX_REMOVED,
 202         MGMT_EV_NEW_CONFIG_OPTIONS,
 203         MGMT_EV_EXT_INDEX_ADDED,
 204         MGMT_EV_EXT_INDEX_REMOVED,
 205         MGMT_EV_EXT_INFO_CHANGED,
 206         MGMT_EV_EXP_FEATURE_CHANGED,
 207 };
 208
 209 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 210
 211 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 212                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 213
 214 /* HCI to MGMT error code conversion table */
 215 static const u8 mgmt_status_table[] = {
 216         MGMT_STATUS_SUCCESS,
 217         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 218         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 219         MGMT_STATUS_FAILED,             /* Hardware Failure */
 220         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 221         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 222         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 223         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 224         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 225         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 226         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 227         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 228         MGMT_STATUS_BUSY,               /* Command Disallowed */
 229         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 230         MGMT_STATUS_REJECTED,           /* Rejected Security */
 231         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 232         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 233         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 234         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 235         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 236         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 237         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 238         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 239         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 240         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 241         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 242         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 243         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 244         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 245         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 246         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 247         MGMT_STATUS_FAILED,             /* Unspecified Error */
 248         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 249         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 250         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 251         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 252         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 253         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 254         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 255         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 256         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 257         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 258         MGMT_STATUS_FAILED,             /* Transaction Collision */
 259         MGMT_STATUS_FAILED,             /* Reserved for future use */
 260         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 261         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 262         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 263         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 264         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 265         MGMT_STATUS_FAILED,             /* Reserved for future use */
 266         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 267         MGMT_STATUS_FAILED,             /* Reserved for future use */
 268         MGMT_STATUS_FAILED,             /* Slot Violation */
 269         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 270         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 271         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 272         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 273         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 274         MGMT_STATUS_BUSY,               /* Controller Busy */
 275         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 276         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 277         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 278         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 279         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 280 };
 281
 282 static u8 mgmt_status(u8 hci_status)
 283 {
 284         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 285                 return mgmt_status_table[hci_status];
 286
 287         return MGMT_STATUS_FAILED;
 288 }
 289
 290 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 291                             u16 len, int flag)
 292 {
 293         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 294                                flag, NULL);
 295 }
 296
 297 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 298                               u16 len, int flag, struct sock *skip_sk)
 299 {
 300         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 301                                flag, skip_sk);
 302 }
 303
 304 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 305                       struct sock *skip_sk)
 306 {
 307         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 308                                HCI_SOCK_TRUSTED, skip_sk);
 309 }
 310
 311 static u8 le_addr_type(u8 mgmt_addr_type)
 312 {
 313         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 314                 return ADDR_LE_DEV_PUBLIC;
 315         else
 316                 return ADDR_LE_DEV_RANDOM;
 317 }
 318
 319 void mgmt_fill_version_info(void *ver)
 320 {
 321         struct mgmt_rp_read_version *rp = ver;
 322
 323         rp->version = MGMT_VERSION;
 324         rp->revision = cpu_to_le16(MGMT_REVISION);
 325 }
 326
 327 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 328                         u16 data_len)
 329 {
 330         struct mgmt_rp_read_version rp;
 331
 332         bt_dev_dbg(hdev, "sock %p", sk);
 333
 334         mgmt_fill_version_info(&rp);
 335
 336         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 337                                  &rp, sizeof(rp));
 338 }
 339
 340 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 341                          u16 data_len)
 342 {
 343         struct mgmt_rp_read_commands *rp;
 344         u16 num_commands, num_events;
 345         size_t rp_size;
 346         int i, err;
 347
 348         bt_dev_dbg(hdev, "sock %p", sk);
 349
 350         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 351                 num_commands = ARRAY_SIZE(mgmt_commands);
 352                 num_events = ARRAY_SIZE(mgmt_events);
 353         } else {
 354                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 355                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 356         }
 357
 358         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 359
 360         rp = kmalloc(rp_size, GFP_KERNEL);
 361         if (!rp)
 362                 return -ENOMEM;
 363
 364         rp->num_commands = cpu_to_le16(num_commands);
 365         rp->num_events = cpu_to_le16(num_events);
 366
 367         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 368                 __le16 *opcode = rp->opcodes;
 369
 370                 for (i = 0; i < num_commands; i++, opcode++)
 371                         put_unaligned_le16(mgmt_commands[i], opcode);
 372
 373                 for (i = 0; i < num_events; i++, opcode++)
 374                         put_unaligned_le16(mgmt_events[i], opcode);
 375         } else {
 376                 __le16 *opcode = rp->opcodes;
 377
 378                 for (i = 0; i < num_commands; i++, opcode++)
 379                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 380
 381                 for (i = 0; i < num_events; i++, opcode++)
 382                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 383         }
 384
 385         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 386                                 rp, rp_size);
 387         kfree(rp);
 388
 389         return err;
 390 }
 391
 392 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 393                            u16 data_len)
 394 {
 395         struct mgmt_rp_read_index_list *rp;
 396         struct hci_dev *d;
 397         size_t rp_len;
 398         u16 count;
 399         int err;
 400
 401         bt_dev_dbg(hdev, "sock %p", sk);
 402
 403         read_lock(&hci_dev_list_lock);
 404
 405         count = 0;
 406         list_for_each_entry(d, &hci_dev_list, list) {
 407                 if (d->dev_type == HCI_PRIMARY &&
 408                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 409                         count++;
 410         }
 411
 412         rp_len = sizeof(*rp) + (2 * count);
 413         rp = kmalloc(rp_len, GFP_ATOMIC);
 414         if (!rp) {
 415                 read_unlock(&hci_dev_list_lock);
 416                 return -ENOMEM;
 417         }
 418
 419         count = 0;
 420         list_for_each_entry(d, &hci_dev_list, list) {
 421                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 422                     hci_dev_test_flag(d, HCI_CONFIG) ||
 423                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 424                         continue;
 425
 426                 /* Devices marked as raw-only are neither configured
 427                  * nor unconfigured controllers.
 428                  */
 429                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 430                         continue;
 431
 432                 if (d->dev_type == HCI_PRIMARY &&
 433                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 434                         rp->index[count++] = cpu_to_le16(d->id);
 435                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 436                 }
 437         }
 438
 439         rp->num_controllers = cpu_to_le16(count);
 440         rp_len = sizeof(*rp) + (2 * count);
 441
 442         read_unlock(&hci_dev_list_lock);
 443
 444         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 445                                 0, rp, rp_len);
 446
 447         kfree(rp);
 448
 449         return err;
 450 }
 451
 452 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 453                                   void *data, u16 data_len)
 454 {
 455         struct mgmt_rp_read_unconf_index_list *rp;
 456         struct hci_dev *d;
 457         size_t rp_len;
 458         u16 count;
 459         int err;
 460
 461         bt_dev_dbg(hdev, "sock %p", sk);
 462
 463         read_lock(&hci_dev_list_lock);
 464
 465         count = 0;
 466         list_for_each_entry(d, &hci_dev_list, list) {
 467                 if (d->dev_type == HCI_PRIMARY &&
 468                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 469                         count++;
 470         }
 471
 472         rp_len = sizeof(*rp) + (2 * count);
 473         rp = kmalloc(rp_len, GFP_ATOMIC);
 474         if (!rp) {
 475                 read_unlock(&hci_dev_list_lock);
 476                 return -ENOMEM;
 477         }
 478
 479         count = 0;
 480         list_for_each_entry(d, &hci_dev_list, list) {
 481                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 482                     hci_dev_test_flag(d, HCI_CONFIG) ||
 483                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 484                         continue;
 485
 486                 /* Devices marked as raw-only are neither configured
 487                  * nor unconfigured controllers.
 488                  */
 489                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 490                         continue;
 491
 492                 if (d->dev_type == HCI_PRIMARY &&
 493                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 494                         rp->index[count++] = cpu_to_le16(d->id);
 495                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 496                 }
 497         }
 498
 499         rp->num_controllers = cpu_to_le16(count);
 500         rp_len = sizeof(*rp) + (2 * count);
 501
 502         read_unlock(&hci_dev_list_lock);
 503
 504         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 505                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 506
 507         kfree(rp);
 508
 509         return err;
 510 }
 511
 512 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 513                                void *data, u16 data_len)
 514 {
 515         struct mgmt_rp_read_ext_index_list *rp;
 516         struct hci_dev *d;
 517         u16 count;
 518         int err;
 519
 520         bt_dev_dbg(hdev, "sock %p", sk);
 521
 522         read_lock(&hci_dev_list_lock);
 523
 524         count = 0;
 525         list_for_each_entry(d, &hci_dev_list, list) {
 526                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 527                         count++;
 528         }
 529
 530         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 531         if (!rp) {
 532                 read_unlock(&hci_dev_list_lock);
 533                 return -ENOMEM;
 534         }
 535
 536         count = 0;
 537         list_for_each_entry(d, &hci_dev_list, list) {
 538                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 539                     hci_dev_test_flag(d, HCI_CONFIG) ||
 540                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 541                         continue;
 542
 543                 /* Devices marked as raw-only are neither configured
 544                  * nor unconfigured controllers.
 545                  */
 546                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 547                         continue;
 548
 549                 if (d->dev_type == HCI_PRIMARY) {
 550                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 551                                 rp->entry[count].type = 0x01;
 552                         else
 553                                 rp->entry[count].type = 0x00;
 554                 } else if (d->dev_type == HCI_AMP) {
 555                         rp->entry[count].type = 0x02;
 556                 } else {
 557                         continue;
 558                 }
 559
 560                 rp->entry[count].bus = d->bus;
 561                 rp->entry[count++].index = cpu_to_le16(d->id);
 562                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 563         }
 564
 565         rp->num_controllers = cpu_to_le16(count);
 566
 567         read_unlock(&hci_dev_list_lock);
 568
 569         /* If this command is called at least once, then all the
 570          * default index and unconfigured index events are disabled
 571          * and from now on only extended index events are used.
 572          */
 573         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 574         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 575         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 576
 577         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 578                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 579                                 struct_size(rp, entry, count));
 580
 581         kfree(rp);
 582
 583         return err;
 584 }
 585
 586 static bool is_configured(struct hci_dev *hdev)
 587 {
 588         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 589             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 590                 return false;
 591
 592         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 593              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 594             !bacmp(&hdev->public_addr, BDADDR_ANY))
 595                 return false;
 596
 597         return true;
 598 }
 599
 600 static __le32 get_missing_options(struct hci_dev *hdev)
 601 {
 602         u32 options = 0;
 603
 604         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 605             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 606                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 607
 608         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 609              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 610             !bacmp(&hdev->public_addr, BDADDR_ANY))
 611                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 612
 613         return cpu_to_le32(options);
 614 }
 615
 616 static int new_options(struct hci_dev *hdev, struct sock *skip)
 617 {
 618         __le32 options = get_missing_options(hdev);
 619
 620         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 621                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 622 }
 623
 624 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 625 {
 626         __le32 options = get_missing_options(hdev);
 627
 628         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 629                                  sizeof(options));
 630 }
 631
 632 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 633                             void *data, u16 data_len)
 634 {
 635         struct mgmt_rp_read_config_info rp;
 636         u32 options = 0;
 637
 638         bt_dev_dbg(hdev, "sock %p", sk);
 639
 640         hci_dev_lock(hdev);
 641
 642         memset(&rp, 0, sizeof(rp));
 643         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 644
 645         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 646                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 647
 648         if (hdev->set_bdaddr)
 649                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 650
 651         rp.supported_options = cpu_to_le32(options);
 652         rp.missing_options = get_missing_options(hdev);
 653
 654         hci_dev_unlock(hdev);
 655
 656         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 657                                  &rp, sizeof(rp));
 658 }
 659
 660 static u32 get_supported_phys(struct hci_dev *hdev)
 661 {
 662         u32 supported_phys = 0;
 663
 664         if (lmp_bredr_capable(hdev)) {
 665                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 666
 667                 if (hdev->features[0][0] & LMP_3SLOT)
 668                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 669
 670                 if (hdev->features[0][0] & LMP_5SLOT)
 671                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 672
 673                 if (lmp_edr_2m_capable(hdev)) {
 674                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 675
 676                         if (lmp_edr_3slot_capable(hdev))
 677                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 678
 679                         if (lmp_edr_5slot_capable(hdev))
 680                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 681
 682                         if (lmp_edr_3m_capable(hdev)) {
 683                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 684
 685                                 if (lmp_edr_3slot_capable(hdev))
 686                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 687
 688                                 if (lmp_edr_5slot_capable(hdev))
 689                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 690                         }
 691                 }
 692         }
 693
 694         if (lmp_le_capable(hdev)) {
 695                 supported_phys |= MGMT_PHY_LE_1M_TX;
 696                 supported_phys |= MGMT_PHY_LE_1M_RX;
 697
 698                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 699                         supported_phys |= MGMT_PHY_LE_2M_TX;
 700                         supported_phys |= MGMT_PHY_LE_2M_RX;
 701                 }
 702
 703                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 704                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 705                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 706                 }
 707         }
 708
 709         return supported_phys;
 710 }
 711
 712 static u32 get_selected_phys(struct hci_dev *hdev)
 713 {
 714         u32 selected_phys = 0;
 715
 716         if (lmp_bredr_capable(hdev)) {
 717                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 718
 719                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 720                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 721
 722                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 723                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 724
 725                 if (lmp_edr_2m_capable(hdev)) {
 726                         if (!(hdev->pkt_type & HCI_2DH1))
 727                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 728
 729                         if (lmp_edr_3slot_capable(hdev) &&
 730                             !(hdev->pkt_type & HCI_2DH3))
 731                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 732
 733                         if (lmp_edr_5slot_capable(hdev) &&
 734                             !(hdev->pkt_type & HCI_2DH5))
 735                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 736
 737                         if (lmp_edr_3m_capable(hdev)) {
 738                                 if (!(hdev->pkt_type & HCI_3DH1))
 739                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 740
 741                                 if (lmp_edr_3slot_capable(hdev) &&
 742                                     !(hdev->pkt_type & HCI_3DH3))
 743                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 744
 745                                 if (lmp_edr_5slot_capable(hdev) &&
 746                                     !(hdev->pkt_type & HCI_3DH5))
 747                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 748                         }
 749                 }
 750         }
 751
 752         if (lmp_le_capable(hdev)) {
 753                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 754                         selected_phys |= MGMT_PHY_LE_1M_TX;
 755
 756                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 757                         selected_phys |= MGMT_PHY_LE_1M_RX;
 758
 759                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 760                         selected_phys |= MGMT_PHY_LE_2M_TX;
 761
 762                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 763                         selected_phys |= MGMT_PHY_LE_2M_RX;
 764
 765                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 766                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 767
 768                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 769                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 770         }
 771
 772         return selected_phys;
 773 }
 774
 775 static u32 get_configurable_phys(struct hci_dev *hdev)
 776 {
 777         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 778                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 779 }
 780
 781 static u32 get_supported_settings(struct hci_dev *hdev)
 782 {
 783         u32 settings = 0;
 784
 785         settings |= MGMT_SETTING_POWERED;
 786         settings |= MGMT_SETTING_BONDABLE;
 787         settings |= MGMT_SETTING_DEBUG_KEYS;
 788         settings |= MGMT_SETTING_CONNECTABLE;
 789         settings |= MGMT_SETTING_DISCOVERABLE;
 790
 791         if (lmp_bredr_capable(hdev)) {
 792                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 793                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 794                 settings |= MGMT_SETTING_BREDR;
 795                 settings |= MGMT_SETTING_LINK_SECURITY;
 796
 797                 if (lmp_ssp_capable(hdev)) {
 798                         settings |= MGMT_SETTING_SSP;
 799                         if (IS_ENABLED(CONFIG_BT_HS))
 800                                 settings |= MGMT_SETTING_HS;
 801                 }
 802
 803                 if (lmp_sc_capable(hdev))
 804                         settings |= MGMT_SETTING_SECURE_CONN;
 805
 806                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 807                              &hdev->quirks))
 808                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 809         }
 810
 811         if (lmp_le_capable(hdev)) {
 812                 settings |= MGMT_SETTING_LE;
 813                 settings |= MGMT_SETTING_SECURE_CONN;
 814                 settings |= MGMT_SETTING_PRIVACY;
 815                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 816
 817                 /* When the experimental feature for LL Privacy support is
 818                  * enabled, then advertising is no longer supported.
 819                  */
 820                 if (!hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
 821                         settings |= MGMT_SETTING_ADVERTISING;
 822         }
 823
 824         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 825             hdev->set_bdaddr)
 826                 settings |= MGMT_SETTING_CONFIGURATION;
 827
 828         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 829
 830         return settings;
 831 }
 832
 833 static u32 get_current_settings(struct hci_dev *hdev)
 834 {
 835         u32 settings = 0;
 836
 837         if (hdev_is_powered(hdev))
 838                 settings |= MGMT_SETTING_POWERED;
 839
 840         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 841                 settings |= MGMT_SETTING_CONNECTABLE;
 842
 843         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 844                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 845
 846         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 847                 settings |= MGMT_SETTING_DISCOVERABLE;
 848
 849         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 850                 settings |= MGMT_SETTING_BONDABLE;
 851
 852         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 853                 settings |= MGMT_SETTING_BREDR;
 854
 855         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 856                 settings |= MGMT_SETTING_LE;
 857
 858         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 859                 settings |= MGMT_SETTING_LINK_SECURITY;
 860
 861         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 862                 settings |= MGMT_SETTING_SSP;
 863
 864         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 865                 settings |= MGMT_SETTING_HS;
 866
 867         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 868                 settings |= MGMT_SETTING_ADVERTISING;
 869
 870         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 871                 settings |= MGMT_SETTING_SECURE_CONN;
 872
 873         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 874                 settings |= MGMT_SETTING_DEBUG_KEYS;
 875
 876         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 877                 settings |= MGMT_SETTING_PRIVACY;
 878
 879         /* The current setting for static address has two purposes. The
 880          * first is to indicate if the static address will be used and
 881          * the second is to indicate if it is actually set.
 882          *
 883          * This means if the static address is not configured, this flag
 884          * will never be set. If the address is configured, then if the
 885          * address is actually used decides if the flag is set or not.
 886          *
 887          * For single mode LE only controllers and dual-mode controllers
 888          * with BR/EDR disabled, the existence of the static address will
 889          * be evaluated.
 890          */
 891         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 892             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 893             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 894                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 895                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 896         }
 897
 898         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 899                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 900
 901         return settings;
 902 }
 903
 904 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 905 {
 906         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 907 }
 908
 909 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 910                                                   struct hci_dev *hdev,
 911                                                   const void *data)
 912 {
 913         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 914 }
 915
 916 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 917 {
 918         struct mgmt_pending_cmd *cmd;
 919
 920         /* If there's a pending mgmt command the flags will not yet have
 921          * their final values, so check for this first.
 922          */
 923         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 924         if (cmd) {
 925                 struct mgmt_mode *cp = cmd->param;
 926                 if (cp->val == 0x01)
 927                         return LE_AD_GENERAL;
 928                 else if (cp->val == 0x02)
 929                         return LE_AD_LIMITED;
 930         } else {
 931                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 932                         return LE_AD_LIMITED;
 933                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 934                         return LE_AD_GENERAL;
 935         }
 936
 937         return 0;
 938 }
 939
 940 bool mgmt_get_connectable(struct hci_dev *hdev)
 941 {
 942         struct mgmt_pending_cmd *cmd;
 943
 944         /* If there's a pending mgmt command the flag will not yet have
 945          * it's final value, so check for this first.
 946          */
 947         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 948         if (cmd) {
 949                 struct mgmt_mode *cp = cmd->param;
 950
 951                 return cp->val;
 952         }
 953
 954         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 955 }
 956
 957 static void service_cache_off(struct work_struct *work)
 958 {
 959         struct hci_dev *hdev = container_of(work, struct hci_dev,
 960                                             service_cache.work);
 961         struct hci_request req;
 962
 963         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 964                 return;
 965
 966         hci_req_init(&req, hdev);
 967
 968         hci_dev_lock(hdev);
 969
 970         __hci_req_update_eir(&req);
 971         __hci_req_update_class(&req);
 972
 973         hci_dev_unlock(hdev);
 974
 975         hci_req_run(&req, NULL);
 976 }
 977
 978 static void rpa_expired(struct work_struct *work)
 979 {
 980         struct hci_dev *hdev = container_of(work, struct hci_dev,
 981                                             rpa_expired.work);
 982         struct hci_request req;
 983
 984         bt_dev_dbg(hdev, "");
 985
 986         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 987
 988         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 989                 return;
 990
 991         /* The generation of a new RPA and programming it into the
 992          * controller happens in the hci_req_enable_advertising()
 993          * function.
 994          */
 995         hci_req_init(&req, hdev);
 996         if (ext_adv_capable(hdev))
 997                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 998         else
 999                 __hci_req_enable_advertising(&req);
1000         hci_req_run(&req, NULL);
1001 }
1002
1003 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1004 {
1005         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1006                 return;
1007
1008         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1009         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1010
1011         /* Non-mgmt controlled devices get this bit set
1012          * implicitly so that pairing works for them, however
1013          * for mgmt we require user-space to explicitly enable
1014          * it
1015          */
1016         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1017 }
1018
1019 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1020                                 void *data, u16 data_len)
1021 {
1022         struct mgmt_rp_read_info rp;
1023
1024         bt_dev_dbg(hdev, "sock %p", sk);
1025
1026         hci_dev_lock(hdev);
1027
1028         memset(&rp, 0, sizeof(rp));
1029
1030         bacpy(&rp.bdaddr, &hdev->bdaddr);
1031
1032         rp.version = hdev->hci_ver;
1033         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1034
1035         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1036         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1037
1038         memcpy(rp.dev_class, hdev->dev_class, 3);
1039
1040         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1041         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1042
1043         hci_dev_unlock(hdev);
1044
1045         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1046                                  sizeof(rp));
1047 }
1048
1049 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1050 {
1051         u16 eir_len = 0;
1052         size_t name_len;
1053
1054         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1055                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1056                                           hdev->dev_class, 3);
1057
1058         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1059                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1060                                           hdev->appearance);
1061
1062         name_len = strlen(hdev->dev_name);
1063         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1064                                   hdev->dev_name, name_len);
1065
1066         name_len = strlen(hdev->short_name);
1067         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1068                                   hdev->short_name, name_len);
1069
1070         return eir_len;
1071 }
1072
1073 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1074                                     void *data, u16 data_len)
1075 {
1076         char buf[512];
1077         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1078         u16 eir_len;
1079
1080         bt_dev_dbg(hdev, "sock %p", sk);
1081
1082         memset(&buf, 0, sizeof(buf));
1083
1084         hci_dev_lock(hdev);
1085
1086         bacpy(&rp->bdaddr, &hdev->bdaddr);
1087
1088         rp->version = hdev->hci_ver;
1089         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1090
1091         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1092         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1093
1094
1095         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1096         rp->eir_len = cpu_to_le16(eir_len);
1097
1098         hci_dev_unlock(hdev);
1099
1100         /* If this command is called at least once, then the events
1101          * for class of device and local name changes are disabled
1102          * and only the new extended controller information event
1103          * is used.
1104          */
1105         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1106         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1107         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1108
1109         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1110                                  sizeof(*rp) + eir_len);
1111 }
1112
1113 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1114 {
1115         char buf[512];
1116         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1117         u16 eir_len;
1118
1119         memset(buf, 0, sizeof(buf));
1120
1121         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1122         ev->eir_len = cpu_to_le16(eir_len);
1123
1124         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1125                                   sizeof(*ev) + eir_len,
1126                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1127 }
1128
1129 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1130 {
1131         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1132
1133         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1134                                  sizeof(settings));
1135 }
1136
1137 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1138 {
1139         bt_dev_dbg(hdev, "status 0x%02x", status);
1140
1141         if (hci_conn_count(hdev) == 0) {
1142                 cancel_delayed_work(&hdev->power_off);
1143                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1144         }
1145 }
1146
1147 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1148 {
1149         struct mgmt_ev_advertising_added ev;
1150
1151         ev.instance = instance;
1152
1153         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1154 }
1155
1156 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1157                               u8 instance)
1158 {
1159         struct mgmt_ev_advertising_removed ev;
1160
1161         ev.instance = instance;
1162
1163         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1164 }
1165
1166 static void cancel_adv_timeout(struct hci_dev *hdev)
1167 {
1168         if (hdev->adv_instance_timeout) {
1169                 hdev->adv_instance_timeout = 0;
1170                 cancel_delayed_work(&hdev->adv_instance_expire);
1171         }
1172 }
1173
1174 static int clean_up_hci_state(struct hci_dev *hdev)
1175 {
1176         struct hci_request req;
1177         struct hci_conn *conn;
1178         bool discov_stopped;
1179         int err;
1180
1181         hci_req_init(&req, hdev);
1182
1183         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1184             test_bit(HCI_PSCAN, &hdev->flags)) {
1185                 u8 scan = 0x00;
1186                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1187         }
1188
1189         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1190
1191         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1192                 __hci_req_disable_advertising(&req);
1193
1194         discov_stopped = hci_req_stop_discovery(&req);
1195
1196         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1197                 /* 0x15 == Terminated due to Power Off */
1198                 __hci_abort_conn(&req, conn, 0x15);
1199         }
1200
1201         err = hci_req_run(&req, clean_up_hci_complete);
1202         if (!err && discov_stopped)
1203                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1204
1205         return err;
1206 }
1207
1208 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1209                        u16 len)
1210 {
1211         struct mgmt_mode *cp = data;
1212         struct mgmt_pending_cmd *cmd;
1213         int err;
1214
1215         bt_dev_dbg(hdev, "sock %p", sk);
1216
1217         if (cp->val != 0x00 && cp->val != 0x01)
1218                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1219                                        MGMT_STATUS_INVALID_PARAMS);
1220
1221         hci_dev_lock(hdev);
1222
1223         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1224                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1225                                       MGMT_STATUS_BUSY);
1226                 goto failed;
1227         }
1228
1229         if (!!cp->val == hdev_is_powered(hdev)) {
1230                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1231                 goto failed;
1232         }
1233
1234         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1235         if (!cmd) {
1236                 err = -ENOMEM;
1237                 goto failed;
1238         }
1239
1240         if (cp->val) {
1241                 queue_work(hdev->req_workqueue, &hdev->power_on);
1242                 err = 0;
1243         } else {
1244                 /* Disconnect connections, stop scans, etc */
1245                 err = clean_up_hci_state(hdev);
1246                 if (!err)
1247                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1248                                            HCI_POWER_OFF_TIMEOUT);
1249
1250                 /* ENODATA means there were no HCI commands queued */
1251                 if (err == -ENODATA) {
1252                         cancel_delayed_work(&hdev->power_off);
1253                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1254                         err = 0;
1255                 }
1256         }
1257
1258 failed:
1259         hci_dev_unlock(hdev);
1260         return err;
1261 }
1262
1263 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1264 {
1265         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1266
1267         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1268                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1269 }
1270
1271 int mgmt_new_settings(struct hci_dev *hdev)
1272 {
1273         return new_settings(hdev, NULL);
1274 }
1275
1276 struct cmd_lookup {
1277         struct sock *sk;
1278         struct hci_dev *hdev;
1279         u8 mgmt_status;
1280 };
1281
1282 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1283 {
1284         struct cmd_lookup *match = data;
1285
1286         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1287
1288         list_del(&cmd->list);
1289
1290         if (match->sk == NULL) {
1291                 match->sk = cmd->sk;
1292                 sock_hold(match->sk);
1293         }
1294
1295         mgmt_pending_free(cmd);
1296 }
1297
1298 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1299 {
1300         u8 *status = data;
1301
1302         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1303         mgmt_pending_remove(cmd);
1304 }
1305
1306 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1307 {
1308         if (cmd->cmd_complete) {
1309                 u8 *status = data;
1310
1311                 cmd->cmd_complete(cmd, *status);
1312                 mgmt_pending_remove(cmd);
1313
1314                 return;
1315         }
1316
1317         cmd_status_rsp(cmd, data);
1318 }
1319
1320 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1321 {
1322         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1323                                  cmd->param, cmd->param_len);
1324 }
1325
1326 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1327 {
1328         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1329                                  cmd->param, sizeof(struct mgmt_addr_info));
1330 }
1331
1332 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1333 {
1334         if (!lmp_bredr_capable(hdev))
1335                 return MGMT_STATUS_NOT_SUPPORTED;
1336         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1337                 return MGMT_STATUS_REJECTED;
1338         else
1339                 return MGMT_STATUS_SUCCESS;
1340 }
1341
1342 static u8 mgmt_le_support(struct hci_dev *hdev)
1343 {
1344         if (!lmp_le_capable(hdev))
1345                 return MGMT_STATUS_NOT_SUPPORTED;
1346         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1347                 return MGMT_STATUS_REJECTED;
1348         else
1349                 return MGMT_STATUS_SUCCESS;
1350 }
1351
1352 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1353 {
1354         struct mgmt_pending_cmd *cmd;
1355
1356         bt_dev_dbg(hdev, "status 0x%02x", status);
1357
1358         hci_dev_lock(hdev);
1359
1360         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1361         if (!cmd)
1362                 goto unlock;
1363
1364         if (status) {
1365                 u8 mgmt_err = mgmt_status(status);
1366                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1367                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1368                 goto remove_cmd;
1369         }
1370
1371         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1372             hdev->discov_timeout > 0) {
1373                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1374                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1375         }
1376
1377         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1378         new_settings(hdev, cmd->sk);
1379
1380 remove_cmd:
1381         mgmt_pending_remove(cmd);
1382
1383 unlock:
1384         hci_dev_unlock(hdev);
1385 }
1386
1387 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1388                             u16 len)
1389 {
1390         struct mgmt_cp_set_discoverable *cp = data;
1391         struct mgmt_pending_cmd *cmd;
1392         u16 timeout;
1393         int err;
1394
1395         bt_dev_dbg(hdev, "sock %p", sk);
1396
1397         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1398             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1399                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1400                                        MGMT_STATUS_REJECTED);
1401
1402         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1403                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1404                                        MGMT_STATUS_INVALID_PARAMS);
1405
1406         timeout = __le16_to_cpu(cp->timeout);
1407
1408         /* Disabling discoverable requires that no timeout is set,
1409          * and enabling limited discoverable requires a timeout.
1410          */
1411         if ((cp->val == 0x00 && timeout > 0) ||
1412             (cp->val == 0x02 && timeout == 0))
1413                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1414                                        MGMT_STATUS_INVALID_PARAMS);
1415
1416         hci_dev_lock(hdev);
1417
1418         if (!hdev_is_powered(hdev) && timeout > 0) {
1419                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1420                                       MGMT_STATUS_NOT_POWERED);
1421                 goto failed;
1422         }
1423
1424         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1425             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1426                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1427                                       MGMT_STATUS_BUSY);
1428                 goto failed;
1429         }
1430
1431         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1432                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1433                                       MGMT_STATUS_REJECTED);
1434                 goto failed;
1435         }
1436
1437         if (hdev->advertising_paused) {
1438                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1439                                       MGMT_STATUS_BUSY);
1440                 goto failed;
1441         }
1442
1443         if (!hdev_is_powered(hdev)) {
1444                 bool changed = false;
1445
1446                 /* Setting limited discoverable when powered off is
1447                  * not a valid operation since it requires a timeout
1448                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1449                  */
1450                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1451                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1452                         changed = true;
1453                 }
1454
1455                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1456                 if (err < 0)
1457                         goto failed;
1458
1459                 if (changed)
1460                         err = new_settings(hdev, sk);
1461
1462                 goto failed;
1463         }
1464
1465         /* If the current mode is the same, then just update the timeout
1466          * value with the new value. And if only the timeout gets updated,
1467          * then no need for any HCI transactions.
1468          */
1469         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1470             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1471                                                    HCI_LIMITED_DISCOVERABLE)) {
1472                 cancel_delayed_work(&hdev->discov_off);
1473                 hdev->discov_timeout = timeout;
1474
1475                 if (cp->val && hdev->discov_timeout > 0) {
1476                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1477                         queue_delayed_work(hdev->req_workqueue,
1478                                            &hdev->discov_off, to);
1479                 }
1480
1481                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1482                 goto failed;
1483         }
1484
1485         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1486         if (!cmd) {
1487                 err = -ENOMEM;
1488                 goto failed;
1489         }
1490
1491         /* Cancel any potential discoverable timeout that might be
1492          * still active and store new timeout value. The arming of
1493          * the timeout happens in the complete handler.
1494          */
1495         cancel_delayed_work(&hdev->discov_off);
1496         hdev->discov_timeout = timeout;
1497
1498         if (cp->val)
1499                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1500         else
1501                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1502
1503         /* Limited discoverable mode */
1504         if (cp->val == 0x02)
1505                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1506         else
1507                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1508
1509         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1510         err = 0;
1511
1512 failed:
1513         hci_dev_unlock(hdev);
1514         return err;
1515 }
1516
1517 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1518 {
1519         struct mgmt_pending_cmd *cmd;
1520
1521         bt_dev_dbg(hdev, "status 0x%02x", status);
1522
1523         hci_dev_lock(hdev);
1524
1525         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1526         if (!cmd)
1527                 goto unlock;
1528
1529         if (status) {
1530                 u8 mgmt_err = mgmt_status(status);
1531                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1532                 goto remove_cmd;
1533         }
1534
1535         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1536         new_settings(hdev, cmd->sk);
1537
1538 remove_cmd:
1539         mgmt_pending_remove(cmd);
1540
1541 unlock:
1542         hci_dev_unlock(hdev);
1543 }
1544
1545 static int set_connectable_update_settings(struct hci_dev *hdev,
1546                                            struct sock *sk, u8 val)
1547 {
1548         bool changed = false;
1549         int err;
1550
1551         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1552                 changed = true;
1553
1554         if (val) {
1555                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1556         } else {
1557                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1558                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1559         }
1560
1561         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1562         if (err < 0)
1563                 return err;
1564
1565         if (changed) {
1566                 hci_req_update_scan(hdev);
1567                 hci_update_background_scan(hdev);
1568                 return new_settings(hdev, sk);
1569         }
1570
1571         return 0;
1572 }
1573
1574 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1575                            u16 len)
1576 {
1577         struct mgmt_mode *cp = data;
1578         struct mgmt_pending_cmd *cmd;
1579         int err;
1580
1581         bt_dev_dbg(hdev, "sock %p", sk);
1582
1583         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1584             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1585                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1586                                        MGMT_STATUS_REJECTED);
1587
1588         if (cp->val != 0x00 && cp->val != 0x01)
1589                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1590                                        MGMT_STATUS_INVALID_PARAMS);
1591
1592         hci_dev_lock(hdev);
1593
1594         if (!hdev_is_powered(hdev)) {
1595                 err = set_connectable_update_settings(hdev, sk, cp->val);
1596                 goto failed;
1597         }
1598
1599         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1600             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1601                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1602                                       MGMT_STATUS_BUSY);
1603                 goto failed;
1604         }
1605
1606         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1607         if (!cmd) {
1608                 err = -ENOMEM;
1609                 goto failed;
1610         }
1611
1612         if (cp->val) {
1613                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1614         } else {
1615                 if (hdev->discov_timeout > 0)
1616                         cancel_delayed_work(&hdev->discov_off);
1617
1618                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1619                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1620                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1621         }
1622
1623         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1624         err = 0;
1625
1626 failed:
1627         hci_dev_unlock(hdev);
1628         return err;
1629 }
1630
1631 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1632                         u16 len)
1633 {
1634         struct mgmt_mode *cp = data;
1635         bool changed;
1636         int err;
1637
1638         bt_dev_dbg(hdev, "sock %p", sk);
1639
1640         if (cp->val != 0x00 && cp->val != 0x01)
1641                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1642                                        MGMT_STATUS_INVALID_PARAMS);
1643
1644         hci_dev_lock(hdev);
1645
1646         if (cp->val)
1647                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1648         else
1649                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1650
1651         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1652         if (err < 0)
1653                 goto unlock;
1654
1655         if (changed) {
1656                 /* In limited privacy mode the change of bondable mode
1657                  * may affect the local advertising address.
1658                  */
1659                 if (hdev_is_powered(hdev) &&
1660                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1661                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1662                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1663                         queue_work(hdev->req_workqueue,
1664                                    &hdev->discoverable_update);
1665
1666                 err = new_settings(hdev, sk);
1667         }
1668
1669 unlock:
1670         hci_dev_unlock(hdev);
1671         return err;
1672 }
1673
1674 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1675                              u16 len)
1676 {
1677         struct mgmt_mode *cp = data;
1678         struct mgmt_pending_cmd *cmd;
1679         u8 val, status;
1680         int err;
1681
1682         bt_dev_dbg(hdev, "sock %p", sk);
1683
1684         status = mgmt_bredr_support(hdev);
1685         if (status)
1686                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1687                                        status);
1688
1689         if (cp->val != 0x00 && cp->val != 0x01)
1690                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1691                                        MGMT_STATUS_INVALID_PARAMS);
1692
1693         hci_dev_lock(hdev);
1694
1695         if (!hdev_is_powered(hdev)) {
1696                 bool changed = false;
1697
1698                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1699                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1700                         changed = true;
1701                 }
1702
1703                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1704                 if (err < 0)
1705                         goto failed;
1706
1707                 if (changed)
1708                         err = new_settings(hdev, sk);
1709
1710                 goto failed;
1711         }
1712
1713         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1714                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1715                                       MGMT_STATUS_BUSY);
1716                 goto failed;
1717         }
1718
1719         val = !!cp->val;
1720
1721         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1722                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1723                 goto failed;
1724         }
1725
1726         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1727         if (!cmd) {
1728                 err = -ENOMEM;
1729                 goto failed;
1730         }
1731
1732         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1733         if (err < 0) {
1734                 mgmt_pending_remove(cmd);
1735                 goto failed;
1736         }
1737
1738 failed:
1739         hci_dev_unlock(hdev);
1740         return err;
1741 }
1742
1743 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1744 {
1745         struct mgmt_mode *cp = data;
1746         struct mgmt_pending_cmd *cmd;
1747         u8 status;
1748         int err;
1749
1750         bt_dev_dbg(hdev, "sock %p", sk);
1751
1752         status = mgmt_bredr_support(hdev);
1753         if (status)
1754                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1755
1756         if (!lmp_ssp_capable(hdev))
1757                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1758                                        MGMT_STATUS_NOT_SUPPORTED);
1759
1760         if (cp->val != 0x00 && cp->val != 0x01)
1761                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1762                                        MGMT_STATUS_INVALID_PARAMS);
1763
1764         hci_dev_lock(hdev);
1765
1766         if (!hdev_is_powered(hdev)) {
1767                 bool changed;
1768
1769                 if (cp->val) {
1770                         changed = !hci_dev_test_and_set_flag(hdev,
1771                                                              HCI_SSP_ENABLED);
1772                 } else {
1773                         changed = hci_dev_test_and_clear_flag(hdev,
1774                                                               HCI_SSP_ENABLED);
1775                         if (!changed)
1776                                 changed = hci_dev_test_and_clear_flag(hdev,
1777                                                                       HCI_HS_ENABLED);
1778                         else
1779                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1780                 }
1781
1782                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1783                 if (err < 0)
1784                         goto failed;
1785
1786                 if (changed)
1787                         err = new_settings(hdev, sk);
1788
1789                 goto failed;
1790         }
1791
1792         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1793                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1794                                       MGMT_STATUS_BUSY);
1795                 goto failed;
1796         }
1797
1798         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1799                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1800                 goto failed;
1801         }
1802
1803         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1804         if (!cmd) {
1805                 err = -ENOMEM;
1806                 goto failed;
1807         }
1808
1809         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1810                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1811                              sizeof(cp->val), &cp->val);
1812
1813         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1814         if (err < 0) {
1815                 mgmt_pending_remove(cmd);
1816                 goto failed;
1817         }
1818
1819 failed:
1820         hci_dev_unlock(hdev);
1821         return err;
1822 }
1823
1824 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1825 {
1826         struct mgmt_mode *cp = data;
1827         bool changed;
1828         u8 status;
1829         int err;
1830
1831         bt_dev_dbg(hdev, "sock %p", sk);
1832
1833         if (!IS_ENABLED(CONFIG_BT_HS))
1834                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1835                                        MGMT_STATUS_NOT_SUPPORTED);
1836
1837         status = mgmt_bredr_support(hdev);
1838         if (status)
1839                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1840
1841         if (!lmp_ssp_capable(hdev))
1842                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1843                                        MGMT_STATUS_NOT_SUPPORTED);
1844
1845         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1846                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1847                                        MGMT_STATUS_REJECTED);
1848
1849         if (cp->val != 0x00 && cp->val != 0x01)
1850                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1851                                        MGMT_STATUS_INVALID_PARAMS);
1852
1853         hci_dev_lock(hdev);
1854
1855         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1856                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1857                                       MGMT_STATUS_BUSY);
1858                 goto unlock;
1859         }
1860
1861         if (cp->val) {
1862                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1863         } else {
1864                 if (hdev_is_powered(hdev)) {
1865                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1866                                               MGMT_STATUS_REJECTED);
1867                         goto unlock;
1868                 }
1869
1870                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1871         }
1872
1873         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1874         if (err < 0)
1875                 goto unlock;
1876
1877         if (changed)
1878                 err = new_settings(hdev, sk);
1879
1880 unlock:
1881         hci_dev_unlock(hdev);
1882         return err;
1883 }
1884
1885 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1886 {
1887         struct cmd_lookup match = { NULL, hdev };
1888
1889         hci_dev_lock(hdev);
1890
1891         if (status) {
1892                 u8 mgmt_err = mgmt_status(status);
1893
1894                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1895                                      &mgmt_err);
1896                 goto unlock;
1897         }
1898
1899         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1900
1901         new_settings(hdev, match.sk);
1902
1903         if (match.sk)
1904                 sock_put(match.sk);
1905
1906         /* Make sure the controller has a good default for
1907          * advertising data. Restrict the update to when LE
1908          * has actually been enabled. During power on, the
1909          * update in powered_update_hci will take care of it.
