net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #ifdef TIZEN_BT
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #endif
  38
  39 #include "hci_request.h"
  40 #include "smp.h"
  41 #include "mgmt_util.h"
  42
  43 #define MGMT_VERSION    1
  44 #define MGMT_REVISION   14
  45
  46 static const u16 mgmt_commands[] = {
  47         MGMT_OP_READ_INDEX_LIST,
  48         MGMT_OP_READ_INFO,
  49         MGMT_OP_SET_POWERED,
  50         MGMT_OP_SET_DISCOVERABLE,
  51         MGMT_OP_SET_CONNECTABLE,
  52         MGMT_OP_SET_FAST_CONNECTABLE,
  53         MGMT_OP_SET_BONDABLE,
  54         MGMT_OP_SET_LINK_SECURITY,
  55         MGMT_OP_SET_SSP,
  56         MGMT_OP_SET_HS,
  57         MGMT_OP_SET_LE,
  58         MGMT_OP_SET_DEV_CLASS,
  59         MGMT_OP_SET_LOCAL_NAME,
  60         MGMT_OP_ADD_UUID,
  61         MGMT_OP_REMOVE_UUID,
  62         MGMT_OP_LOAD_LINK_KEYS,
  63         MGMT_OP_LOAD_LONG_TERM_KEYS,
  64         MGMT_OP_DISCONNECT,
  65         MGMT_OP_GET_CONNECTIONS,
  66         MGMT_OP_PIN_CODE_REPLY,
  67         MGMT_OP_PIN_CODE_NEG_REPLY,
  68         MGMT_OP_SET_IO_CAPABILITY,
  69         MGMT_OP_PAIR_DEVICE,
  70         MGMT_OP_CANCEL_PAIR_DEVICE,
  71         MGMT_OP_UNPAIR_DEVICE,
  72         MGMT_OP_USER_CONFIRM_REPLY,
  73         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  74         MGMT_OP_USER_PASSKEY_REPLY,
  75         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  76         MGMT_OP_READ_LOCAL_OOB_DATA,
  77         MGMT_OP_ADD_REMOTE_OOB_DATA,
  78         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  79         MGMT_OP_START_DISCOVERY,
  80         MGMT_OP_STOP_DISCOVERY,
  81         MGMT_OP_CONFIRM_NAME,
  82         MGMT_OP_BLOCK_DEVICE,
  83         MGMT_OP_UNBLOCK_DEVICE,
  84         MGMT_OP_SET_DEVICE_ID,
  85         MGMT_OP_SET_ADVERTISING,
  86         MGMT_OP_SET_BREDR,
  87         MGMT_OP_SET_STATIC_ADDRESS,
  88         MGMT_OP_SET_SCAN_PARAMS,
  89         MGMT_OP_SET_SECURE_CONN,
  90         MGMT_OP_SET_DEBUG_KEYS,
  91         MGMT_OP_SET_PRIVACY,
  92         MGMT_OP_LOAD_IRKS,
  93         MGMT_OP_GET_CONN_INFO,
  94         MGMT_OP_GET_CLOCK_INFO,
  95         MGMT_OP_ADD_DEVICE,
  96         MGMT_OP_REMOVE_DEVICE,
  97         MGMT_OP_LOAD_CONN_PARAM,
  98         MGMT_OP_READ_UNCONF_INDEX_LIST,
  99         MGMT_OP_READ_CONFIG_INFO,
 100         MGMT_OP_SET_EXTERNAL_CONFIG,
 101         MGMT_OP_SET_PUBLIC_ADDRESS,
 102         MGMT_OP_START_SERVICE_DISCOVERY,
 103         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 104         MGMT_OP_READ_EXT_INDEX_LIST,
 105         MGMT_OP_READ_ADV_FEATURES,
 106         MGMT_OP_ADD_ADVERTISING,
 107         MGMT_OP_REMOVE_ADVERTISING,
 108         MGMT_OP_GET_ADV_SIZE_INFO,
 109         MGMT_OP_START_LIMITED_DISCOVERY,
 110         MGMT_OP_READ_EXT_INFO,
 111         MGMT_OP_SET_APPEARANCE,
 112 };
 113
 114 static const u16 mgmt_events[] = {
 115         MGMT_EV_CONTROLLER_ERROR,
 116         MGMT_EV_INDEX_ADDED,
 117         MGMT_EV_INDEX_REMOVED,
 118         MGMT_EV_NEW_SETTINGS,
 119         MGMT_EV_CLASS_OF_DEV_CHANGED,
 120         MGMT_EV_LOCAL_NAME_CHANGED,
 121         MGMT_EV_NEW_LINK_KEY,
 122         MGMT_EV_NEW_LONG_TERM_KEY,
 123         MGMT_EV_DEVICE_CONNECTED,
 124         MGMT_EV_DEVICE_DISCONNECTED,
 125         MGMT_EV_CONNECT_FAILED,
 126         MGMT_EV_PIN_CODE_REQUEST,
 127         MGMT_EV_USER_CONFIRM_REQUEST,
 128         MGMT_EV_USER_PASSKEY_REQUEST,
 129         MGMT_EV_AUTH_FAILED,
 130         MGMT_EV_DEVICE_FOUND,
 131         MGMT_EV_DISCOVERING,
 132         MGMT_EV_DEVICE_BLOCKED,
 133         MGMT_EV_DEVICE_UNBLOCKED,
 134         MGMT_EV_DEVICE_UNPAIRED,
 135         MGMT_EV_PASSKEY_NOTIFY,
 136         MGMT_EV_NEW_IRK,
 137         MGMT_EV_NEW_CSRK,
 138         MGMT_EV_DEVICE_ADDED,
 139         MGMT_EV_DEVICE_REMOVED,
 140         MGMT_EV_NEW_CONN_PARAM,
 141         MGMT_EV_UNCONF_INDEX_ADDED,
 142         MGMT_EV_UNCONF_INDEX_REMOVED,
 143         MGMT_EV_NEW_CONFIG_OPTIONS,
 144         MGMT_EV_EXT_INDEX_ADDED,
 145         MGMT_EV_EXT_INDEX_REMOVED,
 146         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 147         MGMT_EV_ADVERTISING_ADDED,
 148         MGMT_EV_ADVERTISING_REMOVED,
 149         MGMT_EV_EXT_INFO_CHANGED,
 150 };
 151
 152 static const u16 mgmt_untrusted_commands[] = {
 153         MGMT_OP_READ_INDEX_LIST,
 154         MGMT_OP_READ_INFO,
 155         MGMT_OP_READ_UNCONF_INDEX_LIST,
 156         MGMT_OP_READ_CONFIG_INFO,
 157         MGMT_OP_READ_EXT_INDEX_LIST,
 158         MGMT_OP_READ_EXT_INFO,
 159 };
 160
 161 static const u16 mgmt_untrusted_events[] = {
 162         MGMT_EV_INDEX_ADDED,
 163         MGMT_EV_INDEX_REMOVED,
 164         MGMT_EV_NEW_SETTINGS,
 165         MGMT_EV_CLASS_OF_DEV_CHANGED,
 166         MGMT_EV_LOCAL_NAME_CHANGED,
 167         MGMT_EV_UNCONF_INDEX_ADDED,
 168         MGMT_EV_UNCONF_INDEX_REMOVED,
 169         MGMT_EV_NEW_CONFIG_OPTIONS,
 170         MGMT_EV_EXT_INDEX_ADDED,
 171         MGMT_EV_EXT_INDEX_REMOVED,
 172         MGMT_EV_EXT_INFO_CHANGED,
 173 };
 174
 175 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 176
 177 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 178                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 179
 180 /* HCI to MGMT error code conversion table */
 181 static u8 mgmt_status_table[] = {
 182         MGMT_STATUS_SUCCESS,
 183         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 184         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 185         MGMT_STATUS_FAILED,             /* Hardware Failure */
 186         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 187         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 188         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 189         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 190         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 191         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 192         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 193         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 194         MGMT_STATUS_BUSY,               /* Command Disallowed */
 195         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 196         MGMT_STATUS_REJECTED,           /* Rejected Security */
 197         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 198         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 199         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 200         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 201         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 202         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 203         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 204         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 205         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 206         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 207         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 208         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 209         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 210         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 211         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 212         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 213         MGMT_STATUS_FAILED,             /* Unspecified Error */
 214         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 215         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 216         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 217         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 218         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 219         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 220         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 221         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 222         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 223         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 224         MGMT_STATUS_FAILED,             /* Transaction Collision */
 225         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 226         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 227         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 228         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 229         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 230         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 231         MGMT_STATUS_FAILED,             /* Slot Violation */
 232         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 233         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 234         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 235         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 236         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 237         MGMT_STATUS_BUSY,               /* Controller Busy */
 238         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 239         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 240         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 241         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 242         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 243 };
 244
 245 static u8 mgmt_status(u8 hci_status)
 246 {
 247         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 248                 return mgmt_status_table[hci_status];
 249
 250         return MGMT_STATUS_FAILED;
 251 }
 252
 253 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 254                             u16 len, int flag)
 255 {
 256         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 257                                flag, NULL);
 258 }
 259
 260 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 261                               u16 len, int flag, struct sock *skip_sk)
 262 {
 263         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 264                                flag, skip_sk);
 265 }
 266
 267 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 268                       struct sock *skip_sk)
 269 {
 270         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 271                                HCI_SOCK_TRUSTED, skip_sk);
 272 }
 273
 274 static u8 le_addr_type(u8 mgmt_addr_type)
 275 {
 276         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 277                 return ADDR_LE_DEV_PUBLIC;
 278         else
 279                 return ADDR_LE_DEV_RANDOM;
 280 }
 281
 282 void mgmt_fill_version_info(void *ver)
 283 {
 284         struct mgmt_rp_read_version *rp = ver;
 285
 286         rp->version = MGMT_VERSION;
 287         rp->revision = cpu_to_le16(MGMT_REVISION);
 288 }
 289
 290 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 291                         u16 data_len)
 292 {
 293         struct mgmt_rp_read_version rp;
 294
 295         BT_DBG("sock %p", sk);
 296
 297         mgmt_fill_version_info(&rp);
 298
 299         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 300                                  &rp, sizeof(rp));
 301 }
 302
 303 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 304                          u16 data_len)
 305 {
 306         struct mgmt_rp_read_commands *rp;
 307         u16 num_commands, num_events;
 308         size_t rp_size;
 309         int i, err;
 310
 311         BT_DBG("sock %p", sk);
 312
 313         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 314                 num_commands = ARRAY_SIZE(mgmt_commands);
 315                 num_events = ARRAY_SIZE(mgmt_events);
 316         } else {
 317                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 318                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 319         }
 320
 321         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 322
 323         rp = kmalloc(rp_size, GFP_KERNEL);
 324         if (!rp)
 325                 return -ENOMEM;
 326
 327         rp->num_commands = cpu_to_le16(num_commands);
 328         rp->num_events = cpu_to_le16(num_events);
 329
 330         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 331                 __le16 *opcode = rp->opcodes;
 332
 333                 for (i = 0; i < num_commands; i++, opcode++)
 334                         put_unaligned_le16(mgmt_commands[i], opcode);
 335
 336                 for (i = 0; i < num_events; i++, opcode++)
 337                         put_unaligned_le16(mgmt_events[i], opcode);
 338         } else {
 339                 __le16 *opcode = rp->opcodes;
 340
 341                 for (i = 0; i < num_commands; i++, opcode++)
 342                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 343
 344                 for (i = 0; i < num_events; i++, opcode++)
 345                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 346         }
 347
 348         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 349                                 rp, rp_size);
 350         kfree(rp);
 351
 352         return err;
 353 }
 354
 355 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 356                            u16 data_len)
 357 {
 358         struct mgmt_rp_read_index_list *rp;
 359         struct hci_dev *d;
 360         size_t rp_len;
 361         u16 count;
 362         int err;
 363
 364         BT_DBG("sock %p", sk);
 365
 366         read_lock(&hci_dev_list_lock);
 367
 368         count = 0;
 369         list_for_each_entry(d, &hci_dev_list, list) {
 370                 if (d->dev_type == HCI_PRIMARY &&
 371                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 372                         count++;
 373         }
 374
 375         rp_len = sizeof(*rp) + (2 * count);
 376         rp = kmalloc(rp_len, GFP_ATOMIC);
 377         if (!rp) {
 378                 read_unlock(&hci_dev_list_lock);
 379                 return -ENOMEM;
 380         }
 381
 382         count = 0;
 383         list_for_each_entry(d, &hci_dev_list, list) {
 384                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 385                     hci_dev_test_flag(d, HCI_CONFIG) ||
 386                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 387                         continue;
 388
 389                 /* Devices marked as raw-only are neither configured
 390                  * nor unconfigured controllers.
 391                  */
 392                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 393                         continue;
 394
 395                 if (d->dev_type == HCI_PRIMARY &&
 396                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 397                         rp->index[count++] = cpu_to_le16(d->id);
 398                         BT_DBG("Added hci%u", d->id);
 399                 }
 400         }
 401
 402         rp->num_controllers = cpu_to_le16(count);
 403         rp_len = sizeof(*rp) + (2 * count);
 404
 405         read_unlock(&hci_dev_list_lock);
 406
 407         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 408                                 0, rp, rp_len);
 409
 410         kfree(rp);
 411
 412         return err;
 413 }
 414
 415 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 416                                   void *data, u16 data_len)
 417 {
 418         struct mgmt_rp_read_unconf_index_list *rp;
 419         struct hci_dev *d;
 420         size_t rp_len;
 421         u16 count;
 422         int err;
 423
 424         BT_DBG("sock %p", sk);
 425
 426         read_lock(&hci_dev_list_lock);
 427
 428         count = 0;
 429         list_for_each_entry(d, &hci_dev_list, list) {
 430                 if (d->dev_type == HCI_PRIMARY &&
 431                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 432                         count++;
 433         }
 434
 435         rp_len = sizeof(*rp) + (2 * count);
 436         rp = kmalloc(rp_len, GFP_ATOMIC);
 437         if (!rp) {
 438                 read_unlock(&hci_dev_list_lock);
 439                 return -ENOMEM;
 440         }
 441
 442         count = 0;
 443         list_for_each_entry(d, &hci_dev_list, list) {
 444                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 445                     hci_dev_test_flag(d, HCI_CONFIG) ||
 446                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 447                         continue;
 448
 449                 /* Devices marked as raw-only are neither configured
 450                  * nor unconfigured controllers.
 451                  */
 452                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 453                         continue;
 454
 455                 if (d->dev_type == HCI_PRIMARY &&
 456                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 457                         rp->index[count++] = cpu_to_le16(d->id);
 458                         BT_DBG("Added hci%u", d->id);
 459                 }
 460         }
 461
 462         rp->num_controllers = cpu_to_le16(count);
 463         rp_len = sizeof(*rp) + (2 * count);
 464
 465         read_unlock(&hci_dev_list_lock);
 466
 467         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 468                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 469
 470         kfree(rp);
 471
 472         return err;
 473 }
 474
 475 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 476                                void *data, u16 data_len)
 477 {
 478         struct mgmt_rp_read_ext_index_list *rp;
 479         struct hci_dev *d;
 480         u16 count;
 481         int err;
 482
 483         BT_DBG("sock %p", sk);
 484
 485         read_lock(&hci_dev_list_lock);
 486
 487         count = 0;
 488         list_for_each_entry(d, &hci_dev_list, list) {
 489                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 490                         count++;
 491         }
 492
 493         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 494         if (!rp) {
 495                 read_unlock(&hci_dev_list_lock);
 496                 return -ENOMEM;
 497         }
 498
 499         count = 0;
 500         list_for_each_entry(d, &hci_dev_list, list) {
 501                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 502                     hci_dev_test_flag(d, HCI_CONFIG) ||
 503                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 504                         continue;
 505
 506                 /* Devices marked as raw-only are neither configured
 507                  * nor unconfigured controllers.
 508                  */
 509                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 510                         continue;
 511
 512                 if (d->dev_type == HCI_PRIMARY) {
 513                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 514                                 rp->entry[count].type = 0x01;
 515                         else
 516                                 rp->entry[count].type = 0x00;
 517                 } else if (d->dev_type == HCI_AMP) {
 518                         rp->entry[count].type = 0x02;
 519                 } else {
 520                         continue;
 521                 }
 522
 523                 rp->entry[count].bus = d->bus;
 524                 rp->entry[count++].index = cpu_to_le16(d->id);
 525                 BT_DBG("Added hci%u", d->id);
 526         }
 527
 528         rp->num_controllers = cpu_to_le16(count);
 529
 530         read_unlock(&hci_dev_list_lock);
 531
 532         /* If this command is called at least once, then all the
 533          * default index and unconfigured index events are disabled
 534          * and from now on only extended index events are used.
 535          */
 536         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 537         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 538         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 539
 540         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 541                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 542                                 struct_size(rp, entry, count));
 543
 544         kfree(rp);
 545
 546         return err;
 547 }
 548
 549 static bool is_configured(struct hci_dev *hdev)
 550 {
 551         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 552             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 553                 return false;
 554
 555         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 556              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 557             !bacmp(&hdev->public_addr, BDADDR_ANY))
 558                 return false;
 559
 560         return true;
 561 }
 562
 563 static __le32 get_missing_options(struct hci_dev *hdev)
 564 {
 565         u32 options = 0;
 566
 567         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 568             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 569                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 570
 571         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 572              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 573             !bacmp(&hdev->public_addr, BDADDR_ANY))
 574                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 575
 576         return cpu_to_le32(options);
 577 }
 578
 579 static int new_options(struct hci_dev *hdev, struct sock *skip)
 580 {
 581         __le32 options = get_missing_options(hdev);
 582
 583         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 584                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 585 }
 586
 587 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 588 {
 589         __le32 options = get_missing_options(hdev);
 590
 591         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 592                                  sizeof(options));
 593 }
 594
 595 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 596                             void *data, u16 data_len)
 597 {
 598         struct mgmt_rp_read_config_info rp;
 599         u32 options = 0;
 600
 601         BT_DBG("sock %p %s", sk, hdev->name);
 602
 603         hci_dev_lock(hdev);
 604
 605         memset(&rp, 0, sizeof(rp));
 606         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 607
 608         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 609                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 610
 611         if (hdev->set_bdaddr)
 612                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 613
 614         rp.supported_options = cpu_to_le32(options);
 615         rp.missing_options = get_missing_options(hdev);
 616
 617         hci_dev_unlock(hdev);
 618
 619         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 620                                  &rp, sizeof(rp));
 621 }
 622
 623 static u32 get_supported_phys(struct hci_dev *hdev)
 624 {
 625         u32 supported_phys = 0;
 626
 627         if (lmp_bredr_capable(hdev)) {
 628                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 629
 630                 if (hdev->features[0][0] & LMP_3SLOT)
 631                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 632
 633                 if (hdev->features[0][0] & LMP_5SLOT)
 634                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 635
 636                 if (lmp_edr_2m_capable(hdev)) {
 637                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 638
 639                         if (lmp_edr_3slot_capable(hdev))
 640                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 641
 642                         if (lmp_edr_5slot_capable(hdev))
 643                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 644
 645                         if (lmp_edr_3m_capable(hdev)) {
 646                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 647
 648                                 if (lmp_edr_3slot_capable(hdev))
 649                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 650
 651                                 if (lmp_edr_5slot_capable(hdev))
 652                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 653                         }
 654                 }
 655         }
 656
 657         if (lmp_le_capable(hdev)) {
 658                 supported_phys |= MGMT_PHY_LE_1M_TX;
 659                 supported_phys |= MGMT_PHY_LE_1M_RX;
 660
 661                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 662                         supported_phys |= MGMT_PHY_LE_2M_TX;
 663                         supported_phys |= MGMT_PHY_LE_2M_RX;
 664                 }
 665
 666                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 667                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 668                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 669                 }
 670         }
 671
 672         return supported_phys;
 673 }
 674
 675 static u32 get_selected_phys(struct hci_dev *hdev)
 676 {
 677         u32 selected_phys = 0;
 678
 679         if (lmp_bredr_capable(hdev)) {
 680                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 681
 682                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 683                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 684
 685                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 686                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 687
 688                 if (lmp_edr_2m_capable(hdev)) {
 689                         if (!(hdev->pkt_type & HCI_2DH1))
 690                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 691
 692                         if (lmp_edr_3slot_capable(hdev) &&
 693                             !(hdev->pkt_type & HCI_2DH3))
 694                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 695
 696                         if (lmp_edr_5slot_capable(hdev) &&
 697                             !(hdev->pkt_type & HCI_2DH5))
 698                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 699
 700                         if (lmp_edr_3m_capable(hdev)) {
 701                                 if (!(hdev->pkt_type & HCI_3DH1))
 702                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 703
 704                                 if (lmp_edr_3slot_capable(hdev) &&
 705                                     !(hdev->pkt_type & HCI_3DH3))
 706                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 707
 708                                 if (lmp_edr_5slot_capable(hdev) &&
 709                                     !(hdev->pkt_type & HCI_3DH5))
 710                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 711                         }
 712                 }
 713         }
 714
 715         if (lmp_le_capable(hdev)) {
 716                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 717                         selected_phys |= MGMT_PHY_LE_1M_TX;
 718
 719                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 720                         selected_phys |= MGMT_PHY_LE_1M_RX;
 721
 722                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 723                         selected_phys |= MGMT_PHY_LE_2M_TX;
 724
 725                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 726                         selected_phys |= MGMT_PHY_LE_2M_RX;
 727
 728                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 729                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 730
 731                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 732                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 733         }
 734
 735         return selected_phys;
 736 }
 737
 738 static u32 get_configurable_phys(struct hci_dev *hdev)
 739 {
 740         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 741                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 742 }
 743
 744 static u32 get_supported_settings(struct hci_dev *hdev)
 745 {
 746         u32 settings = 0;
 747
 748         settings |= MGMT_SETTING_POWERED;
 749         settings |= MGMT_SETTING_BONDABLE;
 750         settings |= MGMT_SETTING_DEBUG_KEYS;
 751         settings |= MGMT_SETTING_CONNECTABLE;
 752         settings |= MGMT_SETTING_DISCOVERABLE;
 753
 754         if (lmp_bredr_capable(hdev)) {
 755                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 756                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 757                 settings |= MGMT_SETTING_BREDR;
 758                 settings |= MGMT_SETTING_LINK_SECURITY;
 759
 760                 if (lmp_ssp_capable(hdev)) {
 761                         settings |= MGMT_SETTING_SSP;
 762                         settings |= MGMT_SETTING_HS;
 763                 }
 764
 765                 if (lmp_sc_capable(hdev))
 766                         settings |= MGMT_SETTING_SECURE_CONN;
 767         }
 768
 769         if (lmp_le_capable(hdev)) {
 770                 settings |= MGMT_SETTING_LE;
 771                 settings |= MGMT_SETTING_ADVERTISING;
 772                 settings |= MGMT_SETTING_SECURE_CONN;
 773                 settings |= MGMT_SETTING_PRIVACY;
 774                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 775         }
 776
 777         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 778             hdev->set_bdaddr)
 779                 settings |= MGMT_SETTING_CONFIGURATION;
 780
 781         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 782
 783         return settings;
 784 }
 785
 786 static u32 get_current_settings(struct hci_dev *hdev)
 787 {
 788         u32 settings = 0;
 789
 790         if (hdev_is_powered(hdev))
 791                 settings |= MGMT_SETTING_POWERED;
 792
 793         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 794                 settings |= MGMT_SETTING_CONNECTABLE;
 795
 796         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 797                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 798
 799         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 800                 settings |= MGMT_SETTING_DISCOVERABLE;
 801
 802         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 803                 settings |= MGMT_SETTING_BONDABLE;
 804
 805         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 806                 settings |= MGMT_SETTING_BREDR;
 807
 808         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 809                 settings |= MGMT_SETTING_LE;
 810
 811         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 812                 settings |= MGMT_SETTING_LINK_SECURITY;
 813
 814         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 815                 settings |= MGMT_SETTING_SSP;
 816
 817         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 818                 settings |= MGMT_SETTING_HS;
 819
 820         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 821                 settings |= MGMT_SETTING_ADVERTISING;
 822
 823         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 824                 settings |= MGMT_SETTING_SECURE_CONN;
 825
 826         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 827                 settings |= MGMT_SETTING_DEBUG_KEYS;
 828
 829         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 830                 settings |= MGMT_SETTING_PRIVACY;
 831
 832         /* The current setting for static address has two purposes. The
 833          * first is to indicate if the static address will be used and
 834          * the second is to indicate if it is actually set.
 835          *
 836          * This means if the static address is not configured, this flag
 837          * will never be set. If the address is configured, then if the
 838          * address is actually used decides if the flag is set or not.
 839          *
 840          * For single mode LE only controllers and dual-mode controllers
 841          * with BR/EDR disabled, the existence of the static address will
 842          * be evaluated.
 843          */
 844         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 845             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 846             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 847                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 848                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 849         }
 850
 851         return settings;
 852 }
 853
 854 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 855 {
 856         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 857 }
 858
 859 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 860                                                   struct hci_dev *hdev,
 861                                                   const void *data)
 862 {
 863         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 864 }
 865
 866 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 867 {
 868         struct mgmt_pending_cmd *cmd;
 869
 870         /* If there's a pending mgmt command the flags will not yet have
 871          * their final values, so check for this first.
 872          */
 873         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 874         if (cmd) {
 875                 struct mgmt_mode *cp = cmd->param;
 876                 if (cp->val == 0x01)
 877                         return LE_AD_GENERAL;
 878                 else if (cp->val == 0x02)
 879                         return LE_AD_LIMITED;
 880         } else {
 881                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 882                         return LE_AD_LIMITED;
 883                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 884                         return LE_AD_GENERAL;
 885         }
 886
 887         return 0;
 888 }
 889
 890 bool mgmt_get_connectable(struct hci_dev *hdev)
 891 {
 892         struct mgmt_pending_cmd *cmd;
 893
 894         /* If there's a pending mgmt command the flag will not yet have
 895          * it's final value, so check for this first.
 896          */
 897         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 898         if (cmd) {
 899                 struct mgmt_mode *cp = cmd->param;
 900
 901                 return cp->val;
 902         }
 903
 904         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 905 }
 906
 907 static void service_cache_off(struct work_struct *work)
 908 {
 909         struct hci_dev *hdev = container_of(work, struct hci_dev,
 910                                             service_cache.work);
 911         struct hci_request req;
 912
 913         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 914                 return;
 915
 916         hci_req_init(&req, hdev);
 917
 918         hci_dev_lock(hdev);
 919
 920         __hci_req_update_eir(&req);
 921         __hci_req_update_class(&req);
 922
 923         hci_dev_unlock(hdev);
 924
 925         hci_req_run(&req, NULL);
 926 }
 927
 928 static void rpa_expired(struct work_struct *work)
 929 {
 930         struct hci_dev *hdev = container_of(work, struct hci_dev,
 931                                             rpa_expired.work);
 932         struct hci_request req;
 933
 934         BT_DBG("");
 935
 936         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 937
 938         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 939                 return;
 940
 941         /* The generation of a new RPA and programming it into the
 942          * controller happens in the hci_req_enable_advertising()
 943          * function.
 944          */
 945         hci_req_init(&req, hdev);
 946         if (ext_adv_capable(hdev))
 947                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 948         else
 949                 __hci_req_enable_advertising(&req);
 950         hci_req_run(&req, NULL);
 951 }
 952
 953 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 954 {
 955         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
 956                 return;
 957
 958         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 959         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
 960
 961         /* Non-mgmt controlled devices get this bit set
 962          * implicitly so that pairing works for them, however
 963          * for mgmt we require user-space to explicitly enable
 964          * it
 965          */
 966         hci_dev_clear_flag(hdev, HCI_BONDABLE);
 967 }
 968
 969 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 970                                 void *data, u16 data_len)
 971 {
 972         struct mgmt_rp_read_info rp;
 973
 974         BT_DBG("sock %p %s", sk, hdev->name);
 975
 976         hci_dev_lock(hdev);
 977
 978         memset(&rp, 0, sizeof(rp));
 979
 980         bacpy(&rp.bdaddr, &hdev->bdaddr);
 981
 982         rp.version = hdev->hci_ver;
 983         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 984
 985         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 986         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 987
 988         memcpy(rp.dev_class, hdev->dev_class, 3);
 989
 990         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 991         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 992
 993         hci_dev_unlock(hdev);
 994
 995         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 996                                  sizeof(rp));
 997 }
 998
 999 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1000 {
1001         u16 eir_len = 0;
1002         size_t name_len;
1003
1004         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1005                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1006                                           hdev->dev_class, 3);
1007
1008         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1009                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1010                                           hdev->appearance);
1011
1012         name_len = strlen(hdev->dev_name);
1013         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1014                                   hdev->dev_name, name_len);
1015
1016         name_len = strlen(hdev->short_name);
1017         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1018                                   hdev->short_name, name_len);
1019
1020         return eir_len;
1021 }
1022
1023 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1024                                     void *data, u16 data_len)
1025 {
1026         char buf[512];
1027         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1028         u16 eir_len;
1029
1030         BT_DBG("sock %p %s", sk, hdev->name);
1031
1032         memset(&buf, 0, sizeof(buf));
1033
1034         hci_dev_lock(hdev);
1035
1036         bacpy(&rp->bdaddr, &hdev->bdaddr);
1037
1038         rp->version = hdev->hci_ver;
1039         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1040
1041         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1042         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1043
1044
1045         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1046         rp->eir_len = cpu_to_le16(eir_len);
1047
1048         hci_dev_unlock(hdev);
1049
1050         /* If this command is called at least once, then the events
1051          * for class of device and local name changes are disabled
1052          * and only the new extended controller information event
1053          * is used.
