net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #ifdef TIZEN_BT
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #endif
  38
  39 #include "hci_request.h"
  40 #include "smp.h"
  41 #include "mgmt_util.h"
  42 #include "mgmt_config.h"
  43 #include "msft.h"
  44
  45 #define MGMT_VERSION    1
  46 #define MGMT_REVISION   21
  47
  48 static const u16 mgmt_commands[] = {
  49         MGMT_OP_READ_INDEX_LIST,
  50         MGMT_OP_READ_INFO,
  51         MGMT_OP_SET_POWERED,
  52         MGMT_OP_SET_DISCOVERABLE,
  53         MGMT_OP_SET_CONNECTABLE,
  54         MGMT_OP_SET_FAST_CONNECTABLE,
  55         MGMT_OP_SET_BONDABLE,
  56         MGMT_OP_SET_LINK_SECURITY,
  57         MGMT_OP_SET_SSP,
  58         MGMT_OP_SET_HS,
  59         MGMT_OP_SET_LE,
  60         MGMT_OP_SET_DEV_CLASS,
  61         MGMT_OP_SET_LOCAL_NAME,
  62         MGMT_OP_ADD_UUID,
  63         MGMT_OP_REMOVE_UUID,
  64         MGMT_OP_LOAD_LINK_KEYS,
  65         MGMT_OP_LOAD_LONG_TERM_KEYS,
  66         MGMT_OP_DISCONNECT,
  67         MGMT_OP_GET_CONNECTIONS,
  68         MGMT_OP_PIN_CODE_REPLY,
  69         MGMT_OP_PIN_CODE_NEG_REPLY,
  70         MGMT_OP_SET_IO_CAPABILITY,
  71         MGMT_OP_PAIR_DEVICE,
  72         MGMT_OP_CANCEL_PAIR_DEVICE,
  73         MGMT_OP_UNPAIR_DEVICE,
  74         MGMT_OP_USER_CONFIRM_REPLY,
  75         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  76         MGMT_OP_USER_PASSKEY_REPLY,
  77         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  78         MGMT_OP_READ_LOCAL_OOB_DATA,
  79         MGMT_OP_ADD_REMOTE_OOB_DATA,
  80         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  81         MGMT_OP_START_DISCOVERY,
  82         MGMT_OP_STOP_DISCOVERY,
  83         MGMT_OP_CONFIRM_NAME,
  84         MGMT_OP_BLOCK_DEVICE,
  85         MGMT_OP_UNBLOCK_DEVICE,
  86         MGMT_OP_SET_DEVICE_ID,
  87         MGMT_OP_SET_ADVERTISING,
  88         MGMT_OP_SET_BREDR,
  89         MGMT_OP_SET_STATIC_ADDRESS,
  90         MGMT_OP_SET_SCAN_PARAMS,
  91         MGMT_OP_SET_SECURE_CONN,
  92         MGMT_OP_SET_DEBUG_KEYS,
  93         MGMT_OP_SET_PRIVACY,
  94         MGMT_OP_LOAD_IRKS,
  95         MGMT_OP_GET_CONN_INFO,
  96         MGMT_OP_GET_CLOCK_INFO,
  97         MGMT_OP_ADD_DEVICE,
  98         MGMT_OP_REMOVE_DEVICE,
  99         MGMT_OP_LOAD_CONN_PARAM,
 100         MGMT_OP_READ_UNCONF_INDEX_LIST,
 101         MGMT_OP_READ_CONFIG_INFO,
 102         MGMT_OP_SET_EXTERNAL_CONFIG,
 103         MGMT_OP_SET_PUBLIC_ADDRESS,
 104         MGMT_OP_START_SERVICE_DISCOVERY,
 105         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 106         MGMT_OP_READ_EXT_INDEX_LIST,
 107         MGMT_OP_READ_ADV_FEATURES,
 108         MGMT_OP_ADD_ADVERTISING,
 109         MGMT_OP_REMOVE_ADVERTISING,
 110         MGMT_OP_GET_ADV_SIZE_INFO,
 111         MGMT_OP_START_LIMITED_DISCOVERY,
 112         MGMT_OP_READ_EXT_INFO,
 113         MGMT_OP_SET_APPEARANCE,
 114         MGMT_OP_GET_PHY_CONFIGURATION,
 115         MGMT_OP_SET_PHY_CONFIGURATION,
 116         MGMT_OP_SET_BLOCKED_KEYS,
 117         MGMT_OP_SET_WIDEBAND_SPEECH,
 118         MGMT_OP_READ_CONTROLLER_CAP,
 119         MGMT_OP_READ_EXP_FEATURES_INFO,
 120         MGMT_OP_SET_EXP_FEATURE,
 121         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 122         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 123         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 124         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 125         MGMT_OP_GET_DEVICE_FLAGS,
 126         MGMT_OP_SET_DEVICE_FLAGS,
 127         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 128         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 129         MGMT_OP_REMOVE_ADV_MONITOR,
 130         MGMT_OP_ADD_EXT_ADV_PARAMS,
 131         MGMT_OP_ADD_EXT_ADV_DATA,
 132         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 133 };
 134
 135 static const u16 mgmt_events[] = {
 136         MGMT_EV_CONTROLLER_ERROR,
 137         MGMT_EV_INDEX_ADDED,
 138         MGMT_EV_INDEX_REMOVED,
 139         MGMT_EV_NEW_SETTINGS,
 140         MGMT_EV_CLASS_OF_DEV_CHANGED,
 141         MGMT_EV_LOCAL_NAME_CHANGED,
 142         MGMT_EV_NEW_LINK_KEY,
 143         MGMT_EV_NEW_LONG_TERM_KEY,
 144         MGMT_EV_DEVICE_CONNECTED,
 145         MGMT_EV_DEVICE_DISCONNECTED,
 146         MGMT_EV_CONNECT_FAILED,
 147         MGMT_EV_PIN_CODE_REQUEST,
 148         MGMT_EV_USER_CONFIRM_REQUEST,
 149         MGMT_EV_USER_PASSKEY_REQUEST,
 150         MGMT_EV_AUTH_FAILED,
 151         MGMT_EV_DEVICE_FOUND,
 152         MGMT_EV_DISCOVERING,
 153         MGMT_EV_DEVICE_BLOCKED,
 154         MGMT_EV_DEVICE_UNBLOCKED,
 155         MGMT_EV_DEVICE_UNPAIRED,
 156         MGMT_EV_PASSKEY_NOTIFY,
 157         MGMT_EV_NEW_IRK,
 158         MGMT_EV_NEW_CSRK,
 159         MGMT_EV_DEVICE_ADDED,
 160         MGMT_EV_DEVICE_REMOVED,
 161         MGMT_EV_NEW_CONN_PARAM,
 162         MGMT_EV_UNCONF_INDEX_ADDED,
 163         MGMT_EV_UNCONF_INDEX_REMOVED,
 164         MGMT_EV_NEW_CONFIG_OPTIONS,
 165         MGMT_EV_EXT_INDEX_ADDED,
 166         MGMT_EV_EXT_INDEX_REMOVED,
 167         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 168         MGMT_EV_ADVERTISING_ADDED,
 169         MGMT_EV_ADVERTISING_REMOVED,
 170         MGMT_EV_EXT_INFO_CHANGED,
 171         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 172         MGMT_EV_EXP_FEATURE_CHANGED,
 173         MGMT_EV_DEVICE_FLAGS_CHANGED,