1910          */
1911         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1912                 struct hci_request req;
1913                 hci_req_init(&req, hdev);
1914                 if (ext_adv_capable(hdev)) {
1915                         int err;
1916
1917                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1918                         if (!err)
1919                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1920                 } else {
1921                         __hci_req_update_adv_data(&req, 0x00);
1922                         __hci_req_update_scan_rsp_data(&req, 0x00);
1923                 }
1924                 hci_req_run(&req, NULL);
1925                 hci_update_background_scan(hdev);
1926         }
1927
1928 unlock:
1929         hci_dev_unlock(hdev);
1930 }
1931
1932 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1933 {
1934         struct mgmt_mode *cp = data;
1935         struct hci_cp_write_le_host_supported hci_cp;
1936         struct mgmt_pending_cmd *cmd;
1937         struct hci_request req;
1938         int err;
1939         u8 val, enabled;
1940
1941         bt_dev_dbg(hdev, "sock %p", sk);
1942
1943         if (!lmp_le_capable(hdev))
1944                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1945                                        MGMT_STATUS_NOT_SUPPORTED);
1946
1947         if (cp->val != 0x00 && cp->val != 0x01)
1948                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1949                                        MGMT_STATUS_INVALID_PARAMS);
1950
1951         /* Bluetooth single mode LE only controllers or dual-mode
1952          * controllers configured as LE only devices, do not allow
1953          * switching LE off. These have either LE enabled explicitly
1954          * or BR/EDR has been previously switched off.
1955          *
1956          * When trying to enable an already enabled LE, then gracefully
1957          * send a positive response. Trying to disable it however will
1958          * result into rejection.
1959          */
1960         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1961                 if (cp->val == 0x01)
1962                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1963
1964                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1965                                        MGMT_STATUS_REJECTED);
1966         }
1967
1968         hci_dev_lock(hdev);
1969
1970         val = !!cp->val;
1971         enabled = lmp_host_le_capable(hdev);
1972
1973         if (!val)
1974                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1975
1976         if (!hdev_is_powered(hdev) || val == enabled) {
1977                 bool changed = false;
1978
1979                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1980                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1981                         changed = true;
1982                 }
1983
1984                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1985                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1986                         changed = true;
1987                 }
1988
1989                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1990                 if (err < 0)
1991                         goto unlock;
1992
1993                 if (changed)
1994                         err = new_settings(hdev, sk);
1995
1996                 goto unlock;
1997         }
1998
1999         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2000             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2001                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2002                                       MGMT_STATUS_BUSY);
2003                 goto unlock;
2004         }
2005
2006         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2007         if (!cmd) {
2008                 err = -ENOMEM;
2009                 goto unlock;
2010         }
2011
2012         hci_req_init(&req, hdev);
2013
2014         memset(&hci_cp, 0, sizeof(hci_cp));
2015
2016         if (val) {
2017                 hci_cp.le = val;
2018                 hci_cp.simul = 0x00;
2019         } else {
2020                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2021                         __hci_req_disable_advertising(&req);
2022
2023                 if (ext_adv_capable(hdev))
2024                         __hci_req_clear_ext_adv_sets(&req);
2025         }
2026
2027         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2028                     &hci_cp);
2029
2030         err = hci_req_run(&req, le_enable_complete);
2031         if (err < 0)
2032                 mgmt_pending_remove(cmd);
2033
2034 unlock:
2035         hci_dev_unlock(hdev);
2036         return err;
2037 }
2038
2039 /* This is a helper function to test for pending mgmt commands that can
2040  * cause CoD or EIR HCI commands. We can only allow one such pending
2041  * mgmt command at a time since otherwise we cannot easily track what
2042  * the current values are, will be, and based on that calculate if a new
2043  * HCI command needs to be sent and if yes with what value.
2044  */
2045 static bool pending_eir_or_class(struct hci_dev *hdev)
2046 {
2047         struct mgmt_pending_cmd *cmd;
2048
2049         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2050                 switch (cmd->opcode) {
2051                 case MGMT_OP_ADD_UUID:
2052                 case MGMT_OP_REMOVE_UUID:
2053                 case MGMT_OP_SET_DEV_CLASS:
2054                 case MGMT_OP_SET_POWERED:
2055                         return true;
2056                 }
2057         }
2058
2059         return false;
2060 }
2061
2062 static const u8 bluetooth_base_uuid[] = {
2063                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2064                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2065 };
2066
2067 static u8 get_uuid_size(const u8 *uuid)
2068 {
2069         u32 val;
2070
2071         if (memcmp(uuid, bluetooth_base_uuid, 12))
2072                 return 128;
2073
2074         val = get_unaligned_le32(&uuid[12]);
2075         if (val > 0xffff)
2076                 return 32;
2077
2078         return 16;
2079 }
2080
2081 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2082 {
2083         struct mgmt_pending_cmd *cmd;
2084
2085         hci_dev_lock(hdev);
2086
2087         cmd = pending_find(mgmt_op, hdev);
2088         if (!cmd)
2089                 goto unlock;
2090
2091         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2092                           mgmt_status(status), hdev->dev_class, 3);
2093
2094         mgmt_pending_remove(cmd);
2095
2096 unlock:
2097         hci_dev_unlock(hdev);
2098 }
2099
2100 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2101 {
2102         bt_dev_dbg(hdev, "status 0x%02x", status);
2103
2104         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2105 }
2106
2107 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2108 {
2109         struct mgmt_cp_add_uuid *cp = data;
2110         struct mgmt_pending_cmd *cmd;
2111         struct hci_request req;
2112         struct bt_uuid *uuid;
2113         int err;
2114
2115         bt_dev_dbg(hdev, "sock %p", sk);
2116
2117         hci_dev_lock(hdev);
2118
2119         if (pending_eir_or_class(hdev)) {
2120                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2121                                       MGMT_STATUS_BUSY);
2122                 goto failed;
2123         }
2124
2125         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2126         if (!uuid) {
2127                 err = -ENOMEM;
2128                 goto failed;
2129         }
2130
2131         memcpy(uuid->uuid, cp->uuid, 16);
2132         uuid->svc_hint = cp->svc_hint;
2133         uuid->size = get_uuid_size(cp->uuid);
2134
2135         list_add_tail(&uuid->list, &hdev->uuids);
2136
2137         hci_req_init(&req, hdev);
2138
2139         __hci_req_update_class(&req);
2140         __hci_req_update_eir(&req);
2141
2142         err = hci_req_run(&req, add_uuid_complete);
2143         if (err < 0) {
2144                 if (err != -ENODATA)
2145                         goto failed;
2146
2147                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2148                                         hdev->dev_class, 3);
2149                 goto failed;
2150         }
2151
2152         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2153         if (!cmd) {
2154                 err = -ENOMEM;
2155                 goto failed;
2156         }
2157
2158         err = 0;
2159
2160 failed:
2161         hci_dev_unlock(hdev);
2162         return err;
2163 }
2164
2165 static bool enable_service_cache(struct hci_dev *hdev)
2166 {
2167         if (!hdev_is_powered(hdev))
2168                 return false;
2169
2170         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2171                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2172                                    CACHE_TIMEOUT);
2173                 return true;
2174         }
2175
2176         return false;
2177 }
2178
2179 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2180 {
2181         bt_dev_dbg(hdev, "status 0x%02x", status);
2182
2183         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2184 }
2185
2186 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2187                        u16 len)
2188 {
2189         struct mgmt_cp_remove_uuid *cp = data;
2190         struct mgmt_pending_cmd *cmd;
2191         struct bt_uuid *match, *tmp;
2192         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2193         struct hci_request req;
2194         int err, found;
2195
2196         bt_dev_dbg(hdev, "sock %p", sk);
2197
2198         hci_dev_lock(hdev);
2199
2200         if (pending_eir_or_class(hdev)) {
2201                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2202                                       MGMT_STATUS_BUSY);
2203                 goto unlock;
2204         }
2205
2206         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2207                 hci_uuids_clear(hdev);
2208
2209                 if (enable_service_cache(hdev)) {
2210                         err = mgmt_cmd_complete(sk, hdev->id,
2211                                                 MGMT_OP_REMOVE_UUID,
2212                                                 0, hdev->dev_class, 3);
2213                         goto unlock;
2214                 }
2215
2216                 goto update_class;
2217         }
2218
2219         found = 0;
2220
2221         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2222                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2223                         continue;
2224
2225                 list_del(&match->list);
2226                 kfree(match);
2227                 found++;
2228         }
2229
2230         if (found == 0) {
2231                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2232                                       MGMT_STATUS_INVALID_PARAMS);
2233                 goto unlock;
2234         }
2235
2236 update_class:
2237         hci_req_init(&req, hdev);
2238
2239         __hci_req_update_class(&req);
2240         __hci_req_update_eir(&req);
2241
2242         err = hci_req_run(&req, remove_uuid_complete);
2243         if (err < 0) {
2244                 if (err != -ENODATA)
2245                         goto unlock;
2246
2247                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2248                                         hdev->dev_class, 3);
2249                 goto unlock;
2250         }
2251
2252         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2253         if (!cmd) {
2254                 err = -ENOMEM;
2255                 goto unlock;
2256         }
2257
2258         err = 0;
2259
2260 unlock:
2261         hci_dev_unlock(hdev);
2262         return err;
2263 }
2264
2265 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2266 {
2267         bt_dev_dbg(hdev, "status 0x%02x", status);
2268
2269         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2270 }
2271
2272 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2273                          u16 len)
2274 {
2275         struct mgmt_cp_set_dev_class *cp = data;
2276         struct mgmt_pending_cmd *cmd;
2277         struct hci_request req;
2278         int err;
2279
2280         bt_dev_dbg(hdev, "sock %p", sk);
2281
2282         if (!lmp_bredr_capable(hdev))
2283                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2284                                        MGMT_STATUS_NOT_SUPPORTED);
2285
2286         hci_dev_lock(hdev);
2287
2288         if (pending_eir_or_class(hdev)) {
2289                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2290                                       MGMT_STATUS_BUSY);
2291                 goto unlock;
2292         }
2293
2294         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2295                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2296                                       MGMT_STATUS_INVALID_PARAMS);
2297                 goto unlock;
2298         }
2299
2300         hdev->major_class = cp->major;
2301         hdev->minor_class = cp->minor;
2302
2303         if (!hdev_is_powered(hdev)) {
2304                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2305                                         hdev->dev_class, 3);
2306                 goto unlock;
2307         }
2308
2309         hci_req_init(&req, hdev);
2310
2311         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2312                 hci_dev_unlock(hdev);
2313                 cancel_delayed_work_sync(&hdev->service_cache);
2314                 hci_dev_lock(hdev);
2315                 __hci_req_update_eir(&req);
2316         }
2317
2318         __hci_req_update_class(&req);
2319
2320         err = hci_req_run(&req, set_class_complete);
2321         if (err < 0) {
2322                 if (err != -ENODATA)
2323                         goto unlock;
2324
2325                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2326                                         hdev->dev_class, 3);
2327                 goto unlock;
2328         }
2329
2330         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2331         if (!cmd) {
2332                 err = -ENOMEM;
2333                 goto unlock;
2334         }
2335
2336         err = 0;
2337
2338 unlock:
2339         hci_dev_unlock(hdev);
2340         return err;
2341 }
2342
2343 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2344                           u16 len)
2345 {
2346         struct mgmt_cp_load_link_keys *cp = data;
2347         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2348                                    sizeof(struct mgmt_link_key_info));
2349         u16 key_count, expected_len;
2350         bool changed;
2351         int i;
2352
2353         bt_dev_dbg(hdev, "sock %p", sk);
2354
2355         if (!lmp_bredr_capable(hdev))
2356                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2357                                        MGMT_STATUS_NOT_SUPPORTED);
2358
2359         key_count = __le16_to_cpu(cp->key_count);
2360         if (key_count > max_key_count) {
2361                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2362                            key_count);
2363                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2364                                        MGMT_STATUS_INVALID_PARAMS);
2365         }
2366
2367         expected_len = struct_size(cp, keys, key_count);
2368         if (expected_len != len) {
2369                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2370                            expected_len, len);
2371                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2372                                        MGMT_STATUS_INVALID_PARAMS);
2373         }
2374
2375         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2376                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2377                                        MGMT_STATUS_INVALID_PARAMS);
2378
2379         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2380                    key_count);
2381
2382         for (i = 0; i < key_count; i++) {
2383                 struct mgmt_link_key_info *key = &cp->keys[i];
2384
2385                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2386                         return mgmt_cmd_status(sk, hdev->id,
2387                                                MGMT_OP_LOAD_LINK_KEYS,
2388                                                MGMT_STATUS_INVALID_PARAMS);
2389         }
2390
2391         hci_dev_lock(hdev);
2392
2393         hci_link_keys_clear(hdev);
2394
2395         if (cp->debug_keys)
2396                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2397         else
2398                 changed = hci_dev_test_and_clear_flag(hdev,
2399                                                       HCI_KEEP_DEBUG_KEYS);
2400
2401         if (changed)
2402                 new_settings(hdev, NULL);
2403
2404         for (i = 0; i < key_count; i++) {
2405                 struct mgmt_link_key_info *key = &cp->keys[i];
2406
2407                 if (hci_is_blocked_key(hdev,
2408                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2409                                        key->val)) {
2410                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2411                                     &key->addr.bdaddr);
2412                         continue;
2413                 }
2414
2415                 /* Always ignore debug keys and require a new pairing if
2416                  * the user wants to use them.
2417                  */
2418                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2419                         continue;
2420
2421                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2422                                  key->type, key->pin_len, NULL);
2423         }
2424
2425         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2426
2427         hci_dev_unlock(hdev);
2428
2429         return 0;
2430 }
2431
2432 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2433                            u8 addr_type, struct sock *skip_sk)
2434 {
2435         struct mgmt_ev_device_unpaired ev;
2436
2437         bacpy(&ev.addr.bdaddr, bdaddr);
2438         ev.addr.type = addr_type;
2439
2440         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2441                           skip_sk);
2442 }
2443
2444 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2445                          u16 len)
2446 {
2447         struct mgmt_cp_unpair_device *cp = data;
2448         struct mgmt_rp_unpair_device rp;
2449         struct hci_conn_params *params;
2450         struct mgmt_pending_cmd *cmd;
2451         struct hci_conn *conn;
2452         u8 addr_type;
2453         int err;
2454
2455         memset(&rp, 0, sizeof(rp));
2456         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2457         rp.addr.type = cp->addr.type;
2458
2459         if (!bdaddr_type_is_valid(cp->addr.type))
2460                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2461                                          MGMT_STATUS_INVALID_PARAMS,
2462                                          &rp, sizeof(rp));
2463
2464         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2465                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2466                                          MGMT_STATUS_INVALID_PARAMS,
2467                                          &rp, sizeof(rp));
2468
2469         hci_dev_lock(hdev);
2470
2471         if (!hdev_is_powered(hdev)) {
2472                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2473                                         MGMT_STATUS_NOT_POWERED, &rp,
2474                                         sizeof(rp));
2475                 goto unlock;
2476         }
2477
2478         if (cp->addr.type == BDADDR_BREDR) {
2479                 /* If disconnection is requested, then look up the
2480                  * connection. If the remote device is connected, it
2481                  * will be later used to terminate the link.
2482                  *
2483                  * Setting it to NULL explicitly will cause no
2484                  * termination of the link.
2485                  */
2486                 if (cp->disconnect)
2487                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2488                                                        &cp->addr.bdaddr);
2489                 else
2490                         conn = NULL;
2491
2492                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2493                 if (err < 0) {
2494                         err = mgmt_cmd_complete(sk, hdev->id,
2495                                                 MGMT_OP_UNPAIR_DEVICE,
2496                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2497                                                 sizeof(rp));
2498                         goto unlock;
2499                 }
2500
2501                 goto done;
2502         }
2503
2504         /* LE address type */
2505         addr_type = le_addr_type(cp->addr.type);
2506
2507         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2508         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2509         if (err < 0) {
2510                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2511                                         MGMT_STATUS_NOT_PAIRED, &rp,
2512                                         sizeof(rp));
2513                 goto unlock;
2514         }
2515
2516         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2517         if (!conn) {
2518                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2519                 goto done;
2520         }
2521
2522
2523         /* Defer clearing up the connection parameters until closing to
2524          * give a chance of keeping them if a repairing happens.
2525          */
2526         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2527
2528         /* Disable auto-connection parameters if present */
2529         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2530         if (params) {
2531                 if (params->explicit_connect)
2532                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2533                 else
2534                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2535         }
2536
2537         /* If disconnection is not requested, then clear the connection
2538          * variable so that the link is not terminated.
2539          */
2540         if (!cp->disconnect)
2541                 conn = NULL;
2542
2543 done:
2544         /* If the connection variable is set, then termination of the
2545          * link is requested.
2546          */
2547         if (!conn) {
2548                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2549                                         &rp, sizeof(rp));
2550                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2551                 goto unlock;
2552         }
2553
2554         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2555                                sizeof(*cp));
2556         if (!cmd) {
2557                 err = -ENOMEM;
2558                 goto unlock;
2559         }
2560
2561         cmd->cmd_complete = addr_cmd_complete;
2562
2563         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2564         if (err < 0)
2565                 mgmt_pending_remove(cmd);
2566
2567 unlock:
2568         hci_dev_unlock(hdev);
2569         return err;
2570 }
2571
2572 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2573                       u16 len)
2574 {
2575         struct mgmt_cp_disconnect *cp = data;
2576         struct mgmt_rp_disconnect rp;
2577         struct mgmt_pending_cmd *cmd;
2578         struct hci_conn *conn;
2579         int err;
2580
2581         bt_dev_dbg(hdev, "sock %p", sk);
2582
2583         memset(&rp, 0, sizeof(rp));
2584         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2585         rp.addr.type = cp->addr.type;
2586
2587         if (!bdaddr_type_is_valid(cp->addr.type))
2588                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2589                                          MGMT_STATUS_INVALID_PARAMS,
2590                                          &rp, sizeof(rp));
2591
2592         hci_dev_lock(hdev);
2593
2594         if (!test_bit(HCI_UP, &hdev->flags)) {
2595                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2596                                         MGMT_STATUS_NOT_POWERED, &rp,
2597                                         sizeof(rp));
2598                 goto failed;
2599         }
2600
2601         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2602                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2603                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2604                 goto failed;
2605         }
2606
2607         if (cp->addr.type == BDADDR_BREDR)
2608                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2609                                                &cp->addr.bdaddr);
2610         else
2611                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2612                                                le_addr_type(cp->addr.type));
2613
2614         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2615                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2616                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2617                                         sizeof(rp));
2618                 goto failed;
2619         }
2620
2621         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2622         if (!cmd) {
2623                 err = -ENOMEM;
2624                 goto failed;
2625         }
2626
2627         cmd->cmd_complete = generic_cmd_complete;
2628
2629         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2630         if (err < 0)
2631                 mgmt_pending_remove(cmd);
2632
2633 failed:
2634         hci_dev_unlock(hdev);
2635         return err;
2636 }
2637
2638 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2639 {
2640         switch (link_type) {
2641         case LE_LINK:
2642                 switch (addr_type) {
2643                 case ADDR_LE_DEV_PUBLIC:
2644                         return BDADDR_LE_PUBLIC;
2645
2646                 default:
2647                         /* Fallback to LE Random address type */
2648                         return BDADDR_LE_RANDOM;
2649                 }
2650
2651         default:
2652                 /* Fallback to BR/EDR type */
2653                 return BDADDR_BREDR;
2654         }
2655 }
2656
2657 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2658                            u16 data_len)
2659 {
2660         struct mgmt_rp_get_connections *rp;
2661         struct hci_conn *c;
2662         int err;
2663         u16 i;
2664
2665         bt_dev_dbg(hdev, "sock %p", sk);
2666
2667         hci_dev_lock(hdev);
2668
2669         if (!hdev_is_powered(hdev)) {
2670                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2671                                       MGMT_STATUS_NOT_POWERED);
2672                 goto unlock;
2673         }
2674
2675         i = 0;
2676         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2677                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2678                         i++;
2679         }
2680
2681         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2682         if (!rp) {
2683                 err = -ENOMEM;
2684                 goto unlock;
2685         }
2686
2687         i = 0;
2688         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2689                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2690                         continue;
2691                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2692                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2693                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2694                         continue;
2695                 i++;
2696         }
2697
2698         rp->conn_count = cpu_to_le16(i);
2699
2700         /* Recalculate length in case of filtered SCO connections, etc */
2701         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2702                                 struct_size(rp, addr, i));
2703
2704         kfree(rp);
2705
2706 unlock:
2707         hci_dev_unlock(hdev);
2708         return err;
2709 }
2710
2711 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2712                                    struct mgmt_cp_pin_code_neg_reply *cp)
2713 {
2714         struct mgmt_pending_cmd *cmd;
2715         int err;
2716
2717         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2718                                sizeof(*cp));
2719         if (!cmd)
2720                 return -ENOMEM;
2721
2722         cmd->cmd_complete = addr_cmd_complete;
2723
2724         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2725                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2726         if (err < 0)
2727                 mgmt_pending_remove(cmd);
2728
2729         return err;
2730 }
2731
2732 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2733                           u16 len)
2734 {
2735         struct hci_conn *conn;
2736         struct mgmt_cp_pin_code_reply *cp = data;
2737         struct hci_cp_pin_code_reply reply;
2738         struct mgmt_pending_cmd *cmd;
2739         int err;
2740
2741         bt_dev_dbg(hdev, "sock %p", sk);
2742
2743         hci_dev_lock(hdev);
2744
2745         if (!hdev_is_powered(hdev)) {
2746                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2747                                       MGMT_STATUS_NOT_POWERED);
2748                 goto failed;
2749         }
2750
2751         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2752         if (!conn) {
2753                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2754                                       MGMT_STATUS_NOT_CONNECTED);
2755                 goto failed;
2756         }
2757
2758         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2759                 struct mgmt_cp_pin_code_neg_reply ncp;
2760
2761                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2762
2763                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2764
2765                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2766                 if (err >= 0)
2767                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2768                                               MGMT_STATUS_INVALID_PARAMS);
2769
2770                 goto failed;
2771         }
2772
2773         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2774         if (!cmd) {
2775                 err = -ENOMEM;
2776                 goto failed;
2777         }
2778
2779         cmd->cmd_complete = addr_cmd_complete;
2780
2781         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2782         reply.pin_len = cp->pin_len;
2783         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2784
2785         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2786         if (err < 0)
2787                 mgmt_pending_remove(cmd);
2788
2789 failed:
2790         hci_dev_unlock(hdev);
2791         return err;
2792 }
2793
2794 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2795                              u16 len)
2796 {
2797         struct mgmt_cp_set_io_capability *cp = data;
2798
2799         bt_dev_dbg(hdev, "sock %p", sk);
2800
2801         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2802                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2803                                        MGMT_STATUS_INVALID_PARAMS);
2804
2805         hci_dev_lock(hdev);
2806
2807         hdev->io_capability = cp->io_capability;
2808
2809         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
2810
2811         hci_dev_unlock(hdev);
2812
2813         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2814                                  NULL, 0);
2815 }
2816
2817 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2818 {
2819         struct hci_dev *hdev = conn->hdev;
2820         struct mgmt_pending_cmd *cmd;
2821
2822         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2823                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2824                         continue;
2825
2826                 if (cmd->user_data != conn)
2827                         continue;
2828
2829                 return cmd;
2830         }
2831
2832         return NULL;
2833 }
2834
2835 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2836 {
2837         struct mgmt_rp_pair_device rp;
2838         struct hci_conn *conn = cmd->user_data;
2839         int err;
2840
2841         bacpy(&rp.addr.bdaddr, &conn->dst);
2842         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2843
2844         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2845                                 status, &rp, sizeof(rp));
2846
2847         /* So we don't get further callbacks for this connection */
2848         conn->connect_cfm_cb = NULL;
2849         conn->security_cfm_cb = NULL;
2850         conn->disconn_cfm_cb = NULL;
2851
2852         hci_conn_drop(conn);
2853
2854         /* The device is paired so there is no need to remove
2855          * its connection parameters anymore.
2856          */
2857         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2858
2859         hci_conn_put(conn);
2860
2861         return err;
2862 }
2863
2864 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2865 {
2866         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2867         struct mgmt_pending_cmd *cmd;
2868
2869         cmd = find_pairing(conn);
2870         if (cmd) {
2871                 cmd->cmd_complete(cmd, status);
2872                 mgmt_pending_remove(cmd);
2873         }
2874 }
2875
2876 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2877 {
2878         struct mgmt_pending_cmd *cmd;
2879
2880         BT_DBG("status %u", status);
2881
2882         cmd = find_pairing(conn);
2883         if (!cmd) {
2884                 BT_DBG("Unable to find a pending command");
2885                 return;
2886         }
2887
2888         cmd->cmd_complete(cmd, mgmt_status(status));
2889         mgmt_pending_remove(cmd);
2890 }
2891
2892 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2893 {
2894         struct mgmt_pending_cmd *cmd;
2895
2896         BT_DBG("status %u", status);
2897
2898         if (!status)
2899                 return;
2900
2901         cmd = find_pairing(conn);
2902         if (!cmd) {
2903                 BT_DBG("Unable to find a pending command");
2904                 return;
2905         }
2906
2907         cmd->cmd_complete(cmd, mgmt_status(status));
2908         mgmt_pending_remove(cmd);
2909 }
2910
2911 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2912                        u16 len)
2913 {
2914         struct mgmt_cp_pair_device *cp = data;
2915         struct mgmt_rp_pair_device rp;
2916         struct mgmt_pending_cmd *cmd;
2917         u8 sec_level, auth_type;
2918         struct hci_conn *conn;
2919         int err;
2920
2921         bt_dev_dbg(hdev, "sock %p", sk);
2922
2923         memset(&rp, 0, sizeof(rp));
2924         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2925         rp.addr.type = cp->addr.type;
2926
2927         if (!bdaddr_type_is_valid(cp->addr.type))
2928                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2929                                          MGMT_STATUS_INVALID_PARAMS,
2930                                          &rp, sizeof(rp));
2931
2932         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2933                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2934                                          MGMT_STATUS_INVALID_PARAMS,
2935                                          &rp, sizeof(rp));
2936
2937         hci_dev_lock(hdev);
2938
2939         if (!hdev_is_powered(hdev)) {
2940                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2941                                         MGMT_STATUS_NOT_POWERED, &rp,
2942                                         sizeof(rp));
2943                 goto unlock;
2944         }
2945
2946         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2947                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2948                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2949                                         sizeof(rp));
2950                 goto unlock;
2951         }
2952
2953         sec_level = BT_SECURITY_MEDIUM;
2954         auth_type = HCI_AT_DEDICATED_BONDING;
2955
2956         if (cp->addr.type == BDADDR_BREDR) {
2957                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2958                                        auth_type, CONN_REASON_PAIR_DEVICE);
2959         } else {
2960                 u8 addr_type = le_addr_type(cp->addr.type);
2961                 struct hci_conn_params *p;
2962
2963                 /* When pairing a new device, it is expected to remember
2964                  * this device for future connections. Adding the connection
2965                  * parameter information ahead of time allows tracking
2966                  * of the peripheral preferred values and will speed up any
2967                  * further connection establishment.
2968                  *
2969                  * If connection parameters already exist, then they
2970                  * will be kept and this function does nothing.
2971                  */
2972                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2973
2974                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2975                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2976
2977                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
2978                                            sec_level, HCI_LE_CONN_TIMEOUT,
2979                                            CONN_REASON_PAIR_DEVICE);
2980         }
2981
2982         if (IS_ERR(conn)) {
2983                 int status;
2984
2985                 if (PTR_ERR(conn) == -EBUSY)
2986                         status = MGMT_STATUS_BUSY;
2987                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2988                         status = MGMT_STATUS_NOT_SUPPORTED;
2989                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2990                         status = MGMT_STATUS_REJECTED;
2991                 else
2992                         status = MGMT_STATUS_CONNECT_FAILED;
2993
2994                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2995                                         status, &rp, sizeof(rp));
2996                 goto unlock;
2997         }
2998
2999         if (conn->connect_cfm_cb) {
3000                 hci_conn_drop(conn);
3001                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3002                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3003                 goto unlock;
3004         }
3005
3006         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3007         if (!cmd) {
3008                 err = -ENOMEM;
3009                 hci_conn_drop(conn);
3010                 goto unlock;
3011         }
3012
3013         cmd->cmd_complete = pairing_complete;
3014
3015         /* For LE, just connecting isn't a proof that the pairing finished */
3016         if (cp->addr.type == BDADDR_BREDR) {
3017                 conn->connect_cfm_cb = pairing_complete_cb;
3018                 conn->security_cfm_cb = pairing_complete_cb;
3019                 conn->disconn_cfm_cb = pairing_complete_cb;
3020         } else {
3021                 conn->connect_cfm_cb = le_pairing_complete_cb;
3022                 conn->security_cfm_cb = le_pairing_complete_cb;
3023                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3024         }
3025
3026         conn->io_capability = cp->io_cap;
3027         cmd->user_data = hci_conn_get(conn);
3028
3029         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3030             hci_conn_security(conn, sec_level, auth_type, true)) {
3031                 cmd->cmd_complete(cmd, 0);
3032                 mgmt_pending_remove(cmd);
3033         }
3034
3035         err = 0;
3036
3037 unlock:
3038         hci_dev_unlock(hdev);
3039         return err;
3040 }
3041
3042 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3043                               u16 len)
3044 {
3045         struct mgmt_addr_info *addr = data;
3046         struct mgmt_pending_cmd *cmd;
3047         struct hci_conn *conn;
3048         int err;
3049
3050         bt_dev_dbg(hdev, "sock %p", sk);
3051
3052         hci_dev_lock(hdev);
3053
3054         if (!hdev_is_powered(hdev)) {
3055                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3056                                       MGMT_STATUS_NOT_POWERED);
3057                 goto unlock;
3058         }
3059
3060         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3061         if (!cmd) {
3062                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3063                                       MGMT_STATUS_INVALID_PARAMS);
3064                 goto unlock;
3065         }
3066
3067         conn = cmd->user_data;
3068
3069         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3070                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3071                                       MGMT_STATUS_INVALID_PARAMS);
3072                 goto unlock;
3073         }
3074
3075         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3076         mgmt_pending_remove(cmd);
3077
3078         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3079                                 addr, sizeof(*addr));
3080
3081         /* Since user doesn't want to proceed with the connection, abort any
3082          * ongoing pairing and then terminate the link if it was created
3083          * because of the pair device action.
3084          */
3085         if (addr->type == BDADDR_BREDR)
3086                 hci_remove_link_key(hdev, &addr->bdaddr);
3087         else
3088                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3089                                               le_addr_type(addr->type));
3090
3091         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3092                 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3093
3094 unlock:
3095         hci_dev_unlock(hdev);
3096         return err;
3097 }
3098
3099 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3100                              struct mgmt_addr_info *addr, u16 mgmt_op,
3101                              u16 hci_op, __le32 passkey)
3102 {
3103         struct mgmt_pending_cmd *cmd;
3104         struct hci_conn *conn;
3105         int err;
3106
3107         hci_dev_lock(hdev);
3108
3109         if (!hdev_is_powered(hdev)) {
3110                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3111                                         MGMT_STATUS_NOT_POWERED, addr,
3112                                         sizeof(*addr));
3113                 goto done;
3114         }
3115
3116         if (addr->type == BDADDR_BREDR)
3117                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3118         else
3119                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3120                                                le_addr_type(addr->type));
3121
3122         if (!conn) {
3123                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3124                                         MGMT_STATUS_NOT_CONNECTED, addr,
3125                                         sizeof(*addr));
3126                 goto done;
3127         }
3128
3129         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3130                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3131                 if (!err)
3132                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3133                                                 MGMT_STATUS_SUCCESS, addr,
3134                                                 sizeof(*addr));
3135                 else
3136                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3137                                                 MGMT_STATUS_FAILED, addr,
3138                                                 sizeof(*addr));
3139
3140                 goto done;
3141         }
3142
3143         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3144         if (!cmd) {
3145                 err = -ENOMEM;
3146                 goto done;
3147         }
3148
3149         cmd->cmd_complete = addr_cmd_complete;
3150
3151         /* Continue with pairing via HCI */
3152         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3153                 struct hci_cp_user_passkey_reply cp;
3154
3155                 bacpy(&cp.bdaddr, &addr->bdaddr);
3156                 cp.passkey = passkey;
3157                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3158         } else
3159                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3160                                    &addr->bdaddr);
3161
3162         if (err < 0)
3163                 mgmt_pending_remove(cmd);
3164
3165 done:
3166         hci_dev_unlock(hdev);
3167         return err;
3168 }
3169
3170 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3171                               void *data, u16 len)
3172 {
3173         struct mgmt_cp_pin_code_neg_reply *cp = data;
3174
3175         bt_dev_dbg(hdev, "sock %p", sk);
3176
3177         return user_pairing_resp(sk, hdev, &cp->addr,
3178                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3179                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3180 }
3181
3182 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3183                               u16 len)
3184 {
3185         struct mgmt_cp_user_confirm_reply *cp = data;
3186
3187         bt_dev_dbg(hdev, "sock %p", sk);
3188
3189         if (len != sizeof(*cp))
3190                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3191                                        MGMT_STATUS_INVALID_PARAMS);
3192
3193         return user_pairing_resp(sk, hdev, &cp->addr,
3194                                  MGMT_OP_USER_CONFIRM_REPLY,
3195                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3196 }
3197
3198 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3199                                   void *data, u16 len)
3200 {
3201         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3202
3203         bt_dev_dbg(hdev, "sock %p", sk);
3204
3205         return user_pairing_resp(sk, hdev, &cp->addr,
3206                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3207                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3208 }
3209
3210 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3211                               u16 len)
3212 {
3213         struct mgmt_cp_user_passkey_reply *cp = data;
3214
3215         bt_dev_dbg(hdev, "sock %p", sk);
3216
3217         return user_pairing_resp(sk, hdev, &cp->addr,
3218                                  MGMT_OP_USER_PASSKEY_REPLY,
3219                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3220 }
3221
3222 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3223                                   void *data, u16 len)
3224 {
3225         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3226
3227         bt_dev_dbg(hdev, "sock %p", sk);
3228
3229         return user_pairing_resp(sk, hdev, &cp->addr,
3230                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3231                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3232 }
3233
3234 static void adv_expire(struct hci_dev *hdev, u32 flags)
3235 {
3236         struct adv_info *adv_instance;
3237         struct hci_request req;
3238         int err;
3239
3240         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3241         if (!adv_instance)
3242                 return;
3243
3244         /* stop if current instance doesn't need to be changed */
3245         if (!(adv_instance->flags & flags))
3246                 return;
3247
3248         cancel_adv_timeout(hdev);
3249
3250         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3251         if (!adv_instance)
3252                 return;
3253
3254         hci_req_init(&req, hdev);
3255         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3256                                               true);
3257         if (err)
3258                 return;
3259
3260         hci_req_run(&req, NULL);
3261 }
3262
3263 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3264 {
3265         struct mgmt_cp_set_local_name *cp;
3266         struct mgmt_pending_cmd *cmd;
3267
3268         bt_dev_dbg(hdev, "status 0x%02x", status);
3269
3270         hci_dev_lock(hdev);
3271
3272         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3273         if (!cmd)
3274                 goto unlock;
3275
3276         cp = cmd->param;
3277
3278         if (status) {
3279                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3280                                 mgmt_status(status));
3281         } else {
3282                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3283                                   cp, sizeof(*cp));
3284
3285                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3286                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3287         }
3288
3289         mgmt_pending_remove(cmd);
3290
3291 unlock:
3292         hci_dev_unlock(hdev);
3293 }
3294
3295 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3296                           u16 len)
3297 {
3298         struct mgmt_cp_set_local_name *cp = data;
3299         struct mgmt_pending_cmd *cmd;
3300         struct hci_request req;
3301         int err;
3302
3303         bt_dev_dbg(hdev, "sock %p", sk);
3304
3305         hci_dev_lock(hdev);
3306
3307         /* If the old values are the same as the new ones just return a
3308          * direct command complete event.
3309          */
3310         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3311             !memcmp(hdev->short_name, cp->short_name,
3312                     sizeof(hdev->short_name))) {
3313                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3314                                         data, len);
3315                 goto failed;
3316         }
3317
3318         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3319
3320         if (!hdev_is_powered(hdev)) {
3321                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3322
3323                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3324                                         data, len);
3325                 if (err < 0)
3326                         goto failed;
3327
3328                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3329                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3330                 ext_info_changed(hdev, sk);
3331
3332                 goto failed;
3333         }
3334
3335         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3336         if (!cmd) {
3337                 err = -ENOMEM;
3338                 goto failed;
3339         }
3340
3341         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3342
3343         hci_req_init(&req, hdev);
3344
3345         if (lmp_bredr_capable(hdev)) {
3346                 __hci_req_update_name(&req);
3347                 __hci_req_update_eir(&req);
3348         }
3349
3350         /* The name is stored in the scan response data and so
3351          * no need to update the advertising data here.