1054          */
1055         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1056         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1057         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1058
1059         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1060                                  sizeof(*rp) + eir_len);
1061 }
1062
1063 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1064 {
1065         char buf[512];
1066         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1067         u16 eir_len;
1068
1069         memset(buf, 0, sizeof(buf));
1070
1071         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1072         ev->eir_len = cpu_to_le16(eir_len);
1073
1074         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1075                                   sizeof(*ev) + eir_len,
1076                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1077 }
1078
1079 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1080 {
1081         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1082
1083         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1084                                  sizeof(settings));
1085 }
1086
1087 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1088 {
1089         BT_DBG("%s status 0x%02x", hdev->name, status);
1090
1091         if (hci_conn_count(hdev) == 0) {
1092                 cancel_delayed_work(&hdev->power_off);
1093                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1094         }
1095 }
1096
1097 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1098 {
1099         struct mgmt_ev_advertising_added ev;
1100
1101         ev.instance = instance;
1102
1103         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1104 }
1105
1106 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1107                               u8 instance)
1108 {
1109         struct mgmt_ev_advertising_removed ev;
1110
1111         ev.instance = instance;
1112
1113         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1114 }
1115
1116 static void cancel_adv_timeout(struct hci_dev *hdev)
1117 {
1118         if (hdev->adv_instance_timeout) {
1119                 hdev->adv_instance_timeout = 0;
1120                 cancel_delayed_work(&hdev->adv_instance_expire);
1121         }
1122 }
1123
1124 static int clean_up_hci_state(struct hci_dev *hdev)
1125 {
1126         struct hci_request req;
1127         struct hci_conn *conn;
1128         bool discov_stopped;
1129         int err;
1130
1131         hci_req_init(&req, hdev);
1132
1133         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1134             test_bit(HCI_PSCAN, &hdev->flags)) {
1135                 u8 scan = 0x00;
1136                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1137         }
1138
1139         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1140
1141         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1142                 __hci_req_disable_advertising(&req);
1143
1144         discov_stopped = hci_req_stop_discovery(&req);
1145
1146         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1147                 /* 0x15 == Terminated due to Power Off */
1148                 __hci_abort_conn(&req, conn, 0x15);
1149         }
1150
1151         err = hci_req_run(&req, clean_up_hci_complete);
1152         if (!err && discov_stopped)
1153                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1154
1155         return err;
1156 }
1157
1158 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1159                        u16 len)
1160 {
1161         struct mgmt_mode *cp = data;
1162         struct mgmt_pending_cmd *cmd;
1163         int err;
1164
1165         BT_DBG("request for %s", hdev->name);
1166
1167         if (cp->val != 0x00 && cp->val != 0x01)
1168                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1169                                        MGMT_STATUS_INVALID_PARAMS);
1170
1171         hci_dev_lock(hdev);
1172
1173         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1174                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1175                                       MGMT_STATUS_BUSY);
1176                 goto failed;
1177         }
1178
1179         if (!!cp->val == hdev_is_powered(hdev)) {
1180                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1181                 goto failed;
1182         }
1183
1184         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1185         if (!cmd) {
1186                 err = -ENOMEM;
1187                 goto failed;
1188         }
1189
1190         if (cp->val) {
1191                 queue_work(hdev->req_workqueue, &hdev->power_on);
1192                 err = 0;
1193         } else {
1194                 /* Disconnect connections, stop scans, etc */
1195                 err = clean_up_hci_state(hdev);
1196                 if (!err)
1197                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1198                                            HCI_POWER_OFF_TIMEOUT);
1199
1200                 /* ENODATA means there were no HCI commands queued */
1201                 if (err == -ENODATA) {
1202                         cancel_delayed_work(&hdev->power_off);
1203                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1204                         err = 0;
1205                 }
1206         }
1207
1208 failed:
1209         hci_dev_unlock(hdev);
1210         return err;
1211 }
1212
1213 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1214 {
1215         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1216
1217         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1218                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1219 }
1220
1221 int mgmt_new_settings(struct hci_dev *hdev)
1222 {
1223         return new_settings(hdev, NULL);
1224 }
1225
1226 struct cmd_lookup {
1227         struct sock *sk;
1228         struct hci_dev *hdev;
1229         u8 mgmt_status;
1230 };
1231
1232 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1233 {
1234         struct cmd_lookup *match = data;
1235
1236         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1237
1238         list_del(&cmd->list);
1239
1240         if (match->sk == NULL) {
1241                 match->sk = cmd->sk;
1242                 sock_hold(match->sk);
1243         }
1244
1245         mgmt_pending_free(cmd);
1246 }
1247
1248 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1249 {
1250         u8 *status = data;
1251
1252         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1253         mgmt_pending_remove(cmd);
1254 }
1255
1256 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1257 {
1258         if (cmd->cmd_complete) {
1259                 u8 *status = data;
1260
1261                 cmd->cmd_complete(cmd, *status);
1262                 mgmt_pending_remove(cmd);
1263
1264                 return;
1265         }
1266
1267         cmd_status_rsp(cmd, data);
1268 }
1269
1270 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1271 {
1272         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1273                                  cmd->param, cmd->param_len);
1274 }
1275
1276 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1277 {
1278         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1279                                  cmd->param, sizeof(struct mgmt_addr_info));
1280 }
1281
1282 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1283 {
1284         if (!lmp_bredr_capable(hdev))
1285                 return MGMT_STATUS_NOT_SUPPORTED;
1286         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1287                 return MGMT_STATUS_REJECTED;
1288         else
1289                 return MGMT_STATUS_SUCCESS;
1290 }
1291
1292 static u8 mgmt_le_support(struct hci_dev *hdev)
1293 {
1294         if (!lmp_le_capable(hdev))
1295                 return MGMT_STATUS_NOT_SUPPORTED;
1296         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1297                 return MGMT_STATUS_REJECTED;
1298         else
1299                 return MGMT_STATUS_SUCCESS;
1300 }
1301
1302 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1303 {
1304         struct mgmt_pending_cmd *cmd;
1305
1306         BT_DBG("status 0x%02x", status);
1307
1308         hci_dev_lock(hdev);
1309
1310         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1311         if (!cmd)
1312                 goto unlock;
1313
1314         if (status) {
1315                 u8 mgmt_err = mgmt_status(status);
1316                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1317                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1318                 goto remove_cmd;
1319         }
1320
1321         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1322             hdev->discov_timeout > 0) {
1323                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1324                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1325         }
1326
1327         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1328         new_settings(hdev, cmd->sk);
1329
1330 remove_cmd:
1331         mgmt_pending_remove(cmd);
1332
1333 unlock:
1334         hci_dev_unlock(hdev);
1335 }
1336
1337 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1338                             u16 len)
1339 {
1340         struct mgmt_cp_set_discoverable *cp = data;
1341         struct mgmt_pending_cmd *cmd;
1342         u16 timeout;
1343         int err;
1344
1345         BT_DBG("request for %s", hdev->name);
1346
1347         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1348             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1349                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1350                                        MGMT_STATUS_REJECTED);
1351
1352         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1353                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1354                                        MGMT_STATUS_INVALID_PARAMS);
1355
1356         timeout = __le16_to_cpu(cp->timeout);
1357
1358         /* Disabling discoverable requires that no timeout is set,
1359          * and enabling limited discoverable requires a timeout.
1360          */
1361         if ((cp->val == 0x00 && timeout > 0) ||
1362             (cp->val == 0x02 && timeout == 0))
1363                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1364                                        MGMT_STATUS_INVALID_PARAMS);
1365
1366         hci_dev_lock(hdev);
1367
1368         if (!hdev_is_powered(hdev) && timeout > 0) {
1369                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1370                                       MGMT_STATUS_NOT_POWERED);
1371                 goto failed;
1372         }
1373
1374         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1375             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1376                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1377                                       MGMT_STATUS_BUSY);
1378                 goto failed;
1379         }
1380
1381         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1382                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1383                                       MGMT_STATUS_REJECTED);
1384                 goto failed;
1385         }
1386
1387         if (!hdev_is_powered(hdev)) {
1388                 bool changed = false;
1389
1390                 /* Setting limited discoverable when powered off is
1391                  * not a valid operation since it requires a timeout
1392                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1393                  */
1394                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1395                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1396                         changed = true;
1397                 }
1398
1399                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1400                 if (err < 0)
1401                         goto failed;
1402
1403                 if (changed)
1404                         err = new_settings(hdev, sk);
1405
1406                 goto failed;
1407         }
1408
1409         /* If the current mode is the same, then just update the timeout
1410          * value with the new value. And if only the timeout gets updated,
1411          * then no need for any HCI transactions.
1412          */
1413         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1414             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1415                                                    HCI_LIMITED_DISCOVERABLE)) {
1416                 cancel_delayed_work(&hdev->discov_off);
1417                 hdev->discov_timeout = timeout;
1418
1419                 if (cp->val && hdev->discov_timeout > 0) {
1420                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1421                         queue_delayed_work(hdev->req_workqueue,
1422                                            &hdev->discov_off, to);
1423                 }
1424
1425                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1426                 goto failed;
1427         }
1428
1429         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1430         if (!cmd) {
1431                 err = -ENOMEM;
1432                 goto failed;
1433         }
1434
1435         /* Cancel any potential discoverable timeout that might be
1436          * still active and store new timeout value. The arming of
1437          * the timeout happens in the complete handler.
1438          */
1439         cancel_delayed_work(&hdev->discov_off);
1440         hdev->discov_timeout = timeout;
1441
1442         if (cp->val)
1443                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1444         else
1445                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1446
1447         /* Limited discoverable mode */
1448         if (cp->val == 0x02)
1449                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1450         else
1451                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1452
1453         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1454         err = 0;
1455
1456 failed:
1457         hci_dev_unlock(hdev);
1458         return err;
1459 }
1460
1461 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1462 {
1463         struct mgmt_pending_cmd *cmd;
1464
1465         BT_DBG("status 0x%02x", status);
1466
1467         hci_dev_lock(hdev);
1468
1469         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1470         if (!cmd)
1471                 goto unlock;
1472
1473         if (status) {
1474                 u8 mgmt_err = mgmt_status(status);
1475                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1476                 goto remove_cmd;
1477         }
1478
1479         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1480         new_settings(hdev, cmd->sk);
1481
1482 remove_cmd:
1483         mgmt_pending_remove(cmd);
1484
1485 unlock:
1486         hci_dev_unlock(hdev);
1487 }
1488
1489 static int set_connectable_update_settings(struct hci_dev *hdev,
1490                                            struct sock *sk, u8 val)
1491 {
1492         bool changed = false;
1493         int err;
1494
1495         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1496                 changed = true;
1497
1498         if (val) {
1499                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1500         } else {
1501                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1502                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1503         }
1504
1505         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1506         if (err < 0)
1507                 return err;
1508
1509         if (changed) {
1510                 hci_req_update_scan(hdev);
1511                 hci_update_background_scan(hdev);
1512                 return new_settings(hdev, sk);
1513         }
1514
1515         return 0;
1516 }
1517
1518 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1519                            u16 len)
1520 {
1521         struct mgmt_mode *cp = data;
1522         struct mgmt_pending_cmd *cmd;
1523         int err;
1524
1525         BT_DBG("request for %s", hdev->name);
1526
1527         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1528             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1529                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1530                                        MGMT_STATUS_REJECTED);
1531
1532         if (cp->val != 0x00 && cp->val != 0x01)
1533                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1534                                        MGMT_STATUS_INVALID_PARAMS);
1535
1536         hci_dev_lock(hdev);
1537
1538         if (!hdev_is_powered(hdev)) {
1539                 err = set_connectable_update_settings(hdev, sk, cp->val);
1540                 goto failed;
1541         }
1542
1543         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1544             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1545                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1546                                       MGMT_STATUS_BUSY);
1547                 goto failed;
1548         }
1549
1550         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1551         if (!cmd) {
1552                 err = -ENOMEM;
1553                 goto failed;
1554         }
1555
1556         if (cp->val) {
1557                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1558         } else {
1559                 if (hdev->discov_timeout > 0)
1560                         cancel_delayed_work(&hdev->discov_off);
1561
1562                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1563                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1564                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1565         }
1566
1567         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1568         err = 0;
1569
1570 failed:
1571         hci_dev_unlock(hdev);
1572         return err;
1573 }
1574
1575 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1576                         u16 len)
1577 {
1578         struct mgmt_mode *cp = data;
1579         bool changed;
1580         int err;
1581
1582         BT_DBG("request for %s", hdev->name);
1583
1584         if (cp->val != 0x00 && cp->val != 0x01)
1585                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1586                                        MGMT_STATUS_INVALID_PARAMS);
1587
1588         hci_dev_lock(hdev);
1589
1590         if (cp->val)
1591                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1592         else
1593                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1594
1595         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1596         if (err < 0)
1597                 goto unlock;
1598
1599         if (changed) {
1600                 /* In limited privacy mode the change of bondable mode
1601                  * may affect the local advertising address.
1602                  */
1603                 if (hdev_is_powered(hdev) &&
1604                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1605                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1606                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1607                         queue_work(hdev->req_workqueue,
1608                                    &hdev->discoverable_update);
1609
1610                 err = new_settings(hdev, sk);
1611         }
1612
1613 unlock:
1614         hci_dev_unlock(hdev);
1615         return err;
1616 }
1617
1618 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1619                              u16 len)
1620 {
1621         struct mgmt_mode *cp = data;
1622         struct mgmt_pending_cmd *cmd;
1623         u8 val, status;
1624         int err;
1625
1626         BT_DBG("request for %s", hdev->name);
1627
1628         status = mgmt_bredr_support(hdev);
1629         if (status)
1630                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1631                                        status);
1632
1633         if (cp->val != 0x00 && cp->val != 0x01)
1634                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1635                                        MGMT_STATUS_INVALID_PARAMS);
1636
1637         hci_dev_lock(hdev);
1638
1639         if (!hdev_is_powered(hdev)) {
1640                 bool changed = false;
1641
1642                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1643                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1644                         changed = true;
1645                 }
1646
1647                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1648                 if (err < 0)
1649                         goto failed;
1650
1651                 if (changed)
1652                         err = new_settings(hdev, sk);
1653
1654                 goto failed;
1655         }
1656
1657         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1658                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1659                                       MGMT_STATUS_BUSY);
1660                 goto failed;
1661         }
1662
1663         val = !!cp->val;
1664
1665         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1666                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1667                 goto failed;
1668         }
1669
1670         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1671         if (!cmd) {
1672                 err = -ENOMEM;
1673                 goto failed;
1674         }
1675
1676         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1677         if (err < 0) {
1678                 mgmt_pending_remove(cmd);
1679                 goto failed;
1680         }
1681
1682 failed:
1683         hci_dev_unlock(hdev);
1684         return err;
1685 }
1686
1687 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1688 {
1689         struct mgmt_mode *cp = data;
1690         struct mgmt_pending_cmd *cmd;
1691         u8 status;
1692         int err;
1693
1694         BT_DBG("request for %s", hdev->name);
1695
1696         status = mgmt_bredr_support(hdev);
1697         if (status)
1698                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1699
1700         if (!lmp_ssp_capable(hdev))
1701                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1702                                        MGMT_STATUS_NOT_SUPPORTED);
1703
1704         if (cp->val != 0x00 && cp->val != 0x01)
1705                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1706                                        MGMT_STATUS_INVALID_PARAMS);
1707
1708         hci_dev_lock(hdev);
1709
1710         if (!hdev_is_powered(hdev)) {
1711                 bool changed;
1712
1713                 if (cp->val) {
1714                         changed = !hci_dev_test_and_set_flag(hdev,
1715                                                              HCI_SSP_ENABLED);
1716                 } else {
1717                         changed = hci_dev_test_and_clear_flag(hdev,
1718                                                               HCI_SSP_ENABLED);
1719                         if (!changed)
1720                                 changed = hci_dev_test_and_clear_flag(hdev,
1721                                                                       HCI_HS_ENABLED);
1722                         else
1723                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1724                 }
1725
1726                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1727                 if (err < 0)
1728                         goto failed;
1729
1730                 if (changed)
1731                         err = new_settings(hdev, sk);
1732
1733                 goto failed;
1734         }
1735
1736         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1737                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1738                                       MGMT_STATUS_BUSY);
1739                 goto failed;
1740         }
1741
1742         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1743                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1744                 goto failed;
1745         }
1746
1747         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1748         if (!cmd) {
1749                 err = -ENOMEM;
1750                 goto failed;
1751         }
1752
1753         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1754                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1755                              sizeof(cp->val), &cp->val);
1756
1757         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1758         if (err < 0) {
1759                 mgmt_pending_remove(cmd);
1760                 goto failed;
1761         }
1762
1763 failed:
1764         hci_dev_unlock(hdev);
1765         return err;
1766 }
1767
1768 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1769 {
1770         struct mgmt_mode *cp = data;
1771         bool changed;
1772         u8 status;
1773         int err;
1774
1775         BT_DBG("request for %s", hdev->name);
1776
1777         status = mgmt_bredr_support(hdev);
1778         if (status)
1779                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1780
1781         if (!lmp_ssp_capable(hdev))
1782                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1783                                        MGMT_STATUS_NOT_SUPPORTED);
1784
1785         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1786                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1787                                        MGMT_STATUS_REJECTED);
1788
1789         if (cp->val != 0x00 && cp->val != 0x01)
1790                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1791                                        MGMT_STATUS_INVALID_PARAMS);
1792
1793         hci_dev_lock(hdev);
1794
1795         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1796                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1797                                       MGMT_STATUS_BUSY);
1798                 goto unlock;
1799         }
1800
1801         if (cp->val) {
1802                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1803         } else {
1804                 if (hdev_is_powered(hdev)) {
1805                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1806                                               MGMT_STATUS_REJECTED);
1807                         goto unlock;
1808                 }
1809
1810                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1811         }
1812
1813         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1814         if (err < 0)
1815                 goto unlock;
1816
1817         if (changed)
1818                 err = new_settings(hdev, sk);
1819
1820 unlock:
1821         hci_dev_unlock(hdev);
1822         return err;
1823 }
1824
1825 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1826 {
1827         struct cmd_lookup match = { NULL, hdev };
1828
1829         hci_dev_lock(hdev);
1830
1831         if (status) {
1832                 u8 mgmt_err = mgmt_status(status);
1833
1834                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1835                                      &mgmt_err);
1836                 goto unlock;
1837         }
1838
1839         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1840
1841         new_settings(hdev, match.sk);
1842
1843         if (match.sk)
1844                 sock_put(match.sk);
1845
1846         /* Make sure the controller has a good default for
1847          * advertising data. Restrict the update to when LE
1848          * has actually been enabled. During power on, the
1849          * update in powered_update_hci will take care of it.
1850          */
1851         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1852                 struct hci_request req;
1853                 hci_req_init(&req, hdev);
1854                 if (ext_adv_capable(hdev)) {
1855                         int err;
1856
1857                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1858                         if (!err)
1859                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1860                 } else {
1861                         __hci_req_update_adv_data(&req, 0x00);
1862                         __hci_req_update_scan_rsp_data(&req, 0x00);
1863                 }
1864                 hci_req_run(&req, NULL);
1865                 hci_update_background_scan(hdev);
1866         }
1867
1868 unlock:
1869         hci_dev_unlock(hdev);
1870 }
1871
1872 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1873 {
1874         struct mgmt_mode *cp = data;
1875         struct hci_cp_write_le_host_supported hci_cp;
1876         struct mgmt_pending_cmd *cmd;
1877         struct hci_request req;
1878         int err;
1879         u8 val, enabled;
1880
1881         BT_DBG("request for %s", hdev->name);
1882
1883         if (!lmp_le_capable(hdev))
1884                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1885                                        MGMT_STATUS_NOT_SUPPORTED);
1886
1887         if (cp->val != 0x00 && cp->val != 0x01)
1888                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1889                                        MGMT_STATUS_INVALID_PARAMS);
1890
1891         /* Bluetooth single mode LE only controllers or dual-mode
1892          * controllers configured as LE only devices, do not allow
1893          * switching LE off. These have either LE enabled explicitly
1894          * or BR/EDR has been previously switched off.
1895          *
1896          * When trying to enable an already enabled LE, then gracefully
1897          * send a positive response. Trying to disable it however will
1898          * result into rejection.
1899          */
1900         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1901                 if (cp->val == 0x01)
1902                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1903
1904                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1905                                        MGMT_STATUS_REJECTED);
1906         }
1907
1908         hci_dev_lock(hdev);
1909
1910         val = !!cp->val;
1911         enabled = lmp_host_le_capable(hdev);
1912
1913         if (!val)
1914                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1915
1916         if (!hdev_is_powered(hdev) || val == enabled) {
1917                 bool changed = false;
1918
1919                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1920                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1921                         changed = true;
1922                 }
1923
1924                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1925                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1926                         changed = true;
1927                 }
1928
1929                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1930                 if (err < 0)
1931                         goto unlock;
1932
1933                 if (changed)
1934                         err = new_settings(hdev, sk);
1935
1936                 goto unlock;
1937         }
1938
1939         if (pending_find(MGMT_OP_SET_LE, hdev) ||
1940             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1941                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1942                                       MGMT_STATUS_BUSY);
1943                 goto unlock;
1944         }
1945
1946         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1947         if (!cmd) {
1948                 err = -ENOMEM;
1949                 goto unlock;
1950         }
1951
1952         hci_req_init(&req, hdev);
1953
1954         memset(&hci_cp, 0, sizeof(hci_cp));
1955
1956         if (val) {
1957                 hci_cp.le = val;
1958                 hci_cp.simul = 0x00;
1959         } else {
1960                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1961                         __hci_req_disable_advertising(&req);
1962
1963                 if (ext_adv_capable(hdev))
1964                         __hci_req_clear_ext_adv_sets(&req);
1965         }
1966
1967         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1968                     &hci_cp);
1969
1970         err = hci_req_run(&req, le_enable_complete);
1971         if (err < 0)
1972                 mgmt_pending_remove(cmd);
1973
1974 unlock:
1975         hci_dev_unlock(hdev);
1976         return err;
1977 }
1978
1979 /* This is a helper function to test for pending mgmt commands that can
1980  * cause CoD or EIR HCI commands. We can only allow one such pending
1981  * mgmt command at a time since otherwise we cannot easily track what
1982  * the current values are, will be, and based on that calculate if a new
1983  * HCI command needs to be sent and if yes with what value.
1984  */
1985 static bool pending_eir_or_class(struct hci_dev *hdev)
1986 {
1987         struct mgmt_pending_cmd *cmd;
1988
1989         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1990                 switch (cmd->opcode) {
1991                 case MGMT_OP_ADD_UUID:
1992                 case MGMT_OP_REMOVE_UUID:
1993                 case MGMT_OP_SET_DEV_CLASS:
1994                 case MGMT_OP_SET_POWERED:
1995                         return true;
1996                 }
1997         }
1998
1999         return false;
2000 }
2001
2002 static const u8 bluetooth_base_uuid[] = {
2003                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2004                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2005 };
2006
2007 static u8 get_uuid_size(const u8 *uuid)
2008 {
2009         u32 val;
2010
2011         if (memcmp(uuid, bluetooth_base_uuid, 12))
2012                 return 128;
2013
2014         val = get_unaligned_le32(&uuid[12]);
2015         if (val > 0xffff)
2016                 return 32;
2017
2018         return 16;
2019 }
2020
2021 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2022 {
2023         struct mgmt_pending_cmd *cmd;
2024
2025         hci_dev_lock(hdev);
2026
2027         cmd = pending_find(mgmt_op, hdev);
2028         if (!cmd)
2029                 goto unlock;
2030
2031         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2032                           mgmt_status(status), hdev->dev_class, 3);
2033
2034         mgmt_pending_remove(cmd);
2035
2036 unlock:
2037         hci_dev_unlock(hdev);
2038 }
2039
2040 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2041 {
2042         BT_DBG("status 0x%02x", status);
2043
2044         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2045 }
2046
2047 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2048 {
2049         struct mgmt_cp_add_uuid *cp = data;
2050         struct mgmt_pending_cmd *cmd;
2051         struct hci_request req;
2052         struct bt_uuid *uuid;
2053         int err;
2054
2055         BT_DBG("request for %s", hdev->name);
2056
2057         hci_dev_lock(hdev);
2058
2059         if (pending_eir_or_class(hdev)) {
2060                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2061                                       MGMT_STATUS_BUSY);
2062                 goto failed;
2063         }
2064
2065         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2066         if (!uuid) {
2067                 err = -ENOMEM;
2068                 goto failed;
2069         }
2070
2071         memcpy(uuid->uuid, cp->uuid, 16);
2072         uuid->svc_hint = cp->svc_hint;
2073         uuid->size = get_uuid_size(cp->uuid);
2074
2075         list_add_tail(&uuid->list, &hdev->uuids);
2076
2077         hci_req_init(&req, hdev);
2078
2079         __hci_req_update_class(&req);
2080         __hci_req_update_eir(&req);
2081
2082         err = hci_req_run(&req, add_uuid_complete);
2083         if (err < 0) {
2084                 if (err != -ENODATA)
2085                         goto failed;
2086
2087                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2088                                         hdev->dev_class, 3);
2089                 goto failed;
2090         }
2091
2092         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2093         if (!cmd) {
2094                 err = -ENOMEM;
2095                 goto failed;
2096         }
2097
2098         err = 0;
2099
2100 failed:
2101         hci_dev_unlock(hdev);
2102         return err;
2103 }
2104
2105 static bool enable_service_cache(struct hci_dev *hdev)
2106 {
2107         if (!hdev_is_powered(hdev))
2108                 return false;
2109
2110         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2111                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2112                                    CACHE_TIMEOUT);
2113                 return true;
2114         }
2115
2116         return false;
2117 }
2118
2119 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2120 {
2121         BT_DBG("status 0x%02x", status);
2122
2123         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2124 }
2125
2126 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2127                        u16 len)
2128 {
2129         struct mgmt_cp_remove_uuid *cp = data;
2130         struct mgmt_pending_cmd *cmd;
2131         struct bt_uuid *match, *tmp;
2132         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2133         struct hci_request req;
2134         int err, found;
2135
2136         BT_DBG("request for %s", hdev->name);
2137
2138         hci_dev_lock(hdev);
2139
2140         if (pending_eir_or_class(hdev)) {
2141                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2142                                       MGMT_STATUS_BUSY);
2143                 goto unlock;
2144         }
2145
2146         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2147                 hci_uuids_clear(hdev);
2148
2149                 if (enable_service_cache(hdev)) {
2150                         err = mgmt_cmd_complete(sk, hdev->id,
2151                                                 MGMT_OP_REMOVE_UUID,
2152                                                 0, hdev->dev_class, 3);
2153                         goto unlock;
2154                 }
2155
2156                 goto update_class;
2157         }
2158
2159         found = 0;
2160
2161         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2162                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2163                         continue;
2164
2165                 list_del(&match->list);
2166                 kfree(match);
2167                 found++;
2168         }
2169
2170         if (found == 0) {
2171                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2172                                       MGMT_STATUS_INVALID_PARAMS);
2173                 goto unlock;
2174         }
2175
2176 update_class:
2177         hci_req_init(&req, hdev);
2178
2179         __hci_req_update_class(&req);
2180         __hci_req_update_eir(&req);
2181
2182         err = hci_req_run(&req, remove_uuid_complete);
2183         if (err < 0) {
2184                 if (err != -ENODATA)
2185                         goto unlock;
2186
2187                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2188                                         hdev->dev_class, 3);
2189                 goto unlock;
2190         }
2191
2192         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2193         if (!cmd) {
2194                 err = -ENOMEM;
2195                 goto unlock;
2196         }
2197
2198         err = 0;
2199
2200 unlock:
2201         hci_dev_unlock(hdev);
2202         return err;
2203 }
2204
2205 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2206 {
2207         BT_DBG("status 0x%02x", status);
2208
2209         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2210 }
2211
2212 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2213                          u16 len)
2214 {
2215         struct mgmt_cp_set_dev_class *cp = data;
2216         struct mgmt_pending_cmd *cmd;
2217         struct hci_request req;
2218         int err;
2219
2220         BT_DBG("request for %s", hdev->name);
2221
2222         if (!lmp_bredr_capable(hdev))
2223                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2224                                        MGMT_STATUS_NOT_SUPPORTED);
2225
2226         hci_dev_lock(hdev);
2227
2228         if (pending_eir_or_class(hdev)) {
2229                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2230                                       MGMT_STATUS_BUSY);
2231                 goto unlock;
2232         }
2233
2234         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2235                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2236                                       MGMT_STATUS_INVALID_PARAMS);
2237                 goto unlock;
2238         }
2239
2240         hdev->major_class = cp->major;
2241         hdev->minor_class = cp->minor;
2242
2243         if (!hdev_is_powered(hdev)) {
2244                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2245                                         hdev->dev_class, 3);
2246                 goto unlock;
2247         }
2248
2249         hci_req_init(&req, hdev);
2250
2251         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2252                 hci_dev_unlock(hdev);
2253                 cancel_delayed_work_sync(&hdev->service_cache);
2254                 hci_dev_lock(hdev);
2255                 __hci_req_update_eir(&req);
2256         }
2257
2258         __hci_req_update_class(&req);
2259
2260         err = hci_req_run(&req, set_class_complete);
2261         if (err < 0) {
2262                 if (err != -ENODATA)
2263                         goto unlock;
2264
2265                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2266                                         hdev->dev_class, 3);
2267                 goto unlock;
2268         }
2269
2270         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2271         if (!cmd) {
2272                 err = -ENOMEM;
2273                 goto unlock;
2274         }
2275
2276         err = 0;
2277
2278 unlock:
2279         hci_dev_unlock(hdev);
2280         return err;
2281 }
2282
2283 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2284                           u16 len)
2285 {
2286         struct mgmt_cp_load_link_keys *cp = data;
2287         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2288                                    sizeof(struct mgmt_link_key_info));
2289         u16 key_count, expected_len;
2290         bool changed;
2291         int i;
2292
2293         BT_DBG("request for %s", hdev->name);
2294
2295         if (!lmp_bredr_capable(hdev))
2296                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2297                                        MGMT_STATUS_NOT_SUPPORTED);
2298
2299         key_count = __le16_to_cpu(cp->key_count);
2300         if (key_count > max_key_count) {
2301                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2302                            key_count);
2303                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2304                                        MGMT_STATUS_INVALID_PARAMS);
2305         }
2306
2307         expected_len = struct_size(cp, keys, key_count);
2308         if (expected_len != len) {
2309                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2310                            expected_len, len);
2311                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2312                                        MGMT_STATUS_INVALID_PARAMS);
2313         }
2314
2315         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2316                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2317                                        MGMT_STATUS_INVALID_PARAMS);
2318
2319         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2320                key_count);
2321
2322         for (i = 0; i < key_count; i++) {
2323                 struct mgmt_link_key_info *key = &cp->keys[i];
2324
2325                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2326                         return mgmt_cmd_status(sk, hdev->id,
2327                                                MGMT_OP_LOAD_LINK_KEYS,
2328                                                MGMT_STATUS_INVALID_PARAMS);
2329         }
2330
2331         hci_dev_lock(hdev);
2332
2333         hci_link_keys_clear(hdev);
2334
2335         if (cp->debug_keys)
2336                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2337         else
2338                 changed = hci_dev_test_and_clear_flag(hdev,
2339                                                       HCI_KEEP_DEBUG_KEYS);
2340
2341         if (changed)
2342                 new_settings(hdev, NULL);
2343
2344         for (i = 0; i < key_count; i++) {
2345                 struct mgmt_link_key_info *key = &cp->keys[i];
2346
2347                 /* Always ignore debug keys and require a new pairing if
2348                  * the user wants to use them.
2349                  */
2350                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2351                         continue;
2352
2353                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2354                                  key->type, key->pin_len, NULL);
2355         }
2356
2357         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2358
2359         hci_dev_unlock(hdev);
2360
2361         return 0;
2362 }
2363
2364 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2365                            u8 addr_type, struct sock *skip_sk)
2366 {
2367         struct mgmt_ev_device_unpaired ev;
2368
2369         bacpy(&ev.addr.bdaddr, bdaddr);
2370         ev.addr.type = addr_type;
2371
2372         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2373                           skip_sk);
2374 }
2375
2376 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2377                          u16 len)
2378 {
2379         struct mgmt_cp_unpair_device *cp = data;
2380         struct mgmt_rp_unpair_device rp;
2381         struct hci_conn_params *params;
2382         struct mgmt_pending_cmd *cmd;
2383         struct hci_conn *conn;
2384         u8 addr_type;
2385         int err;
2386
2387         memset(&rp, 0, sizeof(rp));
2388         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2389         rp.addr.type = cp->addr.type;
2390
2391         if (!bdaddr_type_is_valid(cp->addr.type))
2392                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2393                                          MGMT_STATUS_INVALID_PARAMS,
2394                                          &rp, sizeof(rp));
2395
2396         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2397                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2398                                          MGMT_STATUS_INVALID_PARAMS,
2399                                          &rp, sizeof(rp));
2400
2401         hci_dev_lock(hdev);
2402
2403         if (!hdev_is_powered(hdev)) {
2404                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2405                                         MGMT_STATUS_NOT_POWERED, &rp,
2406                                         sizeof(rp));
2407                 goto unlock;
2408         }
2409
2410         if (cp->addr.type == BDADDR_BREDR) {
2411                 /* If disconnection is requested, then look up the
2412                  * connection. If the remote device is connected, it
2413                  * will be later used to terminate the link.
2414                  *
2415                  * Setting it to NULL explicitly will cause no
2416                  * termination of the link.
2417                  */
2418                 if (cp->disconnect)
2419                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2420                                                        &cp->addr.bdaddr);
2421                 else
2422                         conn = NULL;
2423
2424                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2425                 if (err < 0) {
2426                         err = mgmt_cmd_complete(sk, hdev->id,
2427                                                 MGMT_OP_UNPAIR_DEVICE,
2428                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2429                                                 sizeof(rp));
2430                         goto unlock;
2431                 }
2432
2433                 goto done;
2434         }
2435
2436         /* LE address type */
2437         addr_type = le_addr_type(cp->addr.type);
2438
2439         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2440         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2441         if (err < 0) {
2442                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2443                                         MGMT_STATUS_NOT_PAIRED, &rp,
2444                                         sizeof(rp));
2445                 goto unlock;
2446         }
2447
2448         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2449         if (!conn) {
2450                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2451                 goto done;
2452         }
2453
2454
2455         /* Defer clearing up the connection parameters until closing to
2456          * give a chance of keeping them if a repairing happens.
2457          */
2458         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2459
2460         /* Disable auto-connection parameters if present */
2461         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2462         if (params) {
2463                 if (params->explicit_connect)
2464                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2465                 else
2466                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2467         }
2468
2469         /* If disconnection is not requested, then clear the connection
2470          * variable so that the link is not terminated.
2471          */
2472         if (!cp->disconnect)
2473                 conn = NULL;
2474
2475 done:
2476         /* If the connection variable is set, then termination of the
2477          * link is requested.