 174         MGMT_EV_ADV_MONITOR_ADDED,
 175         MGMT_EV_ADV_MONITOR_REMOVED,
 176         MGMT_EV_CONTROLLER_SUSPEND,
 177         MGMT_EV_CONTROLLER_RESUME,
 178 };
 179
 180 static const u16 mgmt_untrusted_commands[] = {
 181         MGMT_OP_READ_INDEX_LIST,
 182         MGMT_OP_READ_INFO,
 183         MGMT_OP_READ_UNCONF_INDEX_LIST,
 184         MGMT_OP_READ_CONFIG_INFO,
 185         MGMT_OP_READ_EXT_INDEX_LIST,
 186         MGMT_OP_READ_EXT_INFO,
 187         MGMT_OP_READ_CONTROLLER_CAP,
 188         MGMT_OP_READ_EXP_FEATURES_INFO,
 189         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 190         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 191 };
 192
 193 static const u16 mgmt_untrusted_events[] = {
 194         MGMT_EV_INDEX_ADDED,
 195         MGMT_EV_INDEX_REMOVED,
 196         MGMT_EV_NEW_SETTINGS,
 197         MGMT_EV_CLASS_OF_DEV_CHANGED,
 198         MGMT_EV_LOCAL_NAME_CHANGED,
 199         MGMT_EV_UNCONF_INDEX_ADDED,
 200         MGMT_EV_UNCONF_INDEX_REMOVED,
 201         MGMT_EV_NEW_CONFIG_OPTIONS,
 202         MGMT_EV_EXT_INDEX_ADDED,
 203         MGMT_EV_EXT_INDEX_REMOVED,
 204         MGMT_EV_EXT_INFO_CHANGED,
 205         MGMT_EV_EXP_FEATURE_CHANGED,
 206 };
 207
 208 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 209
 210 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 211                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 212
 213 /* HCI to MGMT error code conversion table */
 214 static const u8 mgmt_status_table[] = {
 215         MGMT_STATUS_SUCCESS,
 216         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 217         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 218         MGMT_STATUS_FAILED,             /* Hardware Failure */
 219         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 220         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 221         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 222         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 223         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 224         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 225         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 226         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 227         MGMT_STATUS_BUSY,               /* Command Disallowed */
 228         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 229         MGMT_STATUS_REJECTED,           /* Rejected Security */
 230         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 231         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 232         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 233         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 234         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 235         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 236         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 237         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 238         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 239         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 240         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 241         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 242         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 243         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 244         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 245         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 246         MGMT_STATUS_FAILED,             /* Unspecified Error */
 247         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 248         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 249         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 250         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 251         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 252         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 253         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 254         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 255         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 256         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 257         MGMT_STATUS_FAILED,             /* Transaction Collision */
 258         MGMT_STATUS_FAILED,             /* Reserved for future use */
 259         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 260         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 261         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 262         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 263         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 264         MGMT_STATUS_FAILED,             /* Reserved for future use */
 265         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 266         MGMT_STATUS_FAILED,             /* Reserved for future use */
 267         MGMT_STATUS_FAILED,             /* Slot Violation */
 268         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 269         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 270         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 271         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 272         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 273         MGMT_STATUS_BUSY,               /* Controller Busy */