3352          */
3353         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3354                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3355
3356         err = hci_req_run(&req, set_name_complete);
3357         if (err < 0)
3358                 mgmt_pending_remove(cmd);
3359
3360 failed:
3361         hci_dev_unlock(hdev);
3362         return err;
3363 }
3364
3365 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3366                           u16 len)
3367 {
3368         struct mgmt_cp_set_appearance *cp = data;
3369         u16 appearance;
3370         int err;
3371
3372         bt_dev_dbg(hdev, "sock %p", sk);
3373
3374         if (!lmp_le_capable(hdev))
3375                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3376                                        MGMT_STATUS_NOT_SUPPORTED);
3377
3378         appearance = le16_to_cpu(cp->appearance);
3379
3380         hci_dev_lock(hdev);
3381
3382         if (hdev->appearance != appearance) {
3383                 hdev->appearance = appearance;
3384
3385                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3386                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3387
3388                 ext_info_changed(hdev, sk);
3389         }
3390
3391         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3392                                 0);
3393
3394         hci_dev_unlock(hdev);
3395
3396         return err;
3397 }
3398
3399 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3400                                  void *data, u16 len)
3401 {
3402         struct mgmt_rp_get_phy_configuration rp;
3403
3404         bt_dev_dbg(hdev, "sock %p", sk);
3405
3406         hci_dev_lock(hdev);
3407
3408         memset(&rp, 0, sizeof(rp));
3409
3410         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3411         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3412         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3413
3414         hci_dev_unlock(hdev);
3415
3416         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3417                                  &rp, sizeof(rp));
3418 }
3419
3420 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3421 {
3422         struct mgmt_ev_phy_configuration_changed ev;
3423
3424         memset(&ev, 0, sizeof(ev));
3425
3426         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3427
3428         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3429                           sizeof(ev), skip);
3430 }
3431
3432 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3433                                      u16 opcode, struct sk_buff *skb)
3434 {
3435         struct mgmt_pending_cmd *cmd;
3436
3437         bt_dev_dbg(hdev, "status 0x%02x", status);
3438
3439         hci_dev_lock(hdev);
3440
3441         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3442         if (!cmd)
3443                 goto unlock;
3444
3445         if (status) {
3446                 mgmt_cmd_status(cmd->sk, hdev->id,
3447                                 MGMT_OP_SET_PHY_CONFIGURATION,
3448                                 mgmt_status(status));
3449         } else {
3450                 mgmt_cmd_complete(cmd->sk, hdev->id,
3451                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3452                                   NULL, 0);
3453
3454                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3455         }
3456
3457         mgmt_pending_remove(cmd);
3458
3459 unlock:
3460         hci_dev_unlock(hdev);
3461 }
3462
3463 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3464                                  void *data, u16 len)
3465 {
3466         struct mgmt_cp_set_phy_configuration *cp = data;
3467         struct hci_cp_le_set_default_phy cp_phy;
3468         struct mgmt_pending_cmd *cmd;
3469         struct hci_request req;
3470         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3471         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3472         bool changed = false;
3473         int err;
3474
3475         bt_dev_dbg(hdev, "sock %p", sk);
3476
3477         configurable_phys = get_configurable_phys(hdev);
3478         supported_phys = get_supported_phys(hdev);
3479         selected_phys = __le32_to_cpu(cp->selected_phys);
3480
3481         if (selected_phys & ~supported_phys)
3482                 return mgmt_cmd_status(sk, hdev->id,
3483                                        MGMT_OP_SET_PHY_CONFIGURATION,
3484                                        MGMT_STATUS_INVALID_PARAMS);
3485
3486         unconfigure_phys = supported_phys & ~configurable_phys;
3487
3488         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3489                 return mgmt_cmd_status(sk, hdev->id,
3490                                        MGMT_OP_SET_PHY_CONFIGURATION,
3491                                        MGMT_STATUS_INVALID_PARAMS);
3492
3493         if (selected_phys == get_selected_phys(hdev))
3494                 return mgmt_cmd_complete(sk, hdev->id,
3495                                          MGMT_OP_SET_PHY_CONFIGURATION,
3496                                          0, NULL, 0);
3497
3498         hci_dev_lock(hdev);
3499
3500         if (!hdev_is_powered(hdev)) {
3501                 err = mgmt_cmd_status(sk, hdev->id,
3502                                       MGMT_OP_SET_PHY_CONFIGURATION,
3503                                       MGMT_STATUS_REJECTED);
3504                 goto unlock;
3505         }
3506
3507         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3508                 err = mgmt_cmd_status(sk, hdev->id,
3509                                       MGMT_OP_SET_PHY_CONFIGURATION,
3510                                       MGMT_STATUS_BUSY);
3511                 goto unlock;
3512         }
3513
3514         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3515                 pkt_type |= (HCI_DH3 | HCI_DM3);
3516         else
3517                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3518
3519         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3520                 pkt_type |= (HCI_DH5 | HCI_DM5);
3521         else
3522                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3523
3524         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3525                 pkt_type &= ~HCI_2DH1;
3526         else
3527                 pkt_type |= HCI_2DH1;
3528
3529         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3530                 pkt_type &= ~HCI_2DH3;
3531         else
3532                 pkt_type |= HCI_2DH3;
3533
3534         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3535                 pkt_type &= ~HCI_2DH5;
3536         else
3537                 pkt_type |= HCI_2DH5;
3538
3539         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3540                 pkt_type &= ~HCI_3DH1;
3541         else
3542                 pkt_type |= HCI_3DH1;
3543
3544         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3545                 pkt_type &= ~HCI_3DH3;
3546         else
3547                 pkt_type |= HCI_3DH3;
3548
3549         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3550                 pkt_type &= ~HCI_3DH5;
3551         else
3552                 pkt_type |= HCI_3DH5;
3553
3554         if (pkt_type != hdev->pkt_type) {
3555                 hdev->pkt_type = pkt_type;
3556                 changed = true;
3557         }
3558
3559         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3560             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3561                 if (changed)
3562                         mgmt_phy_configuration_changed(hdev, sk);
3563
3564                 err = mgmt_cmd_complete(sk, hdev->id,
3565                                         MGMT_OP_SET_PHY_CONFIGURATION,
3566                                         0, NULL, 0);
3567
3568                 goto unlock;
3569         }
3570
3571         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3572                                len);
3573         if (!cmd) {
3574                 err = -ENOMEM;
3575                 goto unlock;
3576         }
3577
3578         hci_req_init(&req, hdev);
3579
3580         memset(&cp_phy, 0, sizeof(cp_phy));
3581
3582         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3583                 cp_phy.all_phys |= 0x01;
3584
3585         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3586                 cp_phy.all_phys |= 0x02;
3587
3588         if (selected_phys & MGMT_PHY_LE_1M_TX)
3589                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3590
3591         if (selected_phys & MGMT_PHY_LE_2M_TX)
3592                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3593
3594         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3595                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3596
3597         if (selected_phys & MGMT_PHY_LE_1M_RX)
3598                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3599
3600         if (selected_phys & MGMT_PHY_LE_2M_RX)
3601                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3602
3603         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3604                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3605
3606         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3607
3608         err = hci_req_run_skb(&req, set_default_phy_complete);
3609         if (err < 0)
3610                 mgmt_pending_remove(cmd);
3611
3612 unlock:
3613         hci_dev_unlock(hdev);
3614
3615         return err;
3616 }
3617
3618 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3619                             u16 len)
3620 {
3621         int err = MGMT_STATUS_SUCCESS;
3622         struct mgmt_cp_set_blocked_keys *keys = data;
3623         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
3624                                    sizeof(struct mgmt_blocked_key_info));
3625         u16 key_count, expected_len;
3626         int i;
3627
3628         bt_dev_dbg(hdev, "sock %p", sk);
3629
3630         key_count = __le16_to_cpu(keys->key_count);
3631         if (key_count > max_key_count) {
3632                 bt_dev_err(hdev, "too big key_count value %u", key_count);
3633                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3634                                        MGMT_STATUS_INVALID_PARAMS);
3635         }
3636
3637         expected_len = struct_size(keys, keys, key_count);
3638         if (expected_len != len) {
3639                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
3640                            expected_len, len);
3641                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3642                                        MGMT_STATUS_INVALID_PARAMS);
3643         }
3644
3645         hci_dev_lock(hdev);
3646
3647         hci_blocked_keys_clear(hdev);
3648
3649         for (i = 0; i < keys->key_count; ++i) {
3650                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
3651
3652                 if (!b) {
3653                         err = MGMT_STATUS_NO_RESOURCES;
3654                         break;
3655                 }
3656
3657                 b->type = keys->keys[i].type;
3658                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
3659                 list_add_rcu(&b->list, &hdev->blocked_keys);
3660         }
3661         hci_dev_unlock(hdev);
3662
3663         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3664                                 err, NULL, 0);
3665 }
3666
3667 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
3668                                void *data, u16 len)
3669 {
3670         struct mgmt_mode *cp = data;
3671         int err;
3672         bool changed = false;
3673
3674         bt_dev_dbg(hdev, "sock %p", sk);
3675
3676         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
3677                 return mgmt_cmd_status(sk, hdev->id,
3678                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3679                                        MGMT_STATUS_NOT_SUPPORTED);
3680
3681         if (cp->val != 0x00 && cp->val != 0x01)
3682                 return mgmt_cmd_status(sk, hdev->id,
3683                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3684                                        MGMT_STATUS_INVALID_PARAMS);
3685
3686         hci_dev_lock(hdev);
3687
3688         if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) {
3689                 err = mgmt_cmd_status(sk, hdev->id,
3690                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3691                                       MGMT_STATUS_BUSY);
3692                 goto unlock;
3693         }
3694
3695         if (hdev_is_powered(hdev) &&
3696             !!cp->val != hci_dev_test_flag(hdev,
3697                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
3698                 err = mgmt_cmd_status(sk, hdev->id,
3699                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3700                                       MGMT_STATUS_REJECTED);
3701                 goto unlock;
3702         }
3703
3704         if (cp->val)
3705                 changed = !hci_dev_test_and_set_flag(hdev,
3706                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3707         else
3708                 changed = hci_dev_test_and_clear_flag(hdev,
3709                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3710
3711         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
3712         if (err < 0)
3713                 goto unlock;
3714
3715         if (changed)
3716                 err = new_settings(hdev, sk);
3717
3718 unlock:
3719         hci_dev_unlock(hdev);
3720         return err;
3721 }
3722
3723 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
3724                                void *data, u16 data_len)
3725 {
3726         char buf[20];
3727         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
3728         u16 cap_len = 0;
3729         u8 flags = 0;
3730         u8 tx_power_range[2];
3731
3732         bt_dev_dbg(hdev, "sock %p", sk);
3733
3734         memset(&buf, 0, sizeof(buf));
3735
3736         hci_dev_lock(hdev);
3737
3738         /* When the Read Simple Pairing Options command is supported, then
3739          * the remote public key validation is supported.
3740          *
3741          * Alternatively, when Microsoft extensions are available, they can
3742          * indicate support for public key validation as well.
3743          */
3744         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
3745                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
3746
3747         flags |= 0x02;          /* Remote public key validation (LE) */
3748
3749         /* When the Read Encryption Key Size command is supported, then the
3750          * encryption key size is enforced.
3751          */
3752         if (hdev->commands[20] & 0x10)
3753                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
3754
3755         flags |= 0x08;          /* Encryption key size enforcement (LE) */
3756
3757         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
3758                                   &flags, 1);
3759
3760         /* When the Read Simple Pairing Options command is supported, then
3761          * also max encryption key size information is provided.
3762          */
3763         if (hdev->commands[41] & 0x08)
3764                 cap_len = eir_append_le16(rp->cap, cap_len,
3765                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
3766                                           hdev->max_enc_key_size);
3767
3768         cap_len = eir_append_le16(rp->cap, cap_len,
3769                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
3770                                   SMP_MAX_ENC_KEY_SIZE);
3771
3772         /* Append the min/max LE tx power parameters if we were able to fetch
3773          * it from the controller
3774          */
3775         if (hdev->commands[38] & 0x80) {
3776                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
3777                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
3778                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
3779                                           tx_power_range, 2);
3780         }
3781
3782         rp->cap_len = cpu_to_le16(cap_len);
3783
3784         hci_dev_unlock(hdev);
3785
3786         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
3787                                  rp, sizeof(*rp) + cap_len);
3788 }
3789
3790 #ifdef CONFIG_BT_FEATURE_DEBUG
3791 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
3792 static const u8 debug_uuid[16] = {
3793         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
3794         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
3795 };
3796 #endif
3797
3798 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
3799 static const u8 simult_central_periph_uuid[16] = {
3800         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
3801         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
3802 };
3803
3804 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
3805 static const u8 rpa_resolution_uuid[16] = {
3806         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
3807         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
3808 };
3809
3810 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
3811                                   void *data, u16 data_len)
3812 {
3813         char buf[62];   /* Enough space for 3 features */
3814         struct mgmt_rp_read_exp_features_info *rp = (void *)buf;
3815         u16 idx = 0;
3816         u32 flags;
3817
3818         bt_dev_dbg(hdev, "sock %p", sk);
3819
3820         memset(&buf, 0, sizeof(buf));
3821
3822 #ifdef CONFIG_BT_FEATURE_DEBUG
3823         if (!hdev) {
3824                 flags = bt_dbg_get() ? BIT(0) : 0;
3825
3826                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
3827                 rp->features[idx].flags = cpu_to_le32(flags);
3828                 idx++;
3829         }
3830 #endif
3831
3832         if (hdev) {
3833                 if (test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) &&
3834                     (hdev->le_states[4] & 0x08) &&      /* Central */
3835                     (hdev->le_states[4] & 0x40) &&      /* Peripheral */
3836                     (hdev->le_states[3] & 0x10))        /* Simultaneous */
3837                         flags = BIT(0);
3838                 else
3839                         flags = 0;
3840
3841                 memcpy(rp->features[idx].uuid, simult_central_periph_uuid, 16);
3842                 rp->features[idx].flags = cpu_to_le32(flags);
3843                 idx++;
3844         }
3845
3846         if (hdev && use_ll_privacy(hdev)) {
3847                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
3848                         flags = BIT(0) | BIT(1);
3849                 else
3850                         flags = BIT(1);
3851
3852                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
3853                 rp->features[idx].flags = cpu_to_le32(flags);
3854                 idx++;
3855         }
3856
3857         rp->feature_count = cpu_to_le16(idx);
3858
3859         /* After reading the experimental features information, enable
3860          * the events to update client on any future change.
3861          */
3862         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3863
3864         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3865                                  MGMT_OP_READ_EXP_FEATURES_INFO,
3866                                  0, rp, sizeof(*rp) + (20 * idx));
3867 }
3868
3869 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
3870                                           struct sock *skip)
3871 {
3872         struct mgmt_ev_exp_feature_changed ev;
3873
3874         memset(&ev, 0, sizeof(ev));
3875         memcpy(ev.uuid, rpa_resolution_uuid, 16);
3876         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
3877
3878         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
3879                                   &ev, sizeof(ev),
3880                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3881
3882 }
3883
3884 #ifdef CONFIG_BT_FEATURE_DEBUG
3885 static int exp_debug_feature_changed(bool enabled, struct sock *skip)
3886 {
3887         struct mgmt_ev_exp_feature_changed ev;
3888
3889         memset(&ev, 0, sizeof(ev));
3890         memcpy(ev.uuid, debug_uuid, 16);
3891         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
3892
3893         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL,
3894                                   &ev, sizeof(ev),
3895                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3896 }
3897 #endif
3898
3899 #define EXP_FEAT(_uuid, _set_func)      \
3900 {                                       \
3901         .uuid = _uuid,                  \
3902         .set_func = _set_func,          \
3903 }
3904
3905 /* The zero key uuid is special. Multiple exp features are set through it. */
3906 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
3907                              struct mgmt_cp_set_exp_feature *cp, u16 data_len)
3908 {
3909         struct mgmt_rp_set_exp_feature rp;
3910
3911         memset(rp.uuid, 0, 16);
3912         rp.flags = cpu_to_le32(0);
3913
3914 #ifdef CONFIG_BT_FEATURE_DEBUG
3915         if (!hdev) {
3916                 bool changed = bt_dbg_get();
3917
3918                 bt_dbg_set(false);
3919
3920                 if (changed)
3921                         exp_debug_feature_changed(false, sk);
3922         }
3923 #endif
3924
3925         if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
3926                 bool changed;
3927
3928                 changed = hci_dev_test_and_clear_flag(hdev,
3929                                                       HCI_ENABLE_LL_PRIVACY);
3930                 if (changed)
3931                         exp_ll_privacy_feature_changed(false, hdev, sk);
3932         }
3933
3934         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3935
3936         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3937                                  MGMT_OP_SET_EXP_FEATURE, 0,
3938                                  &rp, sizeof(rp));
3939 }
3940
3941 #ifdef CONFIG_BT_FEATURE_DEBUG
3942 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
3943                           struct mgmt_cp_set_exp_feature *cp, u16 data_len)
3944 {
3945         struct mgmt_rp_set_exp_feature rp;
3946
3947         bool val, changed;
3948         int err;
3949
3950         /* Command requires to use the non-controller index */
3951         if (hdev)
3952                 return mgmt_cmd_status(sk, hdev->id,
3953                                        MGMT_OP_SET_EXP_FEATURE,
3954                                        MGMT_STATUS_INVALID_INDEX);
3955
3956         /* Parameters are limited to a single octet */
3957         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3958                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3959                                        MGMT_OP_SET_EXP_FEATURE,
3960                                        MGMT_STATUS_INVALID_PARAMS);
3961
3962         /* Only boolean on/off is supported */
3963         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3964                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3965                                        MGMT_OP_SET_EXP_FEATURE,
3966                                        MGMT_STATUS_INVALID_PARAMS);
3967
3968         val = !!cp->param[0];
3969         changed = val ? !bt_dbg_get() : bt_dbg_get();
3970         bt_dbg_set(val);
3971
3972         memcpy(rp.uuid, debug_uuid, 16);
3973         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
3974
3975         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3976
3977         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
3978                                 MGMT_OP_SET_EXP_FEATURE, 0,
3979                                 &rp, sizeof(rp));
3980
3981         if (changed)
3982                 exp_debug_feature_changed(val, sk);
3983
3984         return err;
3985 }
3986 #endif
3987
3988 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev,
3989                                    struct mgmt_cp_set_exp_feature *cp,
3990                                    u16 data_len)
3991 {
3992         struct mgmt_rp_set_exp_feature rp;
3993         bool val, changed;
3994         int err;
3995         u32 flags;
3996
3997         /* Command requires to use the controller index */
3998         if (!hdev)
3999                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4000                                        MGMT_OP_SET_EXP_FEATURE,
4001                                        MGMT_STATUS_INVALID_INDEX);
4002
4003         /* Changes can only be made when controller is powered down */
4004         if (hdev_is_powered(hdev))
4005                 return mgmt_cmd_status(sk, hdev->id,
4006                                        MGMT_OP_SET_EXP_FEATURE,
4007                                        MGMT_STATUS_REJECTED);
4008
4009         /* Parameters are limited to a single octet */
4010         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4011                 return mgmt_cmd_status(sk, hdev->id,
4012                                        MGMT_OP_SET_EXP_FEATURE,
4013                                        MGMT_STATUS_INVALID_PARAMS);
4014
4015         /* Only boolean on/off is supported */
4016         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4017                 return mgmt_cmd_status(sk, hdev->id,
4018                                        MGMT_OP_SET_EXP_FEATURE,
4019                                        MGMT_STATUS_INVALID_PARAMS);
4020
4021         val = !!cp->param[0];
4022
4023         if (val) {
4024                 changed = !hci_dev_test_and_set_flag(hdev,
4025                                                      HCI_ENABLE_LL_PRIVACY);
4026                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4027
4028                 /* Enable LL privacy + supported settings changed */
4029                 flags = BIT(0) | BIT(1);
4030         } else {
4031                 changed = hci_dev_test_and_clear_flag(hdev,
4032                                                       HCI_ENABLE_LL_PRIVACY);
4033
4034                 /* Disable LL privacy + supported settings changed */
4035                 flags = BIT(1);
4036         }
4037
4038         memcpy(rp.uuid, rpa_resolution_uuid, 16);
4039         rp.flags = cpu_to_le32(flags);
4040
4041         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4042
4043         err = mgmt_cmd_complete(sk, hdev->id,
4044                                 MGMT_OP_SET_EXP_FEATURE, 0,
4045                                 &rp, sizeof(rp));
4046
4047         if (changed)
4048                 exp_ll_privacy_feature_changed(val, hdev, sk);
4049
4050         return err;
4051 }
4052
4053 static const struct mgmt_exp_feature {
4054         const u8 *uuid;
4055         int (*set_func)(struct sock *sk, struct hci_dev *hdev,
4056                         struct mgmt_cp_set_exp_feature *cp, u16 data_len);
4057 } exp_features[] = {
4058         EXP_FEAT(ZERO_KEY, set_zero_key_func),
4059 #ifdef CONFIG_BT_FEATURE_DEBUG
4060         EXP_FEAT(debug_uuid, set_debug_func),
4061 #endif
4062         EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func),
4063
4064         /* end with a null feature */
4065         EXP_FEAT(NULL, NULL)
4066 };
4067
4068 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
4069                            void *data, u16 data_len)
4070 {
4071         struct mgmt_cp_set_exp_feature *cp = data;
4072         size_t i = 0;
4073
4074         bt_dev_dbg(hdev, "sock %p", sk);
4075
4076         for (i = 0; exp_features[i].uuid; i++) {
4077                 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
4078                         return exp_features[i].set_func(sk, hdev, cp, data_len);
4079         }
4080
4081         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4082                                MGMT_OP_SET_EXP_FEATURE,
4083                                MGMT_STATUS_NOT_SUPPORTED);
4084 }
4085
4086 #define SUPPORTED_DEVICE_FLAGS() ((1U << HCI_CONN_FLAG_MAX) - 1)
4087
4088 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4089                             u16 data_len)
4090 {
4091         struct mgmt_cp_get_device_flags *cp = data;
4092         struct mgmt_rp_get_device_flags rp;
4093         struct bdaddr_list_with_flags *br_params;
4094         struct hci_conn_params *params;
4095         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4096         u32 current_flags = 0;
4097         u8 status = MGMT_STATUS_INVALID_PARAMS;
4098
4099         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
4100                    &cp->addr.bdaddr, cp->addr.type);
4101
4102         hci_dev_lock(hdev);
4103
4104         memset(&rp, 0, sizeof(rp));
4105
4106         if (cp->addr.type == BDADDR_BREDR) {
4107                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4108                                                               &cp->addr.bdaddr,
4109                                                               cp->addr.type);
4110                 if (!br_params)
4111                         goto done;
4112
4113                 current_flags = br_params->current_flags;
4114         } else {
4115                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4116                                                 le_addr_type(cp->addr.type));
4117
4118                 if (!params)
4119                         goto done;
4120
4121                 current_flags = params->current_flags;
4122         }
4123
4124         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4125         rp.addr.type = cp->addr.type;
4126         rp.supported_flags = cpu_to_le32(supported_flags);
4127         rp.current_flags = cpu_to_le32(current_flags);
4128
4129         status = MGMT_STATUS_SUCCESS;
4130
4131 done:
4132         hci_dev_unlock(hdev);
4133
4134         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
4135                                 &rp, sizeof(rp));
4136 }
4137
4138 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
4139                                  bdaddr_t *bdaddr, u8 bdaddr_type,
4140                                  u32 supported_flags, u32 current_flags)
4141 {
4142         struct mgmt_ev_device_flags_changed ev;
4143
4144         bacpy(&ev.addr.bdaddr, bdaddr);
4145         ev.addr.type = bdaddr_type;
4146         ev.supported_flags = cpu_to_le32(supported_flags);
4147         ev.current_flags = cpu_to_le32(current_flags);
4148
4149         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
4150 }
4151
4152 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4153                             u16 len)
4154 {
4155         struct mgmt_cp_set_device_flags *cp = data;
4156         struct bdaddr_list_with_flags *br_params;
4157         struct hci_conn_params *params;
4158         u8 status = MGMT_STATUS_INVALID_PARAMS;
4159         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4160         u32 current_flags = __le32_to_cpu(cp->current_flags);
4161
4162         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
4163                    &cp->addr.bdaddr, cp->addr.type,
4164                    __le32_to_cpu(current_flags));
4165
4166         if ((supported_flags | current_flags) != supported_flags) {
4167                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
4168                             current_flags, supported_flags);
4169                 goto done;
4170         }
4171
4172         hci_dev_lock(hdev);
4173
4174         if (cp->addr.type == BDADDR_BREDR) {
4175                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4176                                                               &cp->addr.bdaddr,
4177                                                               cp->addr.type);
4178
4179                 if (br_params) {
4180                         br_params->current_flags = current_flags;
4181                         status = MGMT_STATUS_SUCCESS;
4182                 } else {
4183                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
4184                                     &cp->addr.bdaddr, cp->addr.type);
4185                 }
4186         } else {
4187                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4188                                                 le_addr_type(cp->addr.type));
4189                 if (params) {
4190                         params->current_flags = current_flags;
4191                         status = MGMT_STATUS_SUCCESS;
4192                 } else {
4193                         bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
4194                                     &cp->addr.bdaddr,
4195                                     le_addr_type(cp->addr.type));
4196                 }
4197         }
4198
4199 done:
4200         hci_dev_unlock(hdev);
4201
4202         if (status == MGMT_STATUS_SUCCESS)
4203                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
4204                                      supported_flags, current_flags);
4205
4206         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
4207                                  &cp->addr, sizeof(cp->addr));
4208 }
4209
4210 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
4211                                    u16 handle)
4212 {
4213         struct mgmt_ev_adv_monitor_added ev;
4214
4215         ev.monitor_handle = cpu_to_le16(handle);
4216
4217         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
4218 }
4219
4220 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
4221 {
4222         struct mgmt_ev_adv_monitor_removed ev;
4223         struct mgmt_pending_cmd *cmd;
4224         struct sock *sk_skip = NULL;
4225         struct mgmt_cp_remove_adv_monitor *cp;
4226
4227         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4228         if (cmd) {
4229                 cp = cmd->param;
4230
4231                 if (cp->monitor_handle)
4232                         sk_skip = cmd->sk;
4233         }
4234
4235         ev.monitor_handle = cpu_to_le16(handle);
4236
4237         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
4238 }
4239
4240 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
4241                                  void *data, u16 len)
4242 {
4243         struct adv_monitor *monitor = NULL;
4244         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
4245         int handle, err;
4246         size_t rp_size = 0;
4247         __u32 supported = 0;
4248         __u32 enabled = 0;
4249         __u16 num_handles = 0;
4250         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
4251
4252         BT_DBG("request for %s", hdev->name);
4253
4254         hci_dev_lock(hdev);
4255
4256         if (msft_monitor_supported(hdev))
4257                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
4258
4259         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
4260                 handles[num_handles++] = monitor->handle;
4261
4262         hci_dev_unlock(hdev);
4263
4264         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
4265         rp = kmalloc(rp_size, GFP_KERNEL);
4266         if (!rp)
4267                 return -ENOMEM;
4268
4269         /* All supported features are currently enabled */
4270         enabled = supported;
4271
4272         rp->supported_features = cpu_to_le32(supported);
4273         rp->enabled_features = cpu_to_le32(enabled);
4274         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
4275         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
4276         rp->num_handles = cpu_to_le16(num_handles);
4277         if (num_handles)
4278                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
4279
4280         err = mgmt_cmd_complete(sk, hdev->id,
4281                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
4282                                 MGMT_STATUS_SUCCESS, rp, rp_size);
4283
4284         kfree(rp);
4285
4286         return err;
4287 }
4288
4289 int mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status)
4290 {
4291         struct mgmt_rp_add_adv_patterns_monitor rp;
4292         struct mgmt_pending_cmd *cmd;
4293         struct adv_monitor *monitor;
4294         int err = 0;
4295
4296         hci_dev_lock(hdev);
4297
4298         cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev);
4299         if (!cmd) {
4300                 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev);
4301                 if (!cmd)
4302                         goto done;
4303         }
4304
4305         monitor = cmd->user_data;
4306         rp.monitor_handle = cpu_to_le16(monitor->handle);
4307
4308         if (!status) {
4309                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
4310                 hdev->adv_monitors_cnt++;
4311                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
4312                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
4313                 hci_update_background_scan(hdev);
4314         }
4315
4316         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4317                                 mgmt_status(status), &rp, sizeof(rp));
4318         mgmt_pending_remove(cmd);
4319
4320 done:
4321         hci_dev_unlock(hdev);
4322         bt_dev_dbg(hdev, "add monitor %d complete, status %u",
4323                    rp.monitor_handle, status);
4324
4325         return err;
4326 }
4327
4328 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4329                                       struct adv_monitor *m, u8 status,
4330                                       void *data, u16 len, u16 op)
4331 {
4332         struct mgmt_rp_add_adv_patterns_monitor rp;
4333         struct mgmt_pending_cmd *cmd;
4334         int err;
4335         bool pending;
4336
4337         hci_dev_lock(hdev);
4338
4339         if (status)
4340                 goto unlock;
4341
4342         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4343             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4344             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
4345             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
4346                 status = MGMT_STATUS_BUSY;
4347                 goto unlock;
4348         }
4349
4350         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4351         if (!cmd) {
4352                 status = MGMT_STATUS_NO_RESOURCES;
4353                 goto unlock;
4354         }
4355
4356         cmd->user_data = m;
4357         pending = hci_add_adv_monitor(hdev, m, &err);
4358         if (err) {
4359                 if (err == -ENOSPC || err == -ENOMEM)
4360                         status = MGMT_STATUS_NO_RESOURCES;
4361                 else if (err == -EINVAL)
4362                         status = MGMT_STATUS_INVALID_PARAMS;
4363                 else
4364                         status = MGMT_STATUS_FAILED;
4365
4366                 mgmt_pending_remove(cmd);
4367                 goto unlock;
4368         }
4369
4370         if (!pending) {
4371                 mgmt_pending_remove(cmd);
4372                 rp.monitor_handle = cpu_to_le16(m->handle);
4373                 mgmt_adv_monitor_added(sk, hdev, m->handle);
4374                 m->state = ADV_MONITOR_STATE_REGISTERED;
4375                 hdev->adv_monitors_cnt++;
4376
4377                 hci_dev_unlock(hdev);
4378                 return mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_SUCCESS,
4379                                          &rp, sizeof(rp));
4380         }
4381
4382         hci_dev_unlock(hdev);
4383
4384         return 0;
4385
4386 unlock:
4387         hci_free_adv_monitor(hdev, m);
4388         hci_dev_unlock(hdev);
4389         return mgmt_cmd_status(sk, hdev->id, op, status);
4390 }
4391
4392 static void parse_adv_monitor_rssi(struct adv_monitor *m,
4393                                    struct mgmt_adv_rssi_thresholds *rssi)
4394 {
4395         if (rssi) {
4396                 m->rssi.low_threshold = rssi->low_threshold;
4397                 m->rssi.low_threshold_timeout =
4398                     __le16_to_cpu(rssi->low_threshold_timeout);
4399                 m->rssi.high_threshold = rssi->high_threshold;
4400                 m->rssi.high_threshold_timeout =
4401                     __le16_to_cpu(rssi->high_threshold_timeout);
4402                 m->rssi.sampling_period = rssi->sampling_period;
4403         } else {
4404                 /* Default values. These numbers are the least constricting
4405                  * parameters for MSFT API to work, so it behaves as if there
4406                  * are no rssi parameter to consider. May need to be changed
4407                  * if other API are to be supported.
4408                  */
4409                 m->rssi.low_threshold = -127;
4410                 m->rssi.low_threshold_timeout = 60;
4411                 m->rssi.high_threshold = -127;
4412                 m->rssi.high_threshold_timeout = 0;
4413                 m->rssi.sampling_period = 0;
4414         }
4415 }
4416
4417 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
4418                                     struct mgmt_adv_pattern *patterns)
4419 {
4420         u8 offset = 0, length = 0;
4421         struct adv_pattern *p = NULL;
4422         int i;
4423
4424         for (i = 0; i < pattern_count; i++) {
4425                 offset = patterns[i].offset;
4426                 length = patterns[i].length;
4427                 if (offset >= HCI_MAX_AD_LENGTH ||
4428                     length > HCI_MAX_AD_LENGTH ||
4429                     (offset + length) > HCI_MAX_AD_LENGTH)
4430                         return MGMT_STATUS_INVALID_PARAMS;
4431
4432                 p = kmalloc(sizeof(*p), GFP_KERNEL);
4433                 if (!p)
4434                         return MGMT_STATUS_NO_RESOURCES;
4435
4436                 p->ad_type = patterns[i].ad_type;
4437                 p->offset = patterns[i].offset;
4438                 p->length = patterns[i].length;
4439                 memcpy(p->value, patterns[i].value, p->length);
4440
4441                 INIT_LIST_HEAD(&p->list);
4442                 list_add(&p->list, &m->patterns);
4443         }
4444
4445         return MGMT_STATUS_SUCCESS;
4446 }
4447
4448 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4449                                     void *data, u16 len)
4450 {
4451         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
4452         struct adv_monitor *m = NULL;
4453         u8 status = MGMT_STATUS_SUCCESS;
4454         size_t expected_size = sizeof(*cp);
4455
4456         BT_DBG("request for %s", hdev->name);
4457
4458         if (len <= sizeof(*cp)) {
4459                 status = MGMT_STATUS_INVALID_PARAMS;
4460                 goto done;
4461         }
4462
4463         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4464         if (len != expected_size) {
4465                 status = MGMT_STATUS_INVALID_PARAMS;
4466                 goto done;
4467         }
4468
4469         m = kzalloc(sizeof(*m), GFP_KERNEL);
4470         if (!m) {
4471                 status = MGMT_STATUS_NO_RESOURCES;
4472                 goto done;
4473         }
4474
4475         INIT_LIST_HEAD(&m->patterns);
4476
4477         parse_adv_monitor_rssi(m, NULL);
4478         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4479
4480 done:
4481         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4482                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
4483 }
4484
4485 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
4486                                          void *data, u16 len)
4487 {
4488         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
4489         struct adv_monitor *m = NULL;
4490         u8 status = MGMT_STATUS_SUCCESS;
4491         size_t expected_size = sizeof(*cp);
4492
4493         BT_DBG("request for %s", hdev->name);
4494
4495         if (len <= sizeof(*cp)) {
4496                 status = MGMT_STATUS_INVALID_PARAMS;
4497                 goto done;
4498         }
4499
4500         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4501         if (len != expected_size) {
4502                 status = MGMT_STATUS_INVALID_PARAMS;
4503                 goto done;
4504         }
4505
4506         m = kzalloc(sizeof(*m), GFP_KERNEL);
4507         if (!m) {
4508                 status = MGMT_STATUS_NO_RESOURCES;
4509                 goto done;
4510         }
4511
4512         INIT_LIST_HEAD(&m->patterns);
4513
4514         parse_adv_monitor_rssi(m, &cp->rssi);
4515         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4516
4517 done:
4518         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4519                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
4520 }
4521
4522 int mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status)
4523 {
4524         struct mgmt_rp_remove_adv_monitor rp;
4525         struct mgmt_cp_remove_adv_monitor *cp;
4526         struct mgmt_pending_cmd *cmd;
4527         int err = 0;
4528
4529         hci_dev_lock(hdev);
4530
4531         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4532         if (!cmd)
4533                 goto done;
4534
4535         cp = cmd->param;
4536         rp.monitor_handle = cp->monitor_handle;
4537
4538         if (!status)
4539                 hci_update_background_scan(hdev);
4540
4541         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4542                                 mgmt_status(status), &rp, sizeof(rp));
4543         mgmt_pending_remove(cmd);
4544
4545 done:
4546         hci_dev_unlock(hdev);
4547         bt_dev_dbg(hdev, "remove monitor %d complete, status %u",
4548                    rp.monitor_handle, status);
4549
4550         return err;
4551 }
4552
4553 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
4554                               void *data, u16 len)
4555 {
4556         struct mgmt_cp_remove_adv_monitor *cp = data;
4557         struct mgmt_rp_remove_adv_monitor rp;
4558         struct mgmt_pending_cmd *cmd;
4559         u16 handle = __le16_to_cpu(cp->monitor_handle);
4560         int err, status;
4561         bool pending;
4562
4563         BT_DBG("request for %s", hdev->name);
4564         rp.monitor_handle = cp->monitor_handle;
4565
4566         hci_dev_lock(hdev);
4567
4568         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4569             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
4570             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4571             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
4572                 status = MGMT_STATUS_BUSY;
4573                 goto unlock;
4574         }
4575
4576         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
4577         if (!cmd) {
4578                 status = MGMT_STATUS_NO_RESOURCES;
4579                 goto unlock;
4580         }
4581
4582         if (handle)
4583                 pending = hci_remove_single_adv_monitor(hdev, handle, &err);
4584         else
4585                 pending = hci_remove_all_adv_monitor(hdev, &err);
4586
4587         if (err) {
4588                 mgmt_pending_remove(cmd);
4589
4590                 if (err == -ENOENT)
4591                         status = MGMT_STATUS_INVALID_INDEX;
4592                 else
4593                         status = MGMT_STATUS_FAILED;
4594
4595                 goto unlock;
4596         }
4597
4598         /* monitor can be removed without forwarding request to controller */
4599         if (!pending) {
4600                 mgmt_pending_remove(cmd);
4601                 hci_dev_unlock(hdev);
4602
4603                 return mgmt_cmd_complete(sk, hdev->id,
4604                                          MGMT_OP_REMOVE_ADV_MONITOR,
4605                                          MGMT_STATUS_SUCCESS,
4606                                          &rp, sizeof(rp));
4607         }
4608
4609         hci_dev_unlock(hdev);
4610         return 0;
4611
4612 unlock:
4613         hci_dev_unlock(hdev);
4614         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4615                                status);
4616 }
4617
4618 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
4619                                          u16 opcode, struct sk_buff *skb)
4620 {
4621         struct mgmt_rp_read_local_oob_data mgmt_rp;
4622         size_t rp_size = sizeof(mgmt_rp);
4623         struct mgmt_pending_cmd *cmd;
4624
4625         bt_dev_dbg(hdev, "status %u", status);
4626
4627         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4628         if (!cmd)
4629                 return;
4630
4631         if (status || !skb) {
4632                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4633                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
4634                 goto remove;
4635         }
4636
4637         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
4638
4639         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
4640                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
4641
4642                 if (skb->len < sizeof(*rp)) {
4643                         mgmt_cmd_status(cmd->sk, hdev->id,
4644                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4645                                         MGMT_STATUS_FAILED);
4646                         goto remove;
4647                 }
4648
4649                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
4650                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
4651
4652                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
4653         } else {
4654                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
4655
4656                 if (skb->len < sizeof(*rp)) {
4657                         mgmt_cmd_status(cmd->sk, hdev->id,
4658                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4659                                         MGMT_STATUS_FAILED);
4660                         goto remove;
4661                 }
4662
4663                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
4664                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
4665
4666                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
4667                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
4668         }
4669
4670         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4671                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
4672
4673 remove:
4674         mgmt_pending_remove(cmd);
4675 }
4676
4677 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
4678                                void *data, u16 data_len)
4679 {
4680         struct mgmt_pending_cmd *cmd;
4681         struct hci_request req;
4682         int err;
4683
4684         bt_dev_dbg(hdev, "sock %p", sk);
4685
4686         hci_dev_lock(hdev);
4687
4688         if (!hdev_is_powered(hdev)) {
4689                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4690                                       MGMT_STATUS_NOT_POWERED);
4691                 goto unlock;
4692         }
4693
4694         if (!lmp_ssp_capable(hdev)) {
4695                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4696                                       MGMT_STATUS_NOT_SUPPORTED);
4697                 goto unlock;
4698         }
4699
4700         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
4701                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4702                                       MGMT_STATUS_BUSY);
4703                 goto unlock;
4704         }
4705
4706         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
4707         if (!cmd) {
4708                 err = -ENOMEM;
4709                 goto unlock;
4710         }
4711
4712         hci_req_init(&req, hdev);
4713
4714         if (bredr_sc_enabled(hdev))
4715                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4716         else
4717                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4718
4719         err = hci_req_run_skb(&req, read_local_oob_data_complete);
4720         if (err < 0)
4721                 mgmt_pending_remove(cmd);
4722
4723 unlock:
4724         hci_dev_unlock(hdev);
4725         return err;
4726 }
4727
4728 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4729                                void *data, u16 len)
4730 {
4731         struct mgmt_addr_info *addr = data;
4732         int err;
4733
4734         bt_dev_dbg(hdev, "sock %p", sk);
4735
4736         if (!bdaddr_type_is_valid(addr->type))
4737                 return mgmt_cmd_complete(sk, hdev->id,
4738                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
4739                                          MGMT_STATUS_INVALID_PARAMS,
4740                                          addr, sizeof(*addr));
4741
4742         hci_dev_lock(hdev);
4743
4744         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4745                 struct mgmt_cp_add_remote_oob_data *cp = data;
4746                 u8 status;
4747
4748                 if (cp->addr.type != BDADDR_BREDR) {
4749                         err = mgmt_cmd_complete(sk, hdev->id,
4750                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
4751                                                 MGMT_STATUS_INVALID_PARAMS,
4752                                                 &cp->addr, sizeof(cp->addr));
4753                         goto unlock;
4754                 }
4755
4756                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4757                                               cp->addr.type, cp->hash,
4758                                               cp->rand, NULL, NULL);
4759                 if (err < 0)
4760                         status = MGMT_STATUS_FAILED;
4761                 else
4762                         status = MGMT_STATUS_SUCCESS;
4763
4764                 err = mgmt_cmd_complete(sk, hdev->id,
4765                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4766                                         &cp->addr, sizeof(cp->addr));
4767         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4768                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
4769                 u8 *rand192, *hash192, *rand256, *hash256;
4770                 u8 status;
4771
4772                 if (bdaddr_type_is_le(cp->addr.type)) {
4773                         /* Enforce zero-valued 192-bit parameters as
4774                          * long as legacy SMP OOB isn't implemented.
4775                          */
4776                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4777                             memcmp(cp->hash192, ZERO_KEY, 16)) {
4778                                 err = mgmt_cmd_complete(sk, hdev->id,
4779                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4780                                                         MGMT_STATUS_INVALID_PARAMS,
4781                                                         addr, sizeof(*addr));
4782                                 goto unlock;
4783                         }
4784
4785                         rand192 = NULL;
4786                         hash192 = NULL;
4787                 } else {
4788                         /* In case one of the P-192 values is set to zero,
4789                          * then just disable OOB data for P-192.
4790                          */
4791                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4792                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
4793                                 rand192 = NULL;
4794                                 hash192 = NULL;
4795                         } else {
4796                                 rand192 = cp->rand192;
4797                                 hash192 = cp->hash192;
4798                         }
4799                 }
4800
4801                 /* In case one of the P-256 values is set to zero, then just
4802                  * disable OOB data for P-256.
4803                  */
4804                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4805                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
4806                         rand256 = NULL;
4807                         hash256 = NULL;
4808                 } else {
4809                         rand256 = cp->rand256;
4810                         hash256 = cp->hash256;
4811                 }
4812
4813                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4814                                               cp->addr.type, hash192, rand192,
4815                                               hash256, rand256);
4816                 if (err < 0)
4817                         status = MGMT_STATUS_FAILED;
4818                 else
4819                         status = MGMT_STATUS_SUCCESS;
4820
4821                 err = mgmt_cmd_complete(sk, hdev->id,
4822                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4823                                         status, &cp->addr, sizeof(cp->addr));
4824         } else {
4825                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
4826                            len);
4827                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4828                                       MGMT_STATUS_INVALID_PARAMS);
4829         }
4830
4831 unlock:
4832         hci_dev_unlock(hdev);
4833         return err;
4834 }
4835
4836 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4837                                   void *data, u16 len)
4838 {
4839         struct mgmt_cp_remove_remote_oob_data *cp = data;
4840         u8 status;
4841         int err;
4842
4843         bt_dev_dbg(hdev, "sock %p", sk);
4844
4845         if (cp->addr.type != BDADDR_BREDR)
4846                 return mgmt_cmd_complete(sk, hdev->id,
4847                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4848                                          MGMT_STATUS_INVALID_PARAMS,
4849                                          &cp->addr, sizeof(cp->addr));
4850
4851         hci_dev_lock(hdev);
4852
4853         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4854                 hci_remote_oob_data_clear(hdev);
4855                 status = MGMT_STATUS_SUCCESS;
4856                 goto done;
4857         }
4858
4859         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
4860         if (err < 0)
4861                 status = MGMT_STATUS_INVALID_PARAMS;
4862         else
4863                 status = MGMT_STATUS_SUCCESS;
4864
4865 done:
4866         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4867                                 status, &cp->addr, sizeof(cp->addr));
4868
4869         hci_dev_unlock(hdev);
4870         return err;
4871 }
4872
4873 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
4874 {
4875         struct mgmt_pending_cmd *cmd;
4876
4877         bt_dev_dbg(hdev, "status %u", status);
4878
4879         hci_dev_lock(hdev);
4880
4881         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4882         if (!cmd)
4883                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4884
4885         if (!cmd)
4886                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
4887
4888         if (cmd) {
4889                 cmd->cmd_complete(cmd, mgmt_status(status));
4890                 mgmt_pending_remove(cmd);
4891         }
4892
4893         hci_dev_unlock(hdev);
4894
4895         /* Handle suspend notifier */
4896         if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY,
4897                                hdev->suspend_tasks)) {
4898                 bt_dev_dbg(hdev, "Unpaused discovery");
4899                 wake_up(&hdev->suspend_wait_q);
4900         }
4901 }
4902
4903 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
4904                                     uint8_t *mgmt_status)
4905 {
4906         switch (type) {
4907         case DISCOV_TYPE_LE:
4908                 *mgmt_status = mgmt_le_support(hdev);
4909                 if (*mgmt_status)
4910                         return false;
4911                 break;
4912         case DISCOV_TYPE_INTERLEAVED:
4913                 *mgmt_status = mgmt_le_support(hdev);
4914                 if (*mgmt_status)
4915                         return false;
4916                 fallthrough;
4917         case DISCOV_TYPE_BREDR:
4918                 *mgmt_status = mgmt_bredr_support(hdev);
4919                 if (*mgmt_status)
4920                         return false;
4921                 break;
4922         default:
4923                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
4924                 return false;
4925         }
4926
4927         return true;
4928 }
4929
4930 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
4931                                     u16 op, void *data, u16 len)
4932 {
4933         struct mgmt_cp_start_discovery *cp = data;
4934         struct mgmt_pending_cmd *cmd;
4935         u8 status;
4936         int err;
4937
4938         bt_dev_dbg(hdev, "sock %p", sk);
4939
4940         hci_dev_lock(hdev);
4941
4942         if (!hdev_is_powered(hdev)) {
4943                 err = mgmt_cmd_complete(sk, hdev->id, op,
4944                                         MGMT_STATUS_NOT_POWERED,
4945                                         &cp->type, sizeof(cp->type));
4946                 goto failed;
4947         }
4948
4949         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4950             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4951                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4952                                         &cp->type, sizeof(cp->type));
4953                 goto failed;
4954         }
4955
4956         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4957                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
4958                                         &cp->type, sizeof(cp->type));
4959                 goto failed;
4960         }
4961
4962         /* Can't start discovery when it is paused */
4963         if (hdev->discovery_paused) {
4964                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4965                                         &cp->type, sizeof(cp->type));
4966                 goto failed;
4967         }
4968
4969         /* Clear the discovery filter first to free any previously
4970          * allocated memory for the UUID list.