2478          */
2479         if (!conn) {
2480                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2481                                         &rp, sizeof(rp));
2482                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2483                 goto unlock;
2484         }
2485
2486         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2487                                sizeof(*cp));
2488         if (!cmd) {
2489                 err = -ENOMEM;
2490                 goto unlock;
2491         }
2492
2493         cmd->cmd_complete = addr_cmd_complete;
2494
2495         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2496         if (err < 0)
2497                 mgmt_pending_remove(cmd);
2498
2499 unlock:
2500         hci_dev_unlock(hdev);
2501         return err;
2502 }
2503
2504 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2505                       u16 len)
2506 {
2507         struct mgmt_cp_disconnect *cp = data;
2508         struct mgmt_rp_disconnect rp;
2509         struct mgmt_pending_cmd *cmd;
2510         struct hci_conn *conn;
2511         int err;
2512
2513         BT_DBG("");
2514
2515         memset(&rp, 0, sizeof(rp));
2516         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2517         rp.addr.type = cp->addr.type;
2518
2519         if (!bdaddr_type_is_valid(cp->addr.type))
2520                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2521                                          MGMT_STATUS_INVALID_PARAMS,
2522                                          &rp, sizeof(rp));
2523
2524         hci_dev_lock(hdev);
2525
2526         if (!test_bit(HCI_UP, &hdev->flags)) {
2527                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2528                                         MGMT_STATUS_NOT_POWERED, &rp,
2529                                         sizeof(rp));
2530                 goto failed;
2531         }
2532
2533         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2534                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2535                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2536                 goto failed;
2537         }
2538
2539         if (cp->addr.type == BDADDR_BREDR)
2540                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2541                                                &cp->addr.bdaddr);
2542         else
2543                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2544                                                le_addr_type(cp->addr.type));
2545
2546         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2547                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2548                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2549                                         sizeof(rp));
2550                 goto failed;
2551         }
2552
2553         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2554         if (!cmd) {
2555                 err = -ENOMEM;
2556                 goto failed;
2557         }
2558
2559         cmd->cmd_complete = generic_cmd_complete;
2560
2561         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2562         if (err < 0)
2563                 mgmt_pending_remove(cmd);
2564
2565 failed:
2566         hci_dev_unlock(hdev);
2567         return err;
2568 }
2569
2570 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2571 {
2572         switch (link_type) {
2573         case LE_LINK:
2574                 switch (addr_type) {
2575                 case ADDR_LE_DEV_PUBLIC:
2576                         return BDADDR_LE_PUBLIC;
2577
2578                 default:
2579                         /* Fallback to LE Random address type */
2580                         return BDADDR_LE_RANDOM;
2581                 }
2582
2583         default:
2584                 /* Fallback to BR/EDR type */
2585                 return BDADDR_BREDR;
2586         }
2587 }
2588
2589 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2590                            u16 data_len)
2591 {
2592         struct mgmt_rp_get_connections *rp;
2593         struct hci_conn *c;
2594         int err;
2595         u16 i;
2596
2597         BT_DBG("");
2598
2599         hci_dev_lock(hdev);
2600
2601         if (!hdev_is_powered(hdev)) {
2602                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2603                                       MGMT_STATUS_NOT_POWERED);
2604                 goto unlock;
2605         }
2606
2607         i = 0;
2608         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2609                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2610                         i++;
2611         }
2612
2613         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2614         if (!rp) {
2615                 err = -ENOMEM;
2616                 goto unlock;
2617         }
2618
2619         i = 0;
2620         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2621                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2622                         continue;
2623                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2624                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2625                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2626                         continue;
2627                 i++;
2628         }
2629
2630         rp->conn_count = cpu_to_le16(i);
2631
2632         /* Recalculate length in case of filtered SCO connections, etc */
2633         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2634                                 struct_size(rp, addr, i));
2635
2636         kfree(rp);
2637
2638 unlock:
2639         hci_dev_unlock(hdev);
2640         return err;
2641 }
2642
2643 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2644                                    struct mgmt_cp_pin_code_neg_reply *cp)
2645 {
2646         struct mgmt_pending_cmd *cmd;
2647         int err;
2648
2649         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2650                                sizeof(*cp));
2651         if (!cmd)
2652                 return -ENOMEM;
2653
2654         cmd->cmd_complete = addr_cmd_complete;
2655
2656         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2657                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2658         if (err < 0)
2659                 mgmt_pending_remove(cmd);
2660
2661         return err;
2662 }
2663
2664 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2665                           u16 len)
2666 {
2667         struct hci_conn *conn;
2668         struct mgmt_cp_pin_code_reply *cp = data;
2669         struct hci_cp_pin_code_reply reply;
2670         struct mgmt_pending_cmd *cmd;
2671         int err;
2672
2673         BT_DBG("");
2674
2675         hci_dev_lock(hdev);
2676
2677         if (!hdev_is_powered(hdev)) {
2678                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2679                                       MGMT_STATUS_NOT_POWERED);
2680                 goto failed;
2681         }
2682
2683         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2684         if (!conn) {
2685                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2686                                       MGMT_STATUS_NOT_CONNECTED);
2687                 goto failed;
2688         }
2689
2690         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2691                 struct mgmt_cp_pin_code_neg_reply ncp;
2692
2693                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2694
2695                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2696
2697                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2698                 if (err >= 0)
2699                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2700                                               MGMT_STATUS_INVALID_PARAMS);
2701
2702                 goto failed;
2703         }
2704
2705         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2706         if (!cmd) {
2707                 err = -ENOMEM;
2708                 goto failed;
2709         }
2710
2711         cmd->cmd_complete = addr_cmd_complete;
2712
2713         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2714         reply.pin_len = cp->pin_len;
2715         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2716
2717         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2718         if (err < 0)
2719                 mgmt_pending_remove(cmd);
2720
2721 failed:
2722         hci_dev_unlock(hdev);
2723         return err;
2724 }
2725
2726 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2727                              u16 len)
2728 {
2729         struct mgmt_cp_set_io_capability *cp = data;
2730
2731         BT_DBG("");
2732
2733         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2734                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2735                                        MGMT_STATUS_INVALID_PARAMS);
2736
2737         hci_dev_lock(hdev);
2738
2739         hdev->io_capability = cp->io_capability;
2740
2741         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2742                hdev->io_capability);
2743
2744         hci_dev_unlock(hdev);
2745
2746         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2747                                  NULL, 0);
2748 }
2749
2750 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2751 {
2752         struct hci_dev *hdev = conn->hdev;
2753         struct mgmt_pending_cmd *cmd;
2754
2755         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2756                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2757                         continue;
2758
2759                 if (cmd->user_data != conn)
2760                         continue;
2761
2762                 return cmd;
2763         }
2764
2765         return NULL;
2766 }
2767
2768 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2769 {
2770         struct mgmt_rp_pair_device rp;
2771         struct hci_conn *conn = cmd->user_data;
2772         int err;
2773
2774         bacpy(&rp.addr.bdaddr, &conn->dst);
2775         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2776
2777         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2778                                 status, &rp, sizeof(rp));
2779
2780         /* So we don't get further callbacks for this connection */
2781         conn->connect_cfm_cb = NULL;
2782         conn->security_cfm_cb = NULL;
2783         conn->disconn_cfm_cb = NULL;
2784
2785         hci_conn_drop(conn);
2786
2787         /* The device is paired so there is no need to remove
2788          * its connection parameters anymore.
2789          */
2790         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2791
2792         hci_conn_put(conn);
2793
2794         return err;
2795 }
2796
2797 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2798 {
2799         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2800         struct mgmt_pending_cmd *cmd;
2801
2802         cmd = find_pairing(conn);
2803         if (cmd) {
2804                 cmd->cmd_complete(cmd, status);
2805                 mgmt_pending_remove(cmd);
2806         }
2807 }
2808
2809 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2810 {
2811         struct mgmt_pending_cmd *cmd;
2812
2813         BT_DBG("status %u", status);
2814
2815         cmd = find_pairing(conn);
2816         if (!cmd) {
2817                 BT_DBG("Unable to find a pending command");
2818                 return;
2819         }
2820
2821         cmd->cmd_complete(cmd, mgmt_status(status));
2822         mgmt_pending_remove(cmd);
2823 }
2824
2825 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2826 {
2827         struct mgmt_pending_cmd *cmd;
2828
2829         BT_DBG("status %u", status);
2830
2831         if (!status)
2832                 return;
2833
2834         cmd = find_pairing(conn);
2835         if (!cmd) {
2836                 BT_DBG("Unable to find a pending command");
2837                 return;
2838         }
2839
2840         cmd->cmd_complete(cmd, mgmt_status(status));
2841         mgmt_pending_remove(cmd);
2842 }
2843
2844 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2845                        u16 len)
2846 {
2847         struct mgmt_cp_pair_device *cp = data;
2848         struct mgmt_rp_pair_device rp;
2849         struct mgmt_pending_cmd *cmd;
2850         u8 sec_level, auth_type;
2851         struct hci_conn *conn;
2852         int err;
2853
2854         BT_DBG("");
2855
2856         memset(&rp, 0, sizeof(rp));
2857         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2858         rp.addr.type = cp->addr.type;
2859
2860         if (!bdaddr_type_is_valid(cp->addr.type))
2861                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2862                                          MGMT_STATUS_INVALID_PARAMS,
2863                                          &rp, sizeof(rp));
2864
2865         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2866                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2867                                          MGMT_STATUS_INVALID_PARAMS,
2868                                          &rp, sizeof(rp));
2869
2870         hci_dev_lock(hdev);
2871
2872         if (!hdev_is_powered(hdev)) {
2873                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2874                                         MGMT_STATUS_NOT_POWERED, &rp,
2875                                         sizeof(rp));
2876                 goto unlock;
2877         }
2878
2879         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2880                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2881                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2882                                         sizeof(rp));
2883                 goto unlock;
2884         }
2885
2886         sec_level = BT_SECURITY_MEDIUM;
2887         auth_type = HCI_AT_DEDICATED_BONDING;
2888
2889         if (cp->addr.type == BDADDR_BREDR) {
2890                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2891                                        auth_type);
2892         } else {
2893                 u8 addr_type = le_addr_type(cp->addr.type);
2894                 struct hci_conn_params *p;
2895
2896                 /* When pairing a new device, it is expected to remember
2897                  * this device for future connections. Adding the connection
2898                  * parameter information ahead of time allows tracking
2899                  * of the slave preferred values and will speed up any
2900                  * further connection establishment.
2901                  *
2902                  * If connection parameters already exist, then they
2903                  * will be kept and this function does nothing.
2904                  */
2905                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2906
2907                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2908                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2909
2910                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
2911                                            addr_type, sec_level,
2912                                            HCI_LE_CONN_TIMEOUT);
2913         }
2914
2915         if (IS_ERR(conn)) {
2916                 int status;
2917
2918                 if (PTR_ERR(conn) == -EBUSY)
2919                         status = MGMT_STATUS_BUSY;
2920                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2921                         status = MGMT_STATUS_NOT_SUPPORTED;
2922                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2923                         status = MGMT_STATUS_REJECTED;
2924                 else
2925                         status = MGMT_STATUS_CONNECT_FAILED;
2926
2927                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2928                                         status, &rp, sizeof(rp));
2929                 goto unlock;
2930         }
2931
2932         if (conn->connect_cfm_cb) {
2933                 hci_conn_drop(conn);
2934                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2935                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2936                 goto unlock;
2937         }
2938
2939         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2940         if (!cmd) {
2941                 err = -ENOMEM;
2942                 hci_conn_drop(conn);
2943                 goto unlock;
2944         }
2945
2946         cmd->cmd_complete = pairing_complete;
2947
2948         /* For LE, just connecting isn't a proof that the pairing finished */
2949         if (cp->addr.type == BDADDR_BREDR) {
2950                 conn->connect_cfm_cb = pairing_complete_cb;
2951                 conn->security_cfm_cb = pairing_complete_cb;
2952                 conn->disconn_cfm_cb = pairing_complete_cb;
2953         } else {
2954                 conn->connect_cfm_cb = le_pairing_complete_cb;
2955                 conn->security_cfm_cb = le_pairing_complete_cb;
2956                 conn->disconn_cfm_cb = le_pairing_complete_cb;
2957         }
2958
2959         conn->io_capability = cp->io_cap;
2960         cmd->user_data = hci_conn_get(conn);
2961
2962         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
2963             hci_conn_security(conn, sec_level, auth_type, true)) {
2964                 cmd->cmd_complete(cmd, 0);
2965                 mgmt_pending_remove(cmd);
2966         }
2967
2968         err = 0;
2969
2970 unlock:
2971         hci_dev_unlock(hdev);
2972         return err;
2973 }
2974
2975 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2976                               u16 len)
2977 {
2978         struct mgmt_addr_info *addr = data;
2979         struct mgmt_pending_cmd *cmd;
2980         struct hci_conn *conn;
2981         int err;
2982
2983         BT_DBG("");
2984
2985         hci_dev_lock(hdev);
2986
2987         if (!hdev_is_powered(hdev)) {
2988                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2989                                       MGMT_STATUS_NOT_POWERED);
2990                 goto unlock;
2991         }
2992
2993         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2994         if (!cmd) {
2995                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2996                                       MGMT_STATUS_INVALID_PARAMS);
2997                 goto unlock;
2998         }
2999
3000         conn = cmd->user_data;
3001
3002         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3003                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3004                                       MGMT_STATUS_INVALID_PARAMS);
3005                 goto unlock;
3006         }
3007
3008         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3009         mgmt_pending_remove(cmd);
3010
3011         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3012                                 addr, sizeof(*addr));
3013 unlock:
3014         hci_dev_unlock(hdev);
3015         return err;
3016 }
3017
3018 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3019                              struct mgmt_addr_info *addr, u16 mgmt_op,
3020                              u16 hci_op, __le32 passkey)
3021 {
3022         struct mgmt_pending_cmd *cmd;
3023         struct hci_conn *conn;
3024         int err;
3025
3026         hci_dev_lock(hdev);
3027
3028         if (!hdev_is_powered(hdev)) {
3029                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3030                                         MGMT_STATUS_NOT_POWERED, addr,
3031                                         sizeof(*addr));
3032                 goto done;
3033         }
3034
3035         if (addr->type == BDADDR_BREDR)
3036                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3037         else
3038                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3039                                                le_addr_type(addr->type));
3040
3041         if (!conn) {
3042                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3043                                         MGMT_STATUS_NOT_CONNECTED, addr,
3044                                         sizeof(*addr));
3045                 goto done;
3046         }
3047
3048         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3049                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3050                 if (!err)
3051                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3052                                                 MGMT_STATUS_SUCCESS, addr,
3053                                                 sizeof(*addr));
3054                 else
3055                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3056                                                 MGMT_STATUS_FAILED, addr,
3057                                                 sizeof(*addr));
3058
3059                 goto done;
3060         }
3061
3062         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3063         if (!cmd) {
3064                 err = -ENOMEM;
3065                 goto done;
3066         }
3067
3068         cmd->cmd_complete = addr_cmd_complete;
3069
3070         /* Continue with pairing via HCI */
3071         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3072                 struct hci_cp_user_passkey_reply cp;
3073
3074                 bacpy(&cp.bdaddr, &addr->bdaddr);
3075                 cp.passkey = passkey;
3076                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3077         } else
3078                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3079                                    &addr->bdaddr);
3080
3081         if (err < 0)
3082                 mgmt_pending_remove(cmd);
3083
3084 done:
3085         hci_dev_unlock(hdev);
3086         return err;
3087 }
3088
3089 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3090                               void *data, u16 len)
3091 {
3092         struct mgmt_cp_pin_code_neg_reply *cp = data;
3093
3094         BT_DBG("");
3095
3096         return user_pairing_resp(sk, hdev, &cp->addr,
3097                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3098                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3099 }
3100
3101 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3102                               u16 len)
3103 {
3104         struct mgmt_cp_user_confirm_reply *cp = data;
3105
3106         BT_DBG("");
3107
3108         if (len != sizeof(*cp))
3109                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3110                                        MGMT_STATUS_INVALID_PARAMS);
3111
3112         return user_pairing_resp(sk, hdev, &cp->addr,
3113                                  MGMT_OP_USER_CONFIRM_REPLY,
3114                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3115 }
3116
3117 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3118                                   void *data, u16 len)
3119 {
3120         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3121
3122         BT_DBG("");
3123
3124         return user_pairing_resp(sk, hdev, &cp->addr,
3125                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3126                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3127 }
3128
3129 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3130                               u16 len)
3131 {
3132         struct mgmt_cp_user_passkey_reply *cp = data;
3133
3134         BT_DBG("");
3135
3136         return user_pairing_resp(sk, hdev, &cp->addr,
3137                                  MGMT_OP_USER_PASSKEY_REPLY,
3138                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3139 }
3140
3141 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3142                                   void *data, u16 len)
3143 {
3144         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3145
3146         BT_DBG("");
3147
3148         return user_pairing_resp(sk, hdev, &cp->addr,
3149                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3150                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3151 }
3152
3153 static void adv_expire(struct hci_dev *hdev, u32 flags)
3154 {
3155         struct adv_info *adv_instance;
3156         struct hci_request req;
3157         int err;
3158
3159         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3160         if (!adv_instance)
3161                 return;
3162
3163         /* stop if current instance doesn't need to be changed */
3164         if (!(adv_instance->flags & flags))
3165                 return;
3166
3167         cancel_adv_timeout(hdev);
3168
3169         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3170         if (!adv_instance)
3171                 return;
3172
3173         hci_req_init(&req, hdev);
3174         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3175                                               true);
3176         if (err)
3177                 return;
3178
3179         hci_req_run(&req, NULL);
3180 }
3181
3182 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3183 {
3184         struct mgmt_cp_set_local_name *cp;
3185         struct mgmt_pending_cmd *cmd;
3186
3187         BT_DBG("status 0x%02x", status);
3188
3189         hci_dev_lock(hdev);
3190
3191         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3192         if (!cmd)
3193                 goto unlock;
3194
3195         cp = cmd->param;
3196
3197         if (status) {
3198                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3199                                 mgmt_status(status));
3200         } else {
3201                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3202                                   cp, sizeof(*cp));
3203
3204                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3205                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3206         }
3207
3208         mgmt_pending_remove(cmd);
3209
3210 unlock:
3211         hci_dev_unlock(hdev);
3212 }
3213
3214 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3215                           u16 len)
3216 {
3217         struct mgmt_cp_set_local_name *cp = data;
3218         struct mgmt_pending_cmd *cmd;
3219         struct hci_request req;
3220         int err;
3221
3222         BT_DBG("");
3223
3224         hci_dev_lock(hdev);
3225
3226         /* If the old values are the same as the new ones just return a
3227          * direct command complete event.
3228          */
3229         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3230             !memcmp(hdev->short_name, cp->short_name,
3231                     sizeof(hdev->short_name))) {
3232                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3233                                         data, len);
3234                 goto failed;
3235         }
3236
3237         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3238
3239         if (!hdev_is_powered(hdev)) {
3240                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3241
3242                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3243                                         data, len);
3244                 if (err < 0)
3245                         goto failed;
3246
3247                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3248                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3249                 ext_info_changed(hdev, sk);
3250
3251                 goto failed;
3252         }
3253
3254         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3255         if (!cmd) {
3256                 err = -ENOMEM;
3257                 goto failed;
3258         }
3259
3260         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3261
3262         hci_req_init(&req, hdev);
3263
3264         if (lmp_bredr_capable(hdev)) {
3265                 __hci_req_update_name(&req);
3266                 __hci_req_update_eir(&req);
3267         }
3268
3269         /* The name is stored in the scan response data and so
3270          * no need to udpate the advertising data here.
3271          */
3272         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3273                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3274
3275         err = hci_req_run(&req, set_name_complete);
3276         if (err < 0)
3277                 mgmt_pending_remove(cmd);
3278
3279 failed:
3280         hci_dev_unlock(hdev);
3281         return err;
3282 }
3283
3284 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3285                           u16 len)
3286 {
3287         struct mgmt_cp_set_appearance *cp = data;
3288         u16 apperance;
3289         int err;
3290
3291         BT_DBG("");
3292
3293         if (!lmp_le_capable(hdev))
3294                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3295                                        MGMT_STATUS_NOT_SUPPORTED);
3296
3297         apperance = le16_to_cpu(cp->appearance);
3298
3299         hci_dev_lock(hdev);
3300
3301         if (hdev->appearance != apperance) {
3302                 hdev->appearance = apperance;
3303
3304                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3305                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3306
3307                 ext_info_changed(hdev, sk);
3308         }
3309
3310         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3311                                 0);
3312
3313         hci_dev_unlock(hdev);
3314
3315         return err;
3316 }
3317
3318 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3319                                  void *data, u16 len)
3320 {
3321         struct mgmt_rp_get_phy_confguration rp;
3322
3323         BT_DBG("sock %p %s", sk, hdev->name);
3324
3325         hci_dev_lock(hdev);
3326
3327         memset(&rp, 0, sizeof(rp));
3328
3329         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3330         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3331         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3332
3333         hci_dev_unlock(hdev);
3334
3335         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3336                                  &rp, sizeof(rp));
3337 }
3338
3339 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3340 {
3341         struct mgmt_ev_phy_configuration_changed ev;
3342
3343         memset(&ev, 0, sizeof(ev));
3344
3345         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3346
3347         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3348                           sizeof(ev), skip);
3349 }
3350
3351 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3352                                      u16 opcode, struct sk_buff *skb)
3353 {
3354         struct mgmt_pending_cmd *cmd;
3355
3356         BT_DBG("status 0x%02x", status);
3357
3358         hci_dev_lock(hdev);
3359
3360         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3361         if (!cmd)
3362                 goto unlock;
3363
3364         if (status) {
3365                 mgmt_cmd_status(cmd->sk, hdev->id,
3366                                 MGMT_OP_SET_PHY_CONFIGURATION,
3367                                 mgmt_status(status));
3368         } else {
3369                 mgmt_cmd_complete(cmd->sk, hdev->id,
3370                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3371                                   NULL, 0);
3372
3373                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3374         }
3375
3376         mgmt_pending_remove(cmd);
3377
3378 unlock:
3379         hci_dev_unlock(hdev);
3380 }
3381
3382 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3383                                  void *data, u16 len)
3384 {
3385         struct mgmt_cp_set_phy_confguration *cp = data;
3386         struct hci_cp_le_set_default_phy cp_phy;
3387         struct mgmt_pending_cmd *cmd;
3388         struct hci_request req;
3389         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3390         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3391         bool changed = false;
3392         int err;
3393
3394         BT_DBG("sock %p %s", sk, hdev->name);
3395
3396         configurable_phys = get_configurable_phys(hdev);
3397         supported_phys = get_supported_phys(hdev);
3398         selected_phys = __le32_to_cpu(cp->selected_phys);
3399
3400         if (selected_phys & ~supported_phys)
3401                 return mgmt_cmd_status(sk, hdev->id,
3402                                        MGMT_OP_SET_PHY_CONFIGURATION,
3403                                        MGMT_STATUS_INVALID_PARAMS);
3404
3405         unconfigure_phys = supported_phys & ~configurable_phys;
3406
3407         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3408                 return mgmt_cmd_status(sk, hdev->id,
3409                                        MGMT_OP_SET_PHY_CONFIGURATION,
3410                                        MGMT_STATUS_INVALID_PARAMS);
3411
3412         if (selected_phys == get_selected_phys(hdev))
3413                 return mgmt_cmd_complete(sk, hdev->id,
3414                                          MGMT_OP_SET_PHY_CONFIGURATION,
3415                                          0, NULL, 0);
3416
3417         hci_dev_lock(hdev);
3418
3419         if (!hdev_is_powered(hdev)) {
3420                 err = mgmt_cmd_status(sk, hdev->id,
3421                                       MGMT_OP_SET_PHY_CONFIGURATION,
3422                                       MGMT_STATUS_REJECTED);
3423                 goto unlock;
3424         }
3425
3426         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3427                 err = mgmt_cmd_status(sk, hdev->id,
3428                                       MGMT_OP_SET_PHY_CONFIGURATION,
3429                                       MGMT_STATUS_BUSY);
3430                 goto unlock;
3431         }
3432
3433         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3434                 pkt_type |= (HCI_DH3 | HCI_DM3);
3435         else
3436                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3437
3438         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3439                 pkt_type |= (HCI_DH5 | HCI_DM5);
3440         else
3441                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3442
3443         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3444                 pkt_type &= ~HCI_2DH1;
3445         else
3446                 pkt_type |= HCI_2DH1;
3447
3448         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3449                 pkt_type &= ~HCI_2DH3;
3450         else
3451                 pkt_type |= HCI_2DH3;
3452
3453         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3454                 pkt_type &= ~HCI_2DH5;
3455         else
3456                 pkt_type |= HCI_2DH5;
3457
3458         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3459                 pkt_type &= ~HCI_3DH1;
3460         else
3461                 pkt_type |= HCI_3DH1;
3462
3463         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3464                 pkt_type &= ~HCI_3DH3;
3465         else
3466                 pkt_type |= HCI_3DH3;
3467
3468         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3469                 pkt_type &= ~HCI_3DH5;
3470         else
3471                 pkt_type |= HCI_3DH5;
3472
3473         if (pkt_type != hdev->pkt_type) {
3474                 hdev->pkt_type = pkt_type;
3475                 changed = true;
3476         }
3477
3478         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3479             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3480                 if (changed)
3481                         mgmt_phy_configuration_changed(hdev, sk);
3482
3483                 err = mgmt_cmd_complete(sk, hdev->id,
3484                                         MGMT_OP_SET_PHY_CONFIGURATION,
3485                                         0, NULL, 0);
3486
3487                 goto unlock;
3488         }
3489
3490         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3491                                len);
3492         if (!cmd) {
3493                 err = -ENOMEM;
3494                 goto unlock;
3495         }
3496
3497         hci_req_init(&req, hdev);
3498
3499         memset(&cp_phy, 0, sizeof(cp_phy));
3500
3501         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3502                 cp_phy.all_phys |= 0x01;
3503
3504         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3505                 cp_phy.all_phys |= 0x02;
3506
3507         if (selected_phys & MGMT_PHY_LE_1M_TX)
3508                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3509
3510         if (selected_phys & MGMT_PHY_LE_2M_TX)
3511                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3512
3513         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3514                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3515
3516         if (selected_phys & MGMT_PHY_LE_1M_RX)
3517                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3518
3519         if (selected_phys & MGMT_PHY_LE_2M_RX)
3520                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3521
3522         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3523                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3524
3525         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3526
3527         err = hci_req_run_skb(&req, set_default_phy_complete);
3528         if (err < 0)
3529                 mgmt_pending_remove(cmd);
3530
3531 unlock:
3532         hci_dev_unlock(hdev);
3533
3534         return err;
3535 }
3536
3537 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3538                                          u16 opcode, struct sk_buff *skb)
3539 {
3540         struct mgmt_rp_read_local_oob_data mgmt_rp;
3541         size_t rp_size = sizeof(mgmt_rp);
3542         struct mgmt_pending_cmd *cmd;
3543
3544         BT_DBG("%s status %u", hdev->name, status);
3545
3546         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3547         if (!cmd)
3548                 return;
3549
3550         if (status || !skb) {
3551                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3552                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3553                 goto remove;
3554         }
3555
3556         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3557
3558         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3559                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3560
3561                 if (skb->len < sizeof(*rp)) {
3562                         mgmt_cmd_status(cmd->sk, hdev->id,
3563                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3564                                         MGMT_STATUS_FAILED);
3565                         goto remove;
3566                 }
3567
3568                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3569                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3570
3571                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3572         } else {
3573                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3574
3575                 if (skb->len < sizeof(*rp)) {
3576                         mgmt_cmd_status(cmd->sk, hdev->id,
3577                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3578                                         MGMT_STATUS_FAILED);
3579                         goto remove;
3580                 }
3581
3582                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3583                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3584
3585                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3586                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3587         }
3588
3589         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3590                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3591
3592 remove:
3593         mgmt_pending_remove(cmd);
3594 }
3595
3596 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3597                                void *data, u16 data_len)
3598 {
3599         struct mgmt_pending_cmd *cmd;
3600         struct hci_request req;
3601         int err;
3602
3603         BT_DBG("%s", hdev->name);
3604
3605         hci_dev_lock(hdev);
3606
3607         if (!hdev_is_powered(hdev)) {
3608                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3609                                       MGMT_STATUS_NOT_POWERED);
3610                 goto unlock;
3611         }
3612
3613         if (!lmp_ssp_capable(hdev)) {
3614                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3615                                       MGMT_STATUS_NOT_SUPPORTED);
3616                 goto unlock;
3617         }
3618
3619         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3620                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3621                                       MGMT_STATUS_BUSY);
3622                 goto unlock;
3623         }
3624
3625         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3626         if (!cmd) {
3627                 err = -ENOMEM;
3628                 goto unlock;
3629         }
3630
3631         hci_req_init(&req, hdev);
3632
3633         if (bredr_sc_enabled(hdev))
3634                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
3635         else
3636                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3637
3638         err = hci_req_run_skb(&req, read_local_oob_data_complete);
3639         if (err < 0)
3640                 mgmt_pending_remove(cmd);
3641
3642 unlock:
3643         hci_dev_unlock(hdev);
3644         return err;
3645 }
3646
3647 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3648                                void *data, u16 len)
3649 {
3650         struct mgmt_addr_info *addr = data;
3651         int err;
3652
3653         BT_DBG("%s ", hdev->name);
3654
3655         if (!bdaddr_type_is_valid(addr->type))
3656                 return mgmt_cmd_complete(sk, hdev->id,
3657                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
3658                                          MGMT_STATUS_INVALID_PARAMS,
3659                                          addr, sizeof(*addr));
3660
3661         hci_dev_lock(hdev);
3662
3663         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3664                 struct mgmt_cp_add_remote_oob_data *cp = data;
3665                 u8 status;
3666
3667                 if (cp->addr.type != BDADDR_BREDR) {
3668                         err = mgmt_cmd_complete(sk, hdev->id,
3669                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
3670                                                 MGMT_STATUS_INVALID_PARAMS,
3671                                                 &cp->addr, sizeof(cp->addr));
3672                         goto unlock;
3673                 }
3674
3675                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3676                                               cp->addr.type, cp->hash,
3677                                               cp->rand, NULL, NULL);
3678                 if (err < 0)
3679                         status = MGMT_STATUS_FAILED;
3680                 else
3681                         status = MGMT_STATUS_SUCCESS;
3682
3683                 err = mgmt_cmd_complete(sk, hdev->id,
3684                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3685                                         &cp->addr, sizeof(cp->addr));
3686         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3687                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3688                 u8 *rand192, *hash192, *rand256, *hash256;
3689                 u8 status;
3690
3691                 if (bdaddr_type_is_le(cp->addr.type)) {
3692                         /* Enforce zero-valued 192-bit parameters as
3693                          * long as legacy SMP OOB isn't implemented.
3694                          */
3695                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3696                             memcmp(cp->hash192, ZERO_KEY, 16)) {
3697                                 err = mgmt_cmd_complete(sk, hdev->id,
3698                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3699                                                         MGMT_STATUS_INVALID_PARAMS,
3700                                                         addr, sizeof(*addr));
3701                                 goto unlock;
3702                         }
3703
3704                         rand192 = NULL;
3705                         hash192 = NULL;
3706                 } else {
3707                         /* In case one of the P-192 values is set to zero,
3708                          * then just disable OOB data for P-192.
3709                          */
3710                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3711                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
3712                                 rand192 = NULL;
3713                                 hash192 = NULL;
3714                         } else {
3715                                 rand192 = cp->rand192;
3716                                 hash192 = cp->hash192;
3717                         }
3718                 }
3719
3720                 /* In case one of the P-256 values is set to zero, then just
3721                  * disable OOB data for P-256.
3722                  */
3723                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3724                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
3725                         rand256 = NULL;
3726                         hash256 = NULL;
3727                 } else {
3728                         rand256 = cp->rand256;
3729                         hash256 = cp->hash256;
3730                 }
3731
3732                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3733                                               cp->addr.type, hash192, rand192,
3734                                               hash256, rand256);
3735                 if (err < 0)
3736                         status = MGMT_STATUS_FAILED;
3737                 else
3738                         status = MGMT_STATUS_SUCCESS;
3739
3740                 err = mgmt_cmd_complete(sk, hdev->id,
3741                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3742                                         status, &cp->addr, sizeof(cp->addr));
3743         } else {
3744                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
3745                            len);
3746                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3747                                       MGMT_STATUS_INVALID_PARAMS);
3748         }
3749
3750 unlock:
3751         hci_dev_unlock(hdev);
3752         return err;
3753 }
3754
3755 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3756                                   void *data, u16 len)
3757 {
3758         struct mgmt_cp_remove_remote_oob_data *cp = data;
3759         u8 status;
3760         int err;
3761
3762         BT_DBG("%s", hdev->name);
3763
3764         if (cp->addr.type != BDADDR_BREDR)
3765                 return mgmt_cmd_complete(sk, hdev->id,
3766                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3767                                          MGMT_STATUS_INVALID_PARAMS,
3768                                          &cp->addr, sizeof(cp->addr));
3769
3770         hci_dev_lock(hdev);
3771
3772         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3773                 hci_remote_oob_data_clear(hdev);
3774                 status = MGMT_STATUS_SUCCESS;
3775                 goto done;
3776         }
3777
3778         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3779         if (err < 0)
3780                 status = MGMT_STATUS_INVALID_PARAMS;
3781         else
3782                 status = MGMT_STATUS_SUCCESS;
3783
3784 done:
3785         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3786                                 status, &cp->addr, sizeof(cp->addr));
3787
3788         hci_dev_unlock(hdev);
3789         return err;
3790 }
3791
3792 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
3793 {
3794         struct mgmt_pending_cmd *cmd;
3795
3796         BT_DBG("status %d", status);
3797
3798         hci_dev_lock(hdev);
3799
3800         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
3801         if (!cmd)
3802                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3803
3804         if (!cmd)
3805                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
3806
3807         if (cmd) {
3808                 cmd->cmd_complete(cmd, mgmt_status(status));
3809                 mgmt_pending_remove(cmd);
3810         }
3811
3812         hci_dev_unlock(hdev);
3813 }
3814
3815 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
3816                                     uint8_t *mgmt_status)
3817 {
3818         switch (type) {
3819         case DISCOV_TYPE_LE:
3820                 *mgmt_status = mgmt_le_support(hdev);
3821                 if (*mgmt_status)
3822                         return false;
3823                 break;
3824         case DISCOV_TYPE_INTERLEAVED:
3825                 *mgmt_status = mgmt_le_support(hdev);
3826                 if (*mgmt_status)
3827                         return false;
3828                 /* Intentional fall-through */
3829         case DISCOV_TYPE_BREDR:
3830                 *mgmt_status = mgmt_bredr_support(hdev);
3831                 if (*mgmt_status)
3832                         return false;
3833                 break;
3834         default:
3835                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
3836                 return false;
3837         }
3838
3839         return true;
3840 }
3841
3842 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
3843                                     u16 op, void *data, u16 len)
3844 {
3845         struct mgmt_cp_start_discovery *cp = data;
3846         struct mgmt_pending_cmd *cmd;
3847         u8 status;
3848         int err;
3849
3850         BT_DBG("%s", hdev->name);
3851
3852         hci_dev_lock(hdev);
3853
3854         if (!hdev_is_powered(hdev)) {
3855                 err = mgmt_cmd_complete(sk, hdev->id, op,
3856                                         MGMT_STATUS_NOT_POWERED,
3857                                         &cp->type, sizeof(cp->type));
3858                 goto failed;
3859         }
3860
3861         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3862             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3863                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
3864                                         &cp->type, sizeof(cp->type));
3865                 goto failed;
3866         }
3867
3868         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3869                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
3870                                         &cp->type, sizeof(cp->type));
3871                 goto failed;
3872         }
3873
3874         /* Clear the discovery filter first to free any previously
3875          * allocated memory for the UUID list.