 274         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 275         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 276         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 277         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 278         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 279 };
 280
 281 static u8 mgmt_status(u8 hci_status)
 282 {
 283         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 284                 return mgmt_status_table[hci_status];
 285
 286         return MGMT_STATUS_FAILED;
 287 }
 288
 289 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 290                             u16 len, int flag)
 291 {
 292         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 293                                flag, NULL);
 294 }
 295
 296 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 297                               u16 len, int flag, struct sock *skip_sk)
 298 {
 299         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 300                                flag, skip_sk);
 301 }
 302
 303 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 304                       struct sock *skip_sk)
 305 {
 306         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 307                                HCI_SOCK_TRUSTED, skip_sk);
 308 }
 309
 310 static u8 le_addr_type(u8 mgmt_addr_type)
 311 {
 312         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 313                 return ADDR_LE_DEV_PUBLIC;
 314         else
 315                 return ADDR_LE_DEV_RANDOM;
 316 }
 317
 318 void mgmt_fill_version_info(void *ver)
 319 {
 320         struct mgmt_rp_read_version *rp = ver;
 321
 322         rp->version = MGMT_VERSION;
 323         rp->revision = cpu_to_le16(MGMT_REVISION);
 324 }
 325
 326 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 327                         u16 data_len)
 328 {
 329         struct mgmt_rp_read_version rp;
 330
 331         bt_dev_dbg(hdev, "sock %p", sk);
 332
 333         mgmt_fill_version_info(&rp);
 334
 335         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 336                                  &rp, sizeof(rp));
 337 }
 338
 339 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 340                          u16 data_len)
 341 {
 342         struct mgmt_rp_read_commands *rp;
 343         u16 num_commands, num_events;
 344         size_t rp_size;
 345         int i, err;
 346
 347         bt_dev_dbg(hdev, "sock %p", sk);
 348
 349         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 350                 num_commands = ARRAY_SIZE(mgmt_commands);
 351                 num_events = ARRAY_SIZE(mgmt_events);
 352         } else {
 353                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 354                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 355         }
 356
 357         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 358
 359         rp = kmalloc(rp_size, GFP_KERNEL);
 360         if (!rp)
 361                 return -ENOMEM;
 362
 363         rp->num_commands = cpu_to_le16(num_commands);
 364         rp->num_events = cpu_to_le16(num_events);
 365
 366         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 367                 __le16 *opcode = rp->opcodes;
 368
 369                 for (i = 0; i < num_commands; i++, opcode++)
 370                         put_unaligned_le16(mgmt_commands[i], opcode);
 371
 372                 for (i = 0; i < num_events; i++, opcode++)
 373                         put_unaligned_le16(mgmt_events[i], opcode);
 374         } else {
 375                 __le16 *opcode = rp->opcodes;
 376
 377                 for (i = 0; i < num_commands; i++, opcode++)
 378                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 379
 380                 for (i = 0; i < num_events; i++, opcode++)
 381                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 382         }
 383
 384         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 385                                 rp, rp_size);
 386         kfree(rp);
 387
 388         return err;
 389 }
 390
 391 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 392                            u16 data_len)
 393 {
 394         struct mgmt_rp_read_index_list *rp;
 395         struct hci_dev *d;
 396         size_t rp_len;
 397         u16 count;
 398         int err;
 399
 400         bt_dev_dbg(hdev, "sock %p", sk);
 401
 402         read_lock(&hci_dev_list_lock);
 403
 404         count = 0;
 405         list_for_each_entry(d, &hci_dev_list, list) {
 406                 if (d->dev_type == HCI_PRIMARY &&
 407                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 408                         count++;
 409         }
 410
 411         rp_len = sizeof(*rp) + (2 * count);
 412         rp = kmalloc(rp_len, GFP_ATOMIC);
 413         if (!rp) {
 414                 read_unlock(&hci_dev_list_lock);
 415                 return -ENOMEM;
 416         }
 417
 418         count = 0;
 419         list_for_each_entry(d, &hci_dev_list, list) {
 420                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 421                     hci_dev_test_flag(d, HCI_CONFIG) ||
 422                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 423                         continue;
 424
 425                 /* Devices marked as raw-only are neither configured
 426                  * nor unconfigured controllers.