4971          */
4972         hci_discovery_filter_clear(hdev);
4973
4974         hdev->discovery.type = cp->type;
4975         hdev->discovery.report_invalid_rssi = false;
4976         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
4977                 hdev->discovery.limited = true;
4978         else
4979                 hdev->discovery.limited = false;
4980
4981         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4982         if (!cmd) {
4983                 err = -ENOMEM;
4984                 goto failed;
4985         }
4986
4987         cmd->cmd_complete = generic_cmd_complete;
4988
4989         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4990         queue_work(hdev->req_workqueue, &hdev->discov_update);
4991         err = 0;
4992
4993 failed:
4994         hci_dev_unlock(hdev);
4995         return err;
4996 }
4997
4998 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4999                            void *data, u16 len)
5000 {
5001         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
5002                                         data, len);
5003 }
5004
5005 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
5006                                    void *data, u16 len)
5007 {
5008         return start_discovery_internal(sk, hdev,
5009                                         MGMT_OP_START_LIMITED_DISCOVERY,
5010                                         data, len);
5011 }
5012
5013 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
5014                                           u8 status)
5015 {
5016         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
5017                                  cmd->param, 1);
5018 }
5019
5020 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
5021                                    void *data, u16 len)
5022 {
5023         struct mgmt_cp_start_service_discovery *cp = data;
5024         struct mgmt_pending_cmd *cmd;
5025         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
5026         u16 uuid_count, expected_len;
5027         u8 status;
5028         int err;
5029
5030         bt_dev_dbg(hdev, "sock %p", sk);
5031
5032         hci_dev_lock(hdev);
5033
5034         if (!hdev_is_powered(hdev)) {
5035                 err = mgmt_cmd_complete(sk, hdev->id,
5036                                         MGMT_OP_START_SERVICE_DISCOVERY,
5037                                         MGMT_STATUS_NOT_POWERED,
5038                                         &cp->type, sizeof(cp->type));
5039                 goto failed;
5040         }
5041
5042         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5043             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5044                 err = mgmt_cmd_complete(sk, hdev->id,
5045                                         MGMT_OP_START_SERVICE_DISCOVERY,
5046                                         MGMT_STATUS_BUSY, &cp->type,
5047                                         sizeof(cp->type));
5048                 goto failed;
5049         }
5050
5051         if (hdev->discovery_paused) {
5052                 err = mgmt_cmd_complete(sk, hdev->id,
5053                                         MGMT_OP_START_SERVICE_DISCOVERY,
5054                                         MGMT_STATUS_BUSY, &cp->type,
5055                                         sizeof(cp->type));
5056                 goto failed;
5057         }
5058
5059         uuid_count = __le16_to_cpu(cp->uuid_count);
5060         if (uuid_count > max_uuid_count) {
5061                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
5062                            uuid_count);
5063                 err = mgmt_cmd_complete(sk, hdev->id,
5064                                         MGMT_OP_START_SERVICE_DISCOVERY,
5065                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5066                                         sizeof(cp->type));
5067                 goto failed;
5068         }
5069
5070         expected_len = sizeof(*cp) + uuid_count * 16;
5071         if (expected_len != len) {
5072                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
5073                            expected_len, len);
5074                 err = mgmt_cmd_complete(sk, hdev->id,
5075                                         MGMT_OP_START_SERVICE_DISCOVERY,
5076                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5077                                         sizeof(cp->type));
5078                 goto failed;
5079         }
5080
5081         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5082                 err = mgmt_cmd_complete(sk, hdev->id,
5083                                         MGMT_OP_START_SERVICE_DISCOVERY,
5084                                         status, &cp->type, sizeof(cp->type));
5085                 goto failed;
5086         }
5087
5088         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
5089                                hdev, data, len);
5090         if (!cmd) {
5091                 err = -ENOMEM;
5092                 goto failed;
5093         }
5094
5095         cmd->cmd_complete = service_discovery_cmd_complete;
5096
5097         /* Clear the discovery filter first to free any previously
5098          * allocated memory for the UUID list.
5099          */
5100         hci_discovery_filter_clear(hdev);
5101
5102         hdev->discovery.result_filtering = true;
5103         hdev->discovery.type = cp->type;
5104         hdev->discovery.rssi = cp->rssi;
5105         hdev->discovery.uuid_count = uuid_count;
5106
5107         if (uuid_count > 0) {
5108                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
5109                                                 GFP_KERNEL);
5110                 if (!hdev->discovery.uuids) {
5111                         err = mgmt_cmd_complete(sk, hdev->id,
5112                                                 MGMT_OP_START_SERVICE_DISCOVERY,
5113                                                 MGMT_STATUS_FAILED,
5114                                                 &cp->type, sizeof(cp->type));
5115                         mgmt_pending_remove(cmd);
5116                         goto failed;
5117                 }
5118         }
5119
5120         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5121         queue_work(hdev->req_workqueue, &hdev->discov_update);
5122         err = 0;
5123
5124 failed:
5125         hci_dev_unlock(hdev);
5126         return err;
5127 }
5128
5129 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
5130 {
5131         struct mgmt_pending_cmd *cmd;
5132
5133         bt_dev_dbg(hdev, "status %u", status);
5134
5135         hci_dev_lock(hdev);
5136
5137         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
5138         if (cmd) {
5139                 cmd->cmd_complete(cmd, mgmt_status(status));
5140                 mgmt_pending_remove(cmd);
5141         }
5142
5143         hci_dev_unlock(hdev);
5144
5145         /* Handle suspend notifier */
5146         if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) {
5147                 bt_dev_dbg(hdev, "Paused discovery");
5148                 wake_up(&hdev->suspend_wait_q);
5149         }
5150 }
5151
5152 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
5153                           u16 len)
5154 {
5155         struct mgmt_cp_stop_discovery *mgmt_cp = data;
5156         struct mgmt_pending_cmd *cmd;
5157         int err;
5158
5159         bt_dev_dbg(hdev, "sock %p", sk);
5160
5161         hci_dev_lock(hdev);
5162
5163         if (!hci_discovery_active(hdev)) {
5164                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5165                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
5166                                         sizeof(mgmt_cp->type));
5167                 goto unlock;
5168         }
5169
5170         if (hdev->discovery.type != mgmt_cp->type) {
5171                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5172                                         MGMT_STATUS_INVALID_PARAMS,
5173                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
5174                 goto unlock;
5175         }
5176
5177         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
5178         if (!cmd) {
5179                 err = -ENOMEM;
5180                 goto unlock;
5181         }
5182
5183         cmd->cmd_complete = generic_cmd_complete;
5184
5185         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
5186         queue_work(hdev->req_workqueue, &hdev->discov_update);
5187         err = 0;
5188
5189 unlock:
5190         hci_dev_unlock(hdev);
5191         return err;
5192 }
5193
5194 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
5195                         u16 len)
5196 {
5197         struct mgmt_cp_confirm_name *cp = data;
5198         struct inquiry_entry *e;
5199         int err;
5200
5201         bt_dev_dbg(hdev, "sock %p", sk);
5202
5203         hci_dev_lock(hdev);
5204
5205         if (!hci_discovery_active(hdev)) {
5206                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5207                                         MGMT_STATUS_FAILED, &cp->addr,
5208                                         sizeof(cp->addr));
5209                 goto failed;
5210         }
5211
5212         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
5213         if (!e) {
5214                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5215                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
5216                                         sizeof(cp->addr));
5217                 goto failed;
5218         }
5219
5220         if (cp->name_known) {
5221                 e->name_state = NAME_KNOWN;
5222                 list_del(&e->list);
5223         } else {
5224                 e->name_state = NAME_NEEDED;
5225                 hci_inquiry_cache_update_resolve(hdev, e);
5226         }
5227
5228         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
5229                                 &cp->addr, sizeof(cp->addr));
5230
5231 failed:
5232         hci_dev_unlock(hdev);
5233         return err;
5234 }
5235
5236 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
5237                         u16 len)
5238 {
5239         struct mgmt_cp_block_device *cp = data;
5240         u8 status;
5241         int err;
5242
5243         bt_dev_dbg(hdev, "sock %p", sk);
5244
5245         if (!bdaddr_type_is_valid(cp->addr.type))
5246                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
5247                                          MGMT_STATUS_INVALID_PARAMS,
5248                                          &cp->addr, sizeof(cp->addr));
5249
5250         hci_dev_lock(hdev);
5251
5252         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
5253                                   cp->addr.type);
5254         if (err < 0) {
5255                 status = MGMT_STATUS_FAILED;
5256                 goto done;
5257         }
5258
5259         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5260                    sk);
5261         status = MGMT_STATUS_SUCCESS;
5262
5263 done:
5264         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
5265                                 &cp->addr, sizeof(cp->addr));
5266
5267         hci_dev_unlock(hdev);
5268
5269         return err;
5270 }
5271
5272 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
5273                           u16 len)
5274 {
5275         struct mgmt_cp_unblock_device *cp = data;
5276         u8 status;
5277         int err;
5278
5279         bt_dev_dbg(hdev, "sock %p", sk);
5280
5281         if (!bdaddr_type_is_valid(cp->addr.type))
5282                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
5283                                          MGMT_STATUS_INVALID_PARAMS,
5284                                          &cp->addr, sizeof(cp->addr));
5285
5286         hci_dev_lock(hdev);
5287
5288         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
5289                                   cp->addr.type);
5290         if (err < 0) {
5291                 status = MGMT_STATUS_INVALID_PARAMS;
5292                 goto done;
5293         }
5294
5295         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5296                    sk);
5297         status = MGMT_STATUS_SUCCESS;
5298
5299 done:
5300         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
5301                                 &cp->addr, sizeof(cp->addr));
5302
5303         hci_dev_unlock(hdev);
5304
5305         return err;
5306 }
5307
5308 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
5309                          u16 len)
5310 {
5311         struct mgmt_cp_set_device_id *cp = data;
5312         struct hci_request req;
5313         int err;
5314         __u16 source;
5315
5316         bt_dev_dbg(hdev, "sock %p", sk);
5317
5318         source = __le16_to_cpu(cp->source);
5319
5320         if (source > 0x0002)
5321                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
5322                                        MGMT_STATUS_INVALID_PARAMS);
5323
5324         hci_dev_lock(hdev);
5325
5326         hdev->devid_source = source;
5327         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
5328         hdev->devid_product = __le16_to_cpu(cp->product);
5329         hdev->devid_version = __le16_to_cpu(cp->version);
5330
5331         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
5332                                 NULL, 0);
5333
5334         hci_req_init(&req, hdev);
5335         __hci_req_update_eir(&req);
5336         hci_req_run(&req, NULL);
5337
5338         hci_dev_unlock(hdev);
5339
5340         return err;
5341 }
5342
5343 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
5344                                         u16 opcode)
5345 {
5346         bt_dev_dbg(hdev, "status %u", status);
5347 }
5348
5349 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
5350                                      u16 opcode)
5351 {
5352         struct cmd_lookup match = { NULL, hdev };
5353         struct hci_request req;
5354         u8 instance;
5355         struct adv_info *adv_instance;
5356         int err;
5357
5358         hci_dev_lock(hdev);
5359
5360         if (status) {
5361                 u8 mgmt_err = mgmt_status(status);
5362
5363                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
5364                                      cmd_status_rsp, &mgmt_err);
5365                 goto unlock;
5366         }
5367
5368         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
5369                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
5370         else
5371                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
5372
5373         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
5374                              &match);
5375
5376         new_settings(hdev, match.sk);
5377
5378         if (match.sk)
5379                 sock_put(match.sk);
5380
5381         /* Handle suspend notifier */
5382         if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING,
5383                                hdev->suspend_tasks)) {
5384                 bt_dev_dbg(hdev, "Paused advertising");
5385                 wake_up(&hdev->suspend_wait_q);
5386         } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING,
5387                                       hdev->suspend_tasks)) {
5388                 bt_dev_dbg(hdev, "Unpaused advertising");
5389                 wake_up(&hdev->suspend_wait_q);
5390         }
5391
5392         /* If "Set Advertising" was just disabled and instance advertising was
5393          * set up earlier, then re-enable multi-instance advertising.
5394          */
5395         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
5396             list_empty(&hdev->adv_instances))
5397                 goto unlock;
5398
5399         instance = hdev->cur_adv_instance;
5400         if (!instance) {
5401                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
5402                                                         struct adv_info, list);
5403                 if (!adv_instance)
5404                         goto unlock;
5405
5406                 instance = adv_instance->instance;
5407         }
5408
5409         hci_req_init(&req, hdev);
5410
5411         err = __hci_req_schedule_adv_instance(&req, instance, true);
5412
5413         if (!err)
5414                 err = hci_req_run(&req, enable_advertising_instance);
5415
5416         if (err)
5417                 bt_dev_err(hdev, "failed to re-configure advertising");
5418
5419 unlock:
5420         hci_dev_unlock(hdev);
5421 }
5422
5423 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
5424                            u16 len)
5425 {
5426         struct mgmt_mode *cp = data;
5427         struct mgmt_pending_cmd *cmd;
5428         struct hci_request req;
5429         u8 val, status;
5430         int err;
5431
5432         bt_dev_dbg(hdev, "sock %p", sk);
5433
5434         status = mgmt_le_support(hdev);
5435         if (status)
5436                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5437                                        status);
5438
5439         /* Enabling the experimental LL Privay support disables support for
5440          * advertising.
5441          */
5442         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
5443                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5444                                        MGMT_STATUS_NOT_SUPPORTED);
5445
5446         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5447                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5448                                        MGMT_STATUS_INVALID_PARAMS);
5449
5450         if (hdev->advertising_paused)
5451                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5452                                        MGMT_STATUS_BUSY);
5453
5454         hci_dev_lock(hdev);
5455
5456         val = !!cp->val;
5457
5458         /* The following conditions are ones which mean that we should
5459          * not do any HCI communication but directly send a mgmt
5460          * response to user space (after toggling the flag if
5461          * necessary).
5462          */
5463         if (!hdev_is_powered(hdev) ||
5464             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
5465              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
5466             hci_conn_num(hdev, LE_LINK) > 0 ||
5467             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5468              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
5469                 bool changed;
5470
5471                 if (cp->val) {
5472                         hdev->cur_adv_instance = 0x00;
5473                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
5474                         if (cp->val == 0x02)
5475                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5476                         else
5477                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5478                 } else {
5479                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
5480                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5481                 }
5482
5483                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
5484                 if (err < 0)
5485                         goto unlock;
5486
5487                 if (changed)
5488                         err = new_settings(hdev, sk);
5489
5490                 goto unlock;
5491         }
5492
5493         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
5494             pending_find(MGMT_OP_SET_LE, hdev)) {
5495                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5496                                       MGMT_STATUS_BUSY);
5497                 goto unlock;
5498         }
5499
5500         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
5501         if (!cmd) {
5502                 err = -ENOMEM;
5503                 goto unlock;
5504         }
5505
5506         hci_req_init(&req, hdev);
5507
5508         if (cp->val == 0x02)
5509                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5510         else
5511                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5512
5513         cancel_adv_timeout(hdev);
5514
5515         if (val) {
5516                 /* Switch to instance "0" for the Set Advertising setting.
5517                  * We cannot use update_[adv|scan_rsp]_data() here as the
5518                  * HCI_ADVERTISING flag is not yet set.
5519                  */
5520                 hdev->cur_adv_instance = 0x00;
5521
5522                 if (ext_adv_capable(hdev)) {
5523                         __hci_req_start_ext_adv(&req, 0x00);
5524                 } else {
5525                         __hci_req_update_adv_data(&req, 0x00);
5526                         __hci_req_update_scan_rsp_data(&req, 0x00);
5527                         __hci_req_enable_advertising(&req);
5528                 }
5529         } else {
5530                 __hci_req_disable_advertising(&req);
5531         }
5532
5533         err = hci_req_run(&req, set_advertising_complete);
5534         if (err < 0)
5535                 mgmt_pending_remove(cmd);
5536
5537 unlock:
5538         hci_dev_unlock(hdev);
5539         return err;
5540 }
5541
5542 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
5543                               void *data, u16 len)
5544 {
5545         struct mgmt_cp_set_static_address *cp = data;
5546         int err;
5547
5548         bt_dev_dbg(hdev, "sock %p", sk);
5549
5550         if (!lmp_le_capable(hdev))
5551                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5552                                        MGMT_STATUS_NOT_SUPPORTED);
5553
5554         if (hdev_is_powered(hdev))
5555                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5556                                        MGMT_STATUS_REJECTED);
5557
5558         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
5559                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
5560                         return mgmt_cmd_status(sk, hdev->id,
5561                                                MGMT_OP_SET_STATIC_ADDRESS,
5562                                                MGMT_STATUS_INVALID_PARAMS);
5563
5564                 /* Two most significant bits shall be set */
5565                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
5566                         return mgmt_cmd_status(sk, hdev->id,
5567                                                MGMT_OP_SET_STATIC_ADDRESS,
5568                                                MGMT_STATUS_INVALID_PARAMS);
5569         }
5570
5571         hci_dev_lock(hdev);
5572
5573         bacpy(&hdev->static_addr, &cp->bdaddr);
5574
5575         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
5576         if (err < 0)
5577                 goto unlock;
5578
5579         err = new_settings(hdev, sk);
5580
5581 unlock:
5582         hci_dev_unlock(hdev);
5583         return err;
5584 }
5585
5586 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5587                            void *data, u16 len)
5588 {
5589         struct mgmt_cp_set_scan_params *cp = data;
5590         __u16 interval, window;
5591         int err;
5592
5593         bt_dev_dbg(hdev, "sock %p", sk);
5594
5595         if (!lmp_le_capable(hdev))
5596                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5597                                        MGMT_STATUS_NOT_SUPPORTED);
5598
5599         interval = __le16_to_cpu(cp->interval);
5600
5601         if (interval < 0x0004 || interval > 0x4000)
5602                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5603                                        MGMT_STATUS_INVALID_PARAMS);
5604
5605         window = __le16_to_cpu(cp->window);
5606
5607         if (window < 0x0004 || window > 0x4000)
5608                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5609                                        MGMT_STATUS_INVALID_PARAMS);
5610
5611         if (window > interval)
5612                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5613                                        MGMT_STATUS_INVALID_PARAMS);
5614
5615         hci_dev_lock(hdev);
5616
5617         hdev->le_scan_interval = interval;
5618         hdev->le_scan_window = window;
5619
5620         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5621                                 NULL, 0);
5622
5623         /* If background scan is running, restart it so new parameters are
5624          * loaded.
5625          */
5626         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5627             hdev->discovery.state == DISCOVERY_STOPPED) {
5628                 struct hci_request req;
5629
5630                 hci_req_init(&req, hdev);
5631
5632                 hci_req_add_le_scan_disable(&req, false);
5633                 hci_req_add_le_passive_scan(&req);
5634
5635                 hci_req_run(&req, NULL);
5636         }
5637
5638         hci_dev_unlock(hdev);
5639
5640         return err;
5641 }
5642
5643 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5644                                       u16 opcode)
5645 {
5646         struct mgmt_pending_cmd *cmd;
5647
5648         bt_dev_dbg(hdev, "status 0x%02x", status);
5649
5650         hci_dev_lock(hdev);
5651
5652         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5653         if (!cmd)
5654                 goto unlock;
5655
5656         if (status) {
5657                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5658                                 mgmt_status(status));
5659         } else {
5660                 struct mgmt_mode *cp = cmd->param;
5661
5662                 if (cp->val)
5663                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
5664                 else
5665                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5666
5667                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5668                 new_settings(hdev, cmd->sk);
5669         }
5670
5671         mgmt_pending_remove(cmd);
5672
5673 unlock:
5674         hci_dev_unlock(hdev);
5675 }
5676
5677 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
5678                                 void *data, u16 len)
5679 {
5680         struct mgmt_mode *cp = data;
5681         struct mgmt_pending_cmd *cmd;
5682         struct hci_request req;
5683         int err;
5684
5685         bt_dev_dbg(hdev, "sock %p", sk);
5686
5687         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
5688             hdev->hci_ver < BLUETOOTH_VER_1_2)
5689                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5690                                        MGMT_STATUS_NOT_SUPPORTED);
5691
5692         if (cp->val != 0x00 && cp->val != 0x01)
5693                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5694                                        MGMT_STATUS_INVALID_PARAMS);
5695
5696         hci_dev_lock(hdev);
5697
5698         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
5699                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5700                                       MGMT_STATUS_BUSY);
5701                 goto unlock;
5702         }
5703
5704         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
5705                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5706                                         hdev);
5707                 goto unlock;
5708         }
5709
5710         if (!hdev_is_powered(hdev)) {
5711                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
5712                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5713                                         hdev);
5714                 new_settings(hdev, sk);
5715                 goto unlock;
5716         }
5717
5718         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5719                                data, len);
5720         if (!cmd) {
5721                 err = -ENOMEM;
5722                 goto unlock;
5723         }
5724
5725         hci_req_init(&req, hdev);
5726
5727         __hci_req_write_fast_connectable(&req, cp->val);
5728
5729         err = hci_req_run(&req, fast_connectable_complete);
5730         if (err < 0) {
5731                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5732                                       MGMT_STATUS_FAILED);
5733                 mgmt_pending_remove(cmd);
5734         }
5735
5736 unlock:
5737         hci_dev_unlock(hdev);
5738
5739         return err;
5740 }
5741
5742 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5743 {
5744         struct mgmt_pending_cmd *cmd;
5745
5746         bt_dev_dbg(hdev, "status 0x%02x", status);
5747
5748         hci_dev_lock(hdev);
5749
5750         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
5751         if (!cmd)
5752                 goto unlock;
5753
5754         if (status) {
5755                 u8 mgmt_err = mgmt_status(status);
5756
5757                 /* We need to restore the flag if related HCI commands
5758                  * failed.
5759                  */
5760                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
5761
5762                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5763         } else {
5764                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5765                 new_settings(hdev, cmd->sk);
5766         }
5767
5768         mgmt_pending_remove(cmd);
5769
5770 unlock:
5771         hci_dev_unlock(hdev);
5772 }
5773
5774 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5775 {
5776         struct mgmt_mode *cp = data;
5777         struct mgmt_pending_cmd *cmd;
5778         struct hci_request req;
5779         int err;
5780
5781         bt_dev_dbg(hdev, "sock %p", sk);
5782
5783         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5784                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5785                                        MGMT_STATUS_NOT_SUPPORTED);
5786
5787         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5788                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5789                                        MGMT_STATUS_REJECTED);
5790
5791         if (cp->val != 0x00 && cp->val != 0x01)
5792                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5793                                        MGMT_STATUS_INVALID_PARAMS);
5794
5795         hci_dev_lock(hdev);
5796
5797         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5798                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5799                 goto unlock;
5800         }
5801
5802         if (!hdev_is_powered(hdev)) {
5803                 if (!cp->val) {
5804                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5805                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5806                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5807                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5808                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5809                 }
5810
5811                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5812
5813                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5814                 if (err < 0)
5815                         goto unlock;
5816
5817                 err = new_settings(hdev, sk);
5818                 goto unlock;
5819         }
5820
5821         /* Reject disabling when powered on */
5822         if (!cp->val) {
5823                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5824                                       MGMT_STATUS_REJECTED);
5825                 goto unlock;
5826         } else {
5827                 /* When configuring a dual-mode controller to operate
5828                  * with LE only and using a static address, then switching
5829                  * BR/EDR back on is not allowed.
5830                  *
5831                  * Dual-mode controllers shall operate with the public
5832                  * address as its identity address for BR/EDR and LE. So
5833                  * reject the attempt to create an invalid configuration.
5834                  *
5835                  * The same restrictions applies when secure connections
5836                  * has been enabled. For BR/EDR this is a controller feature
5837                  * while for LE it is a host stack feature. This means that
5838                  * switching BR/EDR back on when secure connections has been
5839                  * enabled is not a supported transaction.
5840                  */
5841                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5842                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5843                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5844                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5845                                               MGMT_STATUS_REJECTED);
5846                         goto unlock;
5847                 }
5848         }
5849
5850         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5851                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5852                                       MGMT_STATUS_BUSY);
5853                 goto unlock;
5854         }
5855
5856         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5857         if (!cmd) {
5858                 err = -ENOMEM;
5859                 goto unlock;
5860         }
5861
5862         /* We need to flip the bit already here so that
5863          * hci_req_update_adv_data generates the correct flags.
5864          */
5865         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5866
5867         hci_req_init(&req, hdev);
5868
5869         __hci_req_write_fast_connectable(&req, false);
5870         __hci_req_update_scan(&req);
5871
5872         /* Since only the advertising data flags will change, there
5873          * is no need to update the scan response data.
5874          */
5875         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
5876
5877         err = hci_req_run(&req, set_bredr_complete);
5878         if (err < 0)
5879                 mgmt_pending_remove(cmd);
5880
5881 unlock:
5882         hci_dev_unlock(hdev);
5883         return err;
5884 }
5885
5886 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5887 {
5888         struct mgmt_pending_cmd *cmd;
5889         struct mgmt_mode *cp;
5890
5891         bt_dev_dbg(hdev, "status %u", status);
5892
5893         hci_dev_lock(hdev);
5894
5895         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5896         if (!cmd)
5897                 goto unlock;
5898
5899         if (status) {
5900                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5901                                 mgmt_status(status));
5902                 goto remove;
5903         }
5904
5905         cp = cmd->param;
5906
5907         switch (cp->val) {
5908         case 0x00:
5909                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5910                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5911                 break;
5912         case 0x01:
5913                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5914                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5915                 break;
5916         case 0x02:
5917                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5918                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5919                 break;
5920         }
5921
5922         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5923         new_settings(hdev, cmd->sk);
5924
5925 remove:
5926         mgmt_pending_remove(cmd);
5927 unlock:
5928         hci_dev_unlock(hdev);
5929 }
5930
5931 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5932                            void *data, u16 len)
5933 {
5934         struct mgmt_mode *cp = data;
5935         struct mgmt_pending_cmd *cmd;
5936         struct hci_request req;
5937         u8 val;
5938         int err;
5939
5940         bt_dev_dbg(hdev, "sock %p", sk);
5941
5942         if (!lmp_sc_capable(hdev) &&
5943             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5944                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5945                                        MGMT_STATUS_NOT_SUPPORTED);
5946
5947         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5948             lmp_sc_capable(hdev) &&
5949             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5950                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5951                                        MGMT_STATUS_REJECTED);
5952
5953         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5954                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5955                                   MGMT_STATUS_INVALID_PARAMS);
5956
5957         hci_dev_lock(hdev);
5958
5959         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5960             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5961                 bool changed;
5962
5963                 if (cp->val) {
5964                         changed = !hci_dev_test_and_set_flag(hdev,
5965                                                              HCI_SC_ENABLED);
5966                         if (cp->val == 0x02)
5967                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5968                         else
5969                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5970                 } else {
5971                         changed = hci_dev_test_and_clear_flag(hdev,
5972                                                               HCI_SC_ENABLED);
5973                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5974                 }
5975
5976                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5977                 if (err < 0)
5978                         goto failed;
5979
5980                 if (changed)
5981                         err = new_settings(hdev, sk);
5982
5983                 goto failed;
5984         }
5985
5986         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5987                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5988                                       MGMT_STATUS_BUSY);
5989                 goto failed;
5990         }
5991
5992         val = !!cp->val;
5993
5994         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5995             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5996                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5997                 goto failed;
5998         }
5999
6000         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
6001         if (!cmd) {
6002                 err = -ENOMEM;
6003                 goto failed;
6004         }
6005
6006         hci_req_init(&req, hdev);
6007         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
6008         err = hci_req_run(&req, sc_enable_complete);
6009         if (err < 0) {
6010                 mgmt_pending_remove(cmd);
6011                 goto failed;
6012         }
6013
6014 failed:
6015         hci_dev_unlock(hdev);
6016         return err;
6017 }
6018
6019 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
6020                           void *data, u16 len)
6021 {
6022         struct mgmt_mode *cp = data;
6023         bool changed, use_changed;
6024         int err;
6025
6026         bt_dev_dbg(hdev, "sock %p", sk);
6027
6028         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6029                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
6030                                        MGMT_STATUS_INVALID_PARAMS);
6031
6032         hci_dev_lock(hdev);
6033
6034         if (cp->val)
6035                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6036         else
6037                 changed = hci_dev_test_and_clear_flag(hdev,
6038                                                       HCI_KEEP_DEBUG_KEYS);
6039
6040         if (cp->val == 0x02)
6041                 use_changed = !hci_dev_test_and_set_flag(hdev,
6042                                                          HCI_USE_DEBUG_KEYS);
6043         else
6044                 use_changed = hci_dev_test_and_clear_flag(hdev,
6045                                                           HCI_USE_DEBUG_KEYS);
6046
6047         if (hdev_is_powered(hdev) && use_changed &&
6048             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6049                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6050                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6051                              sizeof(mode), &mode);
6052         }
6053
6054         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
6055         if (err < 0)
6056                 goto unlock;
6057
6058         if (changed)
6059                 err = new_settings(hdev, sk);
6060
6061 unlock:
6062         hci_dev_unlock(hdev);
6063         return err;
6064 }
6065
6066 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6067                        u16 len)
6068 {
6069         struct mgmt_cp_set_privacy *cp = cp_data;
6070         bool changed;
6071         int err;
6072
6073         bt_dev_dbg(hdev, "sock %p", sk);
6074
6075         if (!lmp_le_capable(hdev))
6076                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6077                                        MGMT_STATUS_NOT_SUPPORTED);
6078
6079         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
6080                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6081                                        MGMT_STATUS_INVALID_PARAMS);
6082
6083 #ifndef TIZEN_BT
6084         /* commenting out since set privacy command is always rejected
6085          * if this condition is enabled.