3876          */
3877         hci_discovery_filter_clear(hdev);
3878
3879         hdev->discovery.type = cp->type;
3880         hdev->discovery.report_invalid_rssi = false;
3881         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
3882                 hdev->discovery.limited = true;
3883         else
3884                 hdev->discovery.limited = false;
3885
3886         cmd = mgmt_pending_add(sk, op, hdev, data, len);
3887         if (!cmd) {
3888                 err = -ENOMEM;
3889                 goto failed;
3890         }
3891
3892         cmd->cmd_complete = generic_cmd_complete;
3893
3894         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3895         queue_work(hdev->req_workqueue, &hdev->discov_update);
3896         err = 0;
3897
3898 failed:
3899         hci_dev_unlock(hdev);
3900         return err;
3901 }
3902
3903 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3904                            void *data, u16 len)
3905 {
3906         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
3907                                         data, len);
3908 }
3909
3910 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
3911                                    void *data, u16 len)
3912 {
3913         return start_discovery_internal(sk, hdev,
3914                                         MGMT_OP_START_LIMITED_DISCOVERY,
3915                                         data, len);
3916 }
3917
3918 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
3919                                           u8 status)
3920 {
3921         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
3922                                  cmd->param, 1);
3923 }
3924
3925 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3926                                    void *data, u16 len)
3927 {
3928         struct mgmt_cp_start_service_discovery *cp = data;
3929         struct mgmt_pending_cmd *cmd;
3930         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3931         u16 uuid_count, expected_len;
3932         u8 status;
3933         int err;
3934
3935         BT_DBG("%s", hdev->name);
3936
3937         hci_dev_lock(hdev);
3938
3939         if (!hdev_is_powered(hdev)) {
3940                 err = mgmt_cmd_complete(sk, hdev->id,
3941                                         MGMT_OP_START_SERVICE_DISCOVERY,
3942                                         MGMT_STATUS_NOT_POWERED,
3943                                         &cp->type, sizeof(cp->type));
3944                 goto failed;
3945         }
3946
3947         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3948             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3949                 err = mgmt_cmd_complete(sk, hdev->id,
3950                                         MGMT_OP_START_SERVICE_DISCOVERY,
3951                                         MGMT_STATUS_BUSY, &cp->type,
3952                                         sizeof(cp->type));
3953                 goto failed;
3954         }
3955
3956         uuid_count = __le16_to_cpu(cp->uuid_count);
3957         if (uuid_count > max_uuid_count) {
3958                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
3959                            uuid_count);
3960                 err = mgmt_cmd_complete(sk, hdev->id,
3961                                         MGMT_OP_START_SERVICE_DISCOVERY,
3962                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
3963                                         sizeof(cp->type));
3964                 goto failed;
3965         }
3966
3967         expected_len = sizeof(*cp) + uuid_count * 16;
3968         if (expected_len != len) {
3969                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
3970                            expected_len, len);
3971                 err = mgmt_cmd_complete(sk, hdev->id,
3972                                         MGMT_OP_START_SERVICE_DISCOVERY,
3973                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
3974                                         sizeof(cp->type));
3975                 goto failed;
3976         }
3977
3978         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3979                 err = mgmt_cmd_complete(sk, hdev->id,
3980                                         MGMT_OP_START_SERVICE_DISCOVERY,
3981                                         status, &cp->type, sizeof(cp->type));
3982                 goto failed;
3983         }
3984
3985         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
3986                                hdev, data, len);
3987         if (!cmd) {
3988                 err = -ENOMEM;
3989                 goto failed;
3990         }
3991
3992         cmd->cmd_complete = service_discovery_cmd_complete;
3993
3994         /* Clear the discovery filter first to free any previously
3995          * allocated memory for the UUID list.
3996          */
3997         hci_discovery_filter_clear(hdev);
3998
3999         hdev->discovery.result_filtering = true;
4000         hdev->discovery.type = cp->type;
4001         hdev->discovery.rssi = cp->rssi;
4002         hdev->discovery.uuid_count = uuid_count;
4003
4004         if (uuid_count > 0) {
4005                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4006                                                 GFP_KERNEL);
4007                 if (!hdev->discovery.uuids) {
4008                         err = mgmt_cmd_complete(sk, hdev->id,
4009                                                 MGMT_OP_START_SERVICE_DISCOVERY,
4010                                                 MGMT_STATUS_FAILED,
4011                                                 &cp->type, sizeof(cp->type));
4012                         mgmt_pending_remove(cmd);
4013                         goto failed;
4014                 }
4015         }
4016
4017         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4018         queue_work(hdev->req_workqueue, &hdev->discov_update);
4019         err = 0;
4020
4021 failed:
4022         hci_dev_unlock(hdev);
4023         return err;
4024 }
4025
4026 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
4027 {
4028         struct mgmt_pending_cmd *cmd;
4029
4030         BT_DBG("status %d", status);
4031
4032         hci_dev_lock(hdev);
4033
4034         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4035         if (cmd) {
4036                 cmd->cmd_complete(cmd, mgmt_status(status));
4037                 mgmt_pending_remove(cmd);
4038         }
4039
4040         hci_dev_unlock(hdev);
4041 }
4042
4043 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4044                           u16 len)
4045 {
4046         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4047         struct mgmt_pending_cmd *cmd;
4048         int err;
4049
4050         BT_DBG("%s", hdev->name);
4051
4052         hci_dev_lock(hdev);
4053
4054         if (!hci_discovery_active(hdev)) {
4055                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4056                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
4057                                         sizeof(mgmt_cp->type));
4058                 goto unlock;
4059         }
4060
4061         if (hdev->discovery.type != mgmt_cp->type) {
4062                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4063                                         MGMT_STATUS_INVALID_PARAMS,
4064                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4065                 goto unlock;
4066         }
4067
4068         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4069         if (!cmd) {
4070                 err = -ENOMEM;
4071                 goto unlock;
4072         }
4073
4074         cmd->cmd_complete = generic_cmd_complete;
4075
4076         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4077         queue_work(hdev->req_workqueue, &hdev->discov_update);
4078         err = 0;
4079
4080 unlock:
4081         hci_dev_unlock(hdev);
4082         return err;
4083 }
4084
4085 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4086                         u16 len)
4087 {
4088         struct mgmt_cp_confirm_name *cp = data;
4089         struct inquiry_entry *e;
4090         int err;
4091
4092         BT_DBG("%s", hdev->name);
4093
4094         hci_dev_lock(hdev);
4095
4096         if (!hci_discovery_active(hdev)) {
4097                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4098                                         MGMT_STATUS_FAILED, &cp->addr,
4099                                         sizeof(cp->addr));
4100                 goto failed;
4101         }
4102
4103         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4104         if (!e) {
4105                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4106                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4107                                         sizeof(cp->addr));
4108                 goto failed;
4109         }
4110
4111         if (cp->name_known) {
4112                 e->name_state = NAME_KNOWN;
4113                 list_del(&e->list);
4114         } else {
4115                 e->name_state = NAME_NEEDED;
4116                 hci_inquiry_cache_update_resolve(hdev, e);
4117         }
4118
4119         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4120                                 &cp->addr, sizeof(cp->addr));
4121
4122 failed:
4123         hci_dev_unlock(hdev);
4124         return err;
4125 }
4126
4127 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4128                         u16 len)
4129 {
4130         struct mgmt_cp_block_device *cp = data;
4131         u8 status;
4132         int err;
4133
4134         BT_DBG("%s", hdev->name);
4135
4136         if (!bdaddr_type_is_valid(cp->addr.type))
4137                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4138                                          MGMT_STATUS_INVALID_PARAMS,
4139                                          &cp->addr, sizeof(cp->addr));
4140
4141         hci_dev_lock(hdev);
4142
4143         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4144                                   cp->addr.type);
4145         if (err < 0) {
4146                 status = MGMT_STATUS_FAILED;
4147                 goto done;
4148         }
4149
4150         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4151                    sk);
4152         status = MGMT_STATUS_SUCCESS;
4153
4154 done:
4155         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4156                                 &cp->addr, sizeof(cp->addr));
4157
4158         hci_dev_unlock(hdev);
4159
4160         return err;
4161 }
4162
4163 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4164                           u16 len)
4165 {
4166         struct mgmt_cp_unblock_device *cp = data;
4167         u8 status;
4168         int err;
4169
4170         BT_DBG("%s", hdev->name);
4171
4172         if (!bdaddr_type_is_valid(cp->addr.type))
4173                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4174                                          MGMT_STATUS_INVALID_PARAMS,
4175                                          &cp->addr, sizeof(cp->addr));
4176
4177         hci_dev_lock(hdev);
4178
4179         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4180                                   cp->addr.type);
4181         if (err < 0) {
4182                 status = MGMT_STATUS_INVALID_PARAMS;
4183                 goto done;
4184         }
4185
4186         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4187                    sk);
4188         status = MGMT_STATUS_SUCCESS;
4189
4190 done:
4191         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4192                                 &cp->addr, sizeof(cp->addr));
4193
4194         hci_dev_unlock(hdev);
4195
4196         return err;
4197 }
4198
4199 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4200                          u16 len)
4201 {
4202         struct mgmt_cp_set_device_id *cp = data;
4203         struct hci_request req;
4204         int err;
4205         __u16 source;
4206
4207         BT_DBG("%s", hdev->name);
4208
4209         source = __le16_to_cpu(cp->source);
4210
4211         if (source > 0x0002)
4212                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4213                                        MGMT_STATUS_INVALID_PARAMS);
4214
4215         hci_dev_lock(hdev);
4216
4217         hdev->devid_source = source;
4218         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4219         hdev->devid_product = __le16_to_cpu(cp->product);
4220         hdev->devid_version = __le16_to_cpu(cp->version);
4221
4222         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4223                                 NULL, 0);
4224
4225         hci_req_init(&req, hdev);
4226         __hci_req_update_eir(&req);
4227         hci_req_run(&req, NULL);
4228
4229         hci_dev_unlock(hdev);
4230
4231         return err;
4232 }
4233
4234 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4235                                         u16 opcode)
4236 {
4237         BT_DBG("status %d", status);
4238 }
4239
4240 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4241                                      u16 opcode)
4242 {
4243         struct cmd_lookup match = { NULL, hdev };
4244         struct hci_request req;
4245         u8 instance;
4246         struct adv_info *adv_instance;
4247         int err;
4248
4249         hci_dev_lock(hdev);
4250
4251         if (status) {
4252                 u8 mgmt_err = mgmt_status(status);
4253
4254                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4255                                      cmd_status_rsp, &mgmt_err);
4256                 goto unlock;
4257         }
4258
4259         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4260                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
4261         else
4262                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4263
4264         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4265                              &match);
4266
4267         new_settings(hdev, match.sk);
4268
4269         if (match.sk)
4270                 sock_put(match.sk);
4271
4272         /* If "Set Advertising" was just disabled and instance advertising was
4273          * set up earlier, then re-enable multi-instance advertising.
4274          */
4275         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4276             list_empty(&hdev->adv_instances))
4277                 goto unlock;
4278
4279         instance = hdev->cur_adv_instance;
4280         if (!instance) {
4281                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
4282                                                         struct adv_info, list);
4283                 if (!adv_instance)
4284                         goto unlock;
4285
4286                 instance = adv_instance->instance;
4287         }
4288
4289         hci_req_init(&req, hdev);
4290
4291         err = __hci_req_schedule_adv_instance(&req, instance, true);
4292
4293         if (!err)
4294                 err = hci_req_run(&req, enable_advertising_instance);
4295
4296         if (err)
4297                 bt_dev_err(hdev, "failed to re-configure advertising");
4298
4299 unlock:
4300         hci_dev_unlock(hdev);
4301 }
4302
4303 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4304                            u16 len)
4305 {
4306         struct mgmt_mode *cp = data;
4307         struct mgmt_pending_cmd *cmd;
4308         struct hci_request req;
4309         u8 val, status;
4310         int err;
4311
4312         BT_DBG("request for %s", hdev->name);
4313
4314         status = mgmt_le_support(hdev);
4315         if (status)
4316                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4317                                        status);
4318
4319         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4320                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4321                                        MGMT_STATUS_INVALID_PARAMS);
4322
4323         hci_dev_lock(hdev);
4324
4325         val = !!cp->val;
4326
4327         /* The following conditions are ones which mean that we should
4328          * not do any HCI communication but directly send a mgmt
4329          * response to user space (after toggling the flag if
4330          * necessary).
4331          */
4332         if (!hdev_is_powered(hdev) ||
4333             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4334              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4335             hci_conn_num(hdev, LE_LINK) > 0 ||
4336             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4337              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4338                 bool changed;
4339
4340                 if (cp->val) {
4341                         hdev->cur_adv_instance = 0x00;
4342                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4343                         if (cp->val == 0x02)
4344                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4345                         else
4346                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4347                 } else {
4348                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4349                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4350                 }
4351
4352                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4353                 if (err < 0)
4354                         goto unlock;
4355
4356                 if (changed)
4357                         err = new_settings(hdev, sk);
4358
4359                 goto unlock;
4360         }
4361
4362         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4363             pending_find(MGMT_OP_SET_LE, hdev)) {
4364                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4365                                       MGMT_STATUS_BUSY);
4366                 goto unlock;
4367         }
4368
4369         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4370         if (!cmd) {
4371                 err = -ENOMEM;
4372                 goto unlock;
4373         }
4374
4375         hci_req_init(&req, hdev);
4376
4377         if (cp->val == 0x02)
4378                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4379         else
4380                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4381
4382         cancel_adv_timeout(hdev);
4383
4384         if (val) {
4385                 /* Switch to instance "0" for the Set Advertising setting.
4386                  * We cannot use update_[adv|scan_rsp]_data() here as the
4387                  * HCI_ADVERTISING flag is not yet set.
4388                  */
4389                 hdev->cur_adv_instance = 0x00;
4390
4391                 if (ext_adv_capable(hdev)) {
4392                         __hci_req_start_ext_adv(&req, 0x00);
4393                 } else {
4394                         __hci_req_update_adv_data(&req, 0x00);
4395                         __hci_req_update_scan_rsp_data(&req, 0x00);
4396                         __hci_req_enable_advertising(&req);
4397                 }
4398         } else {
4399                 __hci_req_disable_advertising(&req);
4400         }
4401
4402         err = hci_req_run(&req, set_advertising_complete);
4403         if (err < 0)
4404                 mgmt_pending_remove(cmd);
4405
4406 unlock:
4407         hci_dev_unlock(hdev);
4408         return err;
4409 }
4410
4411 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4412                               void *data, u16 len)
4413 {
4414         struct mgmt_cp_set_static_address *cp = data;
4415         int err;
4416
4417         BT_DBG("%s", hdev->name);
4418
4419         if (!lmp_le_capable(hdev))
4420                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4421                                        MGMT_STATUS_NOT_SUPPORTED);
4422
4423         if (hdev_is_powered(hdev))
4424                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4425                                        MGMT_STATUS_REJECTED);
4426
4427         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4428                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4429                         return mgmt_cmd_status(sk, hdev->id,
4430                                                MGMT_OP_SET_STATIC_ADDRESS,
4431                                                MGMT_STATUS_INVALID_PARAMS);
4432
4433                 /* Two most significant bits shall be set */
4434                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4435                         return mgmt_cmd_status(sk, hdev->id,
4436                                                MGMT_OP_SET_STATIC_ADDRESS,
4437                                                MGMT_STATUS_INVALID_PARAMS);
4438         }
4439
4440         hci_dev_lock(hdev);
4441
4442         bacpy(&hdev->static_addr, &cp->bdaddr);
4443
4444         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4445         if (err < 0)
4446                 goto unlock;
4447
4448         err = new_settings(hdev, sk);
4449
4450 unlock:
4451         hci_dev_unlock(hdev);
4452         return err;
4453 }
4454
4455 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4456                            void *data, u16 len)
4457 {
4458         struct mgmt_cp_set_scan_params *cp = data;
4459         __u16 interval, window;
4460         int err;
4461
4462         BT_DBG("%s", hdev->name);
4463
4464         if (!lmp_le_capable(hdev))
4465                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4466                                        MGMT_STATUS_NOT_SUPPORTED);
4467
4468         interval = __le16_to_cpu(cp->interval);
4469
4470         if (interval < 0x0004 || interval > 0x4000)
4471                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4472                                        MGMT_STATUS_INVALID_PARAMS);
4473
4474         window = __le16_to_cpu(cp->window);
4475
4476         if (window < 0x0004 || window > 0x4000)
4477                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4478                                        MGMT_STATUS_INVALID_PARAMS);
4479
4480         if (window > interval)
4481                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4482                                        MGMT_STATUS_INVALID_PARAMS);
4483
4484         hci_dev_lock(hdev);
4485
4486         hdev->le_scan_interval = interval;
4487         hdev->le_scan_window = window;
4488
4489         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4490                                 NULL, 0);
4491
4492         /* If background scan is running, restart it so new parameters are
4493          * loaded.
4494          */
4495         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4496             hdev->discovery.state == DISCOVERY_STOPPED) {
4497                 struct hci_request req;
4498
4499                 hci_req_init(&req, hdev);
4500
4501                 hci_req_add_le_scan_disable(&req);
4502                 hci_req_add_le_passive_scan(&req);
4503
4504                 hci_req_run(&req, NULL);
4505         }
4506
4507         hci_dev_unlock(hdev);
4508
4509         return err;
4510 }
4511
4512 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4513                                       u16 opcode)
4514 {
4515         struct mgmt_pending_cmd *cmd;
4516
4517         BT_DBG("status 0x%02x", status);
4518
4519         hci_dev_lock(hdev);
4520
4521         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4522         if (!cmd)
4523                 goto unlock;
4524
4525         if (status) {
4526                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4527                                 mgmt_status(status));
4528         } else {
4529                 struct mgmt_mode *cp = cmd->param;
4530
4531                 if (cp->val)
4532                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4533                 else
4534                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4535
4536                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4537                 new_settings(hdev, cmd->sk);
4538         }
4539
4540         mgmt_pending_remove(cmd);
4541
4542 unlock:
4543         hci_dev_unlock(hdev);
4544 }
4545
4546 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4547                                 void *data, u16 len)
4548 {
4549         struct mgmt_mode *cp = data;
4550         struct mgmt_pending_cmd *cmd;
4551         struct hci_request req;
4552         int err;
4553
4554         BT_DBG("%s", hdev->name);
4555
4556         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4557             hdev->hci_ver < BLUETOOTH_VER_1_2)
4558                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4559                                        MGMT_STATUS_NOT_SUPPORTED);
4560
4561         if (cp->val != 0x00 && cp->val != 0x01)
4562                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4563                                        MGMT_STATUS_INVALID_PARAMS);
4564
4565         hci_dev_lock(hdev);
4566
4567         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4568                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4569                                       MGMT_STATUS_BUSY);
4570                 goto unlock;
4571         }
4572
4573         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4574                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4575                                         hdev);
4576                 goto unlock;
4577         }
4578
4579         if (!hdev_is_powered(hdev)) {
4580                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4581                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4582                                         hdev);
4583                 new_settings(hdev, sk);
4584                 goto unlock;
4585         }
4586
4587         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4588                                data, len);
4589         if (!cmd) {
4590                 err = -ENOMEM;
4591                 goto unlock;
4592         }
4593
4594         hci_req_init(&req, hdev);
4595
4596         __hci_req_write_fast_connectable(&req, cp->val);
4597
4598         err = hci_req_run(&req, fast_connectable_complete);
4599         if (err < 0) {
4600                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4601                                       MGMT_STATUS_FAILED);
4602                 mgmt_pending_remove(cmd);
4603         }
4604
4605 unlock:
4606         hci_dev_unlock(hdev);
4607
4608         return err;
4609 }
4610
4611 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4612 {
4613         struct mgmt_pending_cmd *cmd;
4614
4615         BT_DBG("status 0x%02x", status);
4616
4617         hci_dev_lock(hdev);
4618
4619         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4620         if (!cmd)
4621                 goto unlock;
4622
4623         if (status) {
4624                 u8 mgmt_err = mgmt_status(status);
4625
4626                 /* We need to restore the flag if related HCI commands
4627                  * failed.
4628                  */
4629                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4630
4631                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4632         } else {
4633                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4634                 new_settings(hdev, cmd->sk);
4635         }
4636
4637         mgmt_pending_remove(cmd);
4638
4639 unlock:
4640         hci_dev_unlock(hdev);
4641 }
4642
4643 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4644 {
4645         struct mgmt_mode *cp = data;
4646         struct mgmt_pending_cmd *cmd;
4647         struct hci_request req;
4648         int err;
4649
4650         BT_DBG("request for %s", hdev->name);
4651
4652         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4653                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4654                                        MGMT_STATUS_NOT_SUPPORTED);
4655
4656         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4657                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4658                                        MGMT_STATUS_REJECTED);
4659
4660         if (cp->val != 0x00 && cp->val != 0x01)
4661                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4662                                        MGMT_STATUS_INVALID_PARAMS);
4663
4664         hci_dev_lock(hdev);
4665
4666         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4667                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4668                 goto unlock;
4669         }
4670
4671         if (!hdev_is_powered(hdev)) {
4672                 if (!cp->val) {
4673                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4674                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4675                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4676                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4677                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4678                 }
4679
4680                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4681
4682                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4683                 if (err < 0)
4684                         goto unlock;
4685
4686                 err = new_settings(hdev, sk);
4687                 goto unlock;
4688         }
4689
4690         /* Reject disabling when powered on */
4691         if (!cp->val) {
4692                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4693                                       MGMT_STATUS_REJECTED);
4694                 goto unlock;
4695         } else {
4696                 /* When configuring a dual-mode controller to operate
4697                  * with LE only and using a static address, then switching
4698                  * BR/EDR back on is not allowed.
4699                  *
4700                  * Dual-mode controllers shall operate with the public
4701                  * address as its identity address for BR/EDR and LE. So
4702                  * reject the attempt to create an invalid configuration.
4703                  *
4704                  * The same restrictions applies when secure connections
4705                  * has been enabled. For BR/EDR this is a controller feature
4706                  * while for LE it is a host stack feature. This means that
4707                  * switching BR/EDR back on when secure connections has been
4708                  * enabled is not a supported transaction.
4709                  */
4710                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4711                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4712                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
4713                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4714                                               MGMT_STATUS_REJECTED);
4715                         goto unlock;
4716                 }
4717         }
4718
4719         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
4720                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4721                                       MGMT_STATUS_BUSY);
4722                 goto unlock;
4723         }
4724
4725         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4726         if (!cmd) {
4727                 err = -ENOMEM;
4728                 goto unlock;
4729         }
4730
4731         /* We need to flip the bit already here so that
4732          * hci_req_update_adv_data generates the correct flags.
4733          */
4734         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
4735
4736         hci_req_init(&req, hdev);
4737
4738         __hci_req_write_fast_connectable(&req, false);
4739         __hci_req_update_scan(&req);
4740
4741         /* Since only the advertising data flags will change, there
4742          * is no need to update the scan response data.