 427                  */
 428                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 429                         continue;
 430
 431                 if (d->dev_type == HCI_PRIMARY &&
 432                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 433                         rp->index[count++] = cpu_to_le16(d->id);
 434                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 435                 }
 436         }
 437
 438         rp->num_controllers = cpu_to_le16(count);
 439         rp_len = sizeof(*rp) + (2 * count);
 440
 441         read_unlock(&hci_dev_list_lock);
 442
 443         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 444                                 0, rp, rp_len);
 445
 446         kfree(rp);
 447
 448         return err;
 449 }
 450
 451 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 452                                   void *data, u16 data_len)
 453 {
 454         struct mgmt_rp_read_unconf_index_list *rp;
 455         struct hci_dev *d;
 456         size_t rp_len;
 457         u16 count;
 458         int err;
 459
 460         bt_dev_dbg(hdev, "sock %p", sk);
 461
 462         read_lock(&hci_dev_list_lock);
 463
 464         count = 0;
 465         list_for_each_entry(d, &hci_dev_list, list) {
 466                 if (d->dev_type == HCI_PRIMARY &&
 467                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 468                         count++;
 469         }
 470
 471         rp_len = sizeof(*rp) + (2 * count);
 472         rp = kmalloc(rp_len, GFP_ATOMIC);
 473         if (!rp) {
 474                 read_unlock(&hci_dev_list_lock);
 475                 return -ENOMEM;
 476         }
 477
 478         count = 0;
 479         list_for_each_entry(d, &hci_dev_list, list) {
 480                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 481                     hci_dev_test_flag(d, HCI_CONFIG) ||
 482                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 483                         continue;
 484
 485                 /* Devices marked as raw-only are neither configured
 486                  * nor unconfigured controllers.
 487                  */
 488                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 489                         continue;
 490
 491                 if (d->dev_type == HCI_PRIMARY &&
 492                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 493                         rp->index[count++] = cpu_to_le16(d->id);
 494                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 495                 }
 496         }
 497
 498         rp->num_controllers = cpu_to_le16(count);
 499         rp_len = sizeof(*rp) + (2 * count);
 500
 501         read_unlock(&hci_dev_list_lock);
 502
 503         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 504                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 505
 506         kfree(rp);
 507
 508         return err;
 509 }
 510
 511 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 512                                void *data, u16 data_len)
 513 {
 514         struct mgmt_rp_read_ext_index_list *rp;
 515         struct hci_dev *d;
 516         u16 count;
 517         int err;
 518
 519         bt_dev_dbg(hdev, "sock %p", sk);
 520
 521         read_lock(&hci_dev_list_lock);
 522
 523         count = 0;
 524         list_for_each_entry(d, &hci_dev_list, list) {
 525                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 526                         count++;
 527         }
 528
 529         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 530         if (!rp) {
 531                 read_unlock(&hci_dev_list_lock);
 532                 return -ENOMEM;
 533         }
 534
 535         count = 0;
 536         list_for_each_entry(d, &hci_dev_list, list) {
 537                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 538                     hci_dev_test_flag(d, HCI_CONFIG) ||
 539                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 540                         continue;
 541
 542                 /* Devices marked as raw-only are neither configured
 543                  * nor unconfigured controllers.
 544                  */
 545                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 546                         continue;
 547
 548                 if (d->dev_type == HCI_PRIMARY) {
 549                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 550                                 rp->entry[count].type = 0x01;
 551                         else
 552                                 rp->entry[count].type = 0x00;
 553                 } else if (d->dev_type == HCI_AMP) {
 554                         rp->entry[count].type = 0x02;
 555                 } else {
 556                         continue;
 557                 }
 558
 559                 rp->entry[count].bus = d->bus;
 560                 rp->entry[count++].index = cpu_to_le16(d->id);
 561                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 562         }
 563
 564         rp->num_controllers = cpu_to_le16(count);
 565
 566         read_unlock(&hci_dev_list_lock);
 567
 568         /* If this command is called at least once, then all the
 569          * default index and unconfigured index events are disabled
 570          * and from now on only extended index events are used.