6086          */
6087         if (hdev_is_powered(hdev))
6088                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6089                                        MGMT_STATUS_REJECTED);
6090 #endif
6091
6092         hci_dev_lock(hdev);
6093
6094         /* If user space supports this command it is also expected to
6095          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
6096          */
6097         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6098
6099         if (cp->privacy) {
6100                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
6101                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
6102                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
6103                 hci_adv_instances_set_rpa_expired(hdev, true);
6104                 if (cp->privacy == 0x02)
6105                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
6106                 else
6107                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6108         } else {
6109                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
6110                 memset(hdev->irk, 0, sizeof(hdev->irk));
6111                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
6112                 hci_adv_instances_set_rpa_expired(hdev, false);
6113                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6114         }
6115
6116         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
6117         if (err < 0)
6118                 goto unlock;
6119
6120         if (changed)
6121                 err = new_settings(hdev, sk);
6122
6123 unlock:
6124         hci_dev_unlock(hdev);
6125         return err;
6126 }
6127
6128 static bool irk_is_valid(struct mgmt_irk_info *irk)
6129 {
6130         switch (irk->addr.type) {
6131         case BDADDR_LE_PUBLIC:
6132                 return true;
6133
6134         case BDADDR_LE_RANDOM:
6135                 /* Two most significant bits shall be set */
6136                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6137                         return false;
6138                 return true;
6139         }
6140
6141         return false;
6142 }
6143
6144 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6145                      u16 len)
6146 {
6147         struct mgmt_cp_load_irks *cp = cp_data;
6148         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
6149                                    sizeof(struct mgmt_irk_info));
6150         u16 irk_count, expected_len;
6151         int i, err;
6152
6153         bt_dev_dbg(hdev, "sock %p", sk);
6154
6155         if (!lmp_le_capable(hdev))
6156                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6157                                        MGMT_STATUS_NOT_SUPPORTED);
6158
6159         irk_count = __le16_to_cpu(cp->irk_count);
6160         if (irk_count > max_irk_count) {
6161                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
6162                            irk_count);
6163                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6164                                        MGMT_STATUS_INVALID_PARAMS);
6165         }
6166
6167         expected_len = struct_size(cp, irks, irk_count);
6168         if (expected_len != len) {
6169                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
6170                            expected_len, len);
6171                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6172                                        MGMT_STATUS_INVALID_PARAMS);
6173         }
6174
6175         bt_dev_dbg(hdev, "irk_count %u", irk_count);
6176
6177         for (i = 0; i < irk_count; i++) {
6178                 struct mgmt_irk_info *key = &cp->irks[i];
6179
6180                 if (!irk_is_valid(key))
6181                         return mgmt_cmd_status(sk, hdev->id,
6182                                                MGMT_OP_LOAD_IRKS,
6183                                                MGMT_STATUS_INVALID_PARAMS);
6184         }
6185
6186         hci_dev_lock(hdev);
6187
6188         hci_smp_irks_clear(hdev);
6189
6190         for (i = 0; i < irk_count; i++) {
6191                 struct mgmt_irk_info *irk = &cp->irks[i];
6192
6193                 if (hci_is_blocked_key(hdev,
6194                                        HCI_BLOCKED_KEY_TYPE_IRK,
6195                                        irk->val)) {
6196                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
6197                                     &irk->addr.bdaddr);
6198                         continue;
6199                 }
6200
6201                 hci_add_irk(hdev, &irk->addr.bdaddr,
6202                             le_addr_type(irk->addr.type), irk->val,
6203                             BDADDR_ANY);
6204         }
6205
6206         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6207
6208         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
6209
6210         hci_dev_unlock(hdev);
6211
6212         return err;
6213 }
6214
6215 #ifdef TIZEN_BT
6216 static int set_advertising_params(struct sock *sk, struct hci_dev *hdev,
6217                         void *data, u16 len)
6218 {
6219         struct mgmt_cp_set_advertising_params *cp = data;
6220         __u16 min_interval;
6221         __u16 max_interval;
6222         int err;
6223
6224         BT_DBG("%s", hdev->name);
6225
6226         if (!lmp_le_capable(hdev))
6227                 return mgmt_cmd_status(sk, hdev->id,
6228                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6229                                 MGMT_STATUS_NOT_SUPPORTED);
6230
6231         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6232                 return mgmt_cmd_status(sk, hdev->id,
6233                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6234                                 MGMT_STATUS_BUSY);
6235
6236         min_interval = __le16_to_cpu(cp->interval_min);
6237         max_interval = __le16_to_cpu(cp->interval_max);
6238
6239         if (min_interval > max_interval ||
6240             min_interval < 0x0020 || max_interval > 0x4000)
6241                 return mgmt_cmd_status(sk, hdev->id,
6242                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6243                                 MGMT_STATUS_INVALID_PARAMS);
6244
6245         hci_dev_lock(hdev);
6246
6247         hdev->le_adv_min_interval = min_interval;
6248         hdev->le_adv_max_interval = max_interval;
6249         hdev->adv_filter_policy = cp->filter_policy;
6250         hdev->adv_type = cp->type;
6251
6252         err = mgmt_cmd_complete(sk, hdev->id,
6253                         MGMT_OP_SET_ADVERTISING_PARAMS, 0, NULL, 0);
6254
6255         hci_dev_unlock(hdev);
6256
6257         return err;
6258 }
6259
6260 static void set_advertising_data_complete(struct hci_dev *hdev,
6261                         u8 status, u16 opcode)
6262 {
6263         struct mgmt_cp_set_advertising_data *cp;
6264         struct mgmt_pending_cmd *cmd;
6265
6266         BT_DBG("status 0x%02x", status);
6267
6268         hci_dev_lock(hdev);
6269
6270         cmd = pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev);
6271         if (!cmd)
6272                 goto unlock;
6273
6274         cp = cmd->param;
6275
6276         if (status)
6277                 mgmt_cmd_status(cmd->sk, hdev->id,
6278                                 MGMT_OP_SET_ADVERTISING_DATA,
6279                                 mgmt_status(status));
6280         else
6281                 mgmt_cmd_complete(cmd->sk, hdev->id,
6282                                 MGMT_OP_SET_ADVERTISING_DATA, 0,
6283                                 cp, sizeof(*cp));
6284
6285         mgmt_pending_remove(cmd);
6286
6287 unlock:
6288         hci_dev_unlock(hdev);
6289 }
6290
6291 static int set_advertising_data(struct sock *sk, struct hci_dev *hdev,
6292                         void *data, u16 len)
6293 {
6294         struct mgmt_pending_cmd *cmd;
6295         struct hci_request req;
6296         struct mgmt_cp_set_advertising_data *cp = data;
6297         struct hci_cp_le_set_adv_data adv;
6298         int err;
6299
6300         BT_DBG("%s", hdev->name);
6301
6302         if (!lmp_le_capable(hdev)) {
6303                 return mgmt_cmd_status(sk, hdev->id,
6304                                 MGMT_OP_SET_ADVERTISING_DATA,
6305                                 MGMT_STATUS_NOT_SUPPORTED);
6306         }
6307
6308         hci_dev_lock(hdev);
6309
6310         if (pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev)) {
6311                 err = mgmt_cmd_status(sk, hdev->id,
6312                                 MGMT_OP_SET_ADVERTISING_DATA,
6313                                 MGMT_STATUS_BUSY);
6314                 goto unlocked;
6315         }
6316
6317         if (len > HCI_MAX_AD_LENGTH) {
6318                 err = mgmt_cmd_status(sk, hdev->id,
6319                                 MGMT_OP_SET_ADVERTISING_DATA,
6320                                 MGMT_STATUS_INVALID_PARAMS);
6321                 goto unlocked;
6322         }
6323
6324         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING_DATA,
6325                                hdev, data, len);
6326         if (!cmd) {
6327                 err = -ENOMEM;
6328                 goto unlocked;
6329         }
6330
6331         hci_req_init(&req, hdev);
6332
6333         memset(&adv, 0, sizeof(adv));
6334         memcpy(adv.data, cp->data, len);
6335         adv.length = len;
6336
6337         hci_req_add(&req, HCI_OP_LE_SET_ADV_DATA, sizeof(adv), &adv);
6338
6339         err = hci_req_run(&req, set_advertising_data_complete);
6340         if (err < 0)
6341                 mgmt_pending_remove(cmd);
6342
6343 unlocked:
6344         hci_dev_unlock(hdev);
6345
6346         return err;
6347 }
6348
6349 static void set_scan_rsp_data_complete(struct hci_dev *hdev, u8 status,
6350                         u16 opcode)
6351 {
6352         struct mgmt_cp_set_scan_rsp_data *cp;
6353         struct mgmt_pending_cmd *cmd;
6354
6355         BT_DBG("status 0x%02x", status);
6356
6357         hci_dev_lock(hdev);
6358
6359         cmd = pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev);
6360         if (!cmd)
6361                 goto unlock;
6362
6363         cp = cmd->param;
6364
6365         if (status)
6366                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6367                                 mgmt_status(status));
6368         else
6369                 mgmt_cmd_complete(cmd->sk, hdev->id,
6370                                 MGMT_OP_SET_SCAN_RSP_DATA, 0,
6371                                 cp, sizeof(*cp));
6372
6373         mgmt_pending_remove(cmd);
6374
6375 unlock:
6376         hci_dev_unlock(hdev);
6377 }
6378
6379 static int set_scan_rsp_data(struct sock *sk, struct hci_dev *hdev, void *data,
6380                         u16 len)
6381 {
6382         struct mgmt_pending_cmd *cmd;
6383         struct hci_request req;
6384         struct mgmt_cp_set_scan_rsp_data *cp = data;
6385         struct hci_cp_le_set_scan_rsp_data rsp;
6386         int err;
6387
6388         BT_DBG("%s", hdev->name);
6389
6390         if (!lmp_le_capable(hdev))
6391                 return mgmt_cmd_status(sk, hdev->id,
6392                                 MGMT_OP_SET_SCAN_RSP_DATA,
6393                                 MGMT_STATUS_NOT_SUPPORTED);
6394
6395         hci_dev_lock(hdev);
6396
6397         if (pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev)) {
6398                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6399                                 MGMT_STATUS_BUSY);
6400                 goto unlocked;
6401         }
6402
6403         if (len > HCI_MAX_AD_LENGTH) {
6404                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6405                                 MGMT_STATUS_INVALID_PARAMS);
6406                 goto unlocked;
6407         }
6408
6409         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SCAN_RSP_DATA, hdev, data, len);
6410         if (!cmd) {
6411                 err = -ENOMEM;
6412                 goto unlocked;
6413         }
6414
6415         hci_req_init(&req, hdev);
6416
6417         memset(&rsp, 0, sizeof(rsp));
6418         memcpy(rsp.data, cp->data, len);
6419         rsp.length = len;
6420
6421         hci_req_add(&req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(rsp), &rsp);
6422
6423         err = hci_req_run(&req, set_scan_rsp_data_complete);
6424         if (err < 0)
6425                 mgmt_pending_remove(cmd);
6426
6427 unlocked:
6428         hci_dev_unlock(hdev);
6429
6430         return err;
6431 }
6432
6433 /* Adv White List feature */
6434 static void add_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6435 {
6436         struct mgmt_cp_add_dev_white_list *cp;
6437         struct mgmt_pending_cmd *cmd;
6438
6439         BT_DBG("status 0x%02x", status);
6440
6441         hci_dev_lock(hdev);
6442
6443         cmd = pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev);
6444         if (!cmd)
6445                 goto unlock;
6446
6447         cp = cmd->param;
6448
6449         if (status)
6450                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6451                            mgmt_status(status));
6452         else
6453                 mgmt_cmd_complete(cmd->sk, hdev->id,
6454                                 MGMT_OP_ADD_DEV_WHITE_LIST, 0, cp, sizeof(*cp));
6455
6456         mgmt_pending_remove(cmd);
6457
6458 unlock:
6459         hci_dev_unlock(hdev);
6460 }
6461
6462 static int add_white_list(struct sock *sk, struct hci_dev *hdev,
6463                            void *data, u16 len)
6464 {
6465         struct mgmt_pending_cmd *cmd;
6466         struct mgmt_cp_add_dev_white_list *cp = data;
6467         struct hci_request req;
6468         int err;
6469
6470         BT_DBG("%s", hdev->name);
6471
6472         if (!lmp_le_capable(hdev))
6473                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6474                                   MGMT_STATUS_NOT_SUPPORTED);
6475
6476         if (!hdev_is_powered(hdev))
6477                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6478                                   MGMT_STATUS_REJECTED);
6479
6480         hci_dev_lock(hdev);
6481
6482         if (pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev)) {
6483                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6484                                 MGMT_STATUS_BUSY);
6485                 goto unlocked;
6486         }
6487
6488         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEV_WHITE_LIST, hdev, data, len);
6489         if (!cmd) {
6490                 err = -ENOMEM;
6491                 goto unlocked;
6492         }
6493
6494         hci_req_init(&req, hdev);
6495
6496         hci_req_add(&req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(*cp), cp);
6497
6498         err = hci_req_run(&req, add_white_list_complete);
6499         if (err < 0) {
6500                 mgmt_pending_remove(cmd);
6501                 goto unlocked;
6502         }
6503
6504 unlocked:
6505         hci_dev_unlock(hdev);
6506
6507         return err;
6508 }
6509
6510 static void remove_from_white_list_complete(struct hci_dev *hdev,
6511                         u8 status, u16 opcode)
6512 {
6513         struct mgmt_cp_remove_dev_from_white_list *cp;
6514         struct mgmt_pending_cmd *cmd;
6515
6516         BT_DBG("status 0x%02x", status);
6517
6518         hci_dev_lock(hdev);
6519
6520         cmd = pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev);
6521         if (!cmd)
6522                 goto unlock;
6523
6524         cp = cmd->param;
6525
6526         if (status)
6527                 mgmt_cmd_status(cmd->sk, hdev->id,
6528                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6529                         mgmt_status(status));
6530         else
6531                 mgmt_cmd_complete(cmd->sk, hdev->id,
6532                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, 0,
6533                         cp, sizeof(*cp));
6534
6535         mgmt_pending_remove(cmd);
6536
6537 unlock:
6538         hci_dev_unlock(hdev);
6539 }
6540
6541 static int remove_from_white_list(struct sock *sk, struct hci_dev *hdev,
6542                            void *data, u16 len)
6543 {
6544         struct mgmt_pending_cmd *cmd;
6545         struct mgmt_cp_remove_dev_from_white_list *cp = data;
6546         struct hci_request req;
6547         int err;
6548
6549         BT_DBG("%s", hdev->name);
6550
6551         if (!lmp_le_capable(hdev))
6552                 return mgmt_cmd_status(sk, hdev->id,
6553                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6554                                 MGMT_STATUS_NOT_SUPPORTED);
6555
6556         if (!hdev_is_powered(hdev))
6557                 return mgmt_cmd_status(sk, hdev->id,
6558                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6559                                 MGMT_STATUS_REJECTED);
6560
6561         hci_dev_lock(hdev);
6562
6563         if (pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev)) {
6564                 err = mgmt_cmd_status(sk, hdev->id,
6565                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6566                                 MGMT_STATUS_BUSY);
6567                 goto unlocked;
6568         }
6569
6570         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6571                                 hdev, data, len);
6572         if (!cmd) {
6573                 err = -ENOMEM;
6574                 goto unlocked;
6575         }
6576
6577         hci_req_init(&req, hdev);
6578
6579         hci_req_add(&req, HCI_OP_LE_DEL_FROM_WHITE_LIST, sizeof(*cp), cp);
6580
6581         err = hci_req_run(&req, remove_from_white_list_complete);
6582         if (err < 0) {
6583                 mgmt_pending_remove(cmd);
6584                 goto unlocked;
6585         }
6586
6587 unlocked:
6588         hci_dev_unlock(hdev);
6589
6590         return err;
6591 }
6592
6593 static void clear_white_list_complete(struct hci_dev *hdev, u8 status,
6594                         u16 opcode)
6595 {
6596         struct mgmt_pending_cmd *cmd;
6597
6598         BT_DBG("status 0x%02x", status);
6599
6600         hci_dev_lock(hdev);
6601
6602         cmd = pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev);
6603         if (!cmd)
6604                 goto unlock;
6605
6606         if (status)
6607                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
6608                            mgmt_status(status));
6609         else
6610                 mgmt_cmd_complete(cmd->sk, hdev->id,
6611                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6612                                 0, NULL, 0);
6613
6614         mgmt_pending_remove(cmd);
6615
6616 unlock:
6617         hci_dev_unlock(hdev);
6618 }
6619
6620 static int clear_white_list(struct sock *sk, struct hci_dev *hdev,
6621                            void *data, u16 len)
6622 {
6623         struct mgmt_pending_cmd *cmd;
6624         struct hci_request req;
6625         int err;
6626
6627         BT_DBG("%s", hdev->name);
6628
6629         if (!lmp_le_capable(hdev))
6630                 return mgmt_cmd_status(sk, hdev->id,
6631                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6632                                 MGMT_STATUS_NOT_SUPPORTED);
6633
6634         if (!hdev_is_powered(hdev))
6635                 return mgmt_cmd_status(sk, hdev->id,
6636                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6637                                 MGMT_STATUS_REJECTED);
6638
6639         hci_dev_lock(hdev);
6640
6641         if (pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev)) {
6642                 err = mgmt_cmd_status(sk, hdev->id,
6643                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6644                                 MGMT_STATUS_BUSY);
6645                 goto unlocked;
6646         }
6647
6648         cmd = mgmt_pending_add(sk, MGMT_OP_CLEAR_DEV_WHITE_LIST,
6649                                 hdev, NULL, 0);
6650         if (!cmd) {
6651                 err = -ENOMEM;
6652                 goto unlocked;
6653         }
6654
6655         hci_req_init(&req, hdev);
6656
6657         hci_req_add(&req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
6658
6659         err = hci_req_run(&req, clear_white_list_complete);
6660         if (err < 0) {
6661                 mgmt_pending_remove(cmd);
6662                 goto unlocked;
6663         }
6664
6665 unlocked:
6666         hci_dev_unlock(hdev);
6667
6668         return err;
6669 }
6670
6671 static void set_rssi_threshold_complete(struct hci_dev *hdev,
6672                         u8 status, u16 opcode)
6673 {
6674         struct mgmt_pending_cmd *cmd;
6675
6676         BT_DBG("status 0x%02x", status);
6677
6678         hci_dev_lock(hdev);
6679
6680         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6681         if (!cmd)
6682                 goto unlock;
6683
6684         if (status)
6685                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6686                                 mgmt_status(status));
6687         else
6688                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
6689                                 NULL, 0);
6690
6691         mgmt_pending_remove(cmd);
6692
6693 unlock:
6694         hci_dev_unlock(hdev);
6695 }
6696
6697 static void set_rssi_disable_complete(struct hci_dev *hdev,
6698                         u8 status, u16 opcode)
6699 {
6700         struct mgmt_pending_cmd *cmd;
6701
6702         BT_DBG("status 0x%02x", status);
6703
6704         hci_dev_lock(hdev);
6705
6706         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6707         if (!cmd)
6708                 goto unlock;
6709
6710         if (status)
6711                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6712                                 mgmt_status(status));
6713         else
6714                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6715                                 0, NULL, 0);
6716
6717         mgmt_pending_remove(cmd);
6718
6719 unlock:
6720         hci_dev_unlock(hdev);
6721 }
6722
6723 int mgmt_set_rssi_threshold(struct sock *sk, struct hci_dev *hdev,
6724                 void *data, u16 len)
6725 {
6726         int err = 0;
6727         struct hci_cp_set_rssi_threshold th = { 0, };
6728         struct mgmt_cp_set_enable_rssi *cp = data;
6729         struct hci_conn *conn;
6730         struct mgmt_pending_cmd *cmd;
6731         struct hci_request req;
6732         __u8 dest_type;
6733
6734         hci_dev_lock(hdev);
6735
6736         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6737         if (!cmd) {
6738                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6739                                 MGMT_STATUS_FAILED);
6740                 goto unlocked;
6741         }
6742
6743         if (!lmp_le_capable(hdev)) {
6744                 mgmt_pending_remove(cmd);
6745                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6746                                 MGMT_STATUS_NOT_SUPPORTED);
6747                 goto unlocked;
6748         }
6749
6750         if (!hdev_is_powered(hdev)) {
6751                 BT_DBG("%s", hdev->name);
6752                 mgmt_pending_remove(cmd);
6753                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6754                                 MGMT_STATUS_NOT_POWERED);
6755                 goto unlocked;
6756         }
6757
6758         if (cp->link_type == 0x01)
6759                 dest_type = LE_LINK;
6760         else
6761                 dest_type = ACL_LINK;
6762
6763         /* Get LE/ACL link handle info */
6764         conn = hci_conn_hash_lookup_ba(hdev,
6765                         dest_type, &cp->bdaddr);
6766
6767         if (!conn) {
6768                 err = mgmt_cmd_complete(sk, hdev->id,
6769                                 MGMT_OP_SET_RSSI_ENABLE, 1, NULL, 0);
6770                 mgmt_pending_remove(cmd);
6771                 goto unlocked;
6772         }
6773
6774         hci_req_init(&req, hdev);
6775
6776         th.hci_le_ext_opcode = 0x0B;
6777         th.mode = 0x01;
6778         th.conn_handle = conn->handle;
6779         th.alert_mask = 0x07;
6780         th.low_th = cp->low_th;
6781         th.in_range_th = cp->in_range_th;
6782         th.high_th = cp->high_th;
6783
6784         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
6785         err = hci_req_run(&req, set_rssi_threshold_complete);
6786
6787         if (err < 0) {
6788                 mgmt_pending_remove(cmd);
6789                 BT_ERR("Error in requesting hci_req_run");
6790                 goto unlocked;
6791         }
6792
6793 unlocked:
6794         hci_dev_unlock(hdev);
6795         return err;
6796 }
6797
6798 void mgmt_rssi_enable_success(struct sock *sk, struct hci_dev *hdev,
6799                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6800 {
6801         struct mgmt_cc_rsp_enable_rssi mgmt_rp = { 0, };
6802         struct mgmt_cp_set_enable_rssi *cp = data;
6803         struct mgmt_pending_cmd *cmd;
6804
6805         if (!cp || !rp)
6806                 goto remove_cmd;
6807
6808         mgmt_rp.status = rp->status;
6809         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6810         mgmt_rp.bt_address = cp->bdaddr;
6811         mgmt_rp.link_type = cp->link_type;
6812
6813         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6814                         MGMT_STATUS_SUCCESS, &mgmt_rp,
6815                         sizeof(struct mgmt_cc_rsp_enable_rssi));
6816
6817         mgmt_event(MGMT_EV_RSSI_ENABLED, hdev, &mgmt_rp,
6818                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6819
6820         hci_conn_rssi_unset_all(hdev, mgmt_rp.link_type);
6821         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6822                         &mgmt_rp.bt_address, true);
6823
6824 remove_cmd:
6825         hci_dev_lock(hdev);
6826         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6827         if (cmd)
6828                 mgmt_pending_remove(cmd);
6829
6830         hci_dev_unlock(hdev);
6831 }
6832
6833 void mgmt_rssi_disable_success(struct sock *sk, struct hci_dev *hdev,
6834                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6835 {
6836         struct mgmt_cc_rp_disable_rssi mgmt_rp = { 0, };
6837         struct mgmt_cp_disable_rssi *cp = data;
6838         struct mgmt_pending_cmd *cmd;
6839
6840         if (!cp || !rp)
6841                 goto remove_cmd;
6842
6843         mgmt_rp.status = rp->status;
6844         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6845         mgmt_rp.bt_address = cp->bdaddr;
6846         mgmt_rp.link_type = cp->link_type;
6847
6848         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6849                         MGMT_STATUS_SUCCESS, &mgmt_rp,
6850                         sizeof(struct mgmt_cc_rsp_enable_rssi));
6851
6852         mgmt_event(MGMT_EV_RSSI_DISABLED, hdev, &mgmt_rp,
6853                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6854
6855         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6856                         &mgmt_rp.bt_address, false);
6857
6858 remove_cmd:
6859         hci_dev_lock(hdev);
6860         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6861         if (cmd)
6862                 mgmt_pending_remove(cmd);
6863
6864         hci_dev_unlock(hdev);
6865 }
6866
6867 static int mgmt_set_disable_rssi(struct sock *sk, struct hci_dev *hdev,
6868                 void *data, u16 len)
6869 {
6870         struct mgmt_pending_cmd *cmd;
6871         struct hci_request req;
6872         struct hci_cp_set_enable_rssi cp_en = { 0, };
6873         int err;
6874
6875         BT_DBG("Set Disable RSSI.");
6876
6877         cp_en.hci_le_ext_opcode = 0x01;
6878         cp_en.le_enable_cs_Features = 0x00;
6879         cp_en.data[0] = 0x00;
6880         cp_en.data[1] = 0x00;
6881         cp_en.data[2] = 0x00;
6882
6883         hci_dev_lock(hdev);
6884
6885         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6886         if (!cmd) {
6887                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6888                                 MGMT_STATUS_FAILED);
6889                 goto unlocked;
6890         }
6891
6892         if (!lmp_le_capable(hdev)) {
6893                 mgmt_pending_remove(cmd);
6894                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6895                                 MGMT_STATUS_NOT_SUPPORTED);
6896                 goto unlocked;
6897         }
6898
6899         if (!hdev_is_powered(hdev)) {
6900                 BT_DBG("%s", hdev->name);
6901                 mgmt_pending_remove(cmd);
6902                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6903                                 MGMT_STATUS_NOT_POWERED);
6904                 goto unlocked;
6905         }
6906
6907         hci_req_init(&req, hdev);
6908
6909         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
6910                         sizeof(struct hci_cp_set_enable_rssi),
6911                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
6912                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
6913
6914         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
6915         err = hci_req_run(&req, set_rssi_disable_complete);
6916
6917         if (err < 0) {
6918                 mgmt_pending_remove(cmd);
6919                 BT_ERR("Error in requesting hci_req_run");
6920                 goto unlocked;
6921         }
6922
6923 unlocked:
6924         hci_dev_unlock(hdev);
6925         return err;
6926 }
6927
6928 void mgmt_enable_rssi_cc(struct hci_dev *hdev, void *response, u8 status)
6929 {
6930         struct hci_cc_rsp_enable_rssi *rp = response;
6931         struct mgmt_pending_cmd *cmd_enable = NULL;
6932         struct mgmt_pending_cmd *cmd_disable = NULL;
6933         struct mgmt_cp_set_enable_rssi *cp_en;
6934         struct mgmt_cp_disable_rssi *cp_dis;
6935
6936         hci_dev_lock(hdev);
6937         cmd_enable = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6938         cmd_disable = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6939         hci_dev_unlock(hdev);
6940
6941         if (cmd_enable)
6942                 BT_DBG("Enable Request");
6943
6944         if (cmd_disable)
6945                 BT_DBG("Disable Request");
6946
6947         if (cmd_enable) {
6948                 cp_en = cmd_enable->param;
6949
6950                 if (status != 0x00)
6951                         return;
6952
6953                 switch (rp->le_ext_opcode) {
6954                 case 0x01:
6955                         BT_DBG("RSSI enabled.. Setting Threshold...");
6956                         mgmt_set_rssi_threshold(cmd_enable->sk, hdev,
6957                                         cp_en, sizeof(*cp_en));
6958                         break;
6959
6960                 case 0x0B:
6961                         BT_DBG("Sending RSSI enable success");
6962                         mgmt_rssi_enable_success(cmd_enable->sk, hdev,
6963                                         cp_en, rp, rp->status);
6964                         break;
6965                 }
6966
6967         } else if (cmd_disable) {
6968                 cp_dis = cmd_disable->param;
6969
6970                 if (status != 0x00)
6971                         return;
6972
6973                 switch (rp->le_ext_opcode) {
6974                 case 0x01:
6975                         BT_DBG("Sending RSSI disable success");
6976                         mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6977                                         cp_dis, rp, rp->status);
6978                         break;
6979
6980                 case 0x0B:
6981                         /*
6982                          * Only unset RSSI Threshold values for the Link if
6983                          * RSSI is monitored for other BREDR or LE Links
6984                          */
6985                         if (hci_conn_hash_lookup_rssi_count(hdev) > 1) {
6986                                 BT_DBG("Unset Threshold. Other links being monitored");
6987                                 mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6988                                                 cp_dis, rp, rp->status);
6989                         } else {
6990                                 BT_DBG("Unset Threshold. Disabling...");
6991                                 mgmt_set_disable_rssi(cmd_disable->sk, hdev,
6992                                                 cp_dis, sizeof(*cp_dis));
6993                         }
6994                         break;
6995                 }
6996         }
6997 }
6998
6999 static void set_rssi_enable_complete(struct hci_dev *hdev, u8 status,
7000                 u16 opcode)
7001 {
7002         struct mgmt_pending_cmd *cmd;
7003
7004         BT_DBG("status 0x%02x", status);
7005
7006         hci_dev_lock(hdev);
7007
7008         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7009         if (!cmd)
7010                 goto unlock;
7011
7012         if (status)
7013                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7014                                 mgmt_status(status));
7015         else
7016                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
7017                                 NULL, 0);
7018
7019         mgmt_pending_remove(cmd);
7020
7021 unlock:
7022         hci_dev_unlock(hdev);
7023 }
7024
7025 static int set_enable_rssi(struct sock *sk, struct hci_dev *hdev,
7026                 void *data, u16 len)
7027 {
7028         struct mgmt_pending_cmd *cmd;
7029         struct hci_request req;
7030         struct mgmt_cp_set_enable_rssi *cp = data;
7031         struct hci_cp_set_enable_rssi cp_en = { 0, };
7032         int err;
7033
7034         BT_DBG("Set Enable RSSI.");
7035
7036         cp_en.hci_le_ext_opcode = 0x01;
7037         cp_en.le_enable_cs_Features = 0x04;
7038         cp_en.data[0] = 0x00;
7039         cp_en.data[1] = 0x00;
7040         cp_en.data[2] = 0x00;
7041
7042         hci_dev_lock(hdev);
7043
7044         if (!lmp_le_capable(hdev)) {
7045                 err =  mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7046                                 MGMT_STATUS_NOT_SUPPORTED);
7047                 goto unlocked;
7048         }
7049
7050         if (!hdev_is_powered(hdev)) {
7051                 BT_DBG("%s", hdev->name);
7052                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7053                                 MGMT_STATUS_NOT_POWERED);
7054                 goto unlocked;
7055         }
7056
7057         if (pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev)) {
7058                 BT_DBG("%s", hdev->name);
7059                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7060                                 MGMT_STATUS_BUSY);
7061                 goto unlocked;
7062         }
7063
7064         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_ENABLE, hdev, cp,
7065                         sizeof(*cp));
7066         if (!cmd) {
7067                 BT_DBG("%s", hdev->name);
7068                 err = -ENOMEM;
7069                 goto unlocked;
7070         }
7071
7072         /* If RSSI is already enabled directly set Threshold values */
7073         if (hci_conn_hash_lookup_rssi_count(hdev) > 0) {
7074                 hci_dev_unlock(hdev);
7075                 BT_DBG("RSSI Enabled. Directly set Threshold");
7076                 err = mgmt_set_rssi_threshold(sk, hdev, cp, sizeof(*cp));
7077                 return err;
7078         }
7079
7080         hci_req_init(&req, hdev);
7081
7082         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
7083                         sizeof(struct hci_cp_set_enable_rssi),
7084                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
7085                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
7086
7087         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
7088         err = hci_req_run(&req, set_rssi_enable_complete);
7089
7090         if (err < 0) {
7091                 mgmt_pending_remove(cmd);
7092                 BT_ERR("Error in requesting hci_req_run");
7093                 goto unlocked;
7094         }
7095
7096 unlocked:
7097         hci_dev_unlock(hdev);
7098
7099         return err;
7100 }
7101
7102 static void get_raw_rssi_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7103 {
7104         struct mgmt_pending_cmd *cmd;
7105
7106         BT_DBG("status 0x%02x", status);
7107
7108         hci_dev_lock(hdev);
7109
7110         cmd = pending_find(MGMT_OP_GET_RAW_RSSI, hdev);
7111         if (!cmd)
7112                 goto unlock;
7113
7114         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7115                         MGMT_STATUS_SUCCESS, &status, 1);
7116
7117         mgmt_pending_remove(cmd);
7118
7119 unlock:
7120         hci_dev_unlock(hdev);
7121 }
7122
7123 static int get_raw_rssi(struct sock *sk, struct hci_dev *hdev, void *data,
7124                         u16 len)
7125 {
7126         struct mgmt_pending_cmd *cmd;
7127         struct hci_request req;
7128         struct mgmt_cp_get_raw_rssi *cp = data;
7129         struct hci_cp_get_raw_rssi hci_cp;
7130
7131         struct hci_conn *conn;
7132         int err;
7133         __u8 dest_type;
7134
7135         BT_DBG("Get Raw RSSI.");
7136
7137         hci_dev_lock(hdev);
7138
7139         if (!lmp_le_capable(hdev)) {
7140                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7141                                 MGMT_STATUS_NOT_SUPPORTED);
7142                 goto unlocked;
7143         }
7144
7145         if (cp->link_type == 0x01)
7146                 dest_type = LE_LINK;
7147         else
7148                 dest_type = ACL_LINK;
7149
7150         /* Get LE/BREDR link handle info */
7151         conn = hci_conn_hash_lookup_ba(hdev,
7152                         dest_type, &cp->bt_address);
7153         if (!conn) {
7154                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7155                                                    MGMT_STATUS_NOT_CONNECTED);
7156                 goto unlocked;
7157         }
7158         hci_cp.conn_handle = conn->handle;
7159
7160         if (!hdev_is_powered(hdev)) {
7161                 BT_DBG("%s", hdev->name);
7162                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7163                                 MGMT_STATUS_NOT_POWERED);
7164                 goto unlocked;
7165         }
7166
7167         if (pending_find(MGMT_OP_GET_RAW_RSSI, hdev)) {
7168                 BT_DBG("%s", hdev->name);
7169                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7170                                 MGMT_STATUS_BUSY);
7171                 goto unlocked;
7172         }
7173
7174         cmd = mgmt_pending_add(sk, MGMT_OP_GET_RAW_RSSI, hdev, data, len);
7175         if (!cmd) {
7176                 BT_DBG("%s", hdev->name);
7177                 err = -ENOMEM;
7178                 goto unlocked;
7179         }
7180
7181         hci_req_init(&req, hdev);
7182
7183         BT_DBG("Connection Handle [%d]", hci_cp.conn_handle);
7184         hci_req_add(&req, HCI_OP_GET_RAW_RSSI, sizeof(hci_cp), &hci_cp);
7185         err = hci_req_run(&req, get_raw_rssi_complete);
7186
7187         if (err < 0) {
7188                 mgmt_pending_remove(cmd);
7189                 BT_ERR("Error in requesting hci_req_run");
7190         }
7191
7192 unlocked:
7193         hci_dev_unlock(hdev);
7194
7195         return err;
7196 }
7197
7198 void mgmt_raw_rssi_response(struct hci_dev *hdev,
7199                 struct hci_cc_rp_get_raw_rssi *rp, int success)
7200 {
7201         struct mgmt_cc_rp_get_raw_rssi mgmt_rp = { 0, };
7202         struct hci_conn *conn;
7203
7204         mgmt_rp.status = rp->status;
7205         mgmt_rp.rssi_dbm = rp->rssi_dbm;
7206
7207         conn = hci_conn_hash_lookup_handle(hdev, rp->conn_handle);
7208         if (!conn)
7209                 return;
7210
7211         bacpy(&mgmt_rp.bt_address, &conn->dst);
7212         if (conn->type == LE_LINK)
7213                 mgmt_rp.link_type = 0x01;
7214         else
7215                 mgmt_rp.link_type = 0x00;
7216
7217         mgmt_event(MGMT_EV_RAW_RSSI, hdev, &mgmt_rp,
7218                         sizeof(struct mgmt_cc_rp_get_raw_rssi), NULL);
7219 }
7220
7221 static void set_disable_threshold_complete(struct hci_dev *hdev,
7222                         u8 status, u16 opcode)
7223 {
7224         struct mgmt_pending_cmd *cmd;
7225
7226         BT_DBG("status 0x%02x", status);
7227
7228         hci_dev_lock(hdev);
7229
7230         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7231         if (!cmd)
7232                 goto unlock;
7233
7234         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7235                         MGMT_STATUS_SUCCESS, &status, 1);
7236
7237         mgmt_pending_remove(cmd);
7238
7239 unlock:
7240         hci_dev_unlock(hdev);
7241 }
7242
7243 /** Removes monitoring for a link*/
7244 static int set_disable_threshold(struct sock *sk, struct hci_dev *hdev,
7245                 void *data, u16 len)
7246 {
7247         int err = 0;
7248         struct hci_cp_set_rssi_threshold th = { 0, };
7249         struct mgmt_cp_disable_rssi *cp = data;
7250         struct hci_conn *conn;
7251         struct mgmt_pending_cmd *cmd;
7252         struct hci_request req;
7253         __u8 dest_type;
7254
7255         BT_DBG("Set Disable RSSI.");
7256
7257         hci_dev_lock(hdev);
7258
7259         if (!lmp_le_capable(hdev)) {
7260                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7261                                 MGMT_STATUS_NOT_SUPPORTED);
7262                 goto unlocked;
7263         }
7264
7265         /* Get LE/ACL link handle info*/
7266         if (cp->link_type == 0x01)
7267                 dest_type = LE_LINK;
7268         else
7269                 dest_type = ACL_LINK;
7270
7271         conn = hci_conn_hash_lookup_ba(hdev, dest_type, &cp->bdaddr);
7272         if (!conn) {
7273                 err = mgmt_cmd_complete(sk, hdev->id,
7274                                 MGMT_OP_SET_RSSI_DISABLE, 1, NULL, 0);
7275                 goto unlocked;
7276         }
7277
7278         th.hci_le_ext_opcode = 0x0B;
7279         th.mode = 0x01;
7280         th.conn_handle = conn->handle;
7281         th.alert_mask = 0x00;
7282         th.low_th = 0x00;
7283         th.in_range_th = 0x00;
7284         th.high_th = 0x00;
7285
7286         if (!hdev_is_powered(hdev)) {
7287                 BT_DBG("%s", hdev->name);
7288                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7289                                 0, data, len);
7290                 goto unlocked;
7291         }
7292
7293         if (pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev)) {
7294                 BT_DBG("%s", hdev->name);
7295                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7296                                 MGMT_STATUS_BUSY);
7297                 goto unlocked;
7298         }
7299
7300         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_DISABLE, hdev, cp,
7301                         sizeof(*cp));
7302         if (!cmd) {
7303                 BT_DBG("%s", hdev->name);
7304                 err = -ENOMEM;
7305                 goto unlocked;
7306         }
7307
7308         hci_req_init(&req, hdev);
7309
7310         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
7311         err = hci_req_run(&req, set_disable_threshold_complete);
7312         if (err < 0) {
7313                 mgmt_pending_remove(cmd);
7314                 BT_ERR("Error in requesting hci_req_run");
7315                 goto unlocked;
7316         }
7317
7318 unlocked:
7319         hci_dev_unlock(hdev);
7320
7321         return err;
7322 }
7323
7324 void mgmt_rssi_alert_evt(struct hci_dev *hdev, u16 conn_handle,
7325                 s8 alert_type, s8 rssi_dbm)
7326 {
7327         struct mgmt_ev_vendor_specific_rssi_alert mgmt_ev;
7328         struct hci_conn *conn;
7329
7330         BT_DBG("RSSI alert [%2.2X %2.2X %2.2X]",
7331                         conn_handle, alert_type, rssi_dbm);
7332
7333         conn = hci_conn_hash_lookup_handle(hdev, conn_handle);
7334
7335         if (!conn) {
7336                 BT_ERR("RSSI alert Error: Device not found for handle");
7337                 return;
7338         }
7339         bacpy(&mgmt_ev.bdaddr, &conn->dst);
7340
7341         if (conn->type == LE_LINK)
7342                 mgmt_ev.link_type = 0x01;
7343         else
7344                 mgmt_ev.link_type = 0x00;
7345
7346         mgmt_ev.alert_type = alert_type;
7347         mgmt_ev.rssi_dbm = rssi_dbm;
7348
7349         mgmt_event(MGMT_EV_RSSI_ALERT, hdev, &mgmt_ev,
7350                         sizeof(struct mgmt_ev_vendor_specific_rssi_alert),
7351                         NULL);
7352 }
7353
7354 static int mgmt_start_le_discovery_failed(struct hci_dev *hdev, u8 status)
7355 {
7356         struct mgmt_pending_cmd *cmd;
7357         u8 type;
7358         int err;
7359
7360         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
7361
7362         cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
7363         if (!cmd)
7364                 return -ENOENT;
7365
7366         type = hdev->le_discovery.type;
7367
7368         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
7369                                 mgmt_status(status), &type, sizeof(type));
7370         mgmt_pending_remove(cmd);
7371
7372         return err;
7373 }
7374
7375 static void start_le_discovery_complete(struct hci_dev *hdev, u8 status,
7376                 u16 opcode)
7377 {
7378         unsigned long timeout = 0;
7379
7380         BT_DBG("status %d", status);
7381
7382         if (status) {
7383                 hci_dev_lock(hdev);
7384                 mgmt_start_le_discovery_failed(hdev, status);
7385                 hci_dev_unlock(hdev);
7386                 return;
7387         }
7388
7389         hci_dev_lock(hdev);
7390         hci_le_discovery_set_state(hdev, DISCOVERY_FINDING);
7391         hci_dev_unlock(hdev);
7392
7393         if (hdev->le_discovery.type != DISCOV_TYPE_LE)
7394                 BT_ERR("Invalid discovery type %d", hdev->le_discovery.type);
7395
7396         if (!timeout)
7397                 return;
7398
7399         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
7400 }
7401
7402 static int start_le_discovery(struct sock *sk, struct hci_dev *hdev,
7403                 void *data, u16 len)
7404 {
7405         struct mgmt_cp_start_le_discovery *cp = data;
7406         struct mgmt_pending_cmd *cmd;
7407         struct hci_cp_le_set_scan_param param_cp;
7408         struct hci_cp_le_set_scan_enable enable_cp;
7409         struct hci_request req;
7410         u8 status, own_addr_type;
7411         int err;
7412
7413         BT_DBG("%s", hdev->name);
7414
7415         hci_dev_lock(hdev);
7416
7417         if (!hdev_is_powered(hdev)) {
7418                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7419                                 MGMT_STATUS_NOT_POWERED);
7420                 goto unlock;
7421         }
7422
7423         if (hdev->le_discovery.state != DISCOVERY_STOPPED) {
7424                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7425                                 MGMT_STATUS_BUSY);
7426                 goto unlock;
7427         }
7428
7429         if (cp->type != DISCOV_TYPE_LE) {
7430                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7431                                 MGMT_STATUS_INVALID_PARAMS);
7432                 goto unlock;
7433         }
7434
7435         cmd = mgmt_pending_add(sk, MGMT_OP_START_LE_DISCOVERY, hdev, NULL, 0);
7436         if (!cmd) {
7437                 err = -ENOMEM;
7438                 goto unlock;
7439         }
7440
7441         hdev->le_discovery.type = cp->type;
7442
7443         hci_req_init(&req, hdev);
7444
7445         status = mgmt_le_support(hdev);
7446         if (status) {
7447                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7448                                 status);
7449                 mgmt_pending_remove(cmd);
7450                 goto unlock;
7451         }
7452
7453         /* If controller is scanning, it means the background scanning
7454          * is running. Thus, we should temporarily stop it in order to
7455          * set the discovery scanning parameters.
7456          */
7457         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
7458                 hci_req_add_le_scan_disable(&req, false);
7459
7460         memset(&param_cp, 0, sizeof(param_cp));
7461
7462         /* All active scans will be done with either a resolvable
7463          * private address (when privacy feature has been enabled)
7464          * or unresolvable private address.
7465          */
7466         err = hci_update_random_address(&req, true, hci_dev_test_flag(hdev, HCI_PRIVACY), &own_addr_type);
7467         if (err < 0) {
7468                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7469                                 MGMT_STATUS_FAILED);
7470                 mgmt_pending_remove(cmd);
7471                 goto unlock;
7472         }
7473
7474         param_cp.type = hdev->le_scan_type;
7475         param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
7476         param_cp.window = cpu_to_le16(hdev->le_scan_window);
7477         param_cp.own_address_type = own_addr_type;
7478         hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
7479                     &param_cp);
7480
7481         memset(&enable_cp, 0, sizeof(enable_cp));
7482         enable_cp.enable = LE_SCAN_ENABLE;
7483         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
7484
7485         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
7486                     &enable_cp);
7487
7488         err = hci_req_run(&req, start_le_discovery_complete);
7489         if (err < 0)
7490                 mgmt_pending_remove(cmd);
7491         else
7492                 hci_le_discovery_set_state(hdev, DISCOVERY_STARTING);
7493
7494 unlock:
7495         hci_dev_unlock(hdev);
7496         return err;
7497 }
7498
7499 static int mgmt_stop_le_discovery_failed(struct hci_dev *hdev, u8 status)
7500 {
7501         struct mgmt_pending_cmd *cmd;
7502         int err;
7503
7504         cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
7505         if (!cmd)
7506                 return -ENOENT;
7507
7508         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
7509                                 mgmt_status(status), &hdev->le_discovery.type,
7510                                 sizeof(hdev->le_discovery.type));
7511         mgmt_pending_remove(cmd);
7512
7513         return err;
7514 }
7515
7516 static void stop_le_discovery_complete(struct hci_dev *hdev, u8 status,
7517                 u16 opcode)
7518 {
7519         BT_DBG("status %d", status);
7520
7521         hci_dev_lock(hdev);
7522
7523         if (status) {
7524                 mgmt_stop_le_discovery_failed(hdev, status);
7525                 goto unlock;
7526         }
7527
7528         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
7529
7530 unlock:
7531         hci_dev_unlock(hdev);
7532 }
7533
7534 static int stop_le_discovery(struct sock *sk, struct hci_dev *hdev,
7535                 void *data, u16 len)
7536 {
7537         struct mgmt_cp_stop_le_discovery *mgmt_cp = data;
7538         struct mgmt_pending_cmd *cmd;
7539         struct hci_request req;
7540         int err;
7541
7542         BT_DBG("%s", hdev->name);
7543
7544         hci_dev_lock(hdev);
7545
7546         if (!hci_le_discovery_active(hdev)) {
7547                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7548                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
7549                                         sizeof(mgmt_cp->type));
7550                 goto unlock;
7551         }
7552
7553         if (hdev->le_discovery.type != mgmt_cp->type) {
7554                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7555                                         MGMT_STATUS_INVALID_PARAMS,
7556                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
7557                 goto unlock;
7558         }
7559
7560         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_LE_DISCOVERY, hdev, NULL, 0);
7561         if (!cmd) {
7562                 err = -ENOMEM;
7563                 goto unlock;
7564         }
7565
7566         hci_req_init(&req, hdev);
7567
7568         if (hdev->le_discovery.state  != DISCOVERY_FINDING) {
7569                 BT_DBG("unknown le discovery state %u",
7570                                         hdev->le_discovery.state);
7571
7572                 mgmt_pending_remove(cmd);
7573                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7574                                         MGMT_STATUS_FAILED, &mgmt_cp->type,
7575                                         sizeof(mgmt_cp->type));
7576                 goto unlock;
7577         }
7578
7579         cancel_delayed_work(&hdev->le_scan_disable);
7580         hci_req_add_le_scan_disable(&req, false);
7581
7582         err = hci_req_run(&req, stop_le_discovery_complete);
7583         if (err < 0)
7584                 mgmt_pending_remove(cmd);
7585         else
7586                 hci_le_discovery_set_state(hdev, DISCOVERY_STOPPING);
7587
7588 unlock:
7589         hci_dev_unlock(hdev);
7590         return err;
7591 }
7592
7593 /* Separate LE discovery */
7594 void mgmt_le_discovering(struct hci_dev *hdev, u8 discovering)
7595 {
7596         struct mgmt_ev_discovering ev;
7597         struct mgmt_pending_cmd *cmd;
7598
7599         BT_DBG("%s le discovering %u", hdev->name, discovering);
7600
7601         if (discovering)
7602                 cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
7603         else
7604                 cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
7605
7606         if (cmd) {
7607                 u8 type = hdev->le_discovery.type;
7608
7609                 mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
7610                                   sizeof(type));
7611                 mgmt_pending_remove(cmd);
7612         }
7613
7614         memset(&ev, 0, sizeof(ev));
7615         ev.type = hdev->le_discovery.type;
7616         ev.discovering = discovering;
7617
7618         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7619 }
7620
7621 static int disable_le_auto_connect(struct sock *sk, struct hci_dev *hdev,
7622                         void *data, u16 len)
7623 {
7624         int err;
7625
7626         BT_DBG("%s", hdev->name);
7627
7628         hci_dev_lock(hdev);
7629
7630         err = hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
7631         if (err < 0)
7632                 BT_ERR("HCI_OP_LE_CREATE_CONN_CANCEL is failed");
7633
7634         hci_dev_unlock(hdev);
7635
7636         return err;
7637 }
7638
7639 static inline int check_le_conn_update_param(u16 min, u16 max, u16 latency,
7640                 u16 to_multiplier)
7641 {
7642         u16 max_latency;
7643
7644         if (min > max || min < 6 || max > 3200)
7645                 return -EINVAL;
7646
7647         if (to_multiplier < 10 || to_multiplier > 3200)
7648                 return -EINVAL;
7649
7650         if (max >= to_multiplier * 8)
7651                 return -EINVAL;
7652
7653         max_latency = (to_multiplier * 8 / max) - 1;
7654
7655         if (latency > 499 || latency > max_latency)
7656                 return -EINVAL;
7657
7658         return 0;
7659 }
7660
7661 static int le_conn_update(struct sock *sk, struct hci_dev *hdev, void *data,
7662                 u16 len)
7663 {
7664         struct mgmt_cp_le_conn_update *cp = data;
7665
7666         struct hci_conn *conn;
7667         u16 min, max, latency, supervision_timeout;
7668         int err = -1;
7669
7670         if (!hdev_is_powered(hdev))
7671                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7672                                 MGMT_STATUS_NOT_POWERED);
7673
7674         min = __le16_to_cpu(cp->conn_interval_min);
7675         max = __le16_to_cpu(cp->conn_interval_max);
7676         latency = __le16_to_cpu(cp->conn_latency);
7677         supervision_timeout = __le16_to_cpu(cp->supervision_timeout);
7678
7679         BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x supervision_timeout: 0x%4.4x",
7680                         min, max, latency, supervision_timeout);
7681
7682         err = check_le_conn_update_param(min, max, latency,
7683                         supervision_timeout);
7684
7685         if (err < 0)
7686                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7687                                 MGMT_STATUS_INVALID_PARAMS);
7688
7689         hci_dev_lock(hdev);
7690
7691         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
7692         if (!conn) {
7693                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7694                                 MGMT_STATUS_NOT_CONNECTED);
7695                 hci_dev_unlock(hdev);
7696                 return err;
7697         }
7698
7699         hci_dev_unlock(hdev);
7700
7701         hci_le_conn_update(conn, min, max, latency, supervision_timeout);
7702
7703         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE, 0,
7704                                  NULL, 0);
7705 }
7706
7707 static void set_manufacturer_data_complete(struct hci_dev *hdev, u8 status,
7708                 u16 opcode)
7709 {
7710         struct mgmt_cp_set_manufacturer_data *cp;
7711         struct mgmt_pending_cmd *cmd;
7712
7713         BT_DBG("status 0x%02x", status);
7714
7715         hci_dev_lock(hdev);
7716
7717         cmd = pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev);
7718         if (!cmd)
7719                 goto unlock;
7720
7721         cp = cmd->param;
7722
7723         if (status)
7724                 mgmt_cmd_status(cmd->sk, hdev->id,
7725                                 MGMT_OP_SET_MANUFACTURER_DATA,
7726                                 mgmt_status(status));
7727         else
7728                 mgmt_cmd_complete(cmd->sk, hdev->id,
7729                                   MGMT_OP_SET_MANUFACTURER_DATA, 0,
7730                                   cp, sizeof(*cp));
7731
7732         mgmt_pending_remove(cmd);
7733
7734 unlock:
7735         hci_dev_unlock(hdev);
7736 }
7737
7738 static int set_manufacturer_data(struct sock *sk, struct hci_dev *hdev,
7739                 void *data, u16 len)
7740 {
7741         struct mgmt_pending_cmd *cmd;
7742         struct hci_request req;
7743         struct mgmt_cp_set_manufacturer_data *cp = data;
7744         u8 old_data[HCI_MAX_EIR_LENGTH] = {0, };
7745         u8 old_len;
7746         int err;
7747
7748         BT_DBG("%s", hdev->name);
7749
7750         if (!lmp_bredr_capable(hdev))
7751                 return mgmt_cmd_status(sk, hdev->id,
7752                                 MGMT_OP_SET_MANUFACTURER_DATA,
7753                                 MGMT_STATUS_NOT_SUPPORTED);
7754
7755         if (cp->data[0] == 0 ||
7756                         cp->data[0] - 1 > sizeof(hdev->manufacturer_data))
7757                 return mgmt_cmd_status(sk, hdev->id,
7758                                 MGMT_OP_SET_MANUFACTURER_DATA,
7759                                 MGMT_STATUS_INVALID_PARAMS);
7760
7761         if (cp->data[1] != 0xFF)
7762                 return mgmt_cmd_status(sk, hdev->id,
7763                                 MGMT_OP_SET_MANUFACTURER_DATA,
7764                                 MGMT_STATUS_NOT_SUPPORTED);
7765
7766         hci_dev_lock(hdev);
7767
7768         if (pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev)) {
7769                 err = mgmt_cmd_status(sk, hdev->id,
7770                                 MGMT_OP_SET_MANUFACTURER_DATA,
7771                                 MGMT_STATUS_BUSY);
7772                 goto unlocked;
7773         }
7774
7775         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MANUFACTURER_DATA, hdev, data,
7776                         len);
7777         if (!cmd) {
7778                 err = -ENOMEM;
7779                 goto unlocked;
7780         }
7781
7782         hci_req_init(&req, hdev);
7783
7784         /* if new data is same as previous data then return command
7785          * complete event
7786          */
7787         if (hdev->manufacturer_len == cp->data[0] - 1 &&
7788             !memcmp(hdev->manufacturer_data, cp->data + 2, cp->data[0] - 1)) {
7789                 mgmt_pending_remove(cmd);
7790                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
7791                                   0, cp, sizeof(*cp));
7792                 err = 0;
7793                 goto unlocked;
7794         }
7795
7796         old_len = hdev->manufacturer_len;
7797         if (old_len > 0)
7798                 memcpy(old_data, hdev->manufacturer_data, old_len);
7799
7800         hdev->manufacturer_len = cp->data[0] - 1;
7801         if (hdev->manufacturer_len > 0)
7802                 memcpy(hdev->manufacturer_data, cp->data + 2,
7803                                 hdev->manufacturer_len);
7804
7805         __hci_req_update_eir(&req);
7806
7807         err = hci_req_run(&req, set_manufacturer_data_complete);
7808         if (err < 0) {
7809                 mgmt_pending_remove(cmd);
7810                 goto failed;
7811         }
7812
7813 unlocked:
7814         hci_dev_unlock(hdev);
7815
7816         return err;
7817
7818 failed:
7819         memset(hdev->manufacturer_data, 0x00, sizeof(hdev->manufacturer_data));
7820         hdev->manufacturer_len = old_len;
7821         if (hdev->manufacturer_len > 0)
7822                 memcpy(hdev->manufacturer_data, old_data,
7823                        hdev->manufacturer_len);
7824         hci_dev_unlock(hdev);
7825         return err;
7826 }
7827
7828 static int le_set_scan_params(struct sock *sk, struct hci_dev *hdev,
7829                 void *data, u16 len)
7830 {
7831         struct mgmt_cp_le_set_scan_params *cp = data;
7832         __u16 interval, window;
7833         int err;
7834
7835         BT_DBG("%s", hdev->name);
7836
7837         if (!lmp_le_capable(hdev))
7838                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7839                                 MGMT_STATUS_NOT_SUPPORTED);
7840
7841         interval = __le16_to_cpu(cp->interval);
7842
7843         if (interval < 0x0004 || interval > 0x4000)
7844                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7845                                 MGMT_STATUS_INVALID_PARAMS);
7846
7847         window = __le16_to_cpu(cp->window);
7848
7849         if (window < 0x0004 || window > 0x4000)
7850                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7851                                 MGMT_STATUS_INVALID_PARAMS);
7852
7853         if (window > interval)
7854                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7855                                 MGMT_STATUS_INVALID_PARAMS);
7856
7857         hci_dev_lock(hdev);
7858
7859         hdev->le_scan_type = cp->type;
7860         hdev->le_scan_interval = interval;
7861         hdev->le_scan_window = window;
7862
7863         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS, 0,
7864                                 NULL, 0);
7865
7866         /* If background scan is running, restart it so new parameters are
7867          * loaded.