4743          */
4744         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
4745
4746         err = hci_req_run(&req, set_bredr_complete);
4747         if (err < 0)
4748                 mgmt_pending_remove(cmd);
4749
4750 unlock:
4751         hci_dev_unlock(hdev);
4752         return err;
4753 }
4754
4755 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4756 {
4757         struct mgmt_pending_cmd *cmd;
4758         struct mgmt_mode *cp;
4759
4760         BT_DBG("%s status %u", hdev->name, status);
4761
4762         hci_dev_lock(hdev);
4763
4764         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4765         if (!cmd)
4766                 goto unlock;
4767
4768         if (status) {
4769                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
4770                                 mgmt_status(status));
4771                 goto remove;
4772         }
4773
4774         cp = cmd->param;
4775
4776         switch (cp->val) {
4777         case 0x00:
4778                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
4779                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4780                 break;
4781         case 0x01:
4782                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4783                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4784                 break;
4785         case 0x02:
4786                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4787                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4788                 break;
4789         }
4790
4791         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4792         new_settings(hdev, cmd->sk);
4793
4794 remove:
4795         mgmt_pending_remove(cmd);
4796 unlock:
4797         hci_dev_unlock(hdev);
4798 }
4799
4800 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4801                            void *data, u16 len)
4802 {
4803         struct mgmt_mode *cp = data;
4804         struct mgmt_pending_cmd *cmd;
4805         struct hci_request req;
4806         u8 val;
4807         int err;
4808
4809         BT_DBG("request for %s", hdev->name);
4810
4811         if (!lmp_sc_capable(hdev) &&
4812             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4813                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4814                                        MGMT_STATUS_NOT_SUPPORTED);
4815
4816         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4817             lmp_sc_capable(hdev) &&
4818             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
4819                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4820                                        MGMT_STATUS_REJECTED);
4821
4822         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4823                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4824                                   MGMT_STATUS_INVALID_PARAMS);
4825
4826         hci_dev_lock(hdev);
4827
4828         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4829             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4830                 bool changed;
4831
4832                 if (cp->val) {
4833                         changed = !hci_dev_test_and_set_flag(hdev,
4834                                                              HCI_SC_ENABLED);
4835                         if (cp->val == 0x02)
4836                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4837                         else
4838                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4839                 } else {
4840                         changed = hci_dev_test_and_clear_flag(hdev,
4841                                                               HCI_SC_ENABLED);
4842                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4843                 }
4844
4845                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4846                 if (err < 0)
4847                         goto failed;
4848
4849                 if (changed)
4850                         err = new_settings(hdev, sk);
4851
4852                 goto failed;
4853         }
4854
4855         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4856                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4857                                       MGMT_STATUS_BUSY);
4858                 goto failed;
4859         }
4860
4861         val = !!cp->val;
4862
4863         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
4864             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4865                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4866                 goto failed;
4867         }
4868
4869         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4870         if (!cmd) {
4871                 err = -ENOMEM;
4872                 goto failed;
4873         }
4874
4875         hci_req_init(&req, hdev);
4876         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4877         err = hci_req_run(&req, sc_enable_complete);
4878         if (err < 0) {
4879                 mgmt_pending_remove(cmd);
4880                 goto failed;
4881         }
4882
4883 failed:
4884         hci_dev_unlock(hdev);
4885         return err;
4886 }
4887
4888 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4889                           void *data, u16 len)
4890 {
4891         struct mgmt_mode *cp = data;
4892         bool changed, use_changed;
4893         int err;
4894
4895         BT_DBG("request for %s", hdev->name);
4896
4897         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4898                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4899                                        MGMT_STATUS_INVALID_PARAMS);
4900
4901         hci_dev_lock(hdev);
4902
4903         if (cp->val)
4904                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4905         else
4906                 changed = hci_dev_test_and_clear_flag(hdev,
4907                                                       HCI_KEEP_DEBUG_KEYS);
4908
4909         if (cp->val == 0x02)
4910                 use_changed = !hci_dev_test_and_set_flag(hdev,
4911                                                          HCI_USE_DEBUG_KEYS);
4912         else
4913                 use_changed = hci_dev_test_and_clear_flag(hdev,
4914                                                           HCI_USE_DEBUG_KEYS);
4915
4916         if (hdev_is_powered(hdev) && use_changed &&
4917             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
4918                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4919                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4920                              sizeof(mode), &mode);
4921         }
4922
4923         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4924         if (err < 0)
4925                 goto unlock;
4926
4927         if (changed)
4928                 err = new_settings(hdev, sk);
4929
4930 unlock:
4931         hci_dev_unlock(hdev);
4932         return err;
4933 }
4934
4935 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4936                        u16 len)
4937 {
4938         struct mgmt_cp_set_privacy *cp = cp_data;
4939         bool changed;
4940         int err;
4941
4942         BT_DBG("request for %s", hdev->name);
4943
4944         if (!lmp_le_capable(hdev))
4945                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4946                                        MGMT_STATUS_NOT_SUPPORTED);
4947
4948         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
4949                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4950                                        MGMT_STATUS_INVALID_PARAMS);
4951
4952         if (hdev_is_powered(hdev))
4953                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4954                                        MGMT_STATUS_REJECTED);
4955
4956         hci_dev_lock(hdev);
4957
4958         /* If user space supports this command it is also expected to
4959          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4960          */
4961         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4962
4963         if (cp->privacy) {
4964                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
4965                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4966                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
4967                 hci_adv_instances_set_rpa_expired(hdev, true);
4968                 if (cp->privacy == 0x02)
4969                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
4970                 else
4971                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4972         } else {
4973                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
4974                 memset(hdev->irk, 0, sizeof(hdev->irk));
4975                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
4976                 hci_adv_instances_set_rpa_expired(hdev, false);
4977                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4978         }
4979
4980         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4981         if (err < 0)
4982                 goto unlock;
4983
4984         if (changed)
4985                 err = new_settings(hdev, sk);
4986
4987 unlock:
4988         hci_dev_unlock(hdev);
4989         return err;
4990 }
4991
4992 static bool irk_is_valid(struct mgmt_irk_info *irk)
4993 {
4994         switch (irk->addr.type) {
4995         case BDADDR_LE_PUBLIC:
4996                 return true;
4997
4998         case BDADDR_LE_RANDOM:
4999                 /* Two most significant bits shall be set */
5000                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5001                         return false;
5002                 return true;
5003         }
5004
5005         return false;
5006 }
5007
5008 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5009                      u16 len)
5010 {
5011         struct mgmt_cp_load_irks *cp = cp_data;
5012         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5013                                    sizeof(struct mgmt_irk_info));
5014         u16 irk_count, expected_len;
5015         int i, err;
5016
5017         BT_DBG("request for %s", hdev->name);
5018
5019         if (!lmp_le_capable(hdev))
5020                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5021                                        MGMT_STATUS_NOT_SUPPORTED);
5022
5023         irk_count = __le16_to_cpu(cp->irk_count);
5024         if (irk_count > max_irk_count) {
5025                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
5026                            irk_count);
5027                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5028                                        MGMT_STATUS_INVALID_PARAMS);
5029         }
5030
5031         expected_len = struct_size(cp, irks, irk_count);
5032         if (expected_len != len) {
5033                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
5034                            expected_len, len);
5035                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5036                                        MGMT_STATUS_INVALID_PARAMS);
5037         }
5038
5039         BT_DBG("%s irk_count %u", hdev->name, irk_count);
5040
5041         for (i = 0; i < irk_count; i++) {
5042                 struct mgmt_irk_info *key = &cp->irks[i];
5043
5044                 if (!irk_is_valid(key))
5045                         return mgmt_cmd_status(sk, hdev->id,
5046                                                MGMT_OP_LOAD_IRKS,
5047                                                MGMT_STATUS_INVALID_PARAMS);
5048         }
5049
5050         hci_dev_lock(hdev);
5051
5052         hci_smp_irks_clear(hdev);
5053
5054         for (i = 0; i < irk_count; i++) {
5055                 struct mgmt_irk_info *irk = &cp->irks[i];
5056
5057                 hci_add_irk(hdev, &irk->addr.bdaddr,
5058                             le_addr_type(irk->addr.type), irk->val,
5059                             BDADDR_ANY);
5060         }
5061
5062         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5063
5064         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5065
5066         hci_dev_unlock(hdev);
5067
5068         return err;
5069 }
5070
5071 #ifdef TIZEN_BT
5072 static int set_advertising_params(struct sock *sk, struct hci_dev *hdev,
5073                         void *data, u16 len)
5074 {
5075         struct mgmt_cp_set_advertising_params *cp = data;
5076         __u16 min_interval;
5077         __u16 max_interval;
5078         int err;
5079
5080         BT_DBG("%s", hdev->name);
5081
5082         if (!lmp_le_capable(hdev))
5083                 return mgmt_cmd_status(sk, hdev->id,
5084                                 MGMT_OP_SET_ADVERTISING_PARAMS,
5085                                 MGMT_STATUS_NOT_SUPPORTED);
5086
5087         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
5088                 return mgmt_cmd_status(sk, hdev->id,
5089                                 MGMT_OP_SET_ADVERTISING_PARAMS,
5090                                 MGMT_STATUS_BUSY);
5091
5092         min_interval = __le16_to_cpu(cp->interval_min);
5093         max_interval = __le16_to_cpu(cp->interval_max);
5094
5095         if (min_interval > max_interval ||
5096             min_interval < 0x0020 || max_interval > 0x4000)
5097                 return mgmt_cmd_status(sk, hdev->id,
5098                                 MGMT_OP_SET_ADVERTISING_PARAMS,
5099                                 MGMT_STATUS_INVALID_PARAMS);
5100
5101         hci_dev_lock(hdev);
5102
5103         hdev->le_adv_min_interval = min_interval;
5104         hdev->le_adv_max_interval = max_interval;
5105         hdev->adv_filter_policy = cp->filter_policy;
5106         hdev->adv_type = cp->type;
5107
5108         err = mgmt_cmd_complete(sk, hdev->id,
5109                         MGMT_OP_SET_ADVERTISING_PARAMS, 0, NULL, 0);
5110
5111         hci_dev_unlock(hdev);
5112
5113         return err;
5114 }
5115
5116 static void set_advertising_data_complete(struct hci_dev *hdev,
5117                         u8 status, u16 opcode)
5118 {
5119         struct mgmt_cp_set_advertising_data *cp;
5120         struct mgmt_pending_cmd *cmd;
5121
5122         BT_DBG("status 0x%02x", status);
5123
5124         hci_dev_lock(hdev);
5125
5126         cmd = pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev);
5127         if (!cmd)
5128                 goto unlock;
5129
5130         cp = cmd->param;
5131
5132         if (status)
5133                 mgmt_cmd_status(cmd->sk, hdev->id,
5134                                 MGMT_OP_SET_ADVERTISING_DATA,
5135                                 mgmt_status(status));
5136         else
5137                 mgmt_cmd_complete(cmd->sk, hdev->id,
5138                                 MGMT_OP_SET_ADVERTISING_DATA, 0,
5139                                 cp, sizeof(*cp));
5140
5141         mgmt_pending_remove(cmd);
5142
5143 unlock:
5144         hci_dev_unlock(hdev);
5145 }
5146
5147 static int set_advertising_data(struct sock *sk, struct hci_dev *hdev,
5148                         void *data, u16 len)
5149 {
5150         struct mgmt_pending_cmd *cmd;
5151         struct hci_request req;
5152         struct mgmt_cp_set_advertising_data *cp = data;
5153         struct hci_cp_le_set_adv_data adv;
5154         int err;
5155
5156         BT_DBG("%s", hdev->name);
5157
5158         if (!lmp_le_capable(hdev)) {
5159                 return mgmt_cmd_status(sk, hdev->id,
5160                                 MGMT_OP_SET_ADVERTISING_DATA,
5161                                 MGMT_STATUS_NOT_SUPPORTED);
5162         }
5163
5164         hci_dev_lock(hdev);
5165
5166         if (pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev)) {
5167                 err = mgmt_cmd_status(sk, hdev->id,
5168                                 MGMT_OP_SET_ADVERTISING_DATA,
5169                                 MGMT_STATUS_BUSY);
5170                 goto unlocked;
5171         }
5172
5173         if (len > HCI_MAX_AD_LENGTH) {
5174                 err = mgmt_cmd_status(sk, hdev->id,
5175                                 MGMT_OP_SET_ADVERTISING_DATA,
5176                                 MGMT_STATUS_INVALID_PARAMS);
5177                 goto unlocked;
5178         }
5179
5180         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING_DATA,
5181                                hdev, data, len);
5182         if (!cmd) {
5183                 err = -ENOMEM;
5184                 goto unlocked;
5185         }
5186
5187         hci_req_init(&req, hdev);
5188
5189         memset(&adv, 0, sizeof(adv));
5190         memcpy(adv.data, cp->data, len);
5191         adv.length = len;
5192
5193         hci_req_add(&req, HCI_OP_LE_SET_ADV_DATA, sizeof(adv), &adv);
5194
5195         err = hci_req_run(&req, set_advertising_data_complete);
5196         if (err < 0)
5197                 mgmt_pending_remove(cmd);
5198
5199 unlocked:
5200         hci_dev_unlock(hdev);
5201
5202         return err;
5203 }
5204
5205 static void set_scan_rsp_data_complete(struct hci_dev *hdev, u8 status,
5206                         u16 opcode)
5207 {
5208         struct mgmt_cp_set_scan_rsp_data *cp;
5209         struct mgmt_pending_cmd *cmd;
5210
5211         BT_DBG("status 0x%02x", status);
5212
5213         hci_dev_lock(hdev);
5214
5215         cmd = pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev);
5216         if (!cmd)
5217                 goto unlock;
5218
5219         cp = cmd->param;
5220
5221         if (status)
5222                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
5223                                 mgmt_status(status));
5224         else
5225                 mgmt_cmd_complete(cmd->sk, hdev->id,
5226                                 MGMT_OP_SET_SCAN_RSP_DATA, 0,
5227                                 cp, sizeof(*cp));
5228
5229         mgmt_pending_remove(cmd);
5230
5231 unlock:
5232         hci_dev_unlock(hdev);
5233 }
5234
5235 static int set_scan_rsp_data(struct sock *sk, struct hci_dev *hdev, void *data,
5236                         u16 len)
5237 {
5238         struct mgmt_pending_cmd *cmd;
5239         struct hci_request req;
5240         struct mgmt_cp_set_scan_rsp_data *cp = data;
5241         struct hci_cp_le_set_scan_rsp_data rsp;
5242         int err;
5243
5244         BT_DBG("%s", hdev->name);
5245
5246         if (!lmp_le_capable(hdev))
5247                 return mgmt_cmd_status(sk, hdev->id,
5248                                 MGMT_OP_SET_SCAN_RSP_DATA,
5249                                 MGMT_STATUS_NOT_SUPPORTED);
5250
5251         hci_dev_lock(hdev);
5252
5253         if (pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev)) {
5254                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
5255                                 MGMT_STATUS_BUSY);
5256                 goto unlocked;
5257         }
5258
5259         if (len > HCI_MAX_AD_LENGTH) {
5260                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
5261                                 MGMT_STATUS_INVALID_PARAMS);
5262                 goto unlocked;
5263         }
5264
5265         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SCAN_RSP_DATA, hdev, data, len);
5266         if (!cmd) {
5267                 err = -ENOMEM;
5268                 goto unlocked;
5269         }
5270
5271         hci_req_init(&req, hdev);
5272
5273         memset(&rsp, 0, sizeof(rsp));
5274         memcpy(rsp.data, cp->data, len);
5275         rsp.length = len;
5276
5277         hci_req_add(&req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(rsp), &rsp);
5278
5279         err = hci_req_run(&req, set_scan_rsp_data_complete);
5280         if (err < 0)
5281                 mgmt_pending_remove(cmd);
5282
5283 unlocked:
5284         hci_dev_unlock(hdev);
5285
5286         return err;
5287 }
5288
5289 /* Adv White List feature */
5290 static void add_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5291 {
5292         struct mgmt_cp_add_dev_white_list *cp;
5293         struct mgmt_pending_cmd *cmd;
5294
5295         BT_DBG("status 0x%02x", status);
5296
5297         hci_dev_lock(hdev);
5298
5299         cmd = pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev);
5300         if (!cmd)
5301                 goto unlock;
5302
5303         cp = cmd->param;
5304
5305         if (status)
5306                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
5307                            mgmt_status(status));
5308         else
5309                 mgmt_cmd_complete(cmd->sk, hdev->id,
5310                                 MGMT_OP_ADD_DEV_WHITE_LIST, 0, cp, sizeof(*cp));
5311
5312         mgmt_pending_remove(cmd);
5313
5314 unlock:
5315         hci_dev_unlock(hdev);
5316 }
5317
5318 static int add_white_list(struct sock *sk, struct hci_dev *hdev,
5319                            void *data, u16 len)
5320 {
5321         struct mgmt_pending_cmd *cmd;
5322         struct mgmt_cp_add_dev_white_list *cp = data;
5323         struct hci_request req;
5324         int err;
5325
5326         BT_DBG("%s", hdev->name);
5327
5328         if (!lmp_le_capable(hdev))
5329                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
5330                                   MGMT_STATUS_NOT_SUPPORTED);
5331
5332         if (!hdev_is_powered(hdev))
5333                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
5334                                   MGMT_STATUS_REJECTED);
5335
5336         hci_dev_lock(hdev);
5337
5338         if (pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev)) {
5339                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
5340                                 MGMT_STATUS_BUSY);
5341                 goto unlocked;
5342         }
5343
5344         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEV_WHITE_LIST, hdev, data, len);
5345         if (!cmd) {
5346                 err = -ENOMEM;
5347                 goto unlocked;
5348         }
5349
5350         hci_req_init(&req, hdev);
5351
5352         hci_req_add(&req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(*cp), cp);
5353
5354         err = hci_req_run(&req, add_white_list_complete);
5355         if (err < 0) {
5356                 mgmt_pending_remove(cmd);
5357                 goto unlocked;
5358         }
5359
5360 unlocked:
5361         hci_dev_unlock(hdev);
5362
5363         return err;
5364 }
5365
5366 static void remove_from_white_list_complete(struct hci_dev *hdev,
5367                         u8 status, u16 opcode)
5368 {
5369         struct mgmt_cp_remove_dev_from_white_list *cp;
5370         struct mgmt_pending_cmd *cmd;
5371
5372         BT_DBG("status 0x%02x", status);
5373
5374         hci_dev_lock(hdev);
5375
5376         cmd = pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev);
5377         if (!cmd)
5378                 goto unlock;
5379
5380         cp = cmd->param;
5381
5382         if (status)
5383                 mgmt_cmd_status(cmd->sk, hdev->id,
5384                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
5385                         mgmt_status(status));
5386         else
5387                 mgmt_cmd_complete(cmd->sk, hdev->id,
5388                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, 0,
5389                         cp, sizeof(*cp));
5390
5391         mgmt_pending_remove(cmd);
5392
5393 unlock:
5394         hci_dev_unlock(hdev);
5395 }
5396
5397 static int remove_from_white_list(struct sock *sk, struct hci_dev *hdev,
5398                            void *data, u16 len)
5399 {
5400         struct mgmt_pending_cmd *cmd;
5401         struct mgmt_cp_remove_dev_from_white_list *cp = data;
5402         struct hci_request req;
5403         int err;
5404
5405         BT_DBG("%s", hdev->name);
5406
5407         if (!lmp_le_capable(hdev))
5408                 return mgmt_cmd_status(sk, hdev->id,
5409                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
5410                                 MGMT_STATUS_NOT_SUPPORTED);
5411
5412         if (!hdev_is_powered(hdev))
5413                 return mgmt_cmd_status(sk, hdev->id,
5414                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
5415                                 MGMT_STATUS_REJECTED);
5416
5417         hci_dev_lock(hdev);
5418
5419         if (pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev)) {
5420                 err = mgmt_cmd_status(sk, hdev->id,
5421                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
5422                                 MGMT_STATUS_BUSY);
5423                 goto unlocked;
5424         }
5425
5426         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
5427                                 hdev, data, len);
5428         if (!cmd) {
5429                 err = -ENOMEM;
5430                 goto unlocked;
5431         }
5432
5433         hci_req_init(&req, hdev);
5434
5435         hci_req_add(&req, HCI_OP_LE_DEL_FROM_WHITE_LIST, sizeof(*cp), cp);
5436
5437         err = hci_req_run(&req, remove_from_white_list_complete);
5438         if (err < 0) {
5439                 mgmt_pending_remove(cmd);
5440                 goto unlocked;
5441         }
5442
5443 unlocked:
5444         hci_dev_unlock(hdev);
5445
5446         return err;
5447 }
5448
5449 static void clear_white_list_complete(struct hci_dev *hdev, u8 status,
5450                         u16 opcode)
5451 {
5452         struct mgmt_pending_cmd *cmd;
5453
5454         BT_DBG("status 0x%02x", status);
5455
5456         hci_dev_lock(hdev);
5457
5458         cmd = pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev);
5459         if (!cmd)
5460                 goto unlock;
5461
5462         if (status)
5463                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
5464                            mgmt_status(status));
5465         else
5466                 mgmt_cmd_complete(cmd->sk, hdev->id,
5467                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
5468                                 0, NULL, 0);
5469
5470         mgmt_pending_remove(cmd);
5471
5472 unlock:
5473         hci_dev_unlock(hdev);
5474 }
5475
5476 static int clear_white_list(struct sock *sk, struct hci_dev *hdev,
5477                            void *data, u16 len)
5478 {
5479         struct mgmt_pending_cmd *cmd;
5480         struct hci_request req;
5481         int err;
5482
5483         BT_DBG("%s", hdev->name);
5484
5485         if (!lmp_le_capable(hdev))
5486                 return mgmt_cmd_status(sk, hdev->id,
5487                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
5488                                 MGMT_STATUS_NOT_SUPPORTED);
5489
5490         if (!hdev_is_powered(hdev))
5491                 return mgmt_cmd_status(sk, hdev->id,
5492                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
5493                                 MGMT_STATUS_REJECTED);
5494
5495         hci_dev_lock(hdev);
5496
5497         if (pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev)) {
5498                 err = mgmt_cmd_status(sk, hdev->id,
5499                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
5500                                 MGMT_STATUS_BUSY);
5501                 goto unlocked;
5502         }
5503
5504         cmd = mgmt_pending_add(sk, MGMT_OP_CLEAR_DEV_WHITE_LIST,
5505                                 hdev, NULL, 0);
5506         if (!cmd) {
5507                 err = -ENOMEM;
5508                 goto unlocked;
5509         }
5510
5511         hci_req_init(&req, hdev);
5512
5513         hci_req_add(&req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
5514
5515         err = hci_req_run(&req, clear_white_list_complete);
5516         if (err < 0) {
5517                 mgmt_pending_remove(cmd);
5518                 goto unlocked;
5519         }
5520
5521 unlocked:
5522         hci_dev_unlock(hdev);
5523
5524         return err;
5525 }
5526
5527 static void set_rssi_threshold_complete(struct hci_dev *hdev,
5528                         u8 status, u16 opcode)
5529 {
5530         struct mgmt_pending_cmd *cmd;
5531
5532         BT_DBG("status 0x%02x", status);
5533
5534         hci_dev_lock(hdev);
5535
5536         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
5537         if (!cmd)
5538                 goto unlock;
5539
5540         if (status)
5541                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
5542                                 mgmt_status(status));
5543         else
5544                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
5545                                 NULL, 0);
5546
5547         mgmt_pending_remove(cmd);
5548
5549 unlock:
5550         hci_dev_unlock(hdev);
5551 }
5552
5553 static void set_rssi_disable_complete(struct hci_dev *hdev,
5554                         u8 status, u16 opcode)
5555 {
5556         struct mgmt_pending_cmd *cmd;
5557
5558         BT_DBG("status 0x%02x", status);
5559
5560         hci_dev_lock(hdev);
5561
5562         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
5563         if (!cmd)
5564                 goto unlock;
5565
5566         if (status)
5567                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
5568                                 mgmt_status(status));
5569         else
5570                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
5571                                 0, NULL, 0);
5572
5573         mgmt_pending_remove(cmd);
5574
5575 unlock:
5576         hci_dev_unlock(hdev);
5577 }
5578
5579 int mgmt_set_rssi_threshold(struct sock *sk, struct hci_dev *hdev,
5580                 void *data, u16 len)
5581 {
5582         int err = 0;
5583         struct hci_cp_set_rssi_threshold th = { 0, };
5584         struct mgmt_cp_set_enable_rssi *cp = data;
5585         struct hci_conn *conn;
5586         struct mgmt_pending_cmd *cmd;
5587         struct hci_request req;
5588         __u8 dest_type;
5589
5590         hci_dev_lock(hdev);
5591
5592         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
5593         if (!cmd) {
5594                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
5595                                 MGMT_STATUS_FAILED);
5596                 goto unlocked;
5597         }
5598
5599         if (!lmp_le_capable(hdev)) {
5600                 mgmt_pending_remove(cmd);
5601                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
5602                                 MGMT_STATUS_NOT_SUPPORTED);
5603                 goto unlocked;
5604         }
5605
5606         if (!hdev_is_powered(hdev)) {
5607                 BT_DBG("%s", hdev->name);
5608                 mgmt_pending_remove(cmd);
5609                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
5610                                 MGMT_STATUS_NOT_POWERED);
5611                 goto unlocked;
5612         }
5613
5614         if (cp->link_type == 0x01)
5615                 dest_type = LE_LINK;
5616         else
5617                 dest_type = ACL_LINK;
5618
5619         /* Get LE/ACL link handle info */
5620         conn = hci_conn_hash_lookup_ba(hdev,
5621                         dest_type, &cp->bdaddr);
5622
5623         if (!conn) {
5624                 err = mgmt_cmd_complete(sk, hdev->id,
5625                                 MGMT_OP_SET_RSSI_ENABLE, 1, NULL, 0);
5626                 mgmt_pending_remove(cmd);
5627                 goto unlocked;
5628         }
5629
5630         hci_req_init(&req, hdev);
5631
5632         th.hci_le_ext_opcode = 0x0B;
5633         th.mode = 0x01;
5634         th.conn_handle = conn->handle;
5635         th.alert_mask = 0x07;
5636         th.low_th = cp->low_th;
5637         th.in_range_th = cp->in_range_th;
5638         th.high_th = cp->high_th;
5639
5640         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
5641         err = hci_req_run(&req, set_rssi_threshold_complete);
5642
5643         if (err < 0) {
5644                 mgmt_pending_remove(cmd);
5645                 BT_ERR("Error in requesting hci_req_run");
5646                 goto unlocked;
5647         }
5648
5649 unlocked:
5650         hci_dev_unlock(hdev);
5651         return err;
5652 }
5653
5654 void mgmt_rssi_enable_success(struct sock *sk, struct hci_dev *hdev,
5655                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
5656 {
5657         struct mgmt_cc_rsp_enable_rssi mgmt_rp = { 0, };
5658         struct mgmt_cp_set_enable_rssi *cp = data;
5659         struct mgmt_pending_cmd *cmd;
5660
5661         if (!cp || !rp)
5662                 goto remove_cmd;
5663
5664         mgmt_rp.status = rp->status;
5665         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
5666         mgmt_rp.bt_address = cp->bdaddr;
5667         mgmt_rp.link_type = cp->link_type;
5668
5669         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
5670                         MGMT_STATUS_SUCCESS, &mgmt_rp,
5671                         sizeof(struct mgmt_cc_rsp_enable_rssi));
5672
5673         mgmt_event(MGMT_EV_RSSI_ENABLED, hdev, &mgmt_rp,
5674                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
5675
5676         hci_conn_rssi_unset_all(hdev, mgmt_rp.link_type);
5677         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
5678                         &mgmt_rp.bt_address, true);
5679
5680 remove_cmd:
5681         hci_dev_lock(hdev);
5682         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
5683         if (cmd)
5684                 mgmt_pending_remove(cmd);
5685
5686         hci_dev_unlock(hdev);
5687 }
5688
5689 void mgmt_rssi_disable_success(struct sock *sk, struct hci_dev *hdev,
5690                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
5691 {
5692         struct mgmt_cc_rp_disable_rssi mgmt_rp = { 0, };
5693         struct mgmt_cp_disable_rssi *cp = data;
5694         struct mgmt_pending_cmd *cmd;
5695
5696         if (!cp || !rp)
5697                 goto remove_cmd;
5698
5699         mgmt_rp.status = rp->status;
5700         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
5701         mgmt_rp.bt_address = cp->bdaddr;
5702         mgmt_rp.link_type = cp->link_type;
5703
5704         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
5705                         MGMT_STATUS_SUCCESS, &mgmt_rp,
5706                         sizeof(struct mgmt_cc_rsp_enable_rssi));
5707
5708         mgmt_event(MGMT_EV_RSSI_DISABLED, hdev, &mgmt_rp,
5709                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
5710
5711         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
5712                         &mgmt_rp.bt_address, false);
5713
5714 remove_cmd:
5715         hci_dev_lock(hdev);
5716         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
5717         if (cmd)
5718                 mgmt_pending_remove(cmd);
5719
5720         hci_dev_unlock(hdev);
5721 }
5722
5723 static int mgmt_set_disable_rssi(struct sock *sk, struct hci_dev *hdev,
5724                 void *data, u16 len)
5725 {
5726         struct mgmt_pending_cmd *cmd;
5727         struct hci_request req;
5728         struct hci_cp_set_enable_rssi cp_en = { 0, };
5729         int err;
5730
5731         BT_DBG("Set Disable RSSI.");
5732
5733         cp_en.hci_le_ext_opcode = 0x01;
5734         cp_en.le_enable_cs_Features = 0x00;
5735         cp_en.data[0] = 0x00;
5736         cp_en.data[1] = 0x00;
5737         cp_en.data[2] = 0x00;
5738
5739         hci_dev_lock(hdev);
5740
5741         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
5742         if (!cmd) {
5743                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
5744                                 MGMT_STATUS_FAILED);
5745                 goto unlocked;
5746         }
5747
5748         if (!lmp_le_capable(hdev)) {
5749                 mgmt_pending_remove(cmd);
5750                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
5751                                 MGMT_STATUS_NOT_SUPPORTED);
5752                 goto unlocked;
5753         }
5754
5755         if (!hdev_is_powered(hdev)) {
5756                 BT_DBG("%s", hdev->name);
5757                 mgmt_pending_remove(cmd);
5758                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
5759                                 MGMT_STATUS_NOT_POWERED);
5760                 goto unlocked;
5761         }
5762
5763         hci_req_init(&req, hdev);
5764
5765         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
5766                         sizeof(struct hci_cp_set_enable_rssi),
5767                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
5768                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
5769
5770         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
5771         err = hci_req_run(&req, set_rssi_disable_complete);
5772
5773         if (err < 0) {
5774                 mgmt_pending_remove(cmd);
5775                 BT_ERR("Error in requesting hci_req_run");
5776                 goto unlocked;
5777         }
5778
5779 unlocked:
5780         hci_dev_unlock(hdev);
5781         return err;
5782 }
5783
5784 void mgmt_enable_rssi_cc(struct hci_dev *hdev, void *response, u8 status)
5785 {
5786         struct hci_cc_rsp_enable_rssi *rp = response;
5787         struct mgmt_pending_cmd *cmd_enable = NULL;
5788         struct mgmt_pending_cmd *cmd_disable = NULL;
5789         struct mgmt_cp_set_enable_rssi *cp_en;
5790         struct mgmt_cp_disable_rssi *cp_dis;
5791
5792         hci_dev_lock(hdev);
5793         cmd_enable = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
5794         cmd_disable = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
5795         hci_dev_unlock(hdev);
5796
5797         if (cmd_enable)
5798                 BT_DBG("Enable Request");
5799
5800         if (cmd_disable)
5801                 BT_DBG("Disable Request");
5802
5803         if (cmd_enable) {
5804                 cp_en = cmd_enable->param;
5805
5806                 if (status != 0x00)
5807                         return;
5808
5809                 switch (rp->le_ext_opcode) {
5810                 case 0x01:
5811                         BT_DBG("RSSI enabled.. Setting Threshold...");
5812                         mgmt_set_rssi_threshold(cmd_enable->sk, hdev,
5813                                         cp_en, sizeof(*cp_en));
5814                         break;
5815
5816                 case 0x0B:
5817                         BT_DBG("Sending RSSI enable success");
5818                         mgmt_rssi_enable_success(cmd_enable->sk, hdev,
5819                                         cp_en, rp, rp->status);
5820                         break;
5821                 }
5822
5823         } else if (cmd_disable) {
5824                 cp_dis = cmd_disable->param;
5825
5826                 if (status != 0x00)
5827                         return;
5828
5829                 switch (rp->le_ext_opcode) {
5830                 case 0x01:
5831                         BT_DBG("Sending RSSI disable success");
5832                         mgmt_rssi_disable_success(cmd_disable->sk, hdev,
5833                                         cp_dis, rp, rp->status);
5834                         break;
5835
5836                 case 0x0B:
5837                         /*
5838                          * Only unset RSSI Threshold values for the Link if
5839                          * RSSI is monitored for other BREDR or LE Links
5840                          */
5841                         if (hci_conn_hash_lookup_rssi_count(hdev) > 1) {
5842                                 BT_DBG("Unset Threshold. Other links being monitored");
5843                                 mgmt_rssi_disable_success(cmd_disable->sk, hdev,
5844                                                 cp_dis, rp, rp->status);
5845                         } else {
5846                                 BT_DBG("Unset Threshold. Disabling...");
5847                                 mgmt_set_disable_rssi(cmd_disable->sk, hdev,
5848                                                 cp_dis, sizeof(*cp_dis));
5849                         }
5850                         break;
5851                 }
5852         }
5853 }
5854
5855 static void set_rssi_enable_complete(struct hci_dev *hdev, u8 status,
5856                 u16 opcode)
5857 {
5858         struct mgmt_pending_cmd *cmd;
5859
5860         BT_DBG("status 0x%02x", status);
5861
5862         hci_dev_lock(hdev);
5863
5864         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
5865         if (!cmd)
5866                 goto unlock;
5867
5868         if (status)
5869                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
5870                                 mgmt_status(status));
5871         else
5872                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
5873                                 NULL, 0);
5874
5875         mgmt_pending_remove(cmd);
5876
5877 unlock:
5878         hci_dev_unlock(hdev);
5879 }
5880
5881 static int set_enable_rssi(struct sock *sk, struct hci_dev *hdev,
5882                 void *data, u16 len)
5883 {
5884         struct mgmt_pending_cmd *cmd;
5885         struct hci_request req;
5886         struct mgmt_cp_set_enable_rssi *cp = data;
5887         struct hci_cp_set_enable_rssi cp_en = { 0, };
5888         int err;
5889
5890         BT_DBG("Set Enable RSSI.");
5891
5892         cp_en.hci_le_ext_opcode = 0x01;
5893         cp_en.le_enable_cs_Features = 0x04;
5894         cp_en.data[0] = 0x00;
5895         cp_en.data[1] = 0x00;
5896         cp_en.data[2] = 0x00;
5897
5898         hci_dev_lock(hdev);
5899
5900         if (!lmp_le_capable(hdev)) {
5901                 err =  mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
5902                                 MGMT_STATUS_NOT_SUPPORTED);
5903                 goto unlocked;
5904         }
5905
5906         if (!hdev_is_powered(hdev)) {
5907                 BT_DBG("%s", hdev->name);
5908                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
5909                                 MGMT_STATUS_NOT_POWERED);
5910                 goto unlocked;
5911         }
5912
5913         if (pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev)) {
5914                 BT_DBG("%s", hdev->name);
5915                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
5916                                 MGMT_STATUS_BUSY);
5917                 goto unlocked;
5918         }
5919
5920         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_ENABLE, hdev, cp,
5921                         sizeof(*cp));
5922         if (!cmd) {
5923                 BT_DBG("%s", hdev->name);
5924                 err = -ENOMEM;
5925                 goto unlocked;
5926         }
5927
5928         /* If RSSI is already enabled directly set Threshold values */
5929         if (hci_conn_hash_lookup_rssi_count(hdev) > 0) {
5930                 hci_dev_unlock(hdev);
5931                 BT_DBG("RSSI Enabled. Directly set Threshold");
5932                 err = mgmt_set_rssi_threshold(sk, hdev, cp, sizeof(*cp));
5933                 return err;
5934         }
5935
5936         hci_req_init(&req, hdev);
5937
5938         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
5939                         sizeof(struct hci_cp_set_enable_rssi),
5940                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
5941                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
5942
5943         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
5944         err = hci_req_run(&req, set_rssi_enable_complete);
5945
5946         if (err < 0) {
5947                 mgmt_pending_remove(cmd);
5948                 BT_ERR("Error in requesting hci_req_run");
5949                 goto unlocked;
5950         }
5951
5952 unlocked:
5953         hci_dev_unlock(hdev);
5954
5955         return err;
5956 }
5957
5958 static void get_raw_rssi_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5959 {
5960         struct mgmt_pending_cmd *cmd;
5961
5962         BT_DBG("status 0x%02x", status);
5963
5964         hci_dev_lock(hdev);
5965
5966         cmd = pending_find(MGMT_OP_GET_RAW_RSSI, hdev);
5967         if (!cmd)
5968                 goto unlock;
5969
5970         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
5971                         MGMT_STATUS_SUCCESS, &status, 1);
5972
5973         mgmt_pending_remove(cmd);
5974
5975 unlock:
5976         hci_dev_unlock(hdev);
5977 }
5978
5979 static int get_raw_rssi(struct sock *sk, struct hci_dev *hdev, void *data,
5980                         u16 len)
5981 {
5982         struct mgmt_pending_cmd *cmd;
5983         struct hci_request req;
5984         struct mgmt_cp_get_raw_rssi *cp = data;
5985         struct hci_cp_get_raw_rssi hci_cp;
5986
5987         struct hci_conn *conn;
5988         int err;
5989         __u8 dest_type;
5990
5991         BT_DBG("Get Raw RSSI.");
5992
5993         hci_dev_lock(hdev);
5994
5995         if (!lmp_le_capable(hdev)) {
5996                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
5997                                 MGMT_STATUS_NOT_SUPPORTED);
5998                 goto unlocked;
5999         }
6000
6001         if (cp->link_type == 0x01)
6002                 dest_type = LE_LINK;
6003         else
6004                 dest_type = ACL_LINK;
6005
6006         /* Get LE/BREDR link handle info */
6007         conn = hci_conn_hash_lookup_ba(hdev,
6008                         dest_type, &cp->bt_address);
6009         if (!conn) {
6010                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
6011                                                    MGMT_STATUS_NOT_CONNECTED);
6012                 goto unlocked;
6013         }
6014         hci_cp.conn_handle = conn->handle;
6015
6016         if (!hdev_is_powered(hdev)) {
6017                 BT_DBG("%s", hdev->name);
6018                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
6019                                 MGMT_STATUS_NOT_POWERED);
6020                 goto unlocked;
6021         }
6022
6023         if (pending_find(MGMT_OP_GET_RAW_RSSI, hdev)) {
6024                 BT_DBG("%s", hdev->name);
6025                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
6026                                 MGMT_STATUS_BUSY);
6027                 goto unlocked;
6028         }
6029
6030         cmd = mgmt_pending_add(sk, MGMT_OP_GET_RAW_RSSI, hdev, data, len);
6031         if (!cmd) {
6032                 BT_DBG("%s", hdev->name);
6033                 err = -ENOMEM;
6034                 goto unlocked;
6035         }
6036
6037         hci_req_init(&req, hdev);
6038
6039         BT_DBG("Connection Handle [%d]", hci_cp.conn_handle);
6040         hci_req_add(&req, HCI_OP_GET_RAW_RSSI, sizeof(hci_cp), &hci_cp);
6041         err = hci_req_run(&req, get_raw_rssi_complete);
6042
6043         if (err < 0) {
6044                 mgmt_pending_remove(cmd);
6045                 BT_ERR("Error in requesting hci_req_run");
6046         }
6047
6048 unlocked:
6049         hci_dev_unlock(hdev);
6050
6051         return err;
6052 }
6053
6054 void mgmt_raw_rssi_response(struct hci_dev *hdev,
6055                 struct hci_cc_rp_get_raw_rssi *rp, int success)
6056 {
6057         struct mgmt_cc_rp_get_raw_rssi mgmt_rp = { 0, };
6058         struct hci_conn *conn;
6059
6060         mgmt_rp.status = rp->status;
6061         mgmt_rp.rssi_dbm = rp->rssi_dbm;
6062
6063         conn = hci_conn_hash_lookup_handle(hdev, rp->conn_handle);
6064         if (!conn)
6065                 return;
6066
6067         bacpy(&mgmt_rp.bt_address, &conn->dst);
6068         if (conn->type == LE_LINK)
6069                 mgmt_rp.link_type = 0x01;
6070         else
6071                 mgmt_rp.link_type = 0x00;
6072
6073         mgmt_event(MGMT_EV_RAW_RSSI, hdev, &mgmt_rp,
6074                         sizeof(struct mgmt_cc_rp_get_raw_rssi), NULL);
6075 }
6076
6077 static void set_disable_threshold_complete(struct hci_dev *hdev,
6078                         u8 status, u16 opcode)
6079 {
6080         struct mgmt_pending_cmd *cmd;
6081
6082         BT_DBG("status 0x%02x", status);
6083
6084         hci_dev_lock(hdev);
6085
6086         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6087         if (!cmd)
6088                 goto unlock;
6089
6090         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6091                         MGMT_STATUS_SUCCESS, &status, 1);
6092
6093         mgmt_pending_remove(cmd);
6094
6095 unlock:
6096         hci_dev_unlock(hdev);
6097 }
6098
6099 /** Removes monitoring for a link*/
6100 static int set_disable_threshold(struct sock *sk, struct hci_dev *hdev,
6101                 void *data, u16 len)
6102 {
6103         int err = 0;
6104         struct hci_cp_set_rssi_threshold th = { 0, };
6105         struct mgmt_cp_disable_rssi *cp = data;
6106         struct hci_conn *conn;
6107         struct mgmt_pending_cmd *cmd;
6108         struct hci_request req;
6109         __u8 dest_type;
6110
6111         BT_DBG("Set Disable RSSI.");
6112
6113         hci_dev_lock(hdev);
6114
6115         if (!lmp_le_capable(hdev)) {
6116                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6117                                 MGMT_STATUS_NOT_SUPPORTED);
6118                 goto unlocked;
6119         }
6120
6121         /* Get LE/ACL link handle info*/
6122         if (cp->link_type == 0x01)
6123                 dest_type = LE_LINK;
6124         else
6125                 dest_type = ACL_LINK;
6126
6127         conn = hci_conn_hash_lookup_ba(hdev, dest_type, &cp->bdaddr);
6128         if (!conn) {
6129                 err = mgmt_cmd_complete(sk, hdev->id,
6130                                 MGMT_OP_SET_RSSI_DISABLE, 1, NULL, 0);
6131                 goto unlocked;
6132         }
6133
6134         th.hci_le_ext_opcode = 0x0B;
6135         th.mode = 0x01;
6136         th.conn_handle = conn->handle;
6137         th.alert_mask = 0x00;
6138         th.low_th = 0x00;
6139         th.in_range_th = 0x00;
6140         th.high_th = 0x00;
6141
6142         if (!hdev_is_powered(hdev)) {
6143                 BT_DBG("%s", hdev->name);
6144                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6145                                 0, data, len);
6146                 goto unlocked;
6147         }
6148
6149         if (pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev)) {
6150                 BT_DBG("%s", hdev->name);
6151                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6152                                 MGMT_STATUS_BUSY);
6153                 goto unlocked;
6154         }
6155
6156         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_DISABLE, hdev, cp,
6157                         sizeof(*cp));
6158         if (!cmd) {
6159                 BT_DBG("%s", hdev->name);
6160                 err = -ENOMEM;
6161                 goto unlocked;
6162         }
6163
6164         hci_req_init(&req, hdev);
6165
6166         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
6167         err = hci_req_run(&req, set_disable_threshold_complete);
6168         if (err < 0) {
6169                 mgmt_pending_remove(cmd);
6170                 BT_ERR("Error in requesting hci_req_run");
6171                 goto unlocked;
6172         }
6173
6174 unlocked:
6175         hci_dev_unlock(hdev);
6176
6177         return err;
6178 }
6179
6180 void mgmt_rssi_alert_evt(struct hci_dev *hdev, struct sk_buff *skb)
6181 {
6182         struct hci_ev_vendor_specific_rssi_alert *ev = (void *)skb->data;
6183         struct mgmt_ev_vendor_specific_rssi_alert mgmt_ev;
6184         struct hci_conn *conn;
6185
6186         BT_DBG("RSSI alert [%2.2X %2.2X %2.2X]",
6187                         ev->conn_handle, ev->alert_type, ev->rssi_dbm);
6188
6189         conn = hci_conn_hash_lookup_handle(hdev, ev->conn_handle);
6190
6191         if (!conn) {
6192                 BT_ERR("RSSI alert Error: Device not found for handle");
6193                 return;
6194         }
6195         bacpy(&mgmt_ev.bdaddr, &conn->dst);
6196
6197         if (conn->type == LE_LINK)
6198                 mgmt_ev.link_type = 0x01;
6199         else
6200                 mgmt_ev.link_type = 0x00;
6201
6202         mgmt_ev.alert_type = ev->alert_type;
6203         mgmt_ev.rssi_dbm = ev->rssi_dbm;
6204
6205         mgmt_event(MGMT_EV_RSSI_ALERT, hdev, &mgmt_ev,
6206                         sizeof(struct mgmt_ev_vendor_specific_rssi_alert),
6207                         NULL);
6208 }
6209
6210 static int mgmt_start_le_discovery_failed(struct hci_dev *hdev, u8 status)
6211 {
6212         struct mgmt_pending_cmd *cmd;
6213         u8 type;
6214         int err;
6215
6216         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
6217
6218         cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
6219         if (!cmd)
6220                 return -ENOENT;
6221
6222         type = hdev->le_discovery.type;
6223
6224         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
6225                                 mgmt_status(status), &type, sizeof(type));
6226         mgmt_pending_remove(cmd);
6227
6228         return err;
6229 }
6230
6231 static void start_le_discovery_complete(struct hci_dev *hdev, u8 status,
6232                 u16 opcode)
6233 {
6234         unsigned long timeout = 0;
6235
6236         BT_DBG("status %d", status);
6237
6238         if (status) {
6239                 hci_dev_lock(hdev);
6240                 mgmt_start_le_discovery_failed(hdev, status);
6241                 hci_dev_unlock(hdev);
6242                 return;
6243         }
6244
6245         hci_dev_lock(hdev);
6246         hci_le_discovery_set_state(hdev, DISCOVERY_FINDING);
6247         hci_dev_unlock(hdev);
6248
6249         if (hdev->le_discovery.type != DISCOV_TYPE_LE)
6250                 BT_ERR("Invalid discovery type %d", hdev->le_discovery.type);
6251
6252         if (!timeout)
6253                 return;
6254
6255         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
6256 }
6257
6258 static int start_le_discovery(struct sock *sk, struct hci_dev *hdev,
6259                 void *data, u16 len)
6260 {
6261         struct mgmt_cp_start_le_discovery *cp = data;
6262         struct mgmt_pending_cmd *cmd;
6263         struct hci_cp_le_set_scan_param param_cp;
6264         struct hci_cp_le_set_scan_enable enable_cp;
6265         struct hci_request req;
6266         u8 status, own_addr_type;
6267         int err;
6268
6269         BT_DBG("%s", hdev->name);
6270
6271         hci_dev_lock(hdev);
6272
6273         if (!hdev_is_powered(hdev)) {
6274                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
6275                                 MGMT_STATUS_NOT_POWERED);
6276                 goto unlock;
6277         }
6278
6279         if (hdev->le_discovery.state != DISCOVERY_STOPPED) {
6280                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
6281                                 MGMT_STATUS_BUSY);
6282                 goto unlock;
6283         }
6284
6285         if (cp->type != DISCOV_TYPE_LE) {
6286                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
6287                                 MGMT_STATUS_INVALID_PARAMS);
6288                 goto unlock;
6289         }
6290
6291         cmd = mgmt_pending_add(sk, MGMT_OP_START_LE_DISCOVERY, hdev, NULL, 0);
6292         if (!cmd) {
6293                 err = -ENOMEM;
6294                 goto unlock;
6295         }
6296
6297         hdev->le_discovery.type = cp->type;
6298
6299         hci_req_init(&req, hdev);
6300
6301         status = mgmt_le_support(hdev);
6302         if (status) {
6303                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
6304                                 status);
6305                 mgmt_pending_remove(cmd);
6306                 goto unlock;
6307         }
6308
6309         /* If controller is scanning, it means the background scanning
6310          * is running. Thus, we should temporarily stop it in order to
6311          * set the discovery scanning parameters.