 571          */
 572         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 573         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 574         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 575
 576         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 577                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 578                                 struct_size(rp, entry, count));
 579
 580         kfree(rp);
 581
 582         return err;
 583 }
 584
 585 static bool is_configured(struct hci_dev *hdev)
 586 {
 587         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 588             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 589                 return false;
 590
 591         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 592              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 593             !bacmp(&hdev->public_addr, BDADDR_ANY))
 594                 return false;
 595
 596         return true;
 597 }
 598
 599 static __le32 get_missing_options(struct hci_dev *hdev)
 600 {
 601         u32 options = 0;
 602
 603         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 604             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 605                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 606
 607         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 608              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 609             !bacmp(&hdev->public_addr, BDADDR_ANY))
 610                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 611
 612         return cpu_to_le32(options);
 613 }
 614
 615 static int new_options(struct hci_dev *hdev, struct sock *skip)
 616 {
 617         __le32 options = get_missing_options(hdev);
 618
 619         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 620                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 621 }
 622
 623 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 624 {
 625         __le32 options = get_missing_options(hdev);
 626
 627         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 628                                  sizeof(options));
 629 }
 630
 631 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 632                             void *data, u16 data_len)
 633 {
 634         struct mgmt_rp_read_config_info rp;
 635         u32 options = 0;
 636
 637         bt_dev_dbg(hdev, "sock %p", sk);
 638
 639         hci_dev_lock(hdev);
 640
 641         memset(&rp, 0, sizeof(rp));
 642         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 643
 644         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 645                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 646
 647         if (hdev->set_bdaddr)
 648                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 649
 650         rp.supported_options = cpu_to_le32(options);
 651         rp.missing_options = get_missing_options(hdev);
 652
 653         hci_dev_unlock(hdev);
 654
 655         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 656                                  &rp, sizeof(rp));
 657 }
 658
 659 static u32 get_supported_phys(struct hci_dev *hdev)
 660 {
 661         u32 supported_phys = 0;
 662
 663         if (lmp_bredr_capable(hdev)) {
 664                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 665
 666                 if (hdev->features[0][0] & LMP_3SLOT)
 667                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 668
 669                 if (hdev->features[0][0] & LMP_5SLOT)
 670                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 671
 672                 if (lmp_edr_2m_capable(hdev)) {
 673                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 674
 675                         if (lmp_edr_3slot_capable(hdev))
 676                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 677
 678                         if (lmp_edr_5slot_capable(hdev))
 679                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 680
 681                         if (lmp_edr_3m_capable(hdev)) {
 682                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 683
 684                                 if (lmp_edr_3slot_capable(hdev))
 685                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 686
 687                                 if (lmp_edr_5slot_capable(hdev))
 688                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 689                         }
 690                 }
 691         }
 692
 693         if (lmp_le_capable(hdev)) {
 694                 supported_phys |= MGMT_PHY_LE_1M_TX;
 695                 supported_phys |= MGMT_PHY_LE_1M_RX;
 696
 697                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 698                         supported_phys |= MGMT_PHY_LE_2M_TX;
 699                         supported_phys |= MGMT_PHY_LE_2M_RX;
 700                 }
 701
 702                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 703                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 704                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 705                 }
 706         }
 707
 708         return supported_phys;
 709 }
 710
 711 static u32 get_selected_phys(struct hci_dev *hdev)
 712 {
 713         u32 selected_phys = 0;
 714
 715         if (lmp_bredr_capable(hdev)) {
 716                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 717
 718                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 719                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 720
 721                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 722                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 723
 724                 if (lmp_edr_2m_capable(hdev)) {
 725                         if (!(hdev->pkt_type & HCI_2DH1))
 726                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 727
 728                         if (lmp_edr_3slot_capable(hdev) &&
 729                             !(hdev->pkt_type & HCI_2DH3))
 730                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 731
 732                         if (lmp_edr_5slot_capable(hdev) &&
 733                             !(hdev->pkt_type & HCI_2DH5))
 734                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 735
 736                         if (lmp_edr_3m_capable(hdev)) {
 737                                 if (!(hdev->pkt_type & HCI_3DH1))
 738                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 739
 740                                 if (lmp_edr_3slot_capable(hdev) &&
 741                                     !(hdev->pkt_type & HCI_3DH3))
 742                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 743
 744                                 if (lmp_edr_5slot_capable(hdev) &&
 745                                     !(hdev->pkt_type & HCI_3DH5))
 746                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 747                         }
 748                 }
 749         }
 750