7868          */
7869         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
7870             hdev->discovery.state == DISCOVERY_STOPPED) {
7871                 struct hci_request req;
7872
7873                 hci_req_init(&req, hdev);
7874
7875                 hci_req_add_le_scan_disable(&req, false);
7876                 hci_req_add_le_passive_scan(&req);
7877
7878                 hci_req_run(&req, NULL);
7879         }
7880
7881         hci_dev_unlock(hdev);
7882
7883         return err;
7884 }
7885
7886 static int set_voice_setting(struct sock *sk, struct hci_dev *hdev,
7887                 void *data, u16 len)
7888 {
7889         struct mgmt_cp_set_voice_setting *cp = data;
7890         struct hci_conn *conn;
7891         struct hci_conn *sco_conn;
7892
7893         int err;
7894
7895         BT_DBG("%s", hdev->name);
7896
7897         if (!lmp_bredr_capable(hdev)) {
7898                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING,
7899                                 MGMT_STATUS_NOT_SUPPORTED);
7900         }
7901
7902         hci_dev_lock(hdev);
7903
7904         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
7905         if (!conn) {
7906                 err = mgmt_cmd_complete(sk, hdev->id,
7907                                 MGMT_OP_SET_VOICE_SETTING, 0, NULL, 0);
7908                 goto unlock;
7909         }
7910
7911         conn->voice_setting = cp->voice_setting;
7912         conn->sco_role = cp->sco_role;
7913
7914         sco_conn = hci_conn_hash_lookup_sco(hdev);
7915         if (sco_conn && bacmp(&sco_conn->dst, &cp->bdaddr) != 0) {
7916                 BT_ERR("There is other SCO connection.");
7917                 goto done;
7918         }
7919
7920         if (conn->sco_role == MGMT_SCO_ROLE_HANDSFREE) {
7921                 if (conn->voice_setting == 0x0063)
7922                         sco_connect_set_wbc(hdev);
7923                 else
7924                         sco_connect_set_nbc(hdev);
7925         } else {
7926                 if (conn->voice_setting == 0x0063)
7927                         sco_connect_set_gw_wbc(hdev);
7928                 else
7929                         sco_connect_set_gw_nbc(hdev);
7930         }
7931
7932 done:
7933         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING, 0,
7934                         cp, sizeof(cp));
7935
7936 unlock:
7937         hci_dev_unlock(hdev);
7938         return err;
7939 }
7940
7941 static int get_adv_tx_power(struct sock *sk, struct hci_dev *hdev,
7942                 void *data, u16 len)
7943 {
7944         struct mgmt_rp_get_adv_tx_power *rp;
7945         size_t rp_len;
7946         int err;
7947
7948         BT_DBG("%s", hdev->name);
7949
7950         hci_dev_lock(hdev);
7951
7952         rp_len = sizeof(*rp);
7953         rp = kmalloc(rp_len, GFP_KERNEL);
7954         if (!rp) {
7955                 err = -ENOMEM;
7956                 goto unlock;
7957         }
7958
7959         rp->adv_tx_power = hdev->adv_tx_power;
7960
7961         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_TX_POWER, 0, rp,
7962                                 rp_len);
7963
7964         kfree(rp);
7965
7966 unlock:
7967         hci_dev_unlock(hdev);
7968
7969         return err;
7970 }
7971
7972 void mgmt_hardware_error(struct hci_dev *hdev, u8 err_code)
7973 {
7974         struct mgmt_ev_hardware_error ev;
7975
7976         ev.error_code = err_code;
7977         mgmt_event(MGMT_EV_HARDWARE_ERROR, hdev, &ev, sizeof(ev), NULL);
7978 }
7979
7980 void mgmt_tx_timeout_error(struct hci_dev *hdev)
7981 {
7982         mgmt_event(MGMT_EV_TX_TIMEOUT_ERROR, hdev, NULL, 0, NULL);
7983 }
7984
7985 void mgmt_multi_adv_state_change_evt(struct hci_dev *hdev, u8 adv_instance,
7986                 u8 state_change_reason, u16 connection_handle)
7987 {
7988         struct mgmt_ev_vendor_specific_multi_adv_state_changed mgmt_ev;
7989
7990         BT_DBG("Multi adv state changed [%2.2X %2.2X %2.2X]",
7991                adv_instance, state_change_reason, connection_handle);
7992
7993         mgmt_ev.adv_instance = adv_instance;
7994         mgmt_ev.state_change_reason = state_change_reason;
7995         mgmt_ev.connection_handle = connection_handle;
7996
7997         mgmt_event(MGMT_EV_MULTI_ADV_STATE_CHANGED, hdev, &mgmt_ev,
7998                 sizeof(struct mgmt_ev_vendor_specific_multi_adv_state_changed),
7999                 NULL);
8000 }
8001
8002 static int enable_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
8003                 void *data, u16 len)
8004 {
8005         int err;
8006         struct mgmt_cp_enable_6lowpan *cp = data;
8007
8008         BT_DBG("%s", hdev->name);
8009
8010         hci_dev_lock(hdev);
8011
8012         if (!hdev_is_powered(hdev)) {
8013                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
8014                                       MGMT_STATUS_NOT_POWERED);
8015                 goto unlocked;
8016         }
8017
8018         if (!lmp_le_capable(hdev)) {
8019                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
8020                                       MGMT_STATUS_NOT_SUPPORTED);
8021                 goto unlocked;
8022         }
8023
8024         if (cp->enable_6lowpan)
8025                 bt_6lowpan_enable();
8026         else
8027                 bt_6lowpan_disable();
8028
8029         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
8030                                 MGMT_STATUS_SUCCESS, NULL, 0);
8031 unlocked:
8032         hci_dev_unlock(hdev);
8033         return err;
8034 }
8035
8036 static int connect_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
8037                 void *data, u16 len)
8038 {
8039         struct mgmt_cp_connect_6lowpan *cp = data;
8040         __u8 addr_type = ADDR_LE_DEV_PUBLIC;
8041         int err;
8042
8043         BT_DBG("%s", hdev->name);
8044
8045         hci_dev_lock(hdev);
8046
8047         if (!lmp_le_capable(hdev)) {
8048                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
8049                                       MGMT_STATUS_NOT_SUPPORTED);
8050                 goto unlocked;
8051         }
8052
8053         if (!hdev_is_powered(hdev)) {
8054                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
8055                                       MGMT_STATUS_REJECTED);
8056                 goto unlocked;
8057         }
8058
8059         if (bdaddr_type_is_le(cp->addr.type)) {
8060                 if (cp->addr.type == BDADDR_LE_PUBLIC)
8061                         addr_type = ADDR_LE_DEV_PUBLIC;
8062                 else
8063                         addr_type = ADDR_LE_DEV_RANDOM;
8064         } else {
8065                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
8066                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
8067                 goto unlocked;
8068         }
8069
8070         hci_dev_unlock(hdev);
8071
8072         /* 6lowpan Connect */
8073         err = _bt_6lowpan_connect(&cp->addr.bdaddr, cp->addr.type);
8074
8075         hci_dev_lock(hdev);
8076
8077         if (err < 0) {
8078                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
8079                                         MGMT_STATUS_REJECTED, NULL, 0);
8080
8081                 goto unlocked;
8082         }
8083
8084         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN, 0,
8085                                 NULL, 0);
8086 unlocked:
8087         hci_dev_unlock(hdev);
8088         return err;
8089 }
8090
8091 static int disconnect_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
8092                 void *data, u16 len)
8093 {
8094         struct mgmt_cp_disconnect_6lowpan *cp = data;
8095         struct hci_conn *conn = NULL;
8096         __u8 addr_type = ADDR_LE_DEV_PUBLIC;
8097         int err;
8098
8099         BT_DBG("%s", hdev->name);
8100
8101         hci_dev_lock(hdev);
8102
8103         if (!lmp_le_capable(hdev)) {
8104                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT_6LOWPAN,
8105                                       MGMT_STATUS_NOT_SUPPORTED);
8106                 goto unlocked;
8107         }
8108
8109         if (!hdev_is_powered(hdev)) {
8110                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT_6LOWPAN,
8111                                       MGMT_STATUS_REJECTED);
8112                 goto unlocked;
8113         }
8114
8115         if (bdaddr_type_is_le(cp->addr.type)) {
8116                 if (cp->addr.type == BDADDR_LE_PUBLIC)
8117                         addr_type = ADDR_LE_DEV_PUBLIC;
8118                 else
8119                         addr_type = ADDR_LE_DEV_RANDOM;
8120         } else {
8121                 err = mgmt_cmd_complete(sk, hdev->id,
8122                                         MGMT_OP_DISCONNECT_6LOWPAN,
8123                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
8124                 goto unlocked;
8125         }
8126
8127         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
8128         if (!conn) {
8129                 err = mgmt_cmd_complete(sk, hdev->id,
8130                                         MGMT_OP_DISCONNECT_6LOWPAN,
8131                                         MGMT_STATUS_NOT_CONNECTED, NULL, 0);
8132                 goto unlocked;
8133         }
8134
8135         if (conn->dst_type != addr_type) {
8136                 err = mgmt_cmd_complete(sk, hdev->id,
8137                                         MGMT_OP_DISCONNECT_6LOWPAN,
8138                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
8139                 goto unlocked;
8140         }
8141
8142         if (conn->state != BT_CONNECTED) {
8143                 err = mgmt_cmd_complete(sk, hdev->id,
8144                                         MGMT_OP_DISCONNECT_6LOWPAN,
8145                                         MGMT_STATUS_NOT_CONNECTED, NULL, 0);
8146                 goto unlocked;
8147         }
8148
8149         /* 6lowpan Disconnect */
8150         err = _bt_6lowpan_disconnect(conn->l2cap_data, cp->addr.type);
8151         if (err < 0) {
8152                 err = mgmt_cmd_complete(sk, hdev->id,
8153                                         MGMT_OP_DISCONNECT_6LOWPAN,
8154                                         MGMT_STATUS_REJECTED, NULL, 0);
8155                 goto unlocked;
8156         }
8157
8158         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN, 0,
8159                                 NULL, 0);
8160
8161 unlocked:
8162         hci_dev_unlock(hdev);
8163         return err;
8164 }
8165
8166 void mgmt_6lowpan_conn_changed(struct hci_dev *hdev, char if_name[16],
8167                 bdaddr_t *bdaddr, u8 addr_type, bool connected)
8168 {
8169         char buf[512];
8170         struct mgmt_ev_6lowpan_conn_state_changed *ev = (void *)buf;
8171         size_t ev_size;
8172
8173         memset(buf, 0, sizeof(buf));
8174         bacpy(&ev->addr.bdaddr, bdaddr);
8175         ev->addr.type = addr_type;
8176         ev->connected = connected;
8177         memcpy(ev->ifname, (__u8 *)if_name, 16);
8178
8179         ev_size = sizeof(*ev);
8180
8181         mgmt_event(MGMT_EV_6LOWPAN_CONN_STATE_CHANGED, hdev, ev, ev_size, NULL);
8182 }
8183
8184 void mgmt_le_read_maximum_data_length_complete(struct hci_dev *hdev, u8 status)
8185 {
8186         struct mgmt_pending_cmd *cmd;
8187         struct mgmt_rp_le_read_maximum_data_length rp;
8188
8189         BT_DBG("%s status %u", hdev->name, status);
8190
8191         cmd = pending_find(MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, hdev);
8192         if (!cmd)
8193                 return;
8194
8195         if (status)
8196                 mgmt_cmd_status(cmd->sk, hdev->id,
8197                                 MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
8198                                 mgmt_status(status));
8199
8200         memset(&rp, 0, sizeof(rp));
8201
8202         rp.max_tx_octets = cpu_to_le16(hdev->le_max_tx_len);
8203         rp.max_tx_time = cpu_to_le16(hdev->le_max_tx_time);
8204         rp.max_rx_octets = cpu_to_le16(hdev->le_max_rx_len);
8205         rp.max_rx_time = cpu_to_le16(hdev->le_max_rx_time);
8206
8207         mgmt_cmd_complete(cmd->sk, hdev->id,
8208                           MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, 0,
8209                           &rp, sizeof(rp));
8210
8211         mgmt_pending_remove(cmd);
8212 }
8213
8214 static int read_maximum_le_data_length(struct sock *sk,
8215                 struct hci_dev *hdev, void *data, u16 len)
8216 {
8217         struct mgmt_pending_cmd *cmd;
8218         int err;
8219
8220         BT_DBG("read_maximum_le_data_length  %s", hdev->name);
8221
8222         hci_dev_lock(hdev);
8223
8224         if (!hdev_is_powered(hdev)) {
8225                 err = mgmt_cmd_status(sk, hdev->id,
8226                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
8227                                       MGMT_STATUS_NOT_POWERED);
8228                 goto unlock;
8229         }
8230
8231         if (!lmp_le_capable(hdev)) {
8232                 err = mgmt_cmd_status(sk, hdev->id,
8233                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
8234                                       MGMT_STATUS_NOT_SUPPORTED);
8235                 goto unlock;
8236         }
8237
8238         if (pending_find(MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, hdev)) {
8239                 err = mgmt_cmd_status(sk, hdev->id,
8240                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
8241                                       MGMT_STATUS_BUSY);
8242                 goto unlock;
8243         }
8244
8245         cmd = mgmt_pending_add(sk, MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
8246                                hdev, data, len);
8247         if (!cmd) {
8248                 err = -ENOMEM;
8249                 goto unlock;
8250         }
8251
8252         err = hci_send_cmd(hdev, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
8253         if (err < 0)
8254                 mgmt_pending_remove(cmd);
8255
8256 unlock:
8257         hci_dev_unlock(hdev);
8258         return err;
8259 }
8260
8261 void mgmt_le_write_host_suggested_data_length_complete(struct hci_dev *hdev,
8262                 u8 status)
8263 {
8264         struct mgmt_pending_cmd *cmd;
8265
8266         BT_DBG("status 0x%02x", status);
8267
8268         hci_dev_lock(hdev);
8269
8270         cmd = pending_find(MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH, hdev);
8271         if (!cmd) {
8272                 BT_ERR("cmd not found in the pending list");
8273                 goto unlock;
8274         }
8275
8276         if (status)
8277                 mgmt_cmd_status(cmd->sk, hdev->id,
8278                                 MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
8279                                 mgmt_status(status));
8280         else
8281                 mgmt_cmd_complete(cmd->sk, hdev->id,
8282                                   MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
8283                                   0, NULL, 0);
8284
8285         mgmt_pending_remove(cmd);
8286
8287 unlock:
8288         hci_dev_unlock(hdev);
8289 }
8290
8291 static int write_host_suggested_le_data_length(struct sock *sk,
8292                 struct hci_dev *hdev, void *data, u16 len)
8293 {
8294         struct mgmt_pending_cmd *cmd;
8295         struct mgmt_cp_le_write_host_suggested_data_length *cp = data;
8296         struct hci_cp_le_write_def_data_len hci_data;
8297         int err = 0;
8298
8299         BT_DBG("Write host suggested data length request for %s", hdev->name);
8300
8301         hci_dev_lock(hdev);
8302
8303         if (!hdev_is_powered(hdev)) {
8304                 err = mgmt_cmd_status(sk, hdev->id,
8305                                 MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
8306                                 MGMT_STATUS_NOT_POWERED);
8307                 goto unlock;
8308         }
8309
8310         if (!lmp_le_capable(hdev)) {
8311                 err = mgmt_cmd_status(sk, hdev->id,
8312                                 MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
8313                                 MGMT_STATUS_NOT_SUPPORTED);
8314                 goto unlock;
8315         }
8316
8317         if (pending_find(MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH, hdev)) {
8318                 err = mgmt_cmd_status(sk, hdev->id,
8319                                 MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
8320                                 MGMT_STATUS_BUSY);
8321                 goto unlock;
8322         }
8323
8324         cmd = mgmt_pending_add(sk, MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
8325                                hdev, data, len);
8326         if (!cmd) {
8327                 err = -ENOMEM;
8328                 goto unlock;
8329         }
8330
8331         hci_data.tx_len = cp->def_tx_octets;
8332         hci_data.tx_time = cp->def_tx_time;
8333
8334         err = hci_send_cmd(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN,
8335                            sizeof(hci_data), &hci_data);
8336         if (err < 0)
8337                 mgmt_pending_remove(cmd);
8338
8339 unlock:
8340         hci_dev_unlock(hdev);
8341
8342         return err;
8343 }
8344
8345 void mgmt_le_read_host_suggested_data_length_complete(struct hci_dev *hdev,
8346                 u8 status)
8347 {
8348         struct mgmt_pending_cmd *cmd;
8349         struct mgmt_rp_le_read_host_suggested_data_length rp;
8350
8351         BT_DBG("%s status %u", hdev->name, status);
8352
8353         cmd = pending_find(MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH, hdev);
8354         if (!cmd) {
8355                 BT_ERR("cmd not found in the pending list");
8356                 return;
8357         }
8358
8359         if (status)
8360                 mgmt_cmd_status(cmd->sk, hdev->id,
8361                         MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH,
8362                         mgmt_status(status));
8363
8364         memset(&rp, 0, sizeof(rp));
8365
8366         rp.def_tx_octets = cpu_to_le16(hdev->le_def_tx_len);
8367         rp.def_tx_time = cpu_to_le16(hdev->le_def_tx_time);
8368
8369         mgmt_cmd_complete(cmd->sk, hdev->id,
8370                           MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH, 0,
8371                           &rp, sizeof(rp));
8372
8373         mgmt_pending_remove(cmd);
8374 }
8375
8376 static int read_host_suggested_data_length(struct sock *sk,
8377                 struct hci_dev *hdev, void *data, u16 len)
8378 {
8379         struct mgmt_pending_cmd *cmd;
8380         int err;
8381
8382         BT_DBG("read_host_suggested_data_length %s", hdev->name);
8383
8384         hci_dev_lock(hdev);
8385
8386         if (!hdev_is_powered(hdev)) {
8387                 err = mgmt_cmd_status(sk, hdev->id,
8388                                 MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH,
8389                                 MGMT_STATUS_NOT_POWERED);
8390                 goto unlock;
8391         }
8392
8393         if (!lmp_le_capable(hdev)) {
8394                 err = mgmt_cmd_status(sk, hdev->id,
8395                                 MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH,
8396                                 MGMT_STATUS_NOT_SUPPORTED);
8397                 goto unlock;
8398         }
8399
8400         if (pending_find(MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH, hdev)) {
8401                 err = mgmt_cmd_status(sk, hdev->id,
8402                                 MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH,
8403                                 MGMT_STATUS_BUSY);
8404                 goto unlock;
8405         }
8406
8407         cmd = mgmt_pending_add(sk, MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH,
8408                                hdev, data, len);
8409         if (!cmd) {
8410                 err = -ENOMEM;
8411                 goto unlock;
8412         }
8413
8414         err = hci_send_cmd(hdev, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
8415         if (err < 0)
8416                 mgmt_pending_remove(cmd);
8417
8418 unlock:
8419         hci_dev_unlock(hdev);
8420
8421         return err;
8422 }
8423 #endif /* TIZEN_BT */
8424
8425 static bool ltk_is_valid(struct mgmt_ltk_info *key)
8426 {
8427         if (key->initiator != 0x00 && key->initiator != 0x01)
8428                 return false;
8429
8430         switch (key->addr.type) {
8431         case BDADDR_LE_PUBLIC:
8432                 return true;
8433
8434         case BDADDR_LE_RANDOM:
8435                 /* Two most significant bits shall be set */
8436                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
8437                         return false;
8438                 return true;
8439         }
8440
8441         return false;
8442 }
8443
8444 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
8445                                void *cp_data, u16 len)
8446 {
8447         struct mgmt_cp_load_long_term_keys *cp = cp_data;
8448         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
8449                                    sizeof(struct mgmt_ltk_info));
8450         u16 key_count, expected_len;
8451         int i, err;
8452
8453         bt_dev_dbg(hdev, "sock %p", sk);
8454
8455         if (!lmp_le_capable(hdev))
8456                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8457                                        MGMT_STATUS_NOT_SUPPORTED);
8458
8459         key_count = __le16_to_cpu(cp->key_count);
8460         if (key_count > max_key_count) {
8461                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
8462                            key_count);
8463                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8464                                        MGMT_STATUS_INVALID_PARAMS);
8465         }
8466
8467         expected_len = struct_size(cp, keys, key_count);
8468         if (expected_len != len) {
8469                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
8470                            expected_len, len);
8471                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8472                                        MGMT_STATUS_INVALID_PARAMS);
8473         }
8474
8475         bt_dev_dbg(hdev, "key_count %u", key_count);
8476
8477         for (i = 0; i < key_count; i++) {
8478                 struct mgmt_ltk_info *key = &cp->keys[i];
8479
8480                 if (!ltk_is_valid(key))
8481                         return mgmt_cmd_status(sk, hdev->id,
8482                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
8483                                                MGMT_STATUS_INVALID_PARAMS);
8484         }
8485
8486         hci_dev_lock(hdev);
8487
8488         hci_smp_ltks_clear(hdev);
8489
8490         for (i = 0; i < key_count; i++) {
8491                 struct mgmt_ltk_info *key = &cp->keys[i];
8492                 u8 type, authenticated;
8493
8494                 if (hci_is_blocked_key(hdev,
8495                                        HCI_BLOCKED_KEY_TYPE_LTK,
8496                                        key->val)) {
8497                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
8498                                     &key->addr.bdaddr);
8499                         continue;
8500                 }
8501
8502                 switch (key->type) {
8503                 case MGMT_LTK_UNAUTHENTICATED:
8504                         authenticated = 0x00;
8505                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
8506                         break;
8507                 case MGMT_LTK_AUTHENTICATED:
8508                         authenticated = 0x01;
8509                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
8510                         break;
8511                 case MGMT_LTK_P256_UNAUTH:
8512                         authenticated = 0x00;
8513                         type = SMP_LTK_P256;
8514                         break;
8515                 case MGMT_LTK_P256_AUTH:
8516                         authenticated = 0x01;
8517                         type = SMP_LTK_P256;
8518                         break;
8519                 case MGMT_LTK_P256_DEBUG:
8520                         authenticated = 0x00;
8521                         type = SMP_LTK_P256_DEBUG;
8522                         fallthrough;
8523                 default:
8524                         continue;
8525                 }
8526
8527                 hci_add_ltk(hdev, &key->addr.bdaddr,
8528                             le_addr_type(key->addr.type), type, authenticated,
8529                             key->val, key->enc_size, key->ediv, key->rand);
8530         }
8531
8532         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
8533                            NULL, 0);
8534
8535         hci_dev_unlock(hdev);
8536
8537         return err;
8538 }
8539
8540 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
8541 {
8542         struct hci_conn *conn = cmd->user_data;
8543         struct mgmt_rp_get_conn_info rp;
8544         int err;
8545
8546         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
8547
8548         if (status == MGMT_STATUS_SUCCESS) {
8549                 rp.rssi = conn->rssi;
8550                 rp.tx_power = conn->tx_power;
8551                 rp.max_tx_power = conn->max_tx_power;
8552         } else {
8553                 rp.rssi = HCI_RSSI_INVALID;
8554                 rp.tx_power = HCI_TX_POWER_INVALID;
8555                 rp.max_tx_power = HCI_TX_POWER_INVALID;
8556         }
8557
8558         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
8559                                 status, &rp, sizeof(rp));
8560
8561         hci_conn_drop(conn);
8562         hci_conn_put(conn);
8563
8564         return err;
8565 }
8566
8567 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
8568                                        u16 opcode)
8569 {
8570         struct hci_cp_read_rssi *cp;
8571         struct mgmt_pending_cmd *cmd;
8572         struct hci_conn *conn;
8573         u16 handle;
8574         u8 status;
8575
8576         bt_dev_dbg(hdev, "status 0x%02x", hci_status);
8577
8578         hci_dev_lock(hdev);
8579
8580         /* Commands sent in request are either Read RSSI or Read Transmit Power
8581          * Level so we check which one was last sent to retrieve connection
8582          * handle.  Both commands have handle as first parameter so it's safe to
8583          * cast data on the same command struct.
8584          *
8585          * First command sent is always Read RSSI and we fail only if it fails.
8586          * In other case we simply override error to indicate success as we
8587          * already remembered if TX power value is actually valid.
8588          */
8589         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
8590         if (!cp) {
8591                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
8592                 status = MGMT_STATUS_SUCCESS;
8593         } else {
8594                 status = mgmt_status(hci_status);
8595         }
8596
8597         if (!cp) {
8598                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
8599                 goto unlock;
8600         }
8601
8602         handle = __le16_to_cpu(cp->handle);
8603         conn = hci_conn_hash_lookup_handle(hdev, handle);
8604         if (!conn) {
8605                 bt_dev_err(hdev, "unknown handle (%u) in conn_info response",
8606                            handle);
8607                 goto unlock;
8608         }
8609
8610         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
8611         if (!cmd)
8612                 goto unlock;
8613
8614         cmd->cmd_complete(cmd, status);
8615         mgmt_pending_remove(cmd);
8616
8617 unlock:
8618         hci_dev_unlock(hdev);
8619 }
8620
8621 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
8622                          u16 len)
8623 {
8624         struct mgmt_cp_get_conn_info *cp = data;
8625         struct mgmt_rp_get_conn_info rp;
8626         struct hci_conn *conn;
8627         unsigned long conn_info_age;
8628         int err = 0;
8629
8630         bt_dev_dbg(hdev, "sock %p", sk);
8631
8632         memset(&rp, 0, sizeof(rp));
8633         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8634         rp.addr.type = cp->addr.type;
8635
8636         if (!bdaddr_type_is_valid(cp->addr.type))
8637                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8638                                          MGMT_STATUS_INVALID_PARAMS,
8639                                          &rp, sizeof(rp));
8640
8641         hci_dev_lock(hdev);
8642
8643         if (!hdev_is_powered(hdev)) {
8644                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8645                                         MGMT_STATUS_NOT_POWERED, &rp,
8646                                         sizeof(rp));
8647                 goto unlock;
8648         }
8649
8650         if (cp->addr.type == BDADDR_BREDR)
8651                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8652                                                &cp->addr.bdaddr);
8653         else
8654                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
8655
8656         if (!conn || conn->state != BT_CONNECTED) {
8657                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8658                                         MGMT_STATUS_NOT_CONNECTED, &rp,
8659                                         sizeof(rp));
8660                 goto unlock;
8661         }
8662
8663         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
8664                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8665                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
8666                 goto unlock;
8667         }
8668
8669         /* To avoid client trying to guess when to poll again for information we
8670          * calculate conn info age as random value between min/max set in hdev.
8671          */
8672         conn_info_age = hdev->conn_info_min_age +
8673                         prandom_u32_max(hdev->conn_info_max_age -
8674                                         hdev->conn_info_min_age);
8675
8676         /* Query controller to refresh cached values if they are too old or were
8677          * never read.
8678          */
8679         if (time_after(jiffies, conn->conn_info_timestamp +
8680                        msecs_to_jiffies(conn_info_age)) ||
8681             !conn->conn_info_timestamp) {
8682                 struct hci_request req;
8683                 struct hci_cp_read_tx_power req_txp_cp;
8684                 struct hci_cp_read_rssi req_rssi_cp;
8685                 struct mgmt_pending_cmd *cmd;
8686
8687                 hci_req_init(&req, hdev);
8688                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
8689                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
8690                             &req_rssi_cp);
8691
8692                 /* For LE links TX power does not change thus we don't need to
8693                  * query for it once value is known.
8694                  */
8695                 if (!bdaddr_type_is_le(cp->addr.type) ||
8696                     conn->tx_power == HCI_TX_POWER_INVALID) {
8697                         req_txp_cp.handle = cpu_to_le16(conn->handle);
8698                         req_txp_cp.type = 0x00;
8699                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
8700                                     sizeof(req_txp_cp), &req_txp_cp);
8701                 }
8702
8703                 /* Max TX power needs to be read only once per connection */
8704                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
8705                         req_txp_cp.handle = cpu_to_le16(conn->handle);
8706                         req_txp_cp.type = 0x01;
8707                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
8708                                     sizeof(req_txp_cp), &req_txp_cp);
8709                 }
8710
8711                 err = hci_req_run(&req, conn_info_refresh_complete);
8712                 if (err < 0)
8713                         goto unlock;
8714
8715                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
8716                                        data, len);
8717                 if (!cmd) {
8718                         err = -ENOMEM;
8719                         goto unlock;
8720                 }
8721
8722                 hci_conn_hold(conn);
8723                 cmd->user_data = hci_conn_get(conn);
8724                 cmd->cmd_complete = conn_info_cmd_complete;
8725
8726                 conn->conn_info_timestamp = jiffies;
8727         } else {
8728                 /* Cache is valid, just reply with values cached in hci_conn */
8729                 rp.rssi = conn->rssi;
8730                 rp.tx_power = conn->tx_power;
8731                 rp.max_tx_power = conn->max_tx_power;
8732
8733                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8734                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8735         }
8736
8737 unlock:
8738         hci_dev_unlock(hdev);
8739         return err;
8740 }
8741
8742 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
8743 {
8744         struct hci_conn *conn = cmd->user_data;
8745         struct mgmt_rp_get_clock_info rp;
8746         struct hci_dev *hdev;
8747         int err;
8748
8749         memset(&rp, 0, sizeof(rp));
8750         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
8751
8752         if (status)
8753                 goto complete;
8754
8755         hdev = hci_dev_get(cmd->index);
8756         if (hdev) {
8757                 rp.local_clock = cpu_to_le32(hdev->clock);
8758                 hci_dev_put(hdev);
8759         }
8760
8761         if (conn) {
8762                 rp.piconet_clock = cpu_to_le32(conn->clock);
8763                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
8764         }
8765
8766 complete:
8767         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
8768                                 sizeof(rp));
8769
8770         if (conn) {
8771                 hci_conn_drop(conn);
8772                 hci_conn_put(conn);
8773         }
8774
8775         return err;
8776 }
8777
8778 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8779 {
8780         struct hci_cp_read_clock *hci_cp;
8781         struct mgmt_pending_cmd *cmd;
8782         struct hci_conn *conn;
8783
8784         bt_dev_dbg(hdev, "status %u", status);
8785
8786         hci_dev_lock(hdev);
8787
8788         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
8789         if (!hci_cp)
8790                 goto unlock;
8791
8792         if (hci_cp->which) {
8793                 u16 handle = __le16_to_cpu(hci_cp->handle);
8794                 conn = hci_conn_hash_lookup_handle(hdev, handle);
8795         } else {
8796                 conn = NULL;
8797         }
8798
8799         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
8800         if (!cmd)
8801                 goto unlock;
8802
8803         cmd->cmd_complete(cmd, mgmt_status(status));
8804         mgmt_pending_remove(cmd);
8805
8806 unlock:
8807         hci_dev_unlock(hdev);
8808 }
8809
8810 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
8811                          u16 len)
8812 {
8813         struct mgmt_cp_get_clock_info *cp = data;
8814         struct mgmt_rp_get_clock_info rp;
8815         struct hci_cp_read_clock hci_cp;
8816         struct mgmt_pending_cmd *cmd;
8817         struct hci_request req;
8818         struct hci_conn *conn;
8819         int err;
8820
8821         bt_dev_dbg(hdev, "sock %p", sk);
8822
8823         memset(&rp, 0, sizeof(rp));
8824         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8825         rp.addr.type = cp->addr.type;
8826
8827         if (cp->addr.type != BDADDR_BREDR)
8828                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8829                                          MGMT_STATUS_INVALID_PARAMS,
8830                                          &rp, sizeof(rp));
8831
8832         hci_dev_lock(hdev);
8833
8834         if (!hdev_is_powered(hdev)) {
8835                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8836                                         MGMT_STATUS_NOT_POWERED, &rp,
8837                                         sizeof(rp));
8838                 goto unlock;
8839         }
8840
8841         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8842                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8843                                                &cp->addr.bdaddr);
8844                 if (!conn || conn->state != BT_CONNECTED) {
8845                         err = mgmt_cmd_complete(sk, hdev->id,
8846                                                 MGMT_OP_GET_CLOCK_INFO,
8847                                                 MGMT_STATUS_NOT_CONNECTED,
8848                                                 &rp, sizeof(rp));
8849                         goto unlock;
8850                 }
8851         } else {
8852                 conn = NULL;
8853         }
8854
8855         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
8856         if (!cmd) {
8857                 err = -ENOMEM;
8858                 goto unlock;
8859         }
8860
8861         cmd->cmd_complete = clock_info_cmd_complete;
8862
8863         hci_req_init(&req, hdev);
8864
8865         memset(&hci_cp, 0, sizeof(hci_cp));
8866         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
8867
8868         if (conn) {
8869                 hci_conn_hold(conn);
8870                 cmd->user_data = hci_conn_get(conn);
8871
8872                 hci_cp.handle = cpu_to_le16(conn->handle);
8873                 hci_cp.which = 0x01; /* Piconet clock */
8874                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
8875         }
8876
8877         err = hci_req_run(&req, get_clock_info_complete);
8878         if (err < 0)
8879                 mgmt_pending_remove(cmd);
8880
8881 unlock:
8882         hci_dev_unlock(hdev);
8883         return err;
8884 }
8885
8886 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
8887 {
8888         struct hci_conn *conn;
8889
8890         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
8891         if (!conn)
8892                 return false;
8893
8894         if (conn->dst_type != type)
8895                 return false;
8896
8897         if (conn->state != BT_CONNECTED)
8898                 return false;
8899
8900         return true;
8901 }
8902
8903 /* This function requires the caller holds hdev->lock */
8904 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
8905                                u8 addr_type, u8 auto_connect)
8906 {
8907         struct hci_conn_params *params;
8908
8909         params = hci_conn_params_add(hdev, addr, addr_type);
8910         if (!params)
8911                 return -EIO;
8912
8913         if (params->auto_connect == auto_connect)
8914                 return 0;
8915
8916         list_del_init(&params->action);
8917
8918         switch (auto_connect) {
8919         case HCI_AUTO_CONN_DISABLED:
8920         case HCI_AUTO_CONN_LINK_LOSS:
8921                 /* If auto connect is being disabled when we're trying to
8922                  * connect to device, keep connecting.
8923                  */
8924                 if (params->explicit_connect)
8925                         list_add(&params->action, &hdev->pend_le_conns);
8926                 break;
8927         case HCI_AUTO_CONN_REPORT:
8928                 if (params->explicit_connect)
8929                         list_add(&params->action, &hdev->pend_le_conns);
8930                 else
8931                         list_add(&params->action, &hdev->pend_le_reports);
8932                 break;
8933         case HCI_AUTO_CONN_DIRECT:
8934         case HCI_AUTO_CONN_ALWAYS:
8935                 if (!is_connected(hdev, addr, addr_type))
8936                         list_add(&params->action, &hdev->pend_le_conns);
8937                 break;
8938         }
8939
8940         params->auto_connect = auto_connect;
8941
8942         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
8943                    addr, addr_type, auto_connect);
8944
8945         return 0;
8946 }
8947
8948 static void device_added(struct sock *sk, struct hci_dev *hdev,
8949                          bdaddr_t *bdaddr, u8 type, u8 action)
8950 {
8951         struct mgmt_ev_device_added ev;
8952
8953         bacpy(&ev.addr.bdaddr, bdaddr);
8954         ev.addr.type = type;
8955         ev.action = action;
8956
8957         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
8958 }
8959
8960 static int add_device(struct sock *sk, struct hci_dev *hdev,
8961                       void *data, u16 len)
8962 {
8963         struct mgmt_cp_add_device *cp = data;
8964         u8 auto_conn, addr_type;
8965         struct hci_conn_params *params;
8966         int err;
8967         u32 current_flags = 0;
8968
8969         bt_dev_dbg(hdev, "sock %p", sk);
8970
8971         if (!bdaddr_type_is_valid(cp->addr.type) ||
8972             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
8973                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8974                                          MGMT_STATUS_INVALID_PARAMS,
8975                                          &cp->addr, sizeof(cp->addr));
8976
8977         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
8978                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8979                                          MGMT_STATUS_INVALID_PARAMS,
8980                                          &cp->addr, sizeof(cp->addr));
8981
8982         hci_dev_lock(hdev);
8983
8984         if (cp->addr.type == BDADDR_BREDR) {
8985                 /* Only incoming connections action is supported for now */
8986                 if (cp->action != 0x01) {
8987                         err = mgmt_cmd_complete(sk, hdev->id,
8988                                                 MGMT_OP_ADD_DEVICE,
8989                                                 MGMT_STATUS_INVALID_PARAMS,
8990                                                 &cp->addr, sizeof(cp->addr));
8991                         goto unlock;
8992                 }
8993
8994                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
8995                                                      &cp->addr.bdaddr,
8996                                                      cp->addr.type, 0);
8997                 if (err)
8998                         goto unlock;
8999
9000                 hci_req_update_scan(hdev);
9001
9002                 goto added;
9003         }
9004
9005         addr_type = le_addr_type(cp->addr.type);
9006
9007         if (cp->action == 0x02)
9008                 auto_conn = HCI_AUTO_CONN_ALWAYS;
9009         else if (cp->action == 0x01)
9010                 auto_conn = HCI_AUTO_CONN_DIRECT;
9011         else
9012                 auto_conn = HCI_AUTO_CONN_REPORT;
9013
9014         /* Kernel internally uses conn_params with resolvable private
9015          * address, but Add Device allows only identity addresses.
9016          * Make sure it is enforced before calling
9017          * hci_conn_params_lookup.
9018          */
9019         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
9020                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9021                                         MGMT_STATUS_INVALID_PARAMS,
9022                                         &cp->addr, sizeof(cp->addr));
9023                 goto unlock;
9024         }
9025
9026         /* If the connection parameters don't exist for this device,
9027          * they will be created and configured with defaults.