6312          */
6313         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
6314                 hci_req_add_le_scan_disable(&req);
6315
6316         memset(&param_cp, 0, sizeof(param_cp));
6317
6318         /* All active scans will be done with either a resolvable
6319          * private address (when privacy feature has been enabled)
6320          * or unresolvable private address.
6321          */
6322         err = hci_update_random_address(&req, true, hci_dev_test_flag(hdev, HCI_PRIVACY), &own_addr_type);
6323         if (err < 0) {
6324                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
6325                                 MGMT_STATUS_FAILED);
6326                 mgmt_pending_remove(cmd);
6327                 goto unlock;
6328         }
6329
6330         param_cp.type = hdev->le_scan_type;
6331         param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
6332         param_cp.window = cpu_to_le16(hdev->le_scan_window);
6333         param_cp.own_address_type = own_addr_type;
6334         hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
6335                     &param_cp);
6336
6337         memset(&enable_cp, 0, sizeof(enable_cp));
6338         enable_cp.enable = LE_SCAN_ENABLE;
6339         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
6340
6341         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
6342                     &enable_cp);
6343
6344         err = hci_req_run(&req, start_le_discovery_complete);
6345         if (err < 0)
6346                 mgmt_pending_remove(cmd);
6347         else
6348                 hci_le_discovery_set_state(hdev, DISCOVERY_STARTING);
6349
6350 unlock:
6351         hci_dev_unlock(hdev);
6352         return err;
6353 }
6354
6355 static int mgmt_stop_le_discovery_failed(struct hci_dev *hdev, u8 status)
6356 {
6357         struct mgmt_pending_cmd *cmd;
6358         int err;
6359
6360         cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
6361         if (!cmd)
6362                 return -ENOENT;
6363
6364         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
6365                                 mgmt_status(status), &hdev->le_discovery.type,
6366                                 sizeof(hdev->le_discovery.type));
6367         mgmt_pending_remove(cmd);
6368
6369         return err;
6370 }
6371
6372 static void stop_le_discovery_complete(struct hci_dev *hdev, u8 status,
6373                 u16 opcode)
6374 {
6375         BT_DBG("status %d", status);
6376
6377         hci_dev_lock(hdev);
6378
6379         if (status) {
6380                 mgmt_stop_le_discovery_failed(hdev, status);
6381                 goto unlock;
6382         }
6383
6384         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
6385
6386 unlock:
6387         hci_dev_unlock(hdev);
6388 }
6389
6390 static int stop_le_discovery(struct sock *sk, struct hci_dev *hdev,
6391                 void *data, u16 len)
6392 {
6393         struct mgmt_cp_stop_le_discovery *mgmt_cp = data;
6394         struct mgmt_pending_cmd *cmd;
6395         struct hci_request req;
6396         int err;
6397
6398         BT_DBG("%s", hdev->name);
6399
6400         hci_dev_lock(hdev);
6401
6402         if (!hci_le_discovery_active(hdev)) {
6403                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
6404                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
6405                                         sizeof(mgmt_cp->type));
6406                 goto unlock;
6407         }
6408
6409         if (hdev->le_discovery.type != mgmt_cp->type) {
6410                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
6411                                         MGMT_STATUS_INVALID_PARAMS,
6412                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
6413                 goto unlock;
6414         }
6415
6416         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_LE_DISCOVERY, hdev, NULL, 0);
6417         if (!cmd) {
6418                 err = -ENOMEM;
6419                 goto unlock;
6420         }
6421
6422         hci_req_init(&req, hdev);
6423
6424         if (hdev->le_discovery.state  != DISCOVERY_FINDING) {
6425                 BT_DBG("unknown le discovery state %u",
6426                                         hdev->le_discovery.state);
6427
6428                 mgmt_pending_remove(cmd);
6429                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
6430                                         MGMT_STATUS_FAILED, &mgmt_cp->type,
6431                                         sizeof(mgmt_cp->type));
6432                 goto unlock;
6433         }
6434
6435         cancel_delayed_work(&hdev->le_scan_disable);
6436         hci_req_add_le_scan_disable(&req);
6437
6438         err = hci_req_run(&req, stop_le_discovery_complete);
6439         if (err < 0)
6440                 mgmt_pending_remove(cmd);
6441         else
6442                 hci_le_discovery_set_state(hdev, DISCOVERY_STOPPING);
6443
6444 unlock:
6445         hci_dev_unlock(hdev);
6446         return err;
6447 }
6448
6449 /* Separate LE discovery */
6450 void mgmt_le_discovering(struct hci_dev *hdev, u8 discovering)
6451 {
6452         struct mgmt_ev_discovering ev;
6453         struct mgmt_pending_cmd *cmd;
6454
6455         BT_DBG("%s le discovering %u", hdev->name, discovering);
6456
6457         if (discovering)
6458                 cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
6459         else
6460                 cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
6461
6462         if (cmd) {
6463                 u8 type = hdev->le_discovery.type;
6464
6465                 mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
6466                                   sizeof(type));
6467                 mgmt_pending_remove(cmd);
6468         }
6469
6470         memset(&ev, 0, sizeof(ev));
6471         ev.type = hdev->le_discovery.type;
6472         ev.discovering = discovering;
6473
6474         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
6475 }
6476
6477 static int disable_le_auto_connect(struct sock *sk, struct hci_dev *hdev,
6478                         void *data, u16 len)
6479 {
6480         int err;
6481
6482         BT_DBG("%s", hdev->name);
6483
6484         hci_dev_lock(hdev);
6485
6486         err = hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
6487         if (err < 0)
6488                 BT_ERR("HCI_OP_LE_CREATE_CONN_CANCEL is failed");
6489
6490         hci_dev_unlock(hdev);
6491
6492         return err;
6493 }
6494 #endif /* TIZEN_BT */
6495
6496 static bool ltk_is_valid(struct mgmt_ltk_info *key)
6497 {
6498         if (key->master != 0x00 && key->master != 0x01)
6499                 return false;
6500
6501         switch (key->addr.type) {
6502         case BDADDR_LE_PUBLIC:
6503                 return true;
6504
6505         case BDADDR_LE_RANDOM:
6506                 /* Two most significant bits shall be set */
6507                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6508                         return false;
6509                 return true;
6510         }
6511
6512         return false;
6513 }
6514
6515 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
6516                                void *cp_data, u16 len)
6517 {
6518         struct mgmt_cp_load_long_term_keys *cp = cp_data;
6519         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
6520                                    sizeof(struct mgmt_ltk_info));
6521         u16 key_count, expected_len;
6522         int i, err;
6523
6524         BT_DBG("request for %s", hdev->name);
6525
6526         if (!lmp_le_capable(hdev))
6527                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6528                                        MGMT_STATUS_NOT_SUPPORTED);
6529
6530         key_count = __le16_to_cpu(cp->key_count);
6531         if (key_count > max_key_count) {
6532                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
6533                            key_count);
6534                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6535                                        MGMT_STATUS_INVALID_PARAMS);
6536         }
6537
6538         expected_len = struct_size(cp, keys, key_count);
6539         if (expected_len != len) {
6540                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
6541                            expected_len, len);
6542                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6543                                        MGMT_STATUS_INVALID_PARAMS);
6544         }
6545
6546         BT_DBG("%s key_count %u", hdev->name, key_count);
6547
6548         for (i = 0; i < key_count; i++) {
6549                 struct mgmt_ltk_info *key = &cp->keys[i];
6550
6551                 if (!ltk_is_valid(key))
6552                         return mgmt_cmd_status(sk, hdev->id,
6553                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
6554                                                MGMT_STATUS_INVALID_PARAMS);
6555         }
6556
6557         hci_dev_lock(hdev);
6558
6559         hci_smp_ltks_clear(hdev);
6560
6561         for (i = 0; i < key_count; i++) {
6562                 struct mgmt_ltk_info *key = &cp->keys[i];
6563                 u8 type, authenticated;
6564
6565                 switch (key->type) {
6566                 case MGMT_LTK_UNAUTHENTICATED:
6567                         authenticated = 0x00;
6568                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
6569                         break;
6570                 case MGMT_LTK_AUTHENTICATED:
6571                         authenticated = 0x01;
6572                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
6573                         break;
6574                 case MGMT_LTK_P256_UNAUTH:
6575                         authenticated = 0x00;
6576                         type = SMP_LTK_P256;
6577                         break;
6578                 case MGMT_LTK_P256_AUTH:
6579                         authenticated = 0x01;
6580                         type = SMP_LTK_P256;
6581                         break;
6582                 case MGMT_LTK_P256_DEBUG:
6583                         authenticated = 0x00;
6584                         type = SMP_LTK_P256_DEBUG;
6585                         /* fall through */
6586                 default:
6587                         continue;
6588                 }
6589
6590                 hci_add_ltk(hdev, &key->addr.bdaddr,
6591                             le_addr_type(key->addr.type), type, authenticated,
6592                             key->val, key->enc_size, key->ediv, key->rand);
6593         }
6594
6595         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
6596                            NULL, 0);
6597
6598         hci_dev_unlock(hdev);
6599
6600         return err;
6601 }
6602
6603 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
6604 {
6605         struct hci_conn *conn = cmd->user_data;
6606         struct mgmt_rp_get_conn_info rp;
6607         int err;
6608
6609         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
6610
6611         if (status == MGMT_STATUS_SUCCESS) {
6612                 rp.rssi = conn->rssi;
6613                 rp.tx_power = conn->tx_power;
6614                 rp.max_tx_power = conn->max_tx_power;
6615         } else {
6616                 rp.rssi = HCI_RSSI_INVALID;
6617                 rp.tx_power = HCI_TX_POWER_INVALID;
6618                 rp.max_tx_power = HCI_TX_POWER_INVALID;
6619         }
6620
6621         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
6622                                 status, &rp, sizeof(rp));
6623
6624         hci_conn_drop(conn);
6625         hci_conn_put(conn);
6626
6627         return err;
6628 }
6629
6630 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
6631                                        u16 opcode)
6632 {
6633         struct hci_cp_read_rssi *cp;
6634         struct mgmt_pending_cmd *cmd;
6635         struct hci_conn *conn;
6636         u16 handle;
6637         u8 status;
6638
6639         BT_DBG("status 0x%02x", hci_status);
6640
6641         hci_dev_lock(hdev);
6642
6643         /* Commands sent in request are either Read RSSI or Read Transmit Power
6644          * Level so we check which one was last sent to retrieve connection
6645          * handle.  Both commands have handle as first parameter so it's safe to
6646          * cast data on the same command struct.
6647          *
6648          * First command sent is always Read RSSI and we fail only if it fails.
6649          * In other case we simply override error to indicate success as we
6650          * already remembered if TX power value is actually valid.
6651          */
6652         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
6653         if (!cp) {
6654                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
6655                 status = MGMT_STATUS_SUCCESS;
6656         } else {
6657                 status = mgmt_status(hci_status);
6658         }
6659
6660         if (!cp) {
6661                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
6662                 goto unlock;
6663         }
6664
6665         handle = __le16_to_cpu(cp->handle);
6666         conn = hci_conn_hash_lookup_handle(hdev, handle);
6667         if (!conn) {
6668                 bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
6669                            handle);
6670                 goto unlock;
6671         }
6672
6673         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
6674         if (!cmd)
6675                 goto unlock;
6676
6677         cmd->cmd_complete(cmd, status);
6678         mgmt_pending_remove(cmd);
6679
6680 unlock:
6681         hci_dev_unlock(hdev);
6682 }
6683
6684 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
6685                          u16 len)
6686 {
6687         struct mgmt_cp_get_conn_info *cp = data;
6688         struct mgmt_rp_get_conn_info rp;
6689         struct hci_conn *conn;
6690         unsigned long conn_info_age;
6691         int err = 0;
6692
6693         BT_DBG("%s", hdev->name);
6694
6695         memset(&rp, 0, sizeof(rp));
6696         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6697         rp.addr.type = cp->addr.type;
6698
6699         if (!bdaddr_type_is_valid(cp->addr.type))
6700                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6701                                          MGMT_STATUS_INVALID_PARAMS,
6702                                          &rp, sizeof(rp));
6703
6704         hci_dev_lock(hdev);
6705
6706         if (!hdev_is_powered(hdev)) {
6707                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6708                                         MGMT_STATUS_NOT_POWERED, &rp,
6709                                         sizeof(rp));
6710                 goto unlock;
6711         }
6712
6713         if (cp->addr.type == BDADDR_BREDR)
6714                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6715                                                &cp->addr.bdaddr);
6716         else
6717                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
6718
6719         if (!conn || conn->state != BT_CONNECTED) {
6720                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6721                                         MGMT_STATUS_NOT_CONNECTED, &rp,
6722                                         sizeof(rp));
6723                 goto unlock;
6724         }
6725
6726         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
6727                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6728                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
6729                 goto unlock;
6730         }
6731
6732         /* To avoid client trying to guess when to poll again for information we
6733          * calculate conn info age as random value between min/max set in hdev.
6734          */
6735         conn_info_age = hdev->conn_info_min_age +
6736                         prandom_u32_max(hdev->conn_info_max_age -
6737                                         hdev->conn_info_min_age);
6738
6739         /* Query controller to refresh cached values if they are too old or were
6740          * never read.
6741          */
6742         if (time_after(jiffies, conn->conn_info_timestamp +
6743                        msecs_to_jiffies(conn_info_age)) ||
6744             !conn->conn_info_timestamp) {
6745                 struct hci_request req;
6746                 struct hci_cp_read_tx_power req_txp_cp;
6747                 struct hci_cp_read_rssi req_rssi_cp;
6748                 struct mgmt_pending_cmd *cmd;
6749
6750                 hci_req_init(&req, hdev);
6751                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
6752                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
6753                             &req_rssi_cp);
6754
6755                 /* For LE links TX power does not change thus we don't need to
6756                  * query for it once value is known.
6757                  */
6758                 if (!bdaddr_type_is_le(cp->addr.type) ||
6759                     conn->tx_power == HCI_TX_POWER_INVALID) {
6760                         req_txp_cp.handle = cpu_to_le16(conn->handle);
6761                         req_txp_cp.type = 0x00;
6762                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
6763                                     sizeof(req_txp_cp), &req_txp_cp);
6764                 }
6765
6766                 /* Max TX power needs to be read only once per connection */
6767                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
6768                         req_txp_cp.handle = cpu_to_le16(conn->handle);
6769                         req_txp_cp.type = 0x01;
6770                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
6771                                     sizeof(req_txp_cp), &req_txp_cp);
6772                 }
6773
6774                 err = hci_req_run(&req, conn_info_refresh_complete);
6775                 if (err < 0)
6776                         goto unlock;
6777
6778                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
6779                                        data, len);
6780                 if (!cmd) {
6781                         err = -ENOMEM;
6782                         goto unlock;
6783                 }
6784
6785                 hci_conn_hold(conn);
6786                 cmd->user_data = hci_conn_get(conn);
6787                 cmd->cmd_complete = conn_info_cmd_complete;
6788
6789                 conn->conn_info_timestamp = jiffies;
6790         } else {
6791                 /* Cache is valid, just reply with values cached in hci_conn */
6792                 rp.rssi = conn->rssi;
6793                 rp.tx_power = conn->tx_power;
6794                 rp.max_tx_power = conn->max_tx_power;
6795
6796                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6797                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6798         }
6799
6800 unlock:
6801         hci_dev_unlock(hdev);
6802         return err;
6803 }
6804
6805 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
6806 {
6807         struct hci_conn *conn = cmd->user_data;
6808         struct mgmt_rp_get_clock_info rp;
6809         struct hci_dev *hdev;
6810         int err;
6811
6812         memset(&rp, 0, sizeof(rp));
6813         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
6814
6815         if (status)
6816                 goto complete;
6817
6818         hdev = hci_dev_get(cmd->index);
6819         if (hdev) {
6820                 rp.local_clock = cpu_to_le32(hdev->clock);
6821                 hci_dev_put(hdev);
6822         }
6823
6824         if (conn) {
6825                 rp.piconet_clock = cpu_to_le32(conn->clock);
6826                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
6827         }
6828
6829 complete:
6830         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
6831                                 sizeof(rp));
6832
6833         if (conn) {
6834                 hci_conn_drop(conn);
6835                 hci_conn_put(conn);
6836         }
6837
6838         return err;
6839 }
6840
6841 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6842 {
6843         struct hci_cp_read_clock *hci_cp;
6844         struct mgmt_pending_cmd *cmd;
6845         struct hci_conn *conn;
6846
6847         BT_DBG("%s status %u", hdev->name, status);
6848
6849         hci_dev_lock(hdev);
6850
6851         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
6852         if (!hci_cp)
6853                 goto unlock;
6854
6855         if (hci_cp->which) {
6856                 u16 handle = __le16_to_cpu(hci_cp->handle);
6857                 conn = hci_conn_hash_lookup_handle(hdev, handle);
6858         } else {
6859                 conn = NULL;
6860         }
6861
6862         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
6863         if (!cmd)
6864                 goto unlock;
6865
6866         cmd->cmd_complete(cmd, mgmt_status(status));
6867         mgmt_pending_remove(cmd);
6868
6869 unlock:
6870         hci_dev_unlock(hdev);
6871 }
6872
6873 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
6874                          u16 len)
6875 {
6876         struct mgmt_cp_get_clock_info *cp = data;
6877         struct mgmt_rp_get_clock_info rp;
6878         struct hci_cp_read_clock hci_cp;
6879         struct mgmt_pending_cmd *cmd;
6880         struct hci_request req;
6881         struct hci_conn *conn;
6882         int err;
6883
6884         BT_DBG("%s", hdev->name);
6885
6886         memset(&rp, 0, sizeof(rp));
6887         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6888         rp.addr.type = cp->addr.type;
6889
6890         if (cp->addr.type != BDADDR_BREDR)
6891                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6892                                          MGMT_STATUS_INVALID_PARAMS,
6893                                          &rp, sizeof(rp));
6894
6895         hci_dev_lock(hdev);
6896
6897         if (!hdev_is_powered(hdev)) {
6898                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6899                                         MGMT_STATUS_NOT_POWERED, &rp,
6900                                         sizeof(rp));
6901                 goto unlock;
6902         }
6903
6904         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6905                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6906                                                &cp->addr.bdaddr);
6907                 if (!conn || conn->state != BT_CONNECTED) {
6908                         err = mgmt_cmd_complete(sk, hdev->id,
6909                                                 MGMT_OP_GET_CLOCK_INFO,
6910                                                 MGMT_STATUS_NOT_CONNECTED,
6911                                                 &rp, sizeof(rp));
6912                         goto unlock;
6913                 }
6914         } else {
6915                 conn = NULL;
6916         }
6917
6918         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
6919         if (!cmd) {
6920                 err = -ENOMEM;
6921                 goto unlock;
6922         }
6923
6924         cmd->cmd_complete = clock_info_cmd_complete;
6925
6926         hci_req_init(&req, hdev);
6927
6928         memset(&hci_cp, 0, sizeof(hci_cp));
6929         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6930
6931         if (conn) {
6932                 hci_conn_hold(conn);
6933                 cmd->user_data = hci_conn_get(conn);
6934
6935                 hci_cp.handle = cpu_to_le16(conn->handle);
6936                 hci_cp.which = 0x01; /* Piconet clock */
6937                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6938         }
6939
6940         err = hci_req_run(&req, get_clock_info_complete);
6941         if (err < 0)
6942                 mgmt_pending_remove(cmd);
6943
6944 unlock:
6945         hci_dev_unlock(hdev);
6946         return err;
6947 }
6948
6949 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
6950 {
6951         struct hci_conn *conn;
6952
6953         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
6954         if (!conn)
6955                 return false;
6956
6957         if (conn->dst_type != type)
6958                 return false;
6959
6960         if (conn->state != BT_CONNECTED)
6961                 return false;
6962
6963         return true;
6964 }
6965
6966 /* This function requires the caller holds hdev->lock */
6967 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
6968                                u8 addr_type, u8 auto_connect)
6969 {
6970         struct hci_conn_params *params;
6971
6972         params = hci_conn_params_add(hdev, addr, addr_type);
6973         if (!params)
6974                 return -EIO;
6975
6976         if (params->auto_connect == auto_connect)
6977                 return 0;
6978
6979         list_del_init(&params->action);
6980
6981         switch (auto_connect) {
6982         case HCI_AUTO_CONN_DISABLED:
6983         case HCI_AUTO_CONN_LINK_LOSS:
6984                 /* If auto connect is being disabled when we're trying to
6985                  * connect to device, keep connecting.
6986                  */
6987                 if (params->explicit_connect)
6988                         list_add(&params->action, &hdev->pend_le_conns);
6989                 break;
6990         case HCI_AUTO_CONN_REPORT:
6991                 if (params->explicit_connect)
6992                         list_add(&params->action, &hdev->pend_le_conns);
6993                 else
6994                         list_add(&params->action, &hdev->pend_le_reports);
6995                 break;
6996         case HCI_AUTO_CONN_DIRECT:
6997         case HCI_AUTO_CONN_ALWAYS:
6998                 if (!is_connected(hdev, addr, addr_type))
6999                         list_add(&params->action, &hdev->pend_le_conns);
7000                 break;
7001         }
7002
7003         params->auto_connect = auto_connect;
7004
7005         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
7006                auto_connect);
7007
7008         return 0;
7009 }
7010
7011 static void device_added(struct sock *sk, struct hci_dev *hdev,
7012                          bdaddr_t *bdaddr, u8 type, u8 action)
7013 {
7014         struct mgmt_ev_device_added ev;
7015
7016         bacpy(&ev.addr.bdaddr, bdaddr);
7017         ev.addr.type = type;
7018         ev.action = action;
7019
7020         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
7021 }
7022
7023 static int add_device(struct sock *sk, struct hci_dev *hdev,
7024                       void *data, u16 len)
7025 {
7026         struct mgmt_cp_add_device *cp = data;
7027         u8 auto_conn, addr_type;
7028         int err;
7029
7030         BT_DBG("%s", hdev->name);
7031
7032         if (!bdaddr_type_is_valid(cp->addr.type) ||
7033             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
7034                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7035                                          MGMT_STATUS_INVALID_PARAMS,
7036                                          &cp->addr, sizeof(cp->addr));
7037
7038         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
7039                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7040                                          MGMT_STATUS_INVALID_PARAMS,
7041                                          &cp->addr, sizeof(cp->addr));
7042
7043         hci_dev_lock(hdev);
7044
7045         if (cp->addr.type == BDADDR_BREDR) {
7046                 /* Only incoming connections action is supported for now */
7047                 if (cp->action != 0x01) {
7048                         err = mgmt_cmd_complete(sk, hdev->id,
7049                                                 MGMT_OP_ADD_DEVICE,
7050                                                 MGMT_STATUS_INVALID_PARAMS,
7051                                                 &cp->addr, sizeof(cp->addr));
7052                         goto unlock;
7053                 }
7054
7055                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
7056                                           cp->addr.type);
7057                 if (err)
7058                         goto unlock;
7059
7060                 hci_req_update_scan(hdev);
7061
7062                 goto added;
7063         }
7064
7065         addr_type = le_addr_type(cp->addr.type);
7066
7067         if (cp->action == 0x02)
7068                 auto_conn = HCI_AUTO_CONN_ALWAYS;
7069         else if (cp->action == 0x01)
7070                 auto_conn = HCI_AUTO_CONN_DIRECT;
7071         else
7072                 auto_conn = HCI_AUTO_CONN_REPORT;
7073
7074         /* Kernel internally uses conn_params with resolvable private
7075          * address, but Add Device allows only identity addresses.
7076          * Make sure it is enforced before calling
7077          * hci_conn_params_lookup.
7078          */
7079         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7080                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7081                                         MGMT_STATUS_INVALID_PARAMS,
7082                                         &cp->addr, sizeof(cp->addr));
7083                 goto unlock;
7084         }
7085
7086         /* If the connection parameters don't exist for this device,
7087          * they will be created and configured with defaults.