 751         if (lmp_le_capable(hdev)) {
 752                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 753                         selected_phys |= MGMT_PHY_LE_1M_TX;
 754
 755                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 756                         selected_phys |= MGMT_PHY_LE_1M_RX;
 757
 758                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 759                         selected_phys |= MGMT_PHY_LE_2M_TX;
 760
 761                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 762                         selected_phys |= MGMT_PHY_LE_2M_RX;
 763
 764                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 765                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 766
 767                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 768                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 769         }
 770
 771         return selected_phys;
 772 }
 773
 774 static u32 get_configurable_phys(struct hci_dev *hdev)
 775 {
 776         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 777                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 778 }
 779
 780 static u32 get_supported_settings(struct hci_dev *hdev)
 781 {
 782         u32 settings = 0;
 783
 784         settings |= MGMT_SETTING_POWERED;
 785         settings |= MGMT_SETTING_BONDABLE;
 786         settings |= MGMT_SETTING_DEBUG_KEYS;
 787         settings |= MGMT_SETTING_CONNECTABLE;
 788         settings |= MGMT_SETTING_DISCOVERABLE;
 789
 790         if (lmp_bredr_capable(hdev)) {
 791                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 792                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 793                 settings |= MGMT_SETTING_BREDR;
 794                 settings |= MGMT_SETTING_LINK_SECURITY;
 795
 796                 if (lmp_ssp_capable(hdev)) {
 797                         settings |= MGMT_SETTING_SSP;
 798                         if (IS_ENABLED(CONFIG_BT_HS))
 799                                 settings |= MGMT_SETTING_HS;
 800                 }
 801
 802                 if (lmp_sc_capable(hdev))
 803                         settings |= MGMT_SETTING_SECURE_CONN;
 804
 805                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 806                              &hdev->quirks))
 807                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 808         }
 809
 810         if (lmp_le_capable(hdev)) {
 811                 settings |= MGMT_SETTING_LE;
 812                 settings |= MGMT_SETTING_SECURE_CONN;
 813                 settings |= MGMT_SETTING_PRIVACY;
 814                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 815
 816                 /* When the experimental feature for LL Privacy support is
 817                  * enabled, then advertising is no longer supported.
 818                  */
 819                 if (!hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
 820                         settings |= MGMT_SETTING_ADVERTISING;
 821         }
 822
 823         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 824             hdev->set_bdaddr)
 825                 settings |= MGMT_SETTING_CONFIGURATION;
 826
 827         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 828
 829         return settings;
 830 }
 831
 832 static u32 get_current_settings(struct hci_dev *hdev)
 833 {
 834         u32 settings = 0;
 835
 836         if (hdev_is_powered(hdev))
 837                 settings |= MGMT_SETTING_POWERED;
 838
 839         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 840                 settings |= MGMT_SETTING_CONNECTABLE;
 841
 842         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 843                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 844
 845         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 846                 settings |= MGMT_SETTING_DISCOVERABLE;
 847
 848         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 849                 settings |= MGMT_SETTING_BONDABLE;
 850
 851         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 852                 settings |= MGMT_SETTING_BREDR;
 853
 854         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 855                 settings |= MGMT_SETTING_LE;
 856
 857         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 858                 settings |= MGMT_SETTING_LINK_SECURITY;
 859
 860         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 861                 settings |= MGMT_SETTING_SSP;
 862
 863         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 864                 settings |= MGMT_SETTING_HS;
 865
 866         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 867                 settings |= MGMT_SETTING_ADVERTISING;
 868
 869         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 870                 settings |= MGMT_SETTING_SECURE_CONN;
 871
 872         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 873                 settings |= MGMT_SETTING_DEBUG_KEYS;
 874
 875         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 876                 settings |= MGMT_SETTING_PRIVACY;
 877
 878         /* The current setting for static address has two purposes. The
 879          * first is to indicate if the static address will be used and
 880          * the second is to indicate if it is actually set.
 881          *
 882          * This means if the static address is not configured, this flag
 883          * will never be set. If the address is configured, then if the
 884          * address is actually used decides if the flag is set or not.
 885          *
 886          * For single mode LE only controllers and dual-mode controllers
 887          * with BR/EDR disabled, the existence of the static address will
 888          * be evaluated.
 889          */
 890         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 891             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 892             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 893                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 894                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 895         }
 896
 897         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 898                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 899
 900         return settings;
 901 }
 902
 903 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 904 {
 905         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 906 }
 907
 908 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 909                                                   struct hci_dev *hdev,
 910                                                   const void *data)
 911 {
 912         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 913 }
 914
 915 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 916 {
 917         struct mgmt_pending_cmd *cmd;
 918
 919         /* If there's a pending mgmt command the flags will not yet have
 920          * their final values, so check for this first.