9028          */
9029         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
9030                                 auto_conn) < 0) {
9031                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9032                                         MGMT_STATUS_FAILED, &cp->addr,
9033                                         sizeof(cp->addr));
9034                 goto unlock;
9035         } else {
9036                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
9037                                                 addr_type);
9038                 if (params)
9039                         current_flags = params->current_flags;
9040         }
9041
9042         hci_update_background_scan(hdev);
9043
9044 added:
9045         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
9046         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
9047                              SUPPORTED_DEVICE_FLAGS(), current_flags);
9048
9049         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9050                                 MGMT_STATUS_SUCCESS, &cp->addr,
9051                                 sizeof(cp->addr));
9052
9053 unlock:
9054         hci_dev_unlock(hdev);
9055         return err;
9056 }
9057
9058 static void device_removed(struct sock *sk, struct hci_dev *hdev,
9059                            bdaddr_t *bdaddr, u8 type)
9060 {
9061         struct mgmt_ev_device_removed ev;
9062
9063         bacpy(&ev.addr.bdaddr, bdaddr);
9064         ev.addr.type = type;
9065
9066         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
9067 }
9068
9069 static int remove_device(struct sock *sk, struct hci_dev *hdev,
9070                          void *data, u16 len)
9071 {
9072         struct mgmt_cp_remove_device *cp = data;
9073         int err;
9074
9075         bt_dev_dbg(hdev, "sock %p", sk);
9076
9077         hci_dev_lock(hdev);
9078
9079         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
9080                 struct hci_conn_params *params;
9081                 u8 addr_type;
9082
9083                 if (!bdaddr_type_is_valid(cp->addr.type)) {
9084                         err = mgmt_cmd_complete(sk, hdev->id,
9085                                                 MGMT_OP_REMOVE_DEVICE,
9086                                                 MGMT_STATUS_INVALID_PARAMS,
9087                                                 &cp->addr, sizeof(cp->addr));
9088                         goto unlock;
9089                 }
9090
9091                 if (cp->addr.type == BDADDR_BREDR) {
9092                         err = hci_bdaddr_list_del(&hdev->accept_list,
9093                                                   &cp->addr.bdaddr,
9094                                                   cp->addr.type);
9095                         if (err) {
9096                                 err = mgmt_cmd_complete(sk, hdev->id,
9097                                                         MGMT_OP_REMOVE_DEVICE,
9098                                                         MGMT_STATUS_INVALID_PARAMS,
9099                                                         &cp->addr,
9100                                                         sizeof(cp->addr));
9101                                 goto unlock;
9102                         }
9103
9104                         hci_req_update_scan(hdev);
9105
9106                         device_removed(sk, hdev, &cp->addr.bdaddr,
9107                                        cp->addr.type);
9108                         goto complete;
9109                 }
9110
9111                 addr_type = le_addr_type(cp->addr.type);
9112
9113                 /* Kernel internally uses conn_params with resolvable private
9114                  * address, but Remove Device allows only identity addresses.
9115                  * Make sure it is enforced before calling
9116                  * hci_conn_params_lookup.
9117                  */
9118                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
9119                         err = mgmt_cmd_complete(sk, hdev->id,
9120                                                 MGMT_OP_REMOVE_DEVICE,
9121                                                 MGMT_STATUS_INVALID_PARAMS,
9122                                                 &cp->addr, sizeof(cp->addr));
9123                         goto unlock;
9124                 }
9125
9126                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
9127                                                 addr_type);
9128                 if (!params) {
9129                         err = mgmt_cmd_complete(sk, hdev->id,
9130                                                 MGMT_OP_REMOVE_DEVICE,
9131                                                 MGMT_STATUS_INVALID_PARAMS,
9132                                                 &cp->addr, sizeof(cp->addr));
9133                         goto unlock;
9134                 }
9135
9136                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
9137                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
9138                         err = mgmt_cmd_complete(sk, hdev->id,
9139                                                 MGMT_OP_REMOVE_DEVICE,
9140                                                 MGMT_STATUS_INVALID_PARAMS,
9141                                                 &cp->addr, sizeof(cp->addr));
9142                         goto unlock;
9143                 }
9144
9145                 list_del(&params->action);
9146                 list_del(&params->list);
9147                 kfree(params);
9148                 hci_update_background_scan(hdev);
9149
9150                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
9151         } else {
9152                 struct hci_conn_params *p, *tmp;
9153                 struct bdaddr_list *b, *btmp;
9154
9155                 if (cp->addr.type) {
9156                         err = mgmt_cmd_complete(sk, hdev->id,
9157                                                 MGMT_OP_REMOVE_DEVICE,
9158                                                 MGMT_STATUS_INVALID_PARAMS,
9159                                                 &cp->addr, sizeof(cp->addr));
9160                         goto unlock;
9161                 }
9162
9163                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
9164                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
9165                         list_del(&b->list);
9166                         kfree(b);
9167                 }
9168
9169                 hci_req_update_scan(hdev);
9170
9171                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
9172                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
9173                                 continue;
9174                         device_removed(sk, hdev, &p->addr, p->addr_type);
9175                         if (p->explicit_connect) {
9176                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
9177                                 continue;
9178                         }
9179                         list_del(&p->action);
9180                         list_del(&p->list);
9181                         kfree(p);
9182                 }
9183
9184                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
9185
9186                 hci_update_background_scan(hdev);
9187         }
9188
9189 complete:
9190         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
9191                                 MGMT_STATUS_SUCCESS, &cp->addr,
9192                                 sizeof(cp->addr));
9193 unlock:
9194         hci_dev_unlock(hdev);
9195         return err;
9196 }
9197
9198 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
9199                            u16 len)
9200 {
9201         struct mgmt_cp_load_conn_param *cp = data;
9202         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
9203                                      sizeof(struct mgmt_conn_param));
9204         u16 param_count, expected_len;
9205         int i;
9206
9207         if (!lmp_le_capable(hdev))
9208                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9209                                        MGMT_STATUS_NOT_SUPPORTED);
9210
9211         param_count = __le16_to_cpu(cp->param_count);
9212         if (param_count > max_param_count) {
9213                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
9214                            param_count);
9215                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9216                                        MGMT_STATUS_INVALID_PARAMS);
9217         }
9218
9219         expected_len = struct_size(cp, params, param_count);
9220         if (expected_len != len) {
9221                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
9222                            expected_len, len);
9223                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9224                                        MGMT_STATUS_INVALID_PARAMS);
9225         }
9226
9227         bt_dev_dbg(hdev, "param_count %u", param_count);
9228
9229         hci_dev_lock(hdev);
9230
9231         hci_conn_params_clear_disabled(hdev);
9232
9233         for (i = 0; i < param_count; i++) {
9234                 struct mgmt_conn_param *param = &cp->params[i];
9235                 struct hci_conn_params *hci_param;
9236                 u16 min, max, latency, timeout;
9237                 u8 addr_type;
9238
9239                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
9240                            param->addr.type);
9241
9242                 if (param->addr.type == BDADDR_LE_PUBLIC) {
9243                         addr_type = ADDR_LE_DEV_PUBLIC;
9244                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
9245                         addr_type = ADDR_LE_DEV_RANDOM;
9246                 } else {
9247                         bt_dev_err(hdev, "ignoring invalid connection parameters");
9248                         continue;
9249                 }
9250
9251                 min = le16_to_cpu(param->min_interval);
9252                 max = le16_to_cpu(param->max_interval);
9253                 latency = le16_to_cpu(param->latency);
9254                 timeout = le16_to_cpu(param->timeout);
9255
9256                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
9257                            min, max, latency, timeout);
9258
9259                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
9260                         bt_dev_err(hdev, "ignoring invalid connection parameters");
9261                         continue;
9262                 }
9263
9264                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
9265                                                 addr_type);
9266                 if (!hci_param) {
9267                         bt_dev_err(hdev, "failed to add connection parameters");
9268                         continue;
9269                 }
9270
9271                 hci_param->conn_min_interval = min;
9272                 hci_param->conn_max_interval = max;
9273                 hci_param->conn_latency = latency;
9274                 hci_param->supervision_timeout = timeout;
9275         }
9276
9277         hci_dev_unlock(hdev);
9278
9279         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
9280                                  NULL, 0);
9281 }
9282
9283 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
9284                                void *data, u16 len)
9285 {
9286         struct mgmt_cp_set_external_config *cp = data;
9287         bool changed;
9288         int err;
9289
9290         bt_dev_dbg(hdev, "sock %p", sk);
9291
9292         if (hdev_is_powered(hdev))
9293                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9294                                        MGMT_STATUS_REJECTED);
9295
9296         if (cp->config != 0x00 && cp->config != 0x01)
9297                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9298                                          MGMT_STATUS_INVALID_PARAMS);
9299
9300         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
9301                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9302                                        MGMT_STATUS_NOT_SUPPORTED);
9303
9304         hci_dev_lock(hdev);
9305
9306         if (cp->config)
9307                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
9308         else
9309                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
9310
9311         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
9312         if (err < 0)
9313                 goto unlock;
9314
9315         if (!changed)
9316                 goto unlock;
9317
9318         err = new_options(hdev, sk);
9319
9320         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
9321                 mgmt_index_removed(hdev);
9322
9323                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
9324                         hci_dev_set_flag(hdev, HCI_CONFIG);
9325                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9326
9327                         queue_work(hdev->req_workqueue, &hdev->power_on);
9328                 } else {
9329                         set_bit(HCI_RAW, &hdev->flags);
9330                         mgmt_index_added(hdev);
9331                 }
9332         }
9333
9334 unlock:
9335         hci_dev_unlock(hdev);
9336         return err;
9337 }
9338
9339 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
9340                               void *data, u16 len)
9341 {
9342         struct mgmt_cp_set_public_address *cp = data;
9343         bool changed;
9344         int err;
9345
9346         bt_dev_dbg(hdev, "sock %p", sk);
9347
9348         if (hdev_is_powered(hdev))
9349                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9350                                        MGMT_STATUS_REJECTED);
9351
9352         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
9353                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9354                                        MGMT_STATUS_INVALID_PARAMS);
9355
9356         if (!hdev->set_bdaddr)
9357                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9358                                        MGMT_STATUS_NOT_SUPPORTED);
9359
9360         hci_dev_lock(hdev);
9361
9362         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
9363         bacpy(&hdev->public_addr, &cp->bdaddr);
9364
9365         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
9366         if (err < 0)
9367                 goto unlock;
9368
9369         if (!changed)
9370                 goto unlock;
9371
9372         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
9373                 err = new_options(hdev, sk);
9374
9375         if (is_configured(hdev)) {
9376                 mgmt_index_removed(hdev);
9377
9378                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
9379
9380                 hci_dev_set_flag(hdev, HCI_CONFIG);
9381                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9382
9383                 queue_work(hdev->req_workqueue, &hdev->power_on);
9384         }
9385
9386 unlock:
9387         hci_dev_unlock(hdev);
9388         return err;
9389 }
9390
9391 #ifdef TIZEN_BT
9392 int mgmt_device_name_update(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name,
9393                             u8 name_len)
9394 {
9395         char buf[512];
9396         struct mgmt_ev_device_name_update *ev = (void *)buf;
9397         u16 eir_len = 0;
9398
9399         if (name_len <= 0)
9400                 return -EINVAL;
9401
9402         bacpy(&ev->addr.bdaddr, bdaddr);
9403         ev->addr.type = BDADDR_BREDR;
9404
9405         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
9406                                   name_len);
9407
9408         ev->eir_len = cpu_to_le16(eir_len);
9409
9410         return mgmt_event(MGMT_EV_DEVICE_NAME_UPDATE, hdev, buf,
9411                           sizeof(*ev) + eir_len, NULL);
9412 }
9413
9414 int mgmt_le_conn_update_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
9415                                u8 link_type, u8 addr_type, u8 status)
9416 {
9417         struct mgmt_ev_conn_update_failed ev;
9418
9419         bacpy(&ev.addr.bdaddr, bdaddr);
9420         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9421         ev.status = status;
9422
9423         return mgmt_event(MGMT_EV_CONN_UPDATE_FAILED, hdev,
9424                                 &ev, sizeof(ev), NULL);
9425 }
9426
9427 int mgmt_le_conn_updated(struct hci_dev *hdev, bdaddr_t *bdaddr,
9428                          u8 link_type, u8 addr_type, u16 conn_interval,
9429                          u16 conn_latency, u16 supervision_timeout)
9430 {
9431         struct mgmt_ev_conn_updated ev;
9432
9433         bacpy(&ev.addr.bdaddr, bdaddr);
9434         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9435         ev.conn_interval = cpu_to_le16(conn_interval);
9436         ev.conn_latency = cpu_to_le16(conn_latency);
9437         ev.supervision_timeout = cpu_to_le16(supervision_timeout);
9438
9439         return mgmt_event(MGMT_EV_CONN_UPDATED, hdev,
9440                                 &ev, sizeof(ev), NULL);
9441 }
9442
9443 /* le device found event - Pass adv type */
9444 void mgmt_le_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9445                 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, u8 *eir,
9446                 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, u8 adv_type)
9447 {
9448         char buf[512];
9449         struct mgmt_ev_le_device_found *ev = (void *)buf;
9450         size_t ev_size;
9451
9452         if (!hci_discovery_active(hdev) && !hci_le_discovery_active(hdev))
9453                 return;
9454
9455         /* Make sure that the buffer is big enough. The 5 extra bytes
9456          * are for the potential CoD field.
9457          */
9458         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
9459                 return;
9460
9461         memset(buf, 0, sizeof(buf));
9462
9463         bacpy(&ev->addr.bdaddr, bdaddr);
9464         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9465         ev->rssi = rssi;
9466         ev->flags = cpu_to_le32(flags);
9467         ev->adv_type = adv_type;
9468
9469         if (eir_len > 0)
9470                 memcpy(ev->eir, eir, eir_len);
9471
9472         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, NULL))
9473                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
9474                                           dev_class, 3);
9475
9476         if (scan_rsp_len > 0)
9477                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
9478
9479         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
9480         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
9481
9482         mgmt_event(MGMT_EV_LE_DEVICE_FOUND, hdev, ev, ev_size, NULL);
9483 }
9484 #endif
9485
9486 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
9487                                              u16 opcode, struct sk_buff *skb)
9488 {
9489         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
9490         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
9491         u8 *h192, *r192, *h256, *r256;
9492         struct mgmt_pending_cmd *cmd;
9493         u16 eir_len;
9494         int err;
9495
9496         bt_dev_dbg(hdev, "status %u", status);
9497
9498         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
9499         if (!cmd)
9500                 return;
9501
9502         mgmt_cp = cmd->param;
9503
9504         if (status) {
9505                 status = mgmt_status(status);
9506                 eir_len = 0;
9507
9508                 h192 = NULL;
9509                 r192 = NULL;
9510                 h256 = NULL;
9511                 r256 = NULL;
9512         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
9513                 struct hci_rp_read_local_oob_data *rp;
9514
9515                 if (skb->len != sizeof(*rp)) {
9516                         status = MGMT_STATUS_FAILED;
9517                         eir_len = 0;
9518                 } else {
9519                         status = MGMT_STATUS_SUCCESS;
9520                         rp = (void *)skb->data;
9521
9522                         eir_len = 5 + 18 + 18;
9523                         h192 = rp->hash;
9524                         r192 = rp->rand;
9525                         h256 = NULL;
9526                         r256 = NULL;
9527                 }
9528         } else {
9529                 struct hci_rp_read_local_oob_ext_data *rp;
9530
9531                 if (skb->len != sizeof(*rp)) {
9532                         status = MGMT_STATUS_FAILED;
9533                         eir_len = 0;
9534                 } else {
9535                         status = MGMT_STATUS_SUCCESS;
9536                         rp = (void *)skb->data;
9537
9538                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
9539                                 eir_len = 5 + 18 + 18;
9540                                 h192 = NULL;
9541                                 r192 = NULL;
9542                         } else {
9543                                 eir_len = 5 + 18 + 18 + 18 + 18;
9544                                 h192 = rp->hash192;
9545                                 r192 = rp->rand192;
9546                         }
9547
9548                         h256 = rp->hash256;
9549                         r256 = rp->rand256;
9550                 }
9551         }
9552
9553         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
9554         if (!mgmt_rp)
9555                 goto done;
9556
9557         if (eir_len == 0)
9558                 goto send_rsp;
9559
9560         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
9561                                   hdev->dev_class, 3);
9562
9563         if (h192 && r192) {
9564                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9565                                           EIR_SSP_HASH_C192, h192, 16);
9566                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9567                                           EIR_SSP_RAND_R192, r192, 16);
9568         }
9569
9570         if (h256 && r256) {
9571                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9572                                           EIR_SSP_HASH_C256, h256, 16);
9573                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9574                                           EIR_SSP_RAND_R256, r256, 16);
9575         }
9576
9577 send_rsp:
9578         mgmt_rp->type = mgmt_cp->type;
9579         mgmt_rp->eir_len = cpu_to_le16(eir_len);
9580
9581         err = mgmt_cmd_complete(cmd->sk, hdev->id,
9582                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
9583                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
9584         if (err < 0 || status)
9585                 goto done;
9586
9587         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
9588
9589         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9590                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
9591                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
9592 done:
9593         kfree(mgmt_rp);
9594         mgmt_pending_remove(cmd);
9595 }
9596
9597 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
9598                                   struct mgmt_cp_read_local_oob_ext_data *cp)
9599 {
9600         struct mgmt_pending_cmd *cmd;
9601         struct hci_request req;
9602         int err;
9603
9604         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
9605                                cp, sizeof(*cp));
9606         if (!cmd)
9607                 return -ENOMEM;
9608
9609         hci_req_init(&req, hdev);
9610
9611         if (bredr_sc_enabled(hdev))
9612                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
9613         else
9614                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
9615
9616         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
9617         if (err < 0) {
9618                 mgmt_pending_remove(cmd);
9619                 return err;
9620         }
9621
9622         return 0;
9623 }
9624
9625 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
9626                                    void *data, u16 data_len)
9627 {
9628         struct mgmt_cp_read_local_oob_ext_data *cp = data;
9629         struct mgmt_rp_read_local_oob_ext_data *rp;
9630         size_t rp_len;
9631         u16 eir_len;
9632         u8 status, flags, role, addr[7], hash[16], rand[16];
9633         int err;
9634
9635         bt_dev_dbg(hdev, "sock %p", sk);
9636
9637         if (hdev_is_powered(hdev)) {
9638                 switch (cp->type) {
9639                 case BIT(BDADDR_BREDR):
9640                         status = mgmt_bredr_support(hdev);
9641                         if (status)
9642                                 eir_len = 0;
9643                         else
9644                                 eir_len = 5;
9645                         break;
9646                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9647                         status = mgmt_le_support(hdev);
9648                         if (status)
9649                                 eir_len = 0;
9650                         else
9651                                 eir_len = 9 + 3 + 18 + 18 + 3;
9652                         break;
9653                 default:
9654                         status = MGMT_STATUS_INVALID_PARAMS;
9655                         eir_len = 0;
9656                         break;
9657                 }
9658         } else {
9659                 status = MGMT_STATUS_NOT_POWERED;
9660                 eir_len = 0;
9661         }
9662
9663         rp_len = sizeof(*rp) + eir_len;
9664         rp = kmalloc(rp_len, GFP_ATOMIC);
9665         if (!rp)
9666                 return -ENOMEM;
9667
9668         if (status)
9669                 goto complete;
9670
9671         hci_dev_lock(hdev);
9672
9673         eir_len = 0;
9674         switch (cp->type) {
9675         case BIT(BDADDR_BREDR):
9676                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
9677                         err = read_local_ssp_oob_req(hdev, sk, cp);
9678                         hci_dev_unlock(hdev);
9679                         if (!err)
9680                                 goto done;
9681
9682                         status = MGMT_STATUS_FAILED;
9683                         goto complete;
9684                 } else {
9685                         eir_len = eir_append_data(rp->eir, eir_len,
9686                                                   EIR_CLASS_OF_DEV,
9687                                                   hdev->dev_class, 3);
9688                 }
9689                 break;
9690         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9691                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
9692                     smp_generate_oob(hdev, hash, rand) < 0) {
9693                         hci_dev_unlock(hdev);
9694                         status = MGMT_STATUS_FAILED;
9695                         goto complete;
9696                 }
9697
9698                 /* This should return the active RPA, but since the RPA
9699                  * is only programmed on demand, it is really hard to fill
9700                  * this in at the moment. For now disallow retrieving
9701                  * local out-of-band data when privacy is in use.
9702                  *
9703                  * Returning the identity address will not help here since
9704                  * pairing happens before the identity resolving key is
9705                  * known and thus the connection establishment happens
9706                  * based on the RPA and not the identity address.
9707                  */
9708                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
9709                         hci_dev_unlock(hdev);
9710                         status = MGMT_STATUS_REJECTED;
9711                         goto complete;
9712                 }
9713
9714                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
9715                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
9716                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
9717                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
9718                         memcpy(addr, &hdev->static_addr, 6);
9719                         addr[6] = 0x01;
9720                 } else {
9721                         memcpy(addr, &hdev->bdaddr, 6);
9722                         addr[6] = 0x00;
9723                 }
9724
9725                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
9726                                           addr, sizeof(addr));
9727
9728                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
9729                         role = 0x02;
9730                 else
9731                         role = 0x01;
9732
9733                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
9734                                           &role, sizeof(role));
9735
9736                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
9737                         eir_len = eir_append_data(rp->eir, eir_len,
9738                                                   EIR_LE_SC_CONFIRM,
9739                                                   hash, sizeof(hash));
9740
9741                         eir_len = eir_append_data(rp->eir, eir_len,
9742                                                   EIR_LE_SC_RANDOM,
9743                                                   rand, sizeof(rand));
9744                 }
9745
9746                 flags = mgmt_get_adv_discov_flags(hdev);
9747
9748                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
9749                         flags |= LE_AD_NO_BREDR;
9750
9751                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
9752                                           &flags, sizeof(flags));
9753                 break;
9754         }
9755
9756         hci_dev_unlock(hdev);
9757
9758         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
9759
9760         status = MGMT_STATUS_SUCCESS;
9761
9762 complete:
9763         rp->type = cp->type;
9764         rp->eir_len = cpu_to_le16(eir_len);
9765
9766         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
9767                                 status, rp, sizeof(*rp) + eir_len);
9768         if (err < 0 || status)
9769                 goto done;
9770
9771         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9772                                  rp, sizeof(*rp) + eir_len,
9773                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
9774
9775 done:
9776         kfree(rp);
9777
9778         return err;
9779 }
9780
9781 static u32 get_supported_adv_flags(struct hci_dev *hdev)
9782 {
9783         u32 flags = 0;
9784
9785         flags |= MGMT_ADV_FLAG_CONNECTABLE;
9786         flags |= MGMT_ADV_FLAG_DISCOV;
9787         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
9788         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
9789         flags |= MGMT_ADV_FLAG_APPEARANCE;
9790         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
9791         flags |= MGMT_ADV_PARAM_DURATION;
9792         flags |= MGMT_ADV_PARAM_TIMEOUT;
9793         flags |= MGMT_ADV_PARAM_INTERVALS;
9794         flags |= MGMT_ADV_PARAM_TX_POWER;
9795         flags |= MGMT_ADV_PARAM_SCAN_RSP;
9796
9797         /* In extended adv TX_POWER returned from Set Adv Param
9798          * will be always valid.
9799          */
9800         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
9801             ext_adv_capable(hdev))
9802                 flags |= MGMT_ADV_FLAG_TX_POWER;
9803
9804         if (ext_adv_capable(hdev)) {
9805                 flags |= MGMT_ADV_FLAG_SEC_1M;
9806                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
9807                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
9808
9809                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
9810                         flags |= MGMT_ADV_FLAG_SEC_2M;
9811
9812                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
9813                         flags |= MGMT_ADV_FLAG_SEC_CODED;
9814         }
9815
9816         return flags;
9817 }
9818
9819 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
9820                              void *data, u16 data_len)
9821 {
9822         struct mgmt_rp_read_adv_features *rp;
9823         size_t rp_len;
9824         int err;
9825         struct adv_info *adv_instance;
9826         u32 supported_flags;
9827         u8 *instance;
9828
9829         bt_dev_dbg(hdev, "sock %p", sk);
9830
9831         if (!lmp_le_capable(hdev))
9832                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9833                                        MGMT_STATUS_REJECTED);
9834
9835         /* Enabling the experimental LL Privay support disables support for
9836          * advertising.
9837          */
9838         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
9839                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9840                                        MGMT_STATUS_NOT_SUPPORTED);
9841
9842         hci_dev_lock(hdev);
9843
9844         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
9845         rp = kmalloc(rp_len, GFP_ATOMIC);
9846         if (!rp) {
9847                 hci_dev_unlock(hdev);
9848                 return -ENOMEM;
9849         }
9850
9851         supported_flags = get_supported_adv_flags(hdev);
9852
9853         rp->supported_flags = cpu_to_le32(supported_flags);
9854         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
9855         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
9856         rp->max_instances = hdev->le_num_of_adv_sets;
9857         rp->num_instances = hdev->adv_instance_cnt;
9858
9859         instance = rp->instance;
9860         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
9861                 *instance = adv_instance->instance;
9862                 instance++;
9863         }
9864
9865         hci_dev_unlock(hdev);
9866
9867         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9868                                 MGMT_STATUS_SUCCESS, rp, rp_len);
9869
9870         kfree(rp);
9871
9872         return err;
9873 }
9874
9875 static u8 calculate_name_len(struct hci_dev *hdev)
9876 {
9877         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
9878
9879         return append_local_name(hdev, buf, 0);
9880 }
9881
9882 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
9883                            bool is_adv_data)
9884 {
9885         u8 max_len = HCI_MAX_AD_LENGTH;
9886
9887         if (is_adv_data) {
9888                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
9889                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
9890                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
9891                         max_len -= 3;
9892
9893                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
9894                         max_len -= 3;
9895         } else {
9896                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
9897                         max_len -= calculate_name_len(hdev);
9898
9899                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
9900                         max_len -= 4;
9901         }
9902
9903         return max_len;
9904 }
9905
9906 static bool flags_managed(u32 adv_flags)
9907 {
9908         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
9909                             MGMT_ADV_FLAG_LIMITED_DISCOV |
9910                             MGMT_ADV_FLAG_MANAGED_FLAGS);
9911 }
9912
9913 static bool tx_power_managed(u32 adv_flags)
9914 {
9915         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
9916 }
9917
9918 static bool name_managed(u32 adv_flags)
9919 {
9920         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
9921 }
9922
9923 static bool appearance_managed(u32 adv_flags)
9924 {
9925         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
9926 }
9927
9928 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
9929                               u8 len, bool is_adv_data)
9930 {
9931         int i, cur_len;
9932         u8 max_len;
9933
9934         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
9935
9936         if (len > max_len)
9937                 return false;
9938
9939         /* Make sure that the data is correctly formatted. */
9940         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
9941                 cur_len = data[i];
9942
9943                 if (!cur_len)
9944                         continue;
9945
9946                 if (data[i + 1] == EIR_FLAGS &&
9947                     (!is_adv_data || flags_managed(adv_flags)))
9948                         return false;
9949
9950                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
9951                         return false;
9952
9953                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
9954                         return false;
9955
9956                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
9957                         return false;
9958
9959                 if (data[i + 1] == EIR_APPEARANCE &&
9960                     appearance_managed(adv_flags))
9961                         return false;
9962
9963                 /* If the current field length would exceed the total data
9964                  * length, then it's invalid.
9965                  */
9966                 if (i + cur_len >= len)
9967                         return false;
9968         }
9969
9970         return true;
9971 }
9972
9973 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
9974 {
9975         u32 supported_flags, phy_flags;
9976
9977         /* The current implementation only supports a subset of the specified
9978          * flags. Also need to check mutual exclusiveness of sec flags.
9979          */
9980         supported_flags = get_supported_adv_flags(hdev);
9981         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
9982         if (adv_flags & ~supported_flags ||
9983             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
9984                 return false;
9985
9986         return true;
9987 }
9988
9989 static bool adv_busy(struct hci_dev *hdev)
9990 {
9991         return (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
9992                 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
9993                 pending_find(MGMT_OP_SET_LE, hdev) ||
9994                 pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev) ||
9995                 pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev));
9996 }
9997
9998 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
9999                                      u16 opcode)
10000 {
10001         struct mgmt_pending_cmd *cmd;
10002         struct mgmt_cp_add_advertising *cp;
10003         struct mgmt_rp_add_advertising rp;
10004         struct adv_info *adv_instance, *n;
10005         u8 instance;
10006
10007         bt_dev_dbg(hdev, "status %u", status);
10008
10009         hci_dev_lock(hdev);
10010
10011         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
10012         if (!cmd)
10013                 cmd = pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev);
10014
10015         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
10016                 if (!adv_instance->pending)
10017                         continue;
10018
10019                 if (!status) {
10020                         adv_instance->pending = false;
10021                         continue;
10022                 }
10023
10024                 instance = adv_instance->instance;
10025
10026                 if (hdev->cur_adv_instance == instance)
10027                         cancel_adv_timeout(hdev);
10028
10029                 hci_remove_adv_instance(hdev, instance);
10030                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
10031         }
10032
10033         if (!cmd)
10034                 goto unlock;
10035
10036         cp = cmd->param;
10037         rp.instance = cp->instance;
10038
10039         if (status)
10040                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
10041                                 mgmt_status(status));
10042         else
10043                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
10044                                   mgmt_status(status), &rp, sizeof(rp));
10045
10046         mgmt_pending_remove(cmd);
10047
10048 unlock:
10049         hci_dev_unlock(hdev);
10050 }
10051
10052 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
10053                            void *data, u16 data_len)
10054 {
10055         struct mgmt_cp_add_advertising *cp = data;
10056         struct mgmt_rp_add_advertising rp;
10057         u32 flags;
10058         u8 status;
10059         u16 timeout, duration;
10060         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
10061         u8 schedule_instance = 0;
10062         struct adv_info *next_instance;
10063         int err;
10064         struct mgmt_pending_cmd *cmd;
10065         struct hci_request req;
10066
10067         bt_dev_dbg(hdev, "sock %p", sk);
10068
10069         status = mgmt_le_support(hdev);
10070         if (status)
10071                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10072                                        status);
10073
10074         /* Enabling the experimental LL Privay support disables support for
10075          * advertising.
10076          */
10077         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
10078                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10079                                        MGMT_STATUS_NOT_SUPPORTED);
10080
10081         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10082                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10083                                        MGMT_STATUS_INVALID_PARAMS);
10084
10085         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
10086                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10087                                        MGMT_STATUS_INVALID_PARAMS);
10088
10089         flags = __le32_to_cpu(cp->flags);
10090         timeout = __le16_to_cpu(cp->timeout);
10091         duration = __le16_to_cpu(cp->duration);
10092
10093         if (!requested_adv_flags_are_valid(hdev, flags))
10094                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10095                                        MGMT_STATUS_INVALID_PARAMS);
10096
10097         hci_dev_lock(hdev);
10098
10099         if (timeout && !hdev_is_powered(hdev)) {
10100                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10101                                       MGMT_STATUS_REJECTED);
10102                 goto unlock;
10103         }
10104
10105         if (adv_busy(hdev)) {
10106                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10107                                       MGMT_STATUS_BUSY);
10108                 goto unlock;
10109         }
10110
10111         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
10112             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
10113                                cp->scan_rsp_len, false)) {
10114                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10115                                       MGMT_STATUS_INVALID_PARAMS);
10116                 goto unlock;
10117         }
10118
10119         err = hci_add_adv_instance(hdev, cp->instance, flags,
10120                                    cp->adv_data_len, cp->data,
10121                                    cp->scan_rsp_len,
10122                                    cp->data + cp->adv_data_len,
10123                                    timeout, duration,
10124                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
10125                                    hdev->le_adv_min_interval,
10126                                    hdev->le_adv_max_interval);
10127         if (err < 0) {
10128                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10129                                       MGMT_STATUS_FAILED);
10130                 goto unlock;
10131         }
10132
10133         /* Only trigger an advertising added event if a new instance was
10134          * actually added.
10135          */
10136         if (hdev->adv_instance_cnt > prev_instance_cnt)
10137                 mgmt_advertising_added(sk, hdev, cp->instance);
10138
10139         if (hdev->cur_adv_instance == cp->instance) {
10140                 /* If the currently advertised instance is being changed then
10141                  * cancel the current advertising and schedule the next
10142                  * instance. If there is only one instance then the overridden
10143                  * advertising data will be visible right away.
10144                  */
10145                 cancel_adv_timeout(hdev);
10146
10147                 next_instance = hci_get_next_instance(hdev, cp->instance);
10148                 if (next_instance)
10149                         schedule_instance = next_instance->instance;
10150         } else if (!hdev->adv_instance_timeout) {
10151                 /* Immediately advertise the new instance if no other
10152                  * instance is currently being advertised.
10153                  */
10154                 schedule_instance = cp->instance;
10155         }
10156
10157         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
10158          * there is no instance to be advertised then we have no HCI
10159          * communication to make. Simply return.
10160          */
10161         if (!hdev_is_powered(hdev) ||
10162             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
10163             !schedule_instance) {
10164                 rp.instance = cp->instance;
10165                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10166                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10167                 goto unlock;
10168         }
10169
10170         /* We're good to go, update advertising data, parameters, and start
10171          * advertising.
10172          */
10173         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
10174                                data_len);
10175         if (!cmd) {
10176                 err = -ENOMEM;
10177                 goto unlock;
10178         }
10179
10180         hci_req_init(&req, hdev);
10181
10182         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
10183
10184         if (!err)
10185                 err = hci_req_run(&req, add_advertising_complete);
10186
10187         if (err < 0) {
10188                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10189                                       MGMT_STATUS_FAILED);
10190                 mgmt_pending_remove(cmd);
10191         }
10192
10193 unlock:
10194         hci_dev_unlock(hdev);
10195
10196         return err;
10197 }
10198
10199 static void add_ext_adv_params_complete(struct hci_dev *hdev, u8 status,
10200                                         u16 opcode)
10201 {
10202         struct mgmt_pending_cmd *cmd;
10203         struct mgmt_cp_add_ext_adv_params *cp;
10204         struct mgmt_rp_add_ext_adv_params rp;
10205         struct adv_info *adv_instance;
10206         u32 flags;
10207
10208         BT_DBG("%s", hdev->name);
10209
10210         hci_dev_lock(hdev);
10211
10212         cmd = pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev);
10213         if (!cmd)
10214                 goto unlock;
10215
10216         cp = cmd->param;
10217         adv_instance = hci_find_adv_instance(hdev, cp->instance);
10218         if (!adv_instance)
10219                 goto unlock;
10220
10221         rp.instance = cp->instance;
10222         rp.tx_power = adv_instance->tx_power;
10223
10224         /* While we're at it, inform userspace of the available space for this
10225          * advertisement, given the flags that will be used.
10226          */
10227         flags = __le32_to_cpu(cp->flags);
10228         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10229         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10230
10231         if (status) {
10232                 /* If this advertisement was previously advertising and we
10233                  * failed to update it, we signal that it has been removed and
10234                  * delete its structure
10235                  */
10236                 if (!adv_instance->pending)
10237                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
10238
10239                 hci_remove_adv_instance(hdev, cp->instance);
10240
10241                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
10242                                 mgmt_status(status));
10243
10244         } else {
10245                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
10246                                   mgmt_status(status), &rp, sizeof(rp));
10247         }
10248
10249 unlock:
10250         if (cmd)
10251                 mgmt_pending_remove(cmd);
10252
10253         hci_dev_unlock(hdev);
10254 }
10255
10256 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
10257                               void *data, u16 data_len)
10258 {
10259         struct mgmt_cp_add_ext_adv_params *cp = data;
10260         struct mgmt_rp_add_ext_adv_params rp;
10261         struct mgmt_pending_cmd *cmd = NULL;
10262         struct adv_info *adv_instance;
10263         struct hci_request req;
10264         u32 flags, min_interval, max_interval;
10265         u16 timeout, duration;
10266         u8 status;
10267         s8 tx_power;
10268         int err;
10269
10270         BT_DBG("%s", hdev->name);
10271
10272         status = mgmt_le_support(hdev);
10273         if (status)
10274                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10275                                        status);
10276
10277         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10278                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10279                                        MGMT_STATUS_INVALID_PARAMS);
10280
10281         /* The purpose of breaking add_advertising into two separate MGMT calls
10282          * for params and data is to allow more parameters to be added to this
10283          * structure in the future. For this reason, we verify that we have the
10284          * bare minimum structure we know of when the interface was defined. Any
10285          * extra parameters we don't know about will be ignored in this request.
10286          */
10287         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
10288                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10289                                        MGMT_STATUS_INVALID_PARAMS);
10290
10291         flags = __le32_to_cpu(cp->flags);
10292
10293         if (!requested_adv_flags_are_valid(hdev, flags))
10294                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10295                                        MGMT_STATUS_INVALID_PARAMS);
10296
10297         hci_dev_lock(hdev);
10298
10299         /* In new interface, we require that we are powered to register */
10300         if (!hdev_is_powered(hdev)) {
10301                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10302                                       MGMT_STATUS_REJECTED);
10303                 goto unlock;
10304         }
10305
10306         if (adv_busy(hdev)) {
10307                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10308                                       MGMT_STATUS_BUSY);
10309                 goto unlock;
10310         }
10311
10312         /* Parse defined parameters from request, use defaults otherwise */
10313         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
10314                   __le16_to_cpu(cp->timeout) : 0;
10315
10316         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
10317                    __le16_to_cpu(cp->duration) :
10318                    hdev->def_multi_adv_rotation_duration;
10319
10320         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
10321                        __le32_to_cpu(cp->min_interval) :
10322                        hdev->le_adv_min_interval;
10323
10324         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
10325                        __le32_to_cpu(cp->max_interval) :
10326                        hdev->le_adv_max_interval;
10327
10328         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
10329                    cp->tx_power :
10330                    HCI_ADV_TX_POWER_NO_PREFERENCE;
10331
10332         /* Create advertising instance with no advertising or response data */
10333         err = hci_add_adv_instance(hdev, cp->instance, flags,
10334                                    0, NULL, 0, NULL, timeout, duration,
10335                                    tx_power, min_interval, max_interval);
10336
10337         if (err < 0) {
10338                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10339                                       MGMT_STATUS_FAILED);
10340                 goto unlock;
10341         }
10342
10343         /* Submit request for advertising params if ext adv available */
10344         if (ext_adv_capable(hdev)) {
10345                 hci_req_init(&req, hdev);
10346                 adv_instance = hci_find_adv_instance(hdev, cp->instance);
10347
10348                 /* Updating parameters of an active instance will return a
10349                  * Command Disallowed error, so we must first disable the
10350                  * instance if it is active.
10351                  */
10352                 if (!adv_instance->pending)
10353                         __hci_req_disable_ext_adv_instance(&req, cp->instance);
10354
10355                 __hci_req_setup_ext_adv_instance(&req, cp->instance);
10356
10357                 err = hci_req_run(&req, add_ext_adv_params_complete);
10358
10359                 if (!err)
10360                         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_PARAMS,
10361                                                hdev, data, data_len);
10362                 if (!cmd) {
10363                         err = -ENOMEM;
10364                         hci_remove_adv_instance(hdev, cp->instance);
10365                         goto unlock;
10366                 }
10367
10368         } else {
10369                 rp.instance = cp->instance;
10370                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
10371                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10372                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10373                 err = mgmt_cmd_complete(sk, hdev->id,
10374                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
10375                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10376         }
10377
10378 unlock:
10379         hci_dev_unlock(hdev);
10380
10381         return err;
10382 }
10383
10384 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
10385                             u16 data_len)
10386 {
10387         struct mgmt_cp_add_ext_adv_data *cp = data;
10388         struct mgmt_rp_add_ext_adv_data rp;
10389         u8 schedule_instance = 0;
10390         struct adv_info *next_instance;
10391         struct adv_info *adv_instance;
10392         int err = 0;
10393         struct mgmt_pending_cmd *cmd;
10394         struct hci_request req;
10395
10396         BT_DBG("%s", hdev->name);
10397
10398         hci_dev_lock(hdev);
10399
10400         adv_instance = hci_find_adv_instance(hdev, cp->instance);
10401
10402         if (!adv_instance) {
10403                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10404                                       MGMT_STATUS_INVALID_PARAMS);
10405                 goto unlock;
10406         }
10407
10408         /* In new interface, we require that we are powered to register */
10409         if (!hdev_is_powered(hdev)) {
10410                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10411                                       MGMT_STATUS_REJECTED);
10412                 goto clear_new_instance;
10413         }
10414
10415         if (adv_busy(hdev)) {
10416                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10417                                       MGMT_STATUS_BUSY);
10418                 goto clear_new_instance;
10419         }
10420
10421         /* Validate new data */
10422         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
10423                                cp->adv_data_len, true) ||
10424             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
10425                                cp->adv_data_len, cp->scan_rsp_len, false)) {
10426                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10427                                       MGMT_STATUS_INVALID_PARAMS);
10428                 goto clear_new_instance;
10429         }
10430
10431         /* Set the data in the advertising instance */
10432         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
10433                                   cp->data, cp->scan_rsp_len,
10434                                   cp->data + cp->adv_data_len);
10435
10436         /* We're good to go, update advertising data, parameters, and start
10437          * advertising.
10438          */
10439
10440         hci_req_init(&req, hdev);
10441
10442         hci_req_add(&req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
10443
10444         if (ext_adv_capable(hdev)) {
10445                 __hci_req_update_adv_data(&req, cp->instance);
10446                 __hci_req_update_scan_rsp_data(&req, cp->instance);
10447                 __hci_req_enable_ext_advertising(&req, cp->instance);
10448
10449         } else {
10450                 /* If using software rotation, determine next instance to use */
10451
10452                 if (hdev->cur_adv_instance == cp->instance) {
10453                         /* If the currently advertised instance is being changed
10454                          * then cancel the current advertising and schedule the
10455                          * next instance. If there is only one instance then the
10456                          * overridden advertising data will be visible right
10457                          * away
10458                          */
10459                         cancel_adv_timeout(hdev);
10460
10461                         next_instance = hci_get_next_instance(hdev,
10462                                                               cp->instance);
10463                         if (next_instance)
10464                                 schedule_instance = next_instance->instance;
10465                 } else if (!hdev->adv_instance_timeout) {
10466                         /* Immediately advertise the new instance if no other
10467                          * instance is currently being advertised.
10468                          */
10469                         schedule_instance = cp->instance;
10470                 }
10471
10472                 /* If the HCI_ADVERTISING flag is set or there is no instance to
10473                  * be advertised then we have no HCI communication to make.
10474                  * Simply return.