7088          */
7089         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
7090                                 auto_conn) < 0) {
7091                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7092                                         MGMT_STATUS_FAILED, &cp->addr,
7093                                         sizeof(cp->addr));
7094                 goto unlock;
7095         }
7096
7097         hci_update_background_scan(hdev);
7098
7099 added:
7100         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
7101
7102         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7103                                 MGMT_STATUS_SUCCESS, &cp->addr,
7104                                 sizeof(cp->addr));
7105
7106 unlock:
7107         hci_dev_unlock(hdev);
7108         return err;
7109 }
7110
7111 static void device_removed(struct sock *sk, struct hci_dev *hdev,
7112                            bdaddr_t *bdaddr, u8 type)
7113 {
7114         struct mgmt_ev_device_removed ev;
7115
7116         bacpy(&ev.addr.bdaddr, bdaddr);
7117         ev.addr.type = type;
7118
7119         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
7120 }
7121
7122 static int remove_device(struct sock *sk, struct hci_dev *hdev,
7123                          void *data, u16 len)
7124 {
7125         struct mgmt_cp_remove_device *cp = data;
7126         int err;
7127
7128         BT_DBG("%s", hdev->name);
7129
7130         hci_dev_lock(hdev);
7131
7132         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7133                 struct hci_conn_params *params;
7134                 u8 addr_type;
7135
7136                 if (!bdaddr_type_is_valid(cp->addr.type)) {
7137                         err = mgmt_cmd_complete(sk, hdev->id,
7138                                                 MGMT_OP_REMOVE_DEVICE,
7139                                                 MGMT_STATUS_INVALID_PARAMS,
7140                                                 &cp->addr, sizeof(cp->addr));
7141                         goto unlock;
7142                 }
7143
7144                 if (cp->addr.type == BDADDR_BREDR) {
7145                         err = hci_bdaddr_list_del(&hdev->whitelist,
7146                                                   &cp->addr.bdaddr,
7147                                                   cp->addr.type);
7148                         if (err) {
7149                                 err = mgmt_cmd_complete(sk, hdev->id,
7150                                                         MGMT_OP_REMOVE_DEVICE,
7151                                                         MGMT_STATUS_INVALID_PARAMS,
7152                                                         &cp->addr,
7153                                                         sizeof(cp->addr));
7154                                 goto unlock;
7155                         }
7156
7157                         hci_req_update_scan(hdev);
7158
7159                         device_removed(sk, hdev, &cp->addr.bdaddr,
7160                                        cp->addr.type);
7161                         goto complete;
7162                 }
7163
7164                 addr_type = le_addr_type(cp->addr.type);
7165
7166                 /* Kernel internally uses conn_params with resolvable private
7167                  * address, but Remove Device allows only identity addresses.
7168                  * Make sure it is enforced before calling
7169                  * hci_conn_params_lookup.
7170                  */
7171                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7172                         err = mgmt_cmd_complete(sk, hdev->id,
7173                                                 MGMT_OP_REMOVE_DEVICE,
7174                                                 MGMT_STATUS_INVALID_PARAMS,
7175                                                 &cp->addr, sizeof(cp->addr));
7176                         goto unlock;
7177                 }
7178
7179                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7180                                                 addr_type);
7181                 if (!params) {
7182                         err = mgmt_cmd_complete(sk, hdev->id,
7183                                                 MGMT_OP_REMOVE_DEVICE,
7184                                                 MGMT_STATUS_INVALID_PARAMS,
7185                                                 &cp->addr, sizeof(cp->addr));
7186                         goto unlock;
7187                 }
7188
7189                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
7190                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
7191                         err = mgmt_cmd_complete(sk, hdev->id,
7192                                                 MGMT_OP_REMOVE_DEVICE,
7193                                                 MGMT_STATUS_INVALID_PARAMS,
7194                                                 &cp->addr, sizeof(cp->addr));
7195                         goto unlock;
7196                 }
7197
7198                 list_del(&params->action);
7199                 list_del(&params->list);
7200                 kfree(params);
7201                 hci_update_background_scan(hdev);
7202
7203                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
7204         } else {
7205                 struct hci_conn_params *p, *tmp;
7206                 struct bdaddr_list *b, *btmp;
7207
7208                 if (cp->addr.type) {
7209                         err = mgmt_cmd_complete(sk, hdev->id,
7210                                                 MGMT_OP_REMOVE_DEVICE,
7211                                                 MGMT_STATUS_INVALID_PARAMS,
7212                                                 &cp->addr, sizeof(cp->addr));
7213                         goto unlock;
7214                 }
7215
7216                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
7217                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
7218                         list_del(&b->list);
7219                         kfree(b);
7220                 }
7221
7222                 hci_req_update_scan(hdev);
7223
7224                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
7225                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
7226                                 continue;
7227                         device_removed(sk, hdev, &p->addr, p->addr_type);
7228                         if (p->explicit_connect) {
7229                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
7230                                 continue;
7231                         }
7232                         list_del(&p->action);
7233                         list_del(&p->list);
7234                         kfree(p);
7235                 }
7236
7237                 BT_DBG("All LE connection parameters were removed");
7238
7239                 hci_update_background_scan(hdev);
7240         }
7241
7242 complete:
7243         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
7244                                 MGMT_STATUS_SUCCESS, &cp->addr,
7245                                 sizeof(cp->addr));
7246 unlock:
7247         hci_dev_unlock(hdev);
7248         return err;
7249 }
7250
7251 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
7252                            u16 len)
7253 {
7254         struct mgmt_cp_load_conn_param *cp = data;
7255         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
7256                                      sizeof(struct mgmt_conn_param));
7257         u16 param_count, expected_len;
7258         int i;
7259
7260         if (!lmp_le_capable(hdev))
7261                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7262                                        MGMT_STATUS_NOT_SUPPORTED);
7263
7264         param_count = __le16_to_cpu(cp->param_count);
7265         if (param_count > max_param_count) {
7266                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
7267                            param_count);
7268                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7269                                        MGMT_STATUS_INVALID_PARAMS);
7270         }
7271
7272         expected_len = struct_size(cp, params, param_count);
7273         if (expected_len != len) {
7274                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
7275                            expected_len, len);
7276                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7277                                        MGMT_STATUS_INVALID_PARAMS);
7278         }
7279
7280         BT_DBG("%s param_count %u", hdev->name, param_count);
7281
7282         hci_dev_lock(hdev);
7283
7284         hci_conn_params_clear_disabled(hdev);
7285
7286         for (i = 0; i < param_count; i++) {
7287                 struct mgmt_conn_param *param = &cp->params[i];
7288                 struct hci_conn_params *hci_param;
7289                 u16 min, max, latency, timeout;
7290                 u8 addr_type;
7291
7292                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
7293                        param->addr.type);
7294
7295                 if (param->addr.type == BDADDR_LE_PUBLIC) {
7296                         addr_type = ADDR_LE_DEV_PUBLIC;
7297                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
7298                         addr_type = ADDR_LE_DEV_RANDOM;
7299                 } else {
7300                         bt_dev_err(hdev, "ignoring invalid connection parameters");
7301                         continue;
7302                 }
7303
7304                 min = le16_to_cpu(param->min_interval);
7305                 max = le16_to_cpu(param->max_interval);
7306                 latency = le16_to_cpu(param->latency);
7307                 timeout = le16_to_cpu(param->timeout);
7308
7309                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
7310                        min, max, latency, timeout);
7311
7312                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
7313                         bt_dev_err(hdev, "ignoring invalid connection parameters");
7314                         continue;
7315                 }
7316
7317                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
7318                                                 addr_type);
7319                 if (!hci_param) {
7320                         bt_dev_err(hdev, "failed to add connection parameters");
7321                         continue;
7322                 }
7323
7324                 hci_param->conn_min_interval = min;
7325                 hci_param->conn_max_interval = max;
7326                 hci_param->conn_latency = latency;
7327                 hci_param->supervision_timeout = timeout;
7328         }
7329
7330         hci_dev_unlock(hdev);
7331
7332         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
7333                                  NULL, 0);
7334 }
7335
7336 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
7337                                void *data, u16 len)
7338 {
7339         struct mgmt_cp_set_external_config *cp = data;
7340         bool changed;
7341         int err;
7342
7343         BT_DBG("%s", hdev->name);
7344
7345         if (hdev_is_powered(hdev))
7346                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7347                                        MGMT_STATUS_REJECTED);
7348
7349         if (cp->config != 0x00 && cp->config != 0x01)
7350                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7351                                          MGMT_STATUS_INVALID_PARAMS);
7352
7353         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
7354                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7355                                        MGMT_STATUS_NOT_SUPPORTED);
7356
7357         hci_dev_lock(hdev);
7358
7359         if (cp->config)
7360                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
7361         else
7362                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
7363
7364         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
7365         if (err < 0)
7366                 goto unlock;
7367
7368         if (!changed)
7369                 goto unlock;
7370
7371         err = new_options(hdev, sk);
7372
7373         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
7374                 mgmt_index_removed(hdev);
7375
7376                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
7377                         hci_dev_set_flag(hdev, HCI_CONFIG);
7378                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
7379
7380                         queue_work(hdev->req_workqueue, &hdev->power_on);
7381                 } else {
7382                         set_bit(HCI_RAW, &hdev->flags);
7383                         mgmt_index_added(hdev);
7384                 }
7385         }
7386
7387 unlock:
7388         hci_dev_unlock(hdev);
7389         return err;
7390 }
7391
7392 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
7393                               void *data, u16 len)
7394 {
7395         struct mgmt_cp_set_public_address *cp = data;
7396         bool changed;
7397         int err;
7398
7399         BT_DBG("%s", hdev->name);
7400
7401         if (hdev_is_powered(hdev))
7402                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7403                                        MGMT_STATUS_REJECTED);
7404
7405         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
7406                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7407                                        MGMT_STATUS_INVALID_PARAMS);
7408
7409         if (!hdev->set_bdaddr)
7410                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7411                                        MGMT_STATUS_NOT_SUPPORTED);
7412
7413         hci_dev_lock(hdev);
7414
7415         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
7416         bacpy(&hdev->public_addr, &cp->bdaddr);
7417
7418         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
7419         if (err < 0)
7420                 goto unlock;
7421
7422         if (!changed)
7423                 goto unlock;
7424
7425         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
7426                 err = new_options(hdev, sk);
7427
7428         if (is_configured(hdev)) {
7429                 mgmt_index_removed(hdev);
7430
7431                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
7432
7433                 hci_dev_set_flag(hdev, HCI_CONFIG);
7434                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
7435
7436                 queue_work(hdev->req_workqueue, &hdev->power_on);
7437         }
7438
7439 unlock:
7440         hci_dev_unlock(hdev);
7441         return err;
7442 }
7443
7444 #ifdef TIZEN_BT
7445 int mgmt_device_name_update(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name,
7446                             u8 name_len)
7447 {
7448         char buf[512];
7449         struct mgmt_ev_device_name_update *ev = (void *)buf;
7450         u16 eir_len = 0;
7451
7452         if (name_len <= 0)
7453                 return -EINVAL;
7454
7455         bacpy(&ev->addr.bdaddr, bdaddr);
7456         ev->addr.type = BDADDR_BREDR;
7457
7458         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7459                                   name_len);
7460
7461         ev->eir_len = cpu_to_le16(eir_len);
7462
7463         return mgmt_event(MGMT_EV_DEVICE_NAME_UPDATE, hdev, buf,
7464                           sizeof(*ev) + eir_len, NULL);
7465 }
7466 #endif
7467
7468 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
7469                                              u16 opcode, struct sk_buff *skb)
7470 {
7471         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
7472         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
7473         u8 *h192, *r192, *h256, *r256;
7474         struct mgmt_pending_cmd *cmd;
7475         u16 eir_len;
7476         int err;
7477
7478         BT_DBG("%s status %u", hdev->name, status);
7479
7480         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
7481         if (!cmd)
7482                 return;
7483
7484         mgmt_cp = cmd->param;
7485
7486         if (status) {
7487                 status = mgmt_status(status);
7488                 eir_len = 0;
7489
7490                 h192 = NULL;
7491                 r192 = NULL;
7492                 h256 = NULL;
7493                 r256 = NULL;
7494         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
7495                 struct hci_rp_read_local_oob_data *rp;
7496
7497                 if (skb->len != sizeof(*rp)) {
7498                         status = MGMT_STATUS_FAILED;
7499                         eir_len = 0;
7500                 } else {
7501                         status = MGMT_STATUS_SUCCESS;
7502                         rp = (void *)skb->data;
7503
7504                         eir_len = 5 + 18 + 18;
7505                         h192 = rp->hash;
7506                         r192 = rp->rand;
7507                         h256 = NULL;
7508                         r256 = NULL;
7509                 }
7510         } else {
7511                 struct hci_rp_read_local_oob_ext_data *rp;
7512
7513                 if (skb->len != sizeof(*rp)) {
7514                         status = MGMT_STATUS_FAILED;
7515                         eir_len = 0;
7516                 } else {
7517                         status = MGMT_STATUS_SUCCESS;
7518                         rp = (void *)skb->data;
7519
7520                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
7521                                 eir_len = 5 + 18 + 18;
7522                                 h192 = NULL;
7523                                 r192 = NULL;
7524                         } else {
7525                                 eir_len = 5 + 18 + 18 + 18 + 18;
7526                                 h192 = rp->hash192;
7527                                 r192 = rp->rand192;
7528                         }
7529
7530                         h256 = rp->hash256;
7531                         r256 = rp->rand256;
7532                 }
7533         }
7534
7535         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
7536         if (!mgmt_rp)
7537                 goto done;
7538
7539         if (status)
7540                 goto send_rsp;
7541
7542         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
7543                                   hdev->dev_class, 3);
7544
7545         if (h192 && r192) {
7546                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7547                                           EIR_SSP_HASH_C192, h192, 16);
7548                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7549                                           EIR_SSP_RAND_R192, r192, 16);
7550         }
7551
7552         if (h256 && r256) {
7553                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7554                                           EIR_SSP_HASH_C256, h256, 16);
7555                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7556                                           EIR_SSP_RAND_R256, r256, 16);
7557         }
7558
7559 send_rsp:
7560         mgmt_rp->type = mgmt_cp->type;
7561         mgmt_rp->eir_len = cpu_to_le16(eir_len);
7562
7563         err = mgmt_cmd_complete(cmd->sk, hdev->id,
7564                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
7565                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
7566         if (err < 0 || status)
7567                 goto done;
7568
7569         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
7570
7571         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
7572                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
7573                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
7574 done:
7575         kfree(mgmt_rp);
7576         mgmt_pending_remove(cmd);
7577 }
7578
7579 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
7580                                   struct mgmt_cp_read_local_oob_ext_data *cp)
7581 {
7582         struct mgmt_pending_cmd *cmd;
7583         struct hci_request req;
7584         int err;
7585
7586         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
7587                                cp, sizeof(*cp));
7588         if (!cmd)
7589                 return -ENOMEM;
7590
7591         hci_req_init(&req, hdev);
7592
7593         if (bredr_sc_enabled(hdev))
7594                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
7595         else
7596                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
7597
7598         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
7599         if (err < 0) {
7600                 mgmt_pending_remove(cmd);
7601                 return err;
7602         }
7603
7604         return 0;
7605 }
7606
7607 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
7608                                    void *data, u16 data_len)
7609 {
7610         struct mgmt_cp_read_local_oob_ext_data *cp = data;
7611         struct mgmt_rp_read_local_oob_ext_data *rp;
7612         size_t rp_len;
7613         u16 eir_len;
7614         u8 status, flags, role, addr[7], hash[16], rand[16];
7615         int err;
7616
7617         BT_DBG("%s", hdev->name);
7618
7619         if (hdev_is_powered(hdev)) {
7620                 switch (cp->type) {
7621                 case BIT(BDADDR_BREDR):
7622                         status = mgmt_bredr_support(hdev);
7623                         if (status)
7624                                 eir_len = 0;
7625                         else
7626                                 eir_len = 5;
7627                         break;
7628                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
7629                         status = mgmt_le_support(hdev);
7630                         if (status)
7631                                 eir_len = 0;
7632                         else
7633                                 eir_len = 9 + 3 + 18 + 18 + 3;
7634                         break;
7635                 default:
7636                         status = MGMT_STATUS_INVALID_PARAMS;
7637                         eir_len = 0;
7638                         break;
7639                 }
7640         } else {
7641                 status = MGMT_STATUS_NOT_POWERED;
7642                 eir_len = 0;
7643         }
7644
7645         rp_len = sizeof(*rp) + eir_len;
7646         rp = kmalloc(rp_len, GFP_ATOMIC);
7647         if (!rp)
7648                 return -ENOMEM;
7649
7650         if (status)
7651                 goto complete;
7652
7653         hci_dev_lock(hdev);
7654
7655         eir_len = 0;
7656         switch (cp->type) {
7657         case BIT(BDADDR_BREDR):
7658                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7659                         err = read_local_ssp_oob_req(hdev, sk, cp);
7660                         hci_dev_unlock(hdev);
7661                         if (!err)
7662                                 goto done;
7663
7664                         status = MGMT_STATUS_FAILED;
7665                         goto complete;
7666                 } else {
7667                         eir_len = eir_append_data(rp->eir, eir_len,
7668                                                   EIR_CLASS_OF_DEV,
7669                                                   hdev->dev_class, 3);
7670                 }
7671                 break;
7672         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
7673                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
7674                     smp_generate_oob(hdev, hash, rand) < 0) {
7675                         hci_dev_unlock(hdev);
7676                         status = MGMT_STATUS_FAILED;
7677                         goto complete;
7678                 }
7679
7680                 /* This should return the active RPA, but since the RPA
7681                  * is only programmed on demand, it is really hard to fill
7682                  * this in at the moment. For now disallow retrieving
7683                  * local out-of-band data when privacy is in use.
7684                  *
7685                  * Returning the identity address will not help here since
7686                  * pairing happens before the identity resolving key is
7687                  * known and thus the connection establishment happens
7688                  * based on the RPA and not the identity address.
7689                  */
7690                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
7691                         hci_dev_unlock(hdev);
7692                         status = MGMT_STATUS_REJECTED;
7693                         goto complete;
7694                 }
7695
7696                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
7697                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
7698                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
7699                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
7700                         memcpy(addr, &hdev->static_addr, 6);
7701                         addr[6] = 0x01;
7702                 } else {
7703                         memcpy(addr, &hdev->bdaddr, 6);
7704                         addr[6] = 0x00;
7705                 }
7706
7707                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
7708                                           addr, sizeof(addr));
7709
7710                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7711                         role = 0x02;
7712                 else
7713                         role = 0x01;
7714
7715                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
7716                                           &role, sizeof(role));
7717
7718                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
7719                         eir_len = eir_append_data(rp->eir, eir_len,
7720                                                   EIR_LE_SC_CONFIRM,
7721                                                   hash, sizeof(hash));
7722
7723                         eir_len = eir_append_data(rp->eir, eir_len,
7724                                                   EIR_LE_SC_RANDOM,
7725                                                   rand, sizeof(rand));
7726                 }
7727
7728                 flags = mgmt_get_adv_discov_flags(hdev);
7729
7730                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
7731                         flags |= LE_AD_NO_BREDR;
7732
7733                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
7734                                           &flags, sizeof(flags));
7735                 break;
7736         }
7737
7738         hci_dev_unlock(hdev);
7739
7740         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
7741
7742         status = MGMT_STATUS_SUCCESS;
7743
7744 complete:
7745         rp->type = cp->type;
7746         rp->eir_len = cpu_to_le16(eir_len);
7747
7748         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
7749                                 status, rp, sizeof(*rp) + eir_len);
7750         if (err < 0 || status)
7751                 goto done;
7752
7753         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
7754                                  rp, sizeof(*rp) + eir_len,
7755                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
7756
7757 done:
7758         kfree(rp);
7759
7760         return err;
7761 }
7762
7763 static u32 get_supported_adv_flags(struct hci_dev *hdev)
7764 {
7765         u32 flags = 0;
7766
7767         flags |= MGMT_ADV_FLAG_CONNECTABLE;
7768         flags |= MGMT_ADV_FLAG_DISCOV;
7769         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
7770         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
7771         flags |= MGMT_ADV_FLAG_APPEARANCE;
7772         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
7773
7774         /* In extended adv TX_POWER returned from Set Adv Param
7775          * will be always valid.
7776          */
7777         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
7778             ext_adv_capable(hdev))
7779                 flags |= MGMT_ADV_FLAG_TX_POWER;
7780
7781         if (ext_adv_capable(hdev)) {
7782                 flags |= MGMT_ADV_FLAG_SEC_1M;
7783
7784                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
7785                         flags |= MGMT_ADV_FLAG_SEC_2M;
7786
7787                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
7788                         flags |= MGMT_ADV_FLAG_SEC_CODED;
7789         }
7790
7791         return flags;
7792 }
7793
7794 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
7795                              void *data, u16 data_len)
7796 {
7797         struct mgmt_rp_read_adv_features *rp;
7798         size_t rp_len;
7799         int err;
7800         struct adv_info *adv_instance;
7801         u32 supported_flags;
7802         u8 *instance;
7803
7804         BT_DBG("%s", hdev->name);
7805
7806         if (!lmp_le_capable(hdev))
7807                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7808                                        MGMT_STATUS_REJECTED);
7809
7810         hci_dev_lock(hdev);
7811
7812         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
7813         rp = kmalloc(rp_len, GFP_ATOMIC);
7814         if (!rp) {
7815                 hci_dev_unlock(hdev);
7816                 return -ENOMEM;
7817         }
7818
7819         supported_flags = get_supported_adv_flags(hdev);
7820
7821         rp->supported_flags = cpu_to_le32(supported_flags);
7822         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
7823         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
7824         rp->max_instances = HCI_MAX_ADV_INSTANCES;
7825         rp->num_instances = hdev->adv_instance_cnt;
7826
7827         instance = rp->instance;
7828         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
7829                 *instance = adv_instance->instance;
7830                 instance++;
7831         }
7832
7833         hci_dev_unlock(hdev);
7834
7835         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7836                                 MGMT_STATUS_SUCCESS, rp, rp_len);
7837
7838         kfree(rp);
7839
7840         return err;
7841 }
7842
7843 static u8 calculate_name_len(struct hci_dev *hdev)
7844 {
7845         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
7846
7847         return append_local_name(hdev, buf, 0);
7848 }
7849
7850 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
7851                            bool is_adv_data)
7852 {
7853         u8 max_len = HCI_MAX_AD_LENGTH;
7854
7855         if (is_adv_data) {
7856                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
7857                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
7858                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
7859                         max_len -= 3;
7860
7861                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
7862                         max_len -= 3;
7863         } else {
7864                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
7865                         max_len -= calculate_name_len(hdev);
7866
7867                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
7868                         max_len -= 4;
7869         }
7870
7871         return max_len;
7872 }
7873
7874 static bool flags_managed(u32 adv_flags)
7875 {
7876         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
7877                             MGMT_ADV_FLAG_LIMITED_DISCOV |
7878                             MGMT_ADV_FLAG_MANAGED_FLAGS);
7879 }
7880
7881 static bool tx_power_managed(u32 adv_flags)
7882 {
7883         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
7884 }
7885
7886 static bool name_managed(u32 adv_flags)
7887 {
7888         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
7889 }
7890
7891 static bool appearance_managed(u32 adv_flags)
7892 {
7893         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
7894 }
7895
7896 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
7897                               u8 len, bool is_adv_data)
7898 {
7899         int i, cur_len;
7900         u8 max_len;
7901
7902         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
7903
7904         if (len > max_len)
7905                 return false;
7906
7907         /* Make sure that the data is correctly formatted. */
7908         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
7909                 cur_len = data[i];
7910
7911                 if (data[i + 1] == EIR_FLAGS &&
7912                     (!is_adv_data || flags_managed(adv_flags)))
7913                         return false;
7914
7915                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
7916                         return false;
7917
7918                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
7919                         return false;
7920
7921                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
7922                         return false;
7923
7924                 if (data[i + 1] == EIR_APPEARANCE &&
7925                     appearance_managed(adv_flags))
7926                         return false;
7927
7928                 /* If the current field length would exceed the total data
7929                  * length, then it's invalid.
7930                  */
7931                 if (i + cur_len >= len)
7932                         return false;
7933         }
7934
7935         return true;
7936 }
7937
7938 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
7939                                      u16 opcode)
7940 {
7941         struct mgmt_pending_cmd *cmd;
7942         struct mgmt_cp_add_advertising *cp;
7943         struct mgmt_rp_add_advertising rp;
7944         struct adv_info *adv_instance, *n;
7945         u8 instance;
7946
7947         BT_DBG("status %d", status);
7948
7949         hci_dev_lock(hdev);
7950
7951         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
7952
7953         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
7954                 if (!adv_instance->pending)
7955                         continue;
7956
7957                 if (!status) {
7958                         adv_instance->pending = false;
7959                         continue;
7960                 }
7961
7962                 instance = adv_instance->instance;
7963
7964                 if (hdev->cur_adv_instance == instance)
7965                         cancel_adv_timeout(hdev);
7966
7967                 hci_remove_adv_instance(hdev, instance);
7968                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
7969         }
7970
7971         if (!cmd)
7972                 goto unlock;
7973
7974         cp = cmd->param;
7975         rp.instance = cp->instance;
7976
7977         if (status)
7978                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
7979                                 mgmt_status(status));
7980         else
7981                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
7982                                   mgmt_status(status), &rp, sizeof(rp));
7983
7984         mgmt_pending_remove(cmd);
7985
7986 unlock:
7987         hci_dev_unlock(hdev);
7988 }
7989
7990 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
7991                            void *data, u16 data_len)
7992 {
7993         struct mgmt_cp_add_advertising *cp = data;
7994         struct mgmt_rp_add_advertising rp;
7995         u32 flags;
7996         u32 supported_flags, phy_flags;
7997         u8 status;
7998         u16 timeout, duration;
7999         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
8000         u8 schedule_instance = 0;
8001         struct adv_info *next_instance;
8002         int err;
8003         struct mgmt_pending_cmd *cmd;
8004         struct hci_request req;
8005
8006         BT_DBG("%s", hdev->name);
8007
8008         status = mgmt_le_support(hdev);
8009         if (status)
8010                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8011                                        status);
8012
8013         if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
8014                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8015                                        MGMT_STATUS_INVALID_PARAMS);
8016
8017         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
8018                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8019                                        MGMT_STATUS_INVALID_PARAMS);
8020
8021         flags = __le32_to_cpu(cp->flags);
8022         timeout = __le16_to_cpu(cp->timeout);
8023         duration = __le16_to_cpu(cp->duration);
8024
8025         /* The current implementation only supports a subset of the specified
8026          * flags. Also need to check mutual exclusiveness of sec flags.
8027          */
8028         supported_flags = get_supported_adv_flags(hdev);
8029         phy_flags = flags & MGMT_ADV_FLAG_SEC_MASK;
8030         if (flags & ~supported_flags ||
8031             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
8032                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8033                                        MGMT_STATUS_INVALID_PARAMS);
8034
8035         hci_dev_lock(hdev);
8036
8037         if (timeout && !hdev_is_powered(hdev)) {
8038                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8039                                       MGMT_STATUS_REJECTED);
8040                 goto unlock;
8041         }
8042
8043         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
8044             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
8045             pending_find(MGMT_OP_SET_LE, hdev)) {
8046                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8047                                       MGMT_STATUS_BUSY);
8048                 goto unlock;
8049         }
8050
8051         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
8052             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
8053                                cp->scan_rsp_len, false)) {
8054                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8055                                       MGMT_STATUS_INVALID_PARAMS);
8056                 goto unlock;
8057         }
8058
8059         err = hci_add_adv_instance(hdev, cp->instance, flags,
8060                                    cp->adv_data_len, cp->data,
8061                                    cp->scan_rsp_len,
8062                                    cp->data + cp->adv_data_len,
8063                                    timeout, duration);
8064         if (err < 0) {
8065                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8066                                       MGMT_STATUS_FAILED);
8067                 goto unlock;
8068         }
8069
8070         /* Only trigger an advertising added event if a new instance was
8071          * actually added.
8072          */
8073         if (hdev->adv_instance_cnt > prev_instance_cnt)
8074                 mgmt_advertising_added(sk, hdev, cp->instance);
8075
8076         if (hdev->cur_adv_instance == cp->instance) {
8077                 /* If the currently advertised instance is being changed then
8078                  * cancel the current advertising and schedule the next
8079                  * instance. If there is only one instance then the overridden
8080                  * advertising data will be visible right away.
8081                  */
8082                 cancel_adv_timeout(hdev);
8083
8084                 next_instance = hci_get_next_instance(hdev, cp->instance);
8085                 if (next_instance)
8086                         schedule_instance = next_instance->instance;
8087         } else if (!hdev->adv_instance_timeout) {
8088                 /* Immediately advertise the new instance if no other
8089                  * instance is currently being advertised.
8090                  */
8091                 schedule_instance = cp->instance;
8092         }
8093
8094         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
8095          * there is no instance to be advertised then we have no HCI
8096          * communication to make. Simply return.
8097          */
8098         if (!hdev_is_powered(hdev) ||
8099             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
8100             !schedule_instance) {
8101                 rp.instance = cp->instance;
8102                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8103                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8104                 goto unlock;
8105         }
8106
8107         /* We're good to go, update advertising data, parameters, and start
8108          * advertising.
8109          */
8110         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
8111                                data_len);
8112         if (!cmd) {
8113                 err = -ENOMEM;
8114                 goto unlock;
8115         }
8116
8117         hci_req_init(&req, hdev);
8118
8119         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
8120
8121         if (!err)
8122                 err = hci_req_run(&req, add_advertising_complete);
8123
8124         if (err < 0)
8125                 mgmt_pending_remove(cmd);
8126
8127 unlock:
8128         hci_dev_unlock(hdev);
8129
8130         return err;
8131 }
8132
8133 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
8134                                         u16 opcode)
8135 {
8136         struct mgmt_pending_cmd *cmd;
8137         struct mgmt_cp_remove_advertising *cp;
8138         struct mgmt_rp_remove_advertising rp;
8139
8140         BT_DBG("status %d", status);
8141
8142         hci_dev_lock(hdev);
8143
8144         /* A failure status here only means that we failed to disable
8145          * advertising. Otherwise, the advertising instance has been removed,
8146          * so report success.
8147          */
8148         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
8149         if (!cmd)
8150                 goto unlock;
8151
8152         cp = cmd->param;
8153         rp.instance = cp->instance;
8154
8155         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
8156                           &rp, sizeof(rp));
8157         mgmt_pending_remove(cmd);
8158
8159 unlock:
8160         hci_dev_unlock(hdev);
8161 }
8162
8163 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
8164                               void *data, u16 data_len)
8165 {
8166         struct mgmt_cp_remove_advertising *cp = data;
8167         struct mgmt_rp_remove_advertising rp;
8168         struct mgmt_pending_cmd *cmd;
8169         struct hci_request req;
8170         int err;
8171
8172         BT_DBG("%s", hdev->name);
8173
8174         hci_dev_lock(hdev);
8175
8176         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
8177                 err = mgmt_cmd_status(sk, hdev->id,
8178                                       MGMT_OP_REMOVE_ADVERTISING,
8179                                       MGMT_STATUS_INVALID_PARAMS);
8180                 goto unlock;
8181         }
8182
8183         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
8184             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
8185             pending_find(MGMT_OP_SET_LE, hdev)) {
8186                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
8187                                       MGMT_STATUS_BUSY);
8188                 goto unlock;
8189         }
8190
8191         if (list_empty(&hdev->adv_instances)) {
8192                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
8193                                       MGMT_STATUS_INVALID_PARAMS);
8194                 goto unlock;
8195         }
8196
8197         hci_req_init(&req, hdev);
8198
8199         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
8200
8201         if (list_empty(&hdev->adv_instances))
8202                 __hci_req_disable_advertising(&req);
8203
8204         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
8205          * flag is set or the device isn't powered then we have no HCI
8206          * communication to make. Simply return.
8207          */
8208         if (skb_queue_empty(&req.cmd_q) ||
8209             !hdev_is_powered(hdev) ||
8210             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
8211                 hci_req_purge(&req);
8212                 rp.instance = cp->instance;
8213                 err = mgmt_cmd_complete(sk, hdev->id,
8214                                         MGMT_OP_REMOVE_ADVERTISING,
8215                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8216                 goto unlock;
8217         }
8218
8219         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
8220                                data_len);
8221         if (!cmd) {
8222                 err = -ENOMEM;
8223                 goto unlock;
8224         }
8225
8226         err = hci_req_run(&req, remove_advertising_complete);
8227         if (err < 0)
8228                 mgmt_pending_remove(cmd);
8229
8230 unlock:
8231         hci_dev_unlock(hdev);
8232
8233         return err;
8234 }
8235
8236 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
8237                              void *data, u16 data_len)
8238 {
8239         struct mgmt_cp_get_adv_size_info *cp = data;
8240         struct mgmt_rp_get_adv_size_info rp;
8241         u32 flags, supported_flags;
8242         int err;
8243
8244         BT_DBG("%s", hdev->name);
8245
8246         if (!lmp_le_capable(hdev))
8247                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8248                                        MGMT_STATUS_REJECTED);
8249
8250         if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
8251                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8252                                        MGMT_STATUS_INVALID_PARAMS);
8253
8254         flags = __le32_to_cpu(cp->flags);
8255
8256         /* The current implementation only supports a subset of the specified
8257          * flags.