 921          */
 922         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 923         if (cmd) {
 924                 struct mgmt_mode *cp = cmd->param;
 925                 if (cp->val == 0x01)
 926                         return LE_AD_GENERAL;
 927                 else if (cp->val == 0x02)
 928                         return LE_AD_LIMITED;
 929         } else {
 930                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 931                         return LE_AD_LIMITED;
 932                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 933                         return LE_AD_GENERAL;
 934         }
 935
 936         return 0;
 937 }
 938
 939 bool mgmt_get_connectable(struct hci_dev *hdev)
 940 {
 941         struct mgmt_pending_cmd *cmd;
 942
 943         /* If there's a pending mgmt command the flag will not yet have
 944          * it's final value, so check for this first.
 945          */
 946         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 947         if (cmd) {
 948                 struct mgmt_mode *cp = cmd->param;
 949
 950                 return cp->val;
 951         }
 952
 953         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 954 }
 955
 956 static void service_cache_off(struct work_struct *work)
 957 {
 958         struct hci_dev *hdev = container_of(work, struct hci_dev,
 959                                             service_cache.work);
 960         struct hci_request req;
 961
 962         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 963                 return;
 964
 965         hci_req_init(&req, hdev);
 966
 967         hci_dev_lock(hdev);
 968
 969         __hci_req_update_eir(&req);
 970         __hci_req_update_class(&req);
 971
 972         hci_dev_unlock(hdev);
 973
 974         hci_req_run(&req, NULL);
 975 }
 976
 977 static void rpa_expired(struct work_struct *work)
 978 {
 979         struct hci_dev *hdev = container_of(work, struct hci_dev,
 980                                             rpa_expired.work);
 981         struct hci_request req;
 982
 983         bt_dev_dbg(hdev, "");
 984
 985         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 986
 987         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 988                 return;
 989
 990         /* The generation of a new RPA and programming it into the
 991          * controller happens in the hci_req_enable_advertising()
 992          * function.
 993          */
 994         hci_req_init(&req, hdev);
 995         if (ext_adv_capable(hdev))
 996                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 997         else
 998                 __hci_req_enable_advertising(&req);
 999         hci_req_run(&req, NULL);
1000 }
1001
1002 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1003 {
1004         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1005                 return;
1006
1007         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1008         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1009
1010         /* Non-mgmt controlled devices get this bit set
1011          * implicitly so that pairing works for them, however
1012          * for mgmt we require user-space to explicitly enable
1013          * it
1014          */
1015         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1016 }
1017
1018 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1019                                 void *data, u16 data_len)
1020 {
1021         struct mgmt_rp_read_info rp;
1022
1023         bt_dev_dbg(hdev, "sock %p", sk);
1024
1025         hci_dev_lock(hdev);
1026
1027         memset(&rp, 0, sizeof(rp));
1028
1029         bacpy(&rp.bdaddr, &hdev->bdaddr);
1030
1031         rp.version = hdev->hci_ver;
1032         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1033
1034         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1035         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1036
1037         memcpy(rp.dev_class, hdev->dev_class, 3);
1038
1039         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1040         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1041
1042         hci_dev_unlock(hdev);
1043
1044         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1045                                  sizeof(rp));
1046 }
1047
1048 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1049 {
1050         u16 eir_len = 0;
1051         size_t name_len;
1052
1053         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1054                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1055                                           hdev->dev_class, 3);
1056
1057         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1058                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1059                                           hdev->appearance);
1060
1061         name_len = strlen(hdev->dev_name);
1062         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1063                                   hdev->dev_name, name_len);
1064
1065         name_len = strlen(hdev->short_name);
1066         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1067                                   hdev->short_name, name_len);
1068
1069         return eir_len;
1070 }
1071
1072 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1073                                     void *data, u16 data_len)
1074 {
1075         char buf[512];
1076         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1077         u16 eir_len;
1078
1079         bt_dev_dbg(hdev, "sock %p", sk);
1080
1081         memset(&buf, 0, sizeof(buf));
1082
1083         hci_dev_lock(hdev);
1084
1085         bacpy(&rp->bdaddr, &hdev->bdaddr);
1086
1087         rp->version = hdev->hci_ver;
1088         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1089
1090         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1091         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1092
1093
1094         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1095         rp->eir_len = cpu_to_le16(eir_len);
1096
1097         hci_dev_unlock(hdev);
1098
1099         /* If this command is called at least once, then the events
1100          * for class of device and local name changes are disabled
1101          * and only the new extended controller information event
1102          * is used.