10475                  */
10476                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
10477                     !schedule_instance) {
10478                         if (adv_instance->pending) {
10479                                 mgmt_advertising_added(sk, hdev, cp->instance);
10480                                 adv_instance->pending = false;
10481                         }
10482                         rp.instance = cp->instance;
10483                         err = mgmt_cmd_complete(sk, hdev->id,
10484                                                 MGMT_OP_ADD_EXT_ADV_DATA,
10485                                                 MGMT_STATUS_SUCCESS, &rp,
10486                                                 sizeof(rp));
10487                         goto unlock;
10488                 }
10489
10490                 err = __hci_req_schedule_adv_instance(&req, schedule_instance,
10491                                                       true);
10492         }
10493
10494         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
10495                                data_len);
10496         if (!cmd) {
10497                 err = -ENOMEM;
10498                 goto clear_new_instance;
10499         }
10500
10501         if (!err)
10502                 err = hci_req_run(&req, add_advertising_complete);
10503
10504         if (err < 0) {
10505                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10506                                       MGMT_STATUS_FAILED);
10507                 mgmt_pending_remove(cmd);
10508                 goto clear_new_instance;
10509         }
10510
10511         /* We were successful in updating data, so trigger advertising_added
10512          * event if this is an instance that wasn't previously advertising. If
10513          * a failure occurs in the requests we initiated, we will remove the
10514          * instance again in add_advertising_complete
10515          */
10516         if (adv_instance->pending)
10517                 mgmt_advertising_added(sk, hdev, cp->instance);
10518
10519         goto unlock;
10520
10521 clear_new_instance:
10522         hci_remove_adv_instance(hdev, cp->instance);
10523
10524 unlock:
10525         hci_dev_unlock(hdev);
10526
10527         return err;
10528 }
10529
10530 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
10531                                         u16 opcode)
10532 {
10533         struct mgmt_pending_cmd *cmd;
10534         struct mgmt_cp_remove_advertising *cp;
10535         struct mgmt_rp_remove_advertising rp;
10536
10537         bt_dev_dbg(hdev, "status %u", status);
10538
10539         hci_dev_lock(hdev);
10540
10541         /* A failure status here only means that we failed to disable
10542          * advertising. Otherwise, the advertising instance has been removed,
10543          * so report success.
10544          */
10545         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
10546         if (!cmd)
10547                 goto unlock;
10548
10549         cp = cmd->param;
10550         rp.instance = cp->instance;
10551
10552         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
10553                           &rp, sizeof(rp));
10554         mgmt_pending_remove(cmd);
10555
10556 unlock:
10557         hci_dev_unlock(hdev);
10558 }
10559
10560 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
10561                               void *data, u16 data_len)
10562 {
10563         struct mgmt_cp_remove_advertising *cp = data;
10564         struct mgmt_rp_remove_advertising rp;
10565         struct mgmt_pending_cmd *cmd;
10566         struct hci_request req;
10567         int err;
10568
10569         bt_dev_dbg(hdev, "sock %p", sk);
10570
10571         /* Enabling the experimental LL Privay support disables support for
10572          * advertising.
10573          */
10574         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
10575                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
10576                                        MGMT_STATUS_NOT_SUPPORTED);
10577
10578         hci_dev_lock(hdev);
10579
10580         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
10581                 err = mgmt_cmd_status(sk, hdev->id,
10582                                       MGMT_OP_REMOVE_ADVERTISING,
10583                                       MGMT_STATUS_INVALID_PARAMS);
10584                 goto unlock;
10585         }
10586
10587         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
10588             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
10589             pending_find(MGMT_OP_SET_LE, hdev)) {
10590                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10591                                       MGMT_STATUS_BUSY);
10592                 goto unlock;
10593         }
10594
10595         if (list_empty(&hdev->adv_instances)) {
10596                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10597                                       MGMT_STATUS_INVALID_PARAMS);
10598                 goto unlock;
10599         }
10600
10601         hci_req_init(&req, hdev);
10602
10603         /* If we use extended advertising, instance is disabled and removed */
10604         if (ext_adv_capable(hdev)) {
10605                 __hci_req_disable_ext_adv_instance(&req, cp->instance);
10606                 __hci_req_remove_ext_adv_instance(&req, cp->instance);
10607         }
10608
10609         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
10610
10611         if (list_empty(&hdev->adv_instances))
10612                 __hci_req_disable_advertising(&req);
10613
10614         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
10615          * flag is set or the device isn't powered then we have no HCI
10616          * communication to make. Simply return.
10617          */
10618         if (skb_queue_empty(&req.cmd_q) ||
10619             !hdev_is_powered(hdev) ||
10620             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
10621                 hci_req_purge(&req);
10622                 rp.instance = cp->instance;
10623                 err = mgmt_cmd_complete(sk, hdev->id,
10624                                         MGMT_OP_REMOVE_ADVERTISING,
10625                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10626                 goto unlock;
10627         }
10628
10629         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
10630                                data_len);
10631         if (!cmd) {
10632                 err = -ENOMEM;
10633                 goto unlock;
10634         }
10635
10636         err = hci_req_run(&req, remove_advertising_complete);
10637         if (err < 0)
10638                 mgmt_pending_remove(cmd);
10639
10640 unlock:
10641         hci_dev_unlock(hdev);
10642
10643         return err;
10644 }
10645
10646 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
10647                              void *data, u16 data_len)
10648 {
10649         struct mgmt_cp_get_adv_size_info *cp = data;
10650         struct mgmt_rp_get_adv_size_info rp;
10651         u32 flags, supported_flags;
10652         int err;
10653
10654         bt_dev_dbg(hdev, "sock %p", sk);
10655
10656         if (!lmp_le_capable(hdev))
10657                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10658                                        MGMT_STATUS_REJECTED);
10659
10660         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10661                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10662                                        MGMT_STATUS_INVALID_PARAMS);
10663
10664         flags = __le32_to_cpu(cp->flags);
10665
10666         /* The current implementation only supports a subset of the specified
10667          * flags.
10668          */
10669         supported_flags = get_supported_adv_flags(hdev);
10670         if (flags & ~supported_flags)
10671                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10672                                        MGMT_STATUS_INVALID_PARAMS);
10673
10674         rp.instance = cp->instance;
10675         rp.flags = cp->flags;
10676         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10677         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10678
10679         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10680                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10681
10682         return err;
10683 }
10684
10685 static const struct hci_mgmt_handler mgmt_handlers[] = {
10686         { NULL }, /* 0x0000 (no command) */
10687         { read_version,            MGMT_READ_VERSION_SIZE,
10688                                                 HCI_MGMT_NO_HDEV |
10689                                                 HCI_MGMT_UNTRUSTED },
10690         { read_commands,           MGMT_READ_COMMANDS_SIZE,
10691                                                 HCI_MGMT_NO_HDEV |
10692                                                 HCI_MGMT_UNTRUSTED },
10693         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
10694                                                 HCI_MGMT_NO_HDEV |
10695                                                 HCI_MGMT_UNTRUSTED },
10696         { read_controller_info,    MGMT_READ_INFO_SIZE,
10697                                                 HCI_MGMT_UNTRUSTED },
10698         { set_powered,             MGMT_SETTING_SIZE },
10699         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
10700         { set_connectable,         MGMT_SETTING_SIZE },
10701         { set_fast_connectable,    MGMT_SETTING_SIZE },
10702         { set_bondable,            MGMT_SETTING_SIZE },
10703         { set_link_security,       MGMT_SETTING_SIZE },
10704         { set_ssp,                 MGMT_SETTING_SIZE },
10705         { set_hs,                  MGMT_SETTING_SIZE },
10706         { set_le,                  MGMT_SETTING_SIZE },
10707         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
10708         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
10709         { add_uuid,                MGMT_ADD_UUID_SIZE },
10710         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
10711         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
10712                                                 HCI_MGMT_VAR_LEN },
10713         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
10714                                                 HCI_MGMT_VAR_LEN },
10715         { disconnect,              MGMT_DISCONNECT_SIZE },
10716         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
10717         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
10718         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
10719         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
10720         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
10721         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
10722         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
10723         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
10724         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
10725         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
10726         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
10727         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
10728         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
10729                                                 HCI_MGMT_VAR_LEN },
10730         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
10731         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
10732         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
10733         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
10734         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
10735         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
10736         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
10737         { set_advertising,         MGMT_SETTING_SIZE },
10738         { set_bredr,               MGMT_SETTING_SIZE },
10739         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
10740         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
10741         { set_secure_conn,         MGMT_SETTING_SIZE },
10742         { set_debug_keys,          MGMT_SETTING_SIZE },
10743         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
10744         { load_irks,               MGMT_LOAD_IRKS_SIZE,
10745                                                 HCI_MGMT_VAR_LEN },
10746         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
10747         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
10748         { add_device,              MGMT_ADD_DEVICE_SIZE },
10749         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
10750         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
10751                                                 HCI_MGMT_VAR_LEN },
10752         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
10753                                                 HCI_MGMT_NO_HDEV |
10754                                                 HCI_MGMT_UNTRUSTED },
10755         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
10756                                                 HCI_MGMT_UNCONFIGURED |
10757                                                 HCI_MGMT_UNTRUSTED },
10758         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
10759                                                 HCI_MGMT_UNCONFIGURED },
10760         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
10761                                                 HCI_MGMT_UNCONFIGURED },
10762         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
10763                                                 HCI_MGMT_VAR_LEN },
10764         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
10765         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
10766                                                 HCI_MGMT_NO_HDEV |
10767                                                 HCI_MGMT_UNTRUSTED },
10768         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
10769         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
10770                                                 HCI_MGMT_VAR_LEN },
10771         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
10772         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
10773         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
10774         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
10775                                                 HCI_MGMT_UNTRUSTED },
10776         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
10777         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
10778         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
10779         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
10780                                                 HCI_MGMT_VAR_LEN },
10781         { set_wideband_speech,     MGMT_SETTING_SIZE },
10782         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
10783                                                 HCI_MGMT_UNTRUSTED },
10784         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
10785                                                 HCI_MGMT_UNTRUSTED |
10786                                                 HCI_MGMT_HDEV_OPTIONAL },
10787         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
10788                                                 HCI_MGMT_VAR_LEN |
10789                                                 HCI_MGMT_HDEV_OPTIONAL },
10790         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
10791                                                 HCI_MGMT_UNTRUSTED },
10792         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
10793                                                 HCI_MGMT_VAR_LEN },
10794         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
10795                                                 HCI_MGMT_UNTRUSTED },
10796         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
10797                                                 HCI_MGMT_VAR_LEN },
10798         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
10799         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
10800         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
10801         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
10802                                                 HCI_MGMT_VAR_LEN },
10803         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
10804         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
10805                                                 HCI_MGMT_VAR_LEN },
10806         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
10807                                                 HCI_MGMT_VAR_LEN },
10808         { add_adv_patterns_monitor_rssi,
10809                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
10810                                                 HCI_MGMT_VAR_LEN },
10811 };
10812
10813 #ifdef TIZEN_BT
10814 static const struct hci_mgmt_handler tizen_mgmt_handlers[] = {
10815         { NULL }, /* 0x0000 (no command) */
10816         { set_advertising_params,  MGMT_SET_ADVERTISING_PARAMS_SIZE },
10817         { set_advertising_data,    MGMT_SET_ADV_MIN_APP_DATA_SIZE,
10818                                                 HCI_MGMT_VAR_LEN },
10819         { set_scan_rsp_data,       MGMT_SET_SCAN_RSP_MIN_APP_DATA_SIZE,
10820                                                 HCI_MGMT_VAR_LEN },
10821         { add_white_list,          MGMT_ADD_DEV_WHITE_LIST_SIZE },
10822         { remove_from_white_list,  MGMT_REMOVE_DEV_FROM_WHITE_LIST_SIZE },
10823         { clear_white_list,        MGMT_OP_CLEAR_DEV_WHITE_LIST_SIZE },
10824         { set_enable_rssi,         MGMT_SET_RSSI_ENABLE_SIZE },
10825         { get_raw_rssi,            MGMT_GET_RAW_RSSI_SIZE },
10826         { set_disable_threshold,   MGMT_SET_RSSI_DISABLE_SIZE },
10827         { start_le_discovery,      MGMT_START_LE_DISCOVERY_SIZE },
10828         { stop_le_discovery,       MGMT_STOP_LE_DISCOVERY_SIZE },
10829         { disable_le_auto_connect, MGMT_DISABLE_LE_AUTO_CONNECT_SIZE },
10830         { le_conn_update,          MGMT_LE_CONN_UPDATE_SIZE },
10831         { set_manufacturer_data,   MGMT_SET_MANUFACTURER_DATA_SIZE },
10832         { le_set_scan_params,      MGMT_LE_SET_SCAN_PARAMS_SIZE },
10833         { set_voice_setting,       MGMT_SET_VOICE_SETTING_SIZE },
10834         { get_adv_tx_power,        MGMT_GET_ADV_TX_POWER_SIZE },
10835         { enable_bt_6lowpan,       MGMT_ENABLE_BT_6LOWPAN_SIZE },
10836         { connect_bt_6lowpan,      MGMT_CONNECT_6LOWPAN_SIZE },
10837         { disconnect_bt_6lowpan,   MGMT_DISCONNECT_6LOWPAN_SIZE },
10838         { read_maximum_le_data_length,
10839                                    MGMT_LE_READ_MAXIMUM_DATA_LENGTH_SIZE },
10840         { write_host_suggested_le_data_length,
10841                                    MGMT_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH_SIZE },
10842         { read_host_suggested_data_length,
10843                                    MGMT_LE_READ_HOST_SUGGESTED_DATA_LENGTH_SIZE },
10844 };
10845 #endif
10846
10847 void mgmt_index_added(struct hci_dev *hdev)
10848 {
10849         struct mgmt_ev_ext_index ev;
10850
10851         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10852                 return;
10853
10854         switch (hdev->dev_type) {
10855         case HCI_PRIMARY:
10856                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10857                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
10858                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10859                         ev.type = 0x01;
10860                 } else {
10861                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
10862                                          HCI_MGMT_INDEX_EVENTS);
10863                         ev.type = 0x00;
10864                 }
10865                 break;
10866         case HCI_AMP:
10867                 ev.type = 0x02;
10868                 break;
10869         default:
10870                 return;
10871         }
10872
10873         ev.bus = hdev->bus;
10874
10875         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
10876                          HCI_MGMT_EXT_INDEX_EVENTS);
10877 }
10878
10879 void mgmt_index_removed(struct hci_dev *hdev)
10880 {
10881         struct mgmt_ev_ext_index ev;
10882         u8 status = MGMT_STATUS_INVALID_INDEX;
10883
10884         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10885                 return;
10886
10887         switch (hdev->dev_type) {
10888         case HCI_PRIMARY:
10889                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
10890
10891                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10892                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
10893                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10894                         ev.type = 0x01;
10895                 } else {
10896                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
10897                                          HCI_MGMT_INDEX_EVENTS);
10898                         ev.type = 0x00;
10899                 }
10900                 break;
10901         case HCI_AMP:
10902                 ev.type = 0x02;
10903                 break;
10904         default:
10905                 return;
10906         }
10907
10908         ev.bus = hdev->bus;
10909
10910         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
10911                          HCI_MGMT_EXT_INDEX_EVENTS);
10912 }
10913
10914 /* This function requires the caller holds hdev->lock */
10915 static void restart_le_actions(struct hci_dev *hdev)
10916 {
10917         struct hci_conn_params *p;
10918
10919         list_for_each_entry(p, &hdev->le_conn_params, list) {
10920                 /* Needed for AUTO_OFF case where might not "really"
10921                  * have been powered off.
10922                  */
10923                 list_del_init(&p->action);
10924
10925                 switch (p->auto_connect) {
10926                 case HCI_AUTO_CONN_DIRECT:
10927                 case HCI_AUTO_CONN_ALWAYS:
10928                         list_add(&p->action, &hdev->pend_le_conns);
10929                         break;
10930                 case HCI_AUTO_CONN_REPORT:
10931                         list_add(&p->action, &hdev->pend_le_reports);
10932                         break;
10933                 default:
10934                         break;
10935                 }
10936         }
10937 }
10938
10939 void mgmt_power_on(struct hci_dev *hdev, int err)
10940 {
10941         struct cmd_lookup match = { NULL, hdev };
10942
10943         bt_dev_dbg(hdev, "err %d", err);
10944
10945         hci_dev_lock(hdev);
10946
10947         if (!err) {
10948                 restart_le_actions(hdev);
10949                 hci_update_background_scan(hdev);
10950         }
10951
10952         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
10953
10954         new_settings(hdev, match.sk);
10955
10956         if (match.sk)
10957                 sock_put(match.sk);
10958
10959         hci_dev_unlock(hdev);
10960 }
10961
10962 void __mgmt_power_off(struct hci_dev *hdev)
10963 {
10964         struct cmd_lookup match = { NULL, hdev };
10965         u8 status, zero_cod[] = { 0, 0, 0 };
10966
10967         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
10968
10969         /* If the power off is because of hdev unregistration let
10970          * use the appropriate INVALID_INDEX status. Otherwise use
10971          * NOT_POWERED. We cover both scenarios here since later in
10972          * mgmt_index_removed() any hci_conn callbacks will have already
10973          * been triggered, potentially causing misleading DISCONNECTED
10974          * status responses.
10975          */
10976         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
10977                 status = MGMT_STATUS_INVALID_INDEX;
10978         else
10979                 status = MGMT_STATUS_NOT_POWERED;
10980
10981         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
10982
10983         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
10984                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
10985                                    zero_cod, sizeof(zero_cod),
10986                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
10987                 ext_info_changed(hdev, NULL);
10988         }
10989
10990         new_settings(hdev, match.sk);
10991
10992         if (match.sk)
10993                 sock_put(match.sk);
10994 }
10995
10996 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
10997 {
10998         struct mgmt_pending_cmd *cmd;
10999         u8 status;
11000
11001         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
11002         if (!cmd)
11003                 return;
11004
11005         if (err == -ERFKILL)
11006                 status = MGMT_STATUS_RFKILLED;
11007         else
11008                 status = MGMT_STATUS_FAILED;
11009
11010         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
11011
11012         mgmt_pending_remove(cmd);
11013 }
11014
11015 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
11016                        bool persistent)
11017 {
11018         struct mgmt_ev_new_link_key ev;
11019
11020         memset(&ev, 0, sizeof(ev));
11021
11022         ev.store_hint = persistent;
11023         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
11024         ev.key.addr.type = BDADDR_BREDR;
11025         ev.key.type = key->type;
11026         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
11027         ev.key.pin_len = key->pin_len;
11028
11029         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
11030 }
11031
11032 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
11033 {
11034         switch (ltk->type) {
11035         case SMP_LTK:
11036         case SMP_LTK_RESPONDER:
11037                 if (ltk->authenticated)
11038                         return MGMT_LTK_AUTHENTICATED;
11039                 return MGMT_LTK_UNAUTHENTICATED;
11040         case SMP_LTK_P256:
11041                 if (ltk->authenticated)
11042                         return MGMT_LTK_P256_AUTH;
11043                 return MGMT_LTK_P256_UNAUTH;
11044         case SMP_LTK_P256_DEBUG:
11045                 return MGMT_LTK_P256_DEBUG;
11046         }
11047
11048         return MGMT_LTK_UNAUTHENTICATED;
11049 }
11050
11051 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
11052 {
11053         struct mgmt_ev_new_long_term_key ev;
11054
11055         memset(&ev, 0, sizeof(ev));
11056
11057         /* Devices using resolvable or non-resolvable random addresses
11058          * without providing an identity resolving key don't require
11059          * to store long term keys. Their addresses will change the
11060          * next time around.
11061          *
11062          * Only when a remote device provides an identity address
11063          * make sure the long term key is stored. If the remote
11064          * identity is known, the long term keys are internally
11065          * mapped to the identity address. So allow static random
11066          * and public addresses here.
11067          */
11068         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
11069             (key->bdaddr.b[5] & 0xc0) != 0xc0)
11070                 ev.store_hint = 0x00;
11071         else
11072                 ev.store_hint = persistent;
11073
11074         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
11075         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
11076         ev.key.type = mgmt_ltk_type(key);
11077         ev.key.enc_size = key->enc_size;
11078         ev.key.ediv = key->ediv;
11079         ev.key.rand = key->rand;
11080
11081         if (key->type == SMP_LTK)
11082                 ev.key.initiator = 1;
11083
11084         /* Make sure we copy only the significant bytes based on the
11085          * encryption key size, and set the rest of the value to zeroes.
11086          */
11087         memcpy(ev.key.val, key->val, key->enc_size);
11088         memset(ev.key.val + key->enc_size, 0,
11089                sizeof(ev.key.val) - key->enc_size);
11090
11091         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
11092 }
11093
11094 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
11095 {
11096         struct mgmt_ev_new_irk ev;
11097
11098         memset(&ev, 0, sizeof(ev));
11099
11100         ev.store_hint = persistent;
11101
11102         bacpy(&ev.rpa, &irk->rpa);
11103         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
11104         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
11105         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
11106
11107         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
11108 }
11109
11110 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
11111                    bool persistent)
11112 {
11113         struct mgmt_ev_new_csrk ev;
11114
11115         memset(&ev, 0, sizeof(ev));
11116
11117         /* Devices using resolvable or non-resolvable random addresses
11118          * without providing an identity resolving key don't require
11119          * to store signature resolving keys. Their addresses will change
11120          * the next time around.
11121          *
11122          * Only when a remote device provides an identity address
11123          * make sure the signature resolving key is stored. So allow
11124          * static random and public addresses here.
11125          */
11126         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
11127             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
11128                 ev.store_hint = 0x00;
11129         else
11130                 ev.store_hint = persistent;
11131
11132         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
11133         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
11134         ev.key.type = csrk->type;
11135         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
11136
11137         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
11138 }
11139
11140 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
11141                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
11142                          u16 max_interval, u16 latency, u16 timeout)
11143 {
11144         struct mgmt_ev_new_conn_param ev;
11145
11146         if (!hci_is_identity_address(bdaddr, bdaddr_type))
11147                 return;
11148
11149         memset(&ev, 0, sizeof(ev));
11150         bacpy(&ev.addr.bdaddr, bdaddr);
11151         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
11152         ev.store_hint = store_hint;
11153         ev.min_interval = cpu_to_le16(min_interval);
11154         ev.max_interval = cpu_to_le16(max_interval);
11155         ev.latency = cpu_to_le16(latency);
11156         ev.timeout = cpu_to_le16(timeout);
11157
11158         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
11159 }
11160
11161 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
11162                            u8 *name, u8 name_len)
11163 {
11164         char buf[512];
11165         struct mgmt_ev_device_connected *ev = (void *) buf;
11166         u16 eir_len = 0;
11167         u32 flags = 0;
11168
11169         bacpy(&ev->addr.bdaddr, &conn->dst);
11170         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
11171
11172         if (conn->out)
11173                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
11174
11175         ev->flags = __cpu_to_le32(flags);
11176
11177         /* We must ensure that the EIR Data fields are ordered and
11178          * unique. Keep it simple for now and avoid the problem by not
11179          * adding any BR/EDR data to the LE adv.
11180          */
11181         if (conn->le_adv_data_len > 0) {
11182                 memcpy(&ev->eir[eir_len],
11183                        conn->le_adv_data, conn->le_adv_data_len);
11184                 eir_len = conn->le_adv_data_len;
11185         } else {
11186                 if (name_len > 0)
11187                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
11188                                                   name, name_len);
11189
11190                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
11191                         eir_len = eir_append_data(ev->eir, eir_len,
11192                                                   EIR_CLASS_OF_DEV,
11193                                                   conn->dev_class, 3);
11194         }
11195
11196         ev->eir_len = cpu_to_le16(eir_len);
11197
11198         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
11199                     sizeof(*ev) + eir_len, NULL);
11200 }
11201
11202 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
11203 {
11204         struct sock **sk = data;
11205
11206         cmd->cmd_complete(cmd, 0);
11207
11208         *sk = cmd->sk;
11209         sock_hold(*sk);
11210
11211         mgmt_pending_remove(cmd);
11212 }
11213
11214 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
11215 {
11216         struct hci_dev *hdev = data;
11217         struct mgmt_cp_unpair_device *cp = cmd->param;
11218
11219         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
11220
11221         cmd->cmd_complete(cmd, 0);
11222         mgmt_pending_remove(cmd);
11223 }
11224
11225 bool mgmt_powering_down(struct hci_dev *hdev)
11226 {
11227         struct mgmt_pending_cmd *cmd;
11228         struct mgmt_mode *cp;
11229
11230         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
11231         if (!cmd)
11232                 return false;
11233
11234         cp = cmd->param;
11235         if (!cp->val)
11236                 return true;
11237
11238         return false;
11239 }
11240
11241 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
11242                               u8 link_type, u8 addr_type, u8 reason,
11243                               bool mgmt_connected)
11244 {
11245         struct mgmt_ev_device_disconnected ev;
11246         struct sock *sk = NULL;
11247
11248         /* The connection is still in hci_conn_hash so test for 1
11249          * instead of 0 to know if this is the last one.
11250          */
11251         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
11252                 cancel_delayed_work(&hdev->power_off);
11253                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
11254         }
11255
11256         if (!mgmt_connected)
11257                 return;
11258
11259         if (link_type != ACL_LINK && link_type != LE_LINK)
11260                 return;
11261
11262         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
11263
11264         bacpy(&ev.addr.bdaddr, bdaddr);
11265         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11266         ev.reason = reason;
11267
11268         /* Report disconnects due to suspend */
11269         if (hdev->suspended)
11270                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
11271
11272         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
11273
11274         if (sk)
11275                 sock_put(sk);
11276
11277         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
11278                              hdev);
11279 }
11280
11281 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
11282                             u8 link_type, u8 addr_type, u8 status)
11283 {
11284         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
11285         struct mgmt_cp_disconnect *cp;
11286         struct mgmt_pending_cmd *cmd;
11287
11288         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
11289                              hdev);
11290
11291         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
11292         if (!cmd)
11293                 return;
11294
11295         cp = cmd->param;
11296
11297         if (bacmp(bdaddr, &cp->addr.bdaddr))
11298                 return;
11299
11300         if (cp->addr.type != bdaddr_type)
11301                 return;
11302
11303         cmd->cmd_complete(cmd, mgmt_status(status));
11304         mgmt_pending_remove(cmd);
11305 }
11306
11307 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11308                          u8 addr_type, u8 status)
11309 {
11310         struct mgmt_ev_connect_failed ev;
11311
11312         /* The connection is still in hci_conn_hash so test for 1
11313          * instead of 0 to know if this is the last one.
11314          */
11315         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
11316                 cancel_delayed_work(&hdev->power_off);
11317                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
11318         }
11319
11320         bacpy(&ev.addr.bdaddr, bdaddr);
11321         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11322         ev.status = mgmt_status(status);
11323
11324         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
11325 }
11326
11327 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
11328 {
11329         struct mgmt_ev_pin_code_request ev;
11330
11331         bacpy(&ev.addr.bdaddr, bdaddr);
11332         ev.addr.type = BDADDR_BREDR;
11333         ev.secure = secure;
11334
11335         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
11336 }
11337
11338 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11339                                   u8 status)
11340 {
11341         struct mgmt_pending_cmd *cmd;
11342
11343         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
11344         if (!cmd)
11345                 return;
11346
11347         cmd->cmd_complete(cmd, mgmt_status(status));
11348         mgmt_pending_remove(cmd);
11349 }
11350
11351 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11352                                       u8 status)
11353 {
11354         struct mgmt_pending_cmd *cmd;
11355
11356         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
11357         if (!cmd)
11358                 return;
11359
11360         cmd->cmd_complete(cmd, mgmt_status(status));
11361         mgmt_pending_remove(cmd);
11362 }
11363
11364 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
11365                               u8 link_type, u8 addr_type, u32 value,
11366                               u8 confirm_hint)
11367 {
11368         struct mgmt_ev_user_confirm_request ev;
11369
11370         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11371
11372         bacpy(&ev.addr.bdaddr, bdaddr);
11373         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11374         ev.confirm_hint = confirm_hint;
11375         ev.value = cpu_to_le32(value);
11376
11377         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
11378                           NULL);
11379 }
11380
11381 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
11382                               u8 link_type, u8 addr_type)
11383 {
11384         struct mgmt_ev_user_passkey_request ev;
11385
11386         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11387
11388         bacpy(&ev.addr.bdaddr, bdaddr);
11389         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11390
11391         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
11392                           NULL);
11393 }
11394
11395 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11396                                       u8 link_type, u8 addr_type, u8 status,
11397                                       u8 opcode)
11398 {
11399         struct mgmt_pending_cmd *cmd;
11400
11401         cmd = pending_find(opcode, hdev);
11402         if (!cmd)
11403                 return -ENOENT;
11404
11405         cmd->cmd_complete(cmd, mgmt_status(status));
11406         mgmt_pending_remove(cmd);
11407
11408         return 0;
11409 }
11410
11411 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11412                                      u8 link_type, u8 addr_type, u8 status)
11413 {
11414         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11415                                           status, MGMT_OP_USER_CONFIRM_REPLY);
11416 }
11417
11418 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11419                                          u8 link_type, u8 addr_type, u8 status)
11420 {
11421         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11422                                           status,
11423                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
11424 }
11425
11426 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11427                                      u8 link_type, u8 addr_type, u8 status)
11428 {
11429         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11430                                           status, MGMT_OP_USER_PASSKEY_REPLY);
11431 }
11432
11433 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11434                                          u8 link_type, u8 addr_type, u8 status)
11435 {
11436         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11437                                           status,
11438                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
11439 }
11440
11441 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
11442                              u8 link_type, u8 addr_type, u32 passkey,
11443                              u8 entered)
11444 {
11445         struct mgmt_ev_passkey_notify ev;
11446
11447         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11448
11449         bacpy(&ev.addr.bdaddr, bdaddr);
11450         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11451         ev.passkey = __cpu_to_le32(passkey);
11452         ev.entered = entered;
11453
11454         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
11455 }
11456
11457 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
11458 {
11459         struct mgmt_ev_auth_failed ev;
11460         struct mgmt_pending_cmd *cmd;
11461         u8 status = mgmt_status(hci_status);
11462
11463         bacpy(&ev.addr.bdaddr, &conn->dst);
11464         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
11465         ev.status = status;
11466
11467         cmd = find_pairing(conn);
11468
11469         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
11470                     cmd ? cmd->sk : NULL);
11471
11472         if (cmd) {
11473                 cmd->cmd_complete(cmd, status);
11474                 mgmt_pending_remove(cmd);
11475         }
11476 }
11477
11478 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
11479 {
11480         struct cmd_lookup match = { NULL, hdev };
11481         bool changed;
11482
11483         if (status) {
11484                 u8 mgmt_err = mgmt_status(status);
11485                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
11486                                      cmd_status_rsp, &mgmt_err);
11487                 return;
11488         }
11489
11490         if (test_bit(HCI_AUTH, &hdev->flags))
11491                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
11492         else
11493                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
11494
11495         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
11496                              &match);
11497
11498         if (changed)
11499                 new_settings(hdev, match.sk);
11500
11501         if (match.sk)
11502                 sock_put(match.sk);
11503 }
11504
11505 static void clear_eir(struct hci_request *req)
11506 {
11507         struct hci_dev *hdev = req->hdev;
11508         struct hci_cp_write_eir cp;
11509
11510         if (!lmp_ext_inq_capable(hdev))
11511                 return;
11512
11513         memset(hdev->eir, 0, sizeof(hdev->eir));
11514
11515         memset(&cp, 0, sizeof(cp));
11516
11517         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
11518 }
11519
11520 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
11521 {
11522         struct cmd_lookup match = { NULL, hdev };
11523         struct hci_request req;
11524         bool changed = false;
11525
11526         if (status) {
11527                 u8 mgmt_err = mgmt_status(status);
11528
11529                 if (enable && hci_dev_test_and_clear_flag(hdev,
11530                                                           HCI_SSP_ENABLED)) {
11531                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
11532                         new_settings(hdev, NULL);
11533                 }
11534
11535                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
11536                                      &mgmt_err);
11537                 return;
11538         }
11539
11540         if (enable) {
11541                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
11542         } else {
11543                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
11544                 if (!changed)
11545                         changed = hci_dev_test_and_clear_flag(hdev,
11546                                                               HCI_HS_ENABLED);
11547                 else
11548                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
11549         }
11550
11551         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
11552
11553         if (changed)
11554                 new_settings(hdev, match.sk);
11555
11556         if (match.sk)
11557                 sock_put(match.sk);
11558
11559         hci_req_init(&req, hdev);
11560
11561         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
11562                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
11563                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
11564                                     sizeof(enable), &enable);
11565                 __hci_req_update_eir(&req);
11566         } else {
11567                 clear_eir(&req);
11568         }
11569
11570         hci_req_run(&req, NULL);
11571 }
11572
11573 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
11574 {
11575         struct cmd_lookup *match = data;
11576
11577         if (match->sk == NULL) {
11578                 match->sk = cmd->sk;
11579                 sock_hold(match->sk);
11580         }
11581 }
11582
11583 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
11584                                     u8 status)
11585 {
11586         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
11587
11588         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
11589         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
11590         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
11591
11592         if (!status) {
11593                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
11594                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
11595                 ext_info_changed(hdev, NULL);
11596         }
11597
11598         if (match.sk)
11599                 sock_put(match.sk);
11600 }
11601
11602 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
11603 {
11604         struct mgmt_cp_set_local_name ev;
11605         struct mgmt_pending_cmd *cmd;
11606
11607         if (status)
11608                 return;
11609
11610         memset(&ev, 0, sizeof(ev));
11611         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
11612         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
11613
11614         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
11615         if (!cmd) {
11616                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
11617
11618                 /* If this is a HCI command related to powering on the
11619                  * HCI dev don't send any mgmt signals.
11620                  */
11621                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
11622                         return;
11623         }
11624
11625         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
11626                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
11627         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
11628 }
11629
11630 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
11631 {
11632         int i;
11633
11634         for (i = 0; i < uuid_count; i++) {
11635                 if (!memcmp(uuid, uuids[i], 16))
11636                         return true;
11637         }
11638
11639         return false;
11640 }
11641
11642 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
11643 {
11644         u16 parsed = 0;
11645
11646         while (parsed < eir_len) {
11647                 u8 field_len = eir[0];
11648                 u8 uuid[16];
11649                 int i;
11650
11651                 if (field_len == 0)
11652                         break;
11653
11654                 if (eir_len - parsed < field_len + 1)
11655                         break;
11656
11657                 switch (eir[1]) {
11658                 case EIR_UUID16_ALL:
11659                 case EIR_UUID16_SOME:
11660                         for (i = 0; i + 3 <= field_len; i += 2) {
11661                                 memcpy(uuid, bluetooth_base_uuid, 16);
11662                                 uuid[13] = eir[i + 3];
11663                                 uuid[12] = eir[i + 2];
11664                                 if (has_uuid(uuid, uuid_count, uuids))
11665                                         return true;
11666                         }
11667                         break;
11668                 case EIR_UUID32_ALL:
11669                 case EIR_UUID32_SOME:
11670                         for (i = 0; i + 5 <= field_len; i += 4) {
11671                                 memcpy(uuid, bluetooth_base_uuid, 16);
11672                                 uuid[15] = eir[i + 5];
11673                                 uuid[14] = eir[i + 4];
11674                                 uuid[13] = eir[i + 3];
11675                                 uuid[12] = eir[i + 2];
11676                                 if (has_uuid(uuid, uuid_count, uuids))
11677                                         return true;
11678                         }
11679                         break;
11680                 case EIR_UUID128_ALL:
11681                 case EIR_UUID128_SOME:
11682                         for (i = 0; i + 17 <= field_len; i += 16) {
11683                                 memcpy(uuid, eir + i + 2, 16);
11684                                 if (has_uuid(uuid, uuid_count, uuids))
11685                                         return true;
11686                         }
11687                         break;
11688                 }
11689
11690                 parsed += field_len + 1;
11691                 eir += field_len + 1;
11692         }
11693
11694         return false;
11695 }
11696
11697 static void restart_le_scan(struct hci_dev *hdev)
11698 {
11699         /* If controller is not scanning we are done. */
11700         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
11701                 return;
11702
11703         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
11704                        hdev->discovery.scan_start +
11705                        hdev->discovery.scan_duration))
11706                 return;
11707
11708         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
11709                            DISCOV_LE_RESTART_DELAY);
11710 }
11711
11712 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
11713                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
11714 {
11715         /* If a RSSI threshold has been specified, and
11716          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
11717          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
11718          * is set, let it through for further processing, as we might need to
11719          * restart the scan.
11720          *
11721          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
11722          * the results are also dropped.
11723          */
11724         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11725             (rssi == HCI_RSSI_INVALID ||
11726             (rssi < hdev->discovery.rssi &&
11727              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
11728                 return  false;
11729
11730         if (hdev->discovery.uuid_count != 0) {
11731                 /* If a list of UUIDs is provided in filter, results with no
11732                  * matching UUID should be dropped.
11733                  */
11734                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
11735                                    hdev->discovery.uuids) &&
11736                     !eir_has_uuids(scan_rsp, scan_rsp_len,
11737                                    hdev->discovery.uuid_count,
11738                                    hdev->discovery.uuids))
11739                         return false;
11740         }
11741
11742         /* If duplicate filtering does not report RSSI changes, then restart
11743          * scanning to ensure updated result with updated RSSI values.
11744          */
11745         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
11746                 restart_le_scan(hdev);
11747
11748                 /* Validate RSSI value against the RSSI threshold once more. */
11749                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11750                     rssi < hdev->discovery.rssi)
11751                         return false;
11752         }
11753
11754         return true;
11755 }
11756
11757 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11758                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
11759                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
11760 {
11761         char buf[512];
11762         struct mgmt_ev_device_found *ev = (void *)buf;
11763         size_t ev_size;
11764
11765         /* Don't send events for a non-kernel initiated discovery. With
11766          * LE one exception is if we have pend_le_reports > 0 in which
11767          * case we're doing passive scanning and want these events.
11768          */
11769         if (!hci_discovery_active(hdev)) {
11770                 if (link_type == ACL_LINK)
11771                         return;
11772                 if (link_type == LE_LINK &&
11773                     list_empty(&hdev->pend_le_reports) &&
11774                     !hci_is_adv_monitoring(hdev)) {
11775                         return;
11776                 }
11777         }
11778
11779         if (hdev->discovery.result_filtering) {
11780                 /* We are using service discovery */
11781                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
11782                                      scan_rsp_len))
11783                         return;
11784         }
11785
11786         if (hdev->discovery.limited) {
11787                 /* Check for limited discoverable bit */
11788                 if (dev_class) {
11789                         if (!(dev_class[1] & 0x20))
11790                                 return;
11791                 } else {
11792                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
11793                         if (!flags || !(flags[0] & LE_AD_LIMITED))
11794                                 return;
11795                 }
11796         }
11797
11798         /* Make sure that the buffer is big enough. The 5 extra bytes
11799          * are for the potential CoD field.
11800          */
11801         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
11802                 return;
11803
11804         memset(buf, 0, sizeof(buf));
11805
11806         /* In case of device discovery with BR/EDR devices (pre 1.2), the
11807          * RSSI value was reported as 0 when not available. This behavior
11808          * is kept when using device discovery. This is required for full
11809          * backwards compatibility with the API.
11810          *
11811          * However when using service discovery, the value 127 will be
11812          * returned when the RSSI is not available.
11813          */
11814         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
11815             link_type == ACL_LINK)
11816                 rssi = 0;
11817
11818         bacpy(&ev->addr.bdaddr, bdaddr);
11819         ev->addr.type = link_to_bdaddr(link_type, addr_type);
11820         ev->rssi = rssi;
11821         ev->flags = cpu_to_le32(flags);
11822
11823         if (eir_len > 0)
11824                 /* Copy EIR or advertising data into event */
11825                 memcpy(ev->eir, eir, eir_len);
11826
11827         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
11828                                        NULL))
11829                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
11830                                           dev_class, 3);
11831
11832         if (scan_rsp_len > 0)
11833                 /* Append scan response data to event */
11834                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
11835
11836         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
11837         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
11838
11839         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
11840 }
11841
11842 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11843                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
11844 {
11845         struct mgmt_ev_device_found *ev;
11846         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
11847         u16 eir_len;
11848
11849         ev = (struct mgmt_ev_device_found *) buf;
11850
11851         memset(buf, 0, sizeof(buf));
11852
11853         bacpy(&ev->addr.bdaddr, bdaddr);
11854         ev->addr.type = link_to_bdaddr(link_type, addr_type);
11855         ev->rssi = rssi;
11856
11857         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
11858                                   name_len);
11859
11860         ev->eir_len = cpu_to_le16(eir_len);
11861
11862         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
11863 }
11864
11865 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
11866 {
11867         struct mgmt_ev_discovering ev;
11868
11869         bt_dev_dbg(hdev, "discovering %u", discovering);
11870
11871         memset(&ev, 0, sizeof(ev));
11872         ev.type = hdev->discovery.type;
11873         ev.discovering = discovering;
11874
11875         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
11876 }
11877
11878 void mgmt_suspending(struct hci_dev *hdev, u8 state)
11879 {
11880         struct mgmt_ev_controller_suspend ev;
11881
11882         ev.suspend_state = state;
11883         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
11884 }
11885
11886 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
11887                    u8 addr_type)
11888 {
11889         struct mgmt_ev_controller_resume ev;
11890
11891         ev.wake_reason = reason;
11892         if (bdaddr) {
11893                 bacpy(&ev.addr.bdaddr, bdaddr);
11894                 ev.addr.type = addr_type;
11895         } else {
11896                 memset(&ev.addr, 0, sizeof(ev.addr));
11897         }
11898
11899         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
11900 }
11901
11902 static struct hci_mgmt_chan chan = {
11903         .channel        = HCI_CHANNEL_CONTROL,
11904         .handler_count  = ARRAY_SIZE(mgmt_handlers),
11905         .handlers       = mgmt_handlers,
11906 #ifdef TIZEN_BT
11907         .tizen_handler_count    = ARRAY_SIZE(tizen_mgmt_handlers),
11908         .tizen_handlers = tizen_mgmt_handlers,
11909 #endif
11910         .hdev_init      = mgmt_init_hdev,
11911 };
11912
11913 int mgmt_init(void)
11914 {
11915         return hci_mgmt_chan_register(&chan);
11916 }
11917
11918 void mgmt_exit(void)
11919 {
11920         hci_mgmt_chan_unregister(&chan);
11921 }