8258          */
8259         supported_flags = get_supported_adv_flags(hdev);
8260         if (flags & ~supported_flags)
8261                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8262                                        MGMT_STATUS_INVALID_PARAMS);
8263
8264         rp.instance = cp->instance;
8265         rp.flags = cp->flags;
8266         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8267         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8268
8269         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8270                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8271
8272         return err;
8273 }
8274
8275 static const struct hci_mgmt_handler mgmt_handlers[] = {
8276         { NULL }, /* 0x0000 (no command) */
8277         { read_version,            MGMT_READ_VERSION_SIZE,
8278                                                 HCI_MGMT_NO_HDEV |
8279                                                 HCI_MGMT_UNTRUSTED },
8280         { read_commands,           MGMT_READ_COMMANDS_SIZE,
8281                                                 HCI_MGMT_NO_HDEV |
8282                                                 HCI_MGMT_UNTRUSTED },
8283         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
8284                                                 HCI_MGMT_NO_HDEV |
8285                                                 HCI_MGMT_UNTRUSTED },
8286         { read_controller_info,    MGMT_READ_INFO_SIZE,
8287                                                 HCI_MGMT_UNTRUSTED },
8288         { set_powered,             MGMT_SETTING_SIZE },
8289         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
8290         { set_connectable,         MGMT_SETTING_SIZE },
8291         { set_fast_connectable,    MGMT_SETTING_SIZE },
8292         { set_bondable,            MGMT_SETTING_SIZE },
8293         { set_link_security,       MGMT_SETTING_SIZE },
8294         { set_ssp,                 MGMT_SETTING_SIZE },
8295         { set_hs,                  MGMT_SETTING_SIZE },
8296         { set_le,                  MGMT_SETTING_SIZE },
8297         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
8298         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
8299         { add_uuid,                MGMT_ADD_UUID_SIZE },
8300         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
8301         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
8302                                                 HCI_MGMT_VAR_LEN },
8303         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
8304                                                 HCI_MGMT_VAR_LEN },
8305         { disconnect,              MGMT_DISCONNECT_SIZE },
8306         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
8307         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
8308         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
8309         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
8310         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
8311         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
8312         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
8313         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
8314         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
8315         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
8316         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
8317         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
8318         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
8319                                                 HCI_MGMT_VAR_LEN },
8320         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
8321         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
8322         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
8323         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
8324         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
8325         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
8326         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
8327         { set_advertising,         MGMT_SETTING_SIZE },
8328         { set_bredr,               MGMT_SETTING_SIZE },
8329         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
8330         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
8331         { set_secure_conn,         MGMT_SETTING_SIZE },
8332         { set_debug_keys,          MGMT_SETTING_SIZE },
8333         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
8334         { load_irks,               MGMT_LOAD_IRKS_SIZE,
8335                                                 HCI_MGMT_VAR_LEN },
8336         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
8337         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
8338         { add_device,              MGMT_ADD_DEVICE_SIZE },
8339         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
8340         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
8341                                                 HCI_MGMT_VAR_LEN },
8342         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
8343                                                 HCI_MGMT_NO_HDEV |
8344                                                 HCI_MGMT_UNTRUSTED },
8345         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
8346                                                 HCI_MGMT_UNCONFIGURED |
8347                                                 HCI_MGMT_UNTRUSTED },
8348         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
8349                                                 HCI_MGMT_UNCONFIGURED },
8350         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
8351                                                 HCI_MGMT_UNCONFIGURED },
8352         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
8353                                                 HCI_MGMT_VAR_LEN },
8354         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
8355         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
8356                                                 HCI_MGMT_NO_HDEV |
8357                                                 HCI_MGMT_UNTRUSTED },
8358         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
8359         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
8360                                                 HCI_MGMT_VAR_LEN },
8361         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
8362         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
8363         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
8364         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
8365                                                 HCI_MGMT_UNTRUSTED },
8366         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
8367         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
8368         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
8369 };
8370
8371 #ifdef TIZEN_BT
8372 static const struct hci_mgmt_handler tizen_mgmt_handlers[] = {
8373         { NULL }, /* 0x0000 (no command) */
8374         { set_advertising_params,  MGMT_SET_ADVERTISING_PARAMS_SIZE },
8375         { set_advertising_data,    MGMT_SET_ADV_MIN_APP_DATA_SIZE,
8376                                                 HCI_MGMT_VAR_LEN },
8377         { set_scan_rsp_data,       MGMT_SET_SCAN_RSP_MIN_APP_DATA_SIZE,
8378                                                 HCI_MGMT_VAR_LEN },
8379         { add_white_list,          MGMT_ADD_DEV_WHITE_LIST_SIZE },
8380         { remove_from_white_list,  MGMT_REMOVE_DEV_FROM_WHITE_LIST_SIZE },
8381         { clear_white_list,        MGMT_OP_CLEAR_DEV_WHITE_LIST_SIZE },
8382         { set_enable_rssi,         MGMT_SET_RSSI_ENABLE_SIZE },
8383         { get_raw_rssi,            MGMT_GET_RAW_RSSI_SIZE },
8384         { set_disable_threshold,   MGMT_SET_RSSI_DISABLE_SIZE },
8385         { start_le_discovery,      MGMT_START_LE_DISCOVERY_SIZE },
8386         { stop_le_discovery,       MGMT_STOP_LE_DISCOVERY_SIZE },
8387         { disable_le_auto_connect, MGMT_DISABLE_LE_AUTO_CONNECT_SIZE },
8388 };
8389 #endif
8390
8391 void mgmt_index_added(struct hci_dev *hdev)
8392 {
8393         struct mgmt_ev_ext_index ev;
8394
8395         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
8396                 return;
8397
8398         switch (hdev->dev_type) {
8399         case HCI_PRIMARY:
8400                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
8401                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
8402                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
8403                         ev.type = 0x01;
8404                 } else {
8405                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
8406                                          HCI_MGMT_INDEX_EVENTS);
8407                         ev.type = 0x00;
8408                 }
8409                 break;
8410         case HCI_AMP:
8411                 ev.type = 0x02;
8412                 break;
8413         default:
8414                 return;
8415         }
8416
8417         ev.bus = hdev->bus;
8418
8419         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
8420                          HCI_MGMT_EXT_INDEX_EVENTS);
8421 }
8422
8423 void mgmt_index_removed(struct hci_dev *hdev)
8424 {
8425         struct mgmt_ev_ext_index ev;
8426         u8 status = MGMT_STATUS_INVALID_INDEX;
8427
8428         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
8429                 return;
8430
8431         switch (hdev->dev_type) {
8432         case HCI_PRIMARY:
8433                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
8434
8435                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
8436                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
8437                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
8438                         ev.type = 0x01;
8439                 } else {
8440                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
8441                                          HCI_MGMT_INDEX_EVENTS);
8442                         ev.type = 0x00;
8443                 }
8444                 break;
8445         case HCI_AMP:
8446                 ev.type = 0x02;
8447                 break;
8448         default:
8449                 return;
8450         }
8451
8452         ev.bus = hdev->bus;
8453
8454         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
8455                          HCI_MGMT_EXT_INDEX_EVENTS);
8456 }
8457
8458 /* This function requires the caller holds hdev->lock */
8459 static void restart_le_actions(struct hci_dev *hdev)
8460 {
8461         struct hci_conn_params *p;
8462
8463         list_for_each_entry(p, &hdev->le_conn_params, list) {
8464                 /* Needed for AUTO_OFF case where might not "really"
8465                  * have been powered off.
8466                  */
8467                 list_del_init(&p->action);
8468
8469                 switch (p->auto_connect) {
8470                 case HCI_AUTO_CONN_DIRECT:
8471                 case HCI_AUTO_CONN_ALWAYS:
8472                         list_add(&p->action, &hdev->pend_le_conns);
8473                         break;
8474                 case HCI_AUTO_CONN_REPORT:
8475                         list_add(&p->action, &hdev->pend_le_reports);
8476                         break;
8477                 default:
8478                         break;
8479                 }
8480         }
8481 }
8482
8483 void mgmt_power_on(struct hci_dev *hdev, int err)
8484 {
8485         struct cmd_lookup match = { NULL, hdev };
8486
8487         BT_DBG("err %d", err);
8488
8489         hci_dev_lock(hdev);
8490
8491         if (!err) {
8492                 restart_le_actions(hdev);
8493                 hci_update_background_scan(hdev);
8494         }
8495
8496         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
8497
8498         new_settings(hdev, match.sk);
8499
8500         if (match.sk)
8501                 sock_put(match.sk);
8502
8503         hci_dev_unlock(hdev);
8504 }
8505
8506 void __mgmt_power_off(struct hci_dev *hdev)
8507 {
8508         struct cmd_lookup match = { NULL, hdev };
8509         u8 status, zero_cod[] = { 0, 0, 0 };
8510
8511         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
8512
8513         /* If the power off is because of hdev unregistration let
8514          * use the appropriate INVALID_INDEX status. Otherwise use
8515          * NOT_POWERED. We cover both scenarios here since later in
8516          * mgmt_index_removed() any hci_conn callbacks will have already
8517          * been triggered, potentially causing misleading DISCONNECTED
8518          * status responses.
8519          */
8520         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
8521                 status = MGMT_STATUS_INVALID_INDEX;
8522         else
8523                 status = MGMT_STATUS_NOT_POWERED;
8524
8525         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
8526
8527         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
8528                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
8529                                    zero_cod, sizeof(zero_cod),
8530                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
8531                 ext_info_changed(hdev, NULL);
8532         }
8533
8534         new_settings(hdev, match.sk);
8535
8536         if (match.sk)
8537                 sock_put(match.sk);
8538 }
8539
8540 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
8541 {
8542         struct mgmt_pending_cmd *cmd;
8543         u8 status;
8544
8545         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
8546         if (!cmd)
8547                 return;
8548
8549         if (err == -ERFKILL)
8550                 status = MGMT_STATUS_RFKILLED;
8551         else
8552                 status = MGMT_STATUS_FAILED;
8553
8554         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
8555
8556         mgmt_pending_remove(cmd);
8557 }
8558
8559 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
8560                        bool persistent)
8561 {
8562         struct mgmt_ev_new_link_key ev;
8563
8564         memset(&ev, 0, sizeof(ev));
8565
8566         ev.store_hint = persistent;
8567         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
8568         ev.key.addr.type = BDADDR_BREDR;
8569         ev.key.type = key->type;
8570         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
8571         ev.key.pin_len = key->pin_len;
8572
8573         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
8574 }
8575
8576 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
8577 {
8578         switch (ltk->type) {
8579         case SMP_LTK:
8580         case SMP_LTK_SLAVE:
8581                 if (ltk->authenticated)
8582                         return MGMT_LTK_AUTHENTICATED;
8583                 return MGMT_LTK_UNAUTHENTICATED;
8584         case SMP_LTK_P256:
8585                 if (ltk->authenticated)
8586                         return MGMT_LTK_P256_AUTH;
8587                 return MGMT_LTK_P256_UNAUTH;
8588         case SMP_LTK_P256_DEBUG:
8589                 return MGMT_LTK_P256_DEBUG;
8590         }
8591
8592         return MGMT_LTK_UNAUTHENTICATED;
8593 }
8594
8595 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
8596 {
8597         struct mgmt_ev_new_long_term_key ev;
8598
8599         memset(&ev, 0, sizeof(ev));
8600
8601         /* Devices using resolvable or non-resolvable random addresses
8602          * without providing an identity resolving key don't require
8603          * to store long term keys. Their addresses will change the
8604          * next time around.
8605          *
8606          * Only when a remote device provides an identity address
8607          * make sure the long term key is stored. If the remote
8608          * identity is known, the long term keys are internally
8609          * mapped to the identity address. So allow static random
8610          * and public addresses here.
8611          */
8612         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
8613             (key->bdaddr.b[5] & 0xc0) != 0xc0)
8614                 ev.store_hint = 0x00;
8615         else
8616                 ev.store_hint = persistent;
8617
8618         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
8619         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
8620         ev.key.type = mgmt_ltk_type(key);
8621         ev.key.enc_size = key->enc_size;
8622         ev.key.ediv = key->ediv;
8623         ev.key.rand = key->rand;
8624
8625         if (key->type == SMP_LTK)
8626                 ev.key.master = 1;
8627
8628         /* Make sure we copy only the significant bytes based on the
8629          * encryption key size, and set the rest of the value to zeroes.
8630          */
8631         memcpy(ev.key.val, key->val, key->enc_size);
8632         memset(ev.key.val + key->enc_size, 0,
8633                sizeof(ev.key.val) - key->enc_size);
8634
8635         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
8636 }
8637
8638 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
8639 {
8640         struct mgmt_ev_new_irk ev;
8641
8642         memset(&ev, 0, sizeof(ev));
8643
8644         ev.store_hint = persistent;
8645
8646         bacpy(&ev.rpa, &irk->rpa);
8647         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
8648         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
8649         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
8650
8651         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
8652 }
8653
8654 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
8655                    bool persistent)
8656 {
8657         struct mgmt_ev_new_csrk ev;
8658
8659         memset(&ev, 0, sizeof(ev));
8660
8661         /* Devices using resolvable or non-resolvable random addresses
8662          * without providing an identity resolving key don't require
8663          * to store signature resolving keys. Their addresses will change
8664          * the next time around.
8665          *
8666          * Only when a remote device provides an identity address
8667          * make sure the signature resolving key is stored. So allow
8668          * static random and public addresses here.
8669          */
8670         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
8671             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
8672                 ev.store_hint = 0x00;
8673         else
8674                 ev.store_hint = persistent;
8675
8676         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
8677         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
8678         ev.key.type = csrk->type;
8679         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
8680
8681         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
8682 }
8683
8684 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
8685                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
8686                          u16 max_interval, u16 latency, u16 timeout)
8687 {
8688         struct mgmt_ev_new_conn_param ev;
8689
8690         if (!hci_is_identity_address(bdaddr, bdaddr_type))
8691                 return;
8692
8693         memset(&ev, 0, sizeof(ev));
8694         bacpy(&ev.addr.bdaddr, bdaddr);
8695         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
8696         ev.store_hint = store_hint;
8697         ev.min_interval = cpu_to_le16(min_interval);
8698         ev.max_interval = cpu_to_le16(max_interval);
8699         ev.latency = cpu_to_le16(latency);
8700         ev.timeout = cpu_to_le16(timeout);
8701
8702         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
8703 }
8704
8705 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
8706                            u32 flags, u8 *name, u8 name_len)
8707 {
8708         char buf[512];
8709         struct mgmt_ev_device_connected *ev = (void *) buf;
8710         u16 eir_len = 0;
8711
8712         bacpy(&ev->addr.bdaddr, &conn->dst);
8713         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
8714
8715         ev->flags = __cpu_to_le32(flags);
8716
8717         /* We must ensure that the EIR Data fields are ordered and
8718          * unique. Keep it simple for now and avoid the problem by not
8719          * adding any BR/EDR data to the LE adv.
8720          */
8721         if (conn->le_adv_data_len > 0) {
8722                 memcpy(&ev->eir[eir_len],
8723                        conn->le_adv_data, conn->le_adv_data_len);
8724                 eir_len = conn->le_adv_data_len;
8725         } else {
8726                 if (name_len > 0)
8727                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
8728                                                   name, name_len);
8729
8730                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
8731                         eir_len = eir_append_data(ev->eir, eir_len,
8732                                                   EIR_CLASS_OF_DEV,
8733                                                   conn->dev_class, 3);
8734         }
8735
8736         ev->eir_len = cpu_to_le16(eir_len);
8737
8738         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
8739                     sizeof(*ev) + eir_len, NULL);
8740 }
8741
8742 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
8743 {
8744         struct sock **sk = data;
8745
8746         cmd->cmd_complete(cmd, 0);
8747
8748         *sk = cmd->sk;
8749         sock_hold(*sk);
8750
8751         mgmt_pending_remove(cmd);
8752 }
8753
8754 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
8755 {
8756         struct hci_dev *hdev = data;
8757         struct mgmt_cp_unpair_device *cp = cmd->param;
8758
8759         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
8760
8761         cmd->cmd_complete(cmd, 0);
8762         mgmt_pending_remove(cmd);
8763 }
8764
8765 bool mgmt_powering_down(struct hci_dev *hdev)
8766 {
8767         struct mgmt_pending_cmd *cmd;
8768         struct mgmt_mode *cp;
8769
8770         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
8771         if (!cmd)
8772                 return false;
8773
8774         cp = cmd->param;
8775         if (!cp->val)
8776                 return true;
8777
8778         return false;
8779 }
8780
8781 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
8782                               u8 link_type, u8 addr_type, u8 reason,
8783                               bool mgmt_connected)
8784 {
8785         struct mgmt_ev_device_disconnected ev;
8786         struct sock *sk = NULL;
8787
8788         /* The connection is still in hci_conn_hash so test for 1
8789          * instead of 0 to know if this is the last one.
8790          */
8791         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8792                 cancel_delayed_work(&hdev->power_off);
8793                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8794         }
8795
8796         if (!mgmt_connected)
8797                 return;
8798
8799         if (link_type != ACL_LINK && link_type != LE_LINK)
8800                 return;
8801
8802         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
8803
8804         bacpy(&ev.addr.bdaddr, bdaddr);
8805         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8806         ev.reason = reason;
8807
8808         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8809
8810         if (sk)
8811                 sock_put(sk);
8812
8813         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8814                              hdev);
8815 }
8816
8817 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
8818                             u8 link_type, u8 addr_type, u8 status)
8819 {
8820         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
8821         struct mgmt_cp_disconnect *cp;
8822         struct mgmt_pending_cmd *cmd;
8823
8824         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8825                              hdev);
8826
8827         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
8828         if (!cmd)
8829                 return;
8830
8831         cp = cmd->param;
8832
8833         if (bacmp(bdaddr, &cp->addr.bdaddr))
8834                 return;
8835
8836         if (cp->addr.type != bdaddr_type)
8837                 return;
8838
8839         cmd->cmd_complete(cmd, mgmt_status(status));
8840         mgmt_pending_remove(cmd);
8841 }
8842
8843 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8844                          u8 addr_type, u8 status)
8845 {
8846         struct mgmt_ev_connect_failed ev;
8847
8848         /* The connection is still in hci_conn_hash so test for 1
8849          * instead of 0 to know if this is the last one.
8850          */
8851         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8852                 cancel_delayed_work(&hdev->power_off);
8853                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8854         }
8855
8856         bacpy(&ev.addr.bdaddr, bdaddr);
8857         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8858         ev.status = mgmt_status(status);
8859
8860         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
8861 }
8862
8863 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
8864 {
8865         struct mgmt_ev_pin_code_request ev;
8866
8867         bacpy(&ev.addr.bdaddr, bdaddr);
8868         ev.addr.type = BDADDR_BREDR;
8869         ev.secure = secure;
8870
8871         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
8872 }
8873
8874 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8875                                   u8 status)
8876 {
8877         struct mgmt_pending_cmd *cmd;
8878
8879         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
8880         if (!cmd)
8881                 return;
8882
8883         cmd->cmd_complete(cmd, mgmt_status(status));
8884         mgmt_pending_remove(cmd);
8885 }
8886
8887 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8888                                       u8 status)
8889 {
8890         struct mgmt_pending_cmd *cmd;
8891
8892         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
8893         if (!cmd)
8894                 return;
8895
8896         cmd->cmd_complete(cmd, mgmt_status(status));
8897         mgmt_pending_remove(cmd);
8898 }
8899
8900 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8901                               u8 link_type, u8 addr_type, u32 value,
8902                               u8 confirm_hint)
8903 {
8904         struct mgmt_ev_user_confirm_request ev;
8905
8906         BT_DBG("%s", hdev->name);
8907
8908         bacpy(&ev.addr.bdaddr, bdaddr);
8909         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8910         ev.confirm_hint = confirm_hint;
8911         ev.value = cpu_to_le32(value);
8912
8913         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
8914                           NULL);
8915 }
8916
8917 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8918                               u8 link_type, u8 addr_type)
8919 {
8920         struct mgmt_ev_user_passkey_request ev;
8921
8922         BT_DBG("%s", hdev->name);
8923
8924         bacpy(&ev.addr.bdaddr, bdaddr);
8925         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8926
8927         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
8928                           NULL);
8929 }
8930
8931 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8932                                       u8 link_type, u8 addr_type, u8 status,
8933                                       u8 opcode)
8934 {
8935         struct mgmt_pending_cmd *cmd;
8936
8937         cmd = pending_find(opcode, hdev);
8938         if (!cmd)
8939                 return -ENOENT;
8940
8941         cmd->cmd_complete(cmd, mgmt_status(status));
8942         mgmt_pending_remove(cmd);
8943
8944         return 0;
8945 }
8946
8947 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8948                                      u8 link_type, u8 addr_type, u8 status)
8949 {
8950         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8951                                           status, MGMT_OP_USER_CONFIRM_REPLY);
8952 }
8953
8954 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8955                                          u8 link_type, u8 addr_type, u8 status)
8956 {
8957         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8958                                           status,
8959                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
8960 }
8961
8962 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8963                                      u8 link_type, u8 addr_type, u8 status)
8964 {
8965         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8966                                           status, MGMT_OP_USER_PASSKEY_REPLY);
8967 }
8968
8969 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8970                                          u8 link_type, u8 addr_type, u8 status)
8971 {
8972         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8973                                           status,
8974                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
8975 }
8976
8977 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
8978                              u8 link_type, u8 addr_type, u32 passkey,
8979                              u8 entered)
8980 {
8981         struct mgmt_ev_passkey_notify ev;
8982
8983         BT_DBG("%s", hdev->name);
8984
8985         bacpy(&ev.addr.bdaddr, bdaddr);
8986         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8987         ev.passkey = __cpu_to_le32(passkey);
8988         ev.entered = entered;
8989
8990         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
8991 }
8992
8993 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
8994 {
8995         struct mgmt_ev_auth_failed ev;
8996         struct mgmt_pending_cmd *cmd;
8997         u8 status = mgmt_status(hci_status);
8998
8999         bacpy(&ev.addr.bdaddr, &conn->dst);
9000         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9001         ev.status = status;
9002
9003         cmd = find_pairing(conn);
9004
9005         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
9006                     cmd ? cmd->sk : NULL);
9007
9008         if (cmd) {
9009                 cmd->cmd_complete(cmd, status);
9010                 mgmt_pending_remove(cmd);
9011         }
9012 }
9013
9014 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
9015 {
9016         struct cmd_lookup match = { NULL, hdev };
9017         bool changed;
9018
9019         if (status) {
9020                 u8 mgmt_err = mgmt_status(status);
9021                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
9022                                      cmd_status_rsp, &mgmt_err);
9023                 return;
9024         }
9025
9026         if (test_bit(HCI_AUTH, &hdev->flags))
9027                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
9028         else
9029                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
9030
9031         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
9032                              &match);
9033
9034         if (changed)
9035                 new_settings(hdev, match.sk);
9036
9037         if (match.sk)
9038                 sock_put(match.sk);
9039 }
9040
9041 static void clear_eir(struct hci_request *req)
9042 {
9043         struct hci_dev *hdev = req->hdev;
9044         struct hci_cp_write_eir cp;
9045
9046         if (!lmp_ext_inq_capable(hdev))
9047                 return;
9048
9049         memset(hdev->eir, 0, sizeof(hdev->eir));
9050
9051         memset(&cp, 0, sizeof(cp));
9052
9053         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
9054 }
9055
9056 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
9057 {
9058         struct cmd_lookup match = { NULL, hdev };
9059         struct hci_request req;
9060         bool changed = false;
9061
9062         if (status) {
9063                 u8 mgmt_err = mgmt_status(status);
9064
9065                 if (enable && hci_dev_test_and_clear_flag(hdev,
9066                                                           HCI_SSP_ENABLED)) {
9067                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
9068                         new_settings(hdev, NULL);
9069                 }
9070
9071                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
9072                                      &mgmt_err);
9073                 return;
9074         }
9075
9076         if (enable) {
9077                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
9078         } else {
9079                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
9080                 if (!changed)
9081                         changed = hci_dev_test_and_clear_flag(hdev,
9082                                                               HCI_HS_ENABLED);
9083                 else
9084                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
9085         }
9086
9087         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
9088
9089         if (changed)
9090                 new_settings(hdev, match.sk);
9091
9092         if (match.sk)
9093                 sock_put(match.sk);
9094
9095         hci_req_init(&req, hdev);
9096
9097         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
9098                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
9099                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
9100                                     sizeof(enable), &enable);
9101                 __hci_req_update_eir(&req);
9102         } else {
9103                 clear_eir(&req);
9104         }
9105
9106         hci_req_run(&req, NULL);
9107 }
9108
9109 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
9110 {
9111         struct cmd_lookup *match = data;
9112
9113         if (match->sk == NULL) {
9114                 match->sk = cmd->sk;
9115                 sock_hold(match->sk);
9116         }
9117 }
9118
9119 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
9120                                     u8 status)
9121 {
9122         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
9123
9124         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
9125         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
9126         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
9127
9128         if (!status) {
9129                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
9130                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
9131                 ext_info_changed(hdev, NULL);
9132         }
9133
9134         if (match.sk)
9135                 sock_put(match.sk);
9136 }
9137
9138 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
9139 {
9140         struct mgmt_cp_set_local_name ev;
9141         struct mgmt_pending_cmd *cmd;
9142
9143         if (status)
9144                 return;
9145
9146         memset(&ev, 0, sizeof(ev));
9147         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
9148         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
9149
9150         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
9151         if (!cmd) {
9152                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
9153
9154                 /* If this is a HCI command related to powering on the
9155                  * HCI dev don't send any mgmt signals.
9156                  */
9157                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
9158                         return;
9159         }
9160
9161         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
9162                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
9163         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
9164 }
9165
9166 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
9167 {
9168         int i;
9169
9170         for (i = 0; i < uuid_count; i++) {
9171                 if (!memcmp(uuid, uuids[i], 16))
9172                         return true;
9173         }
9174
9175         return false;
9176 }
9177
9178 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
9179 {
9180         u16 parsed = 0;
9181
9182         while (parsed < eir_len) {
9183                 u8 field_len = eir[0];
9184                 u8 uuid[16];
9185                 int i;
9186
9187                 if (field_len == 0)
9188                         break;
9189
9190                 if (eir_len - parsed < field_len + 1)
9191                         break;
9192
9193                 switch (eir[1]) {
9194                 case EIR_UUID16_ALL:
9195                 case EIR_UUID16_SOME:
9196                         for (i = 0; i + 3 <= field_len; i += 2) {
9197                                 memcpy(uuid, bluetooth_base_uuid, 16);
9198                                 uuid[13] = eir[i + 3];
9199                                 uuid[12] = eir[i + 2];
9200                                 if (has_uuid(uuid, uuid_count, uuids))
9201                                         return true;
9202                         }
9203                         break;
9204                 case EIR_UUID32_ALL:
9205                 case EIR_UUID32_SOME:
9206                         for (i = 0; i + 5 <= field_len; i += 4) {
9207                                 memcpy(uuid, bluetooth_base_uuid, 16);
9208                                 uuid[15] = eir[i + 5];
9209                                 uuid[14] = eir[i + 4];
9210                                 uuid[13] = eir[i + 3];
9211                                 uuid[12] = eir[i + 2];
9212                                 if (has_uuid(uuid, uuid_count, uuids))
9213                                         return true;
9214                         }
9215                         break;
9216                 case EIR_UUID128_ALL:
9217                 case EIR_UUID128_SOME:
9218                         for (i = 0; i + 17 <= field_len; i += 16) {
9219                                 memcpy(uuid, eir + i + 2, 16);
9220                                 if (has_uuid(uuid, uuid_count, uuids))
9221                                         return true;
9222                         }
9223                         break;
9224                 }
9225
9226                 parsed += field_len + 1;
9227                 eir += field_len + 1;
9228         }
9229
9230         return false;
9231 }
9232
9233 static void restart_le_scan(struct hci_dev *hdev)
9234 {
9235         /* If controller is not scanning we are done. */
9236         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
9237                 return;
9238
9239         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
9240                        hdev->discovery.scan_start +
9241                        hdev->discovery.scan_duration))
9242                 return;
9243
9244         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
9245                            DISCOV_LE_RESTART_DELAY);
9246 }
9247
9248 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
9249                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
9250 {
9251         /* If a RSSI threshold has been specified, and
9252          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
9253          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
9254          * is set, let it through for further processing, as we might need to
9255          * restart the scan.
9256          *
9257          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
9258          * the results are also dropped.
9259          */
9260         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
9261             (rssi == HCI_RSSI_INVALID ||
9262             (rssi < hdev->discovery.rssi &&
9263              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
9264                 return  false;
9265
9266         if (hdev->discovery.uuid_count != 0) {
9267                 /* If a list of UUIDs is provided in filter, results with no
9268                  * matching UUID should be dropped.
9269                  */
9270                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
9271                                    hdev->discovery.uuids) &&
9272                     !eir_has_uuids(scan_rsp, scan_rsp_len,
9273                                    hdev->discovery.uuid_count,
9274                                    hdev->discovery.uuids))
9275                         return false;
9276         }
9277
9278         /* If duplicate filtering does not report RSSI changes, then restart
9279          * scanning to ensure updated result with updated RSSI values.
9280          */
9281         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
9282                 restart_le_scan(hdev);
9283
9284                 /* Validate RSSI value against the RSSI threshold once more. */
9285                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
9286                     rssi < hdev->discovery.rssi)
9287                         return false;
9288         }
9289
9290         return true;
9291 }
9292
9293 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9294                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
9295                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
9296 {
9297         char buf[512];
9298         struct mgmt_ev_device_found *ev = (void *)buf;
9299         size_t ev_size;
9300
9301         /* Don't send events for a non-kernel initiated discovery. With
9302          * LE one exception is if we have pend_le_reports > 0 in which
9303          * case we're doing passive scanning and want these events.
9304          */
9305         if (!hci_discovery_active(hdev)) {
9306                 if (link_type == ACL_LINK)
9307                         return;
9308                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
9309                         return;
9310         }
9311
9312         if (hdev->discovery.result_filtering) {
9313                 /* We are using service discovery */
9314                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
9315                                      scan_rsp_len))
9316                         return;
9317         }
9318
9319         if (hdev->discovery.limited) {
9320                 /* Check for limited discoverable bit */
9321                 if (dev_class) {
9322                         if (!(dev_class[1] & 0x20))
9323                                 return;
9324                 } else {
9325                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
9326                         if (!flags || !(flags[0] & LE_AD_LIMITED))
9327                                 return;
9328                 }
9329         }
9330
9331         /* Make sure that the buffer is big enough. The 5 extra bytes
9332          * are for the potential CoD field.
9333          */
9334         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
9335                 return;
9336
9337         memset(buf, 0, sizeof(buf));
9338
9339         /* In case of device discovery with BR/EDR devices (pre 1.2), the
9340          * RSSI value was reported as 0 when not available. This behavior
9341          * is kept when using device discovery. This is required for full
9342          * backwards compatibility with the API.
9343          *
9344          * However when using service discovery, the value 127 will be
9345          * returned when the RSSI is not available.
9346          */
9347         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
9348             link_type == ACL_LINK)
9349                 rssi = 0;
9350
9351         bacpy(&ev->addr.bdaddr, bdaddr);
9352         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9353         ev->rssi = rssi;
9354         ev->flags = cpu_to_le32(flags);
9355
9356         if (eir_len > 0)
9357                 /* Copy EIR or advertising data into event */
9358                 memcpy(ev->eir, eir, eir_len);
9359
9360         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
9361                                        NULL))
9362                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
9363                                           dev_class, 3);
9364
9365         if (scan_rsp_len > 0)
9366                 /* Append scan response data to event */
9367                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
9368
9369         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
9370         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
9371
9372         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
9373 }
9374
9375 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9376                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
9377 {
9378         struct mgmt_ev_device_found *ev;
9379         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
9380         u16 eir_len;
9381
9382         ev = (struct mgmt_ev_device_found *) buf;
9383
9384         memset(buf, 0, sizeof(buf));
9385
9386         bacpy(&ev->addr.bdaddr, bdaddr);
9387         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9388         ev->rssi = rssi;
9389
9390         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
9391                                   name_len);
9392
9393         ev->eir_len = cpu_to_le16(eir_len);
9394
9395         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
9396 }
9397
9398 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
9399 {
9400         struct mgmt_ev_discovering ev;
9401
9402         BT_DBG("%s discovering %u", hdev->name, discovering);
9403
9404         memset(&ev, 0, sizeof(ev));
9405         ev.type = hdev->discovery.type;
9406         ev.discovering = discovering;
9407
9408         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
9409 }
9410
9411 static struct hci_mgmt_chan chan = {
9412         .channel        = HCI_CHANNEL_CONTROL,
9413         .handler_count  = ARRAY_SIZE(mgmt_handlers),
9414         .handlers       = mgmt_handlers,
9415 #ifdef TIZEN_BT
9416         .tizen_handler_count    = ARRAY_SIZE(tizen_mgmt_handlers),
9417         .tizen_handlers = tizen_mgmt_handlers,
9418 #endif
9419         .hdev_init      = mgmt_init_hdev,
9420 };
9421
9422 int mgmt_init(void)
9423 {
9424         return hci_mgmt_chan_register(&chan);
9425 }
9426
9427 void mgmt_exit(void)
9428 {
9429         hci_mgmt_chan_unregister(&chan);
9430 }