1103          */
1104         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1105         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1106         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1107
1108         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1109                                  sizeof(*rp) + eir_len);
1110 }
1111
1112 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1113 {
1114         char buf[512];
1115         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1116         u16 eir_len;
1117
1118         memset(buf, 0, sizeof(buf));
1119
1120         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1121         ev->eir_len = cpu_to_le16(eir_len);
1122
1123         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1124                                   sizeof(*ev) + eir_len,
1125                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1126 }
1127
1128 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1129 {
1130         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1131
1132         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1133                                  sizeof(settings));
1134 }
1135
1136 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1137 {
1138         bt_dev_dbg(hdev, "status 0x%02x", status);
1139
1140         if (hci_conn_count(hdev) == 0) {
1141                 cancel_delayed_work(&hdev->power_off);
1142                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1143         }
1144 }
1145
1146 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1147 {
1148         struct mgmt_ev_advertising_added ev;
1149
1150         ev.instance = instance;
1151
1152         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1153 }
1154
1155 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1156                               u8 instance)
1157 {
1158         struct mgmt_ev_advertising_removed ev;
1159
1160         ev.instance = instance;
1161
1162         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1163 }
1164
1165 static void cancel_adv_timeout(struct hci_dev *hdev)
1166 {
1167         if (hdev->adv_instance_timeout) {
1168                 hdev->adv_instance_timeout = 0;
1169                 cancel_delayed_work(&hdev->adv_instance_expire);
1170         }
1171 }
1172
1173 static int clean_up_hci_state(struct hci_dev *hdev)
1174 {
1175         struct hci_request req;
1176         struct hci_conn *conn;
1177         bool discov_stopped;
1178         int err;
1179
1180         hci_req_init(&req, hdev);
1181
1182         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1183             test_bit(HCI_PSCAN, &hdev->flags)) {
1184                 u8 scan = 0x00;
1185                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1186         }
1187
1188         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1189
1190         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1191                 __hci_req_disable_advertising(&req);
1192
1193         discov_stopped = hci_req_stop_discovery(&req);
1194
1195         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1196                 /* 0x15 == Terminated due to Power Off */
1197                 __hci_abort_conn(&req, conn, 0x15);
1198         }
1199
1200         err = hci_req_run(&req, clean_up_hci_complete);
1201         if (!err && discov_stopped)
1202                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1203
1204         return err;
1205 }
1206
1207 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1208                        u16 len)
1209 {
1210         struct mgmt_mode *cp = data;
1211         struct mgmt_pending_cmd *cmd;
1212         int err;
1213
1214         bt_dev_dbg(hdev, "sock %p", sk);
1215
1216         if (cp->val != 0x00 && cp->val != 0x01)
1217                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1218                                        MGMT_STATUS_INVALID_PARAMS);
1219
1220         hci_dev_lock(hdev);
1221
1222         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1223                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1224                                       MGMT_STATUS_BUSY);
1225                 goto failed;
1226         }
1227
1228         if (!!cp->val == hdev_is_powered(hdev)) {
1229                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1230                 goto failed;
1231         }
1232
1233         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1234         if (!cmd) {
1235                 err = -ENOMEM;
1236                 goto failed;
1237         }
1238
1239         if (cp->val) {
1240                 queue_work(hdev->req_workqueue, &hdev->power_on);
1241                 err = 0;
1242         } else {
1243                 /* Disconnect connections, stop scans, etc */
1244                 err = clean_up_hci_state(hdev);
1245                 if (!err)
1246                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1247                                            HCI_POWER_OFF_TIMEOUT);
1248
1249                 /* ENODATA means there were no HCI commands queued */
1250                 if (err == -ENODATA) {
1251                         cancel_delayed_work(&hdev->power_off);
1252                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1253                         err = 0;
1254                 }
1255         }
1256
1257 failed:
1258         hci_dev_unlock(hdev);
1259         return err;
1260 }
1261
1262 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1263 {
1264         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1265
1266         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1267                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1268 }
1269
1270 int mgmt_new_settings(struct hci_dev *hdev)
1271 {
1272         return new_settings(hdev, NULL);
1273 }
1274
1275 struct cmd_lookup {
1276         struct sock *sk;
1277         struct hci_dev *hdev;
1278         u8 mgmt_status;
1279 };
1280
1281 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1282 {
1283         struct cmd_lookup *match = data;
1284
1285         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1286
1287         list_del(&cmd->list);
1288
1289         if (match->sk == NULL) {
1290                 match->sk = cmd->sk;
1291                 sock_hold(match->sk);
1292         }
1293
1294         mgmt_pending_free(cmd);
1295 }
1296
1297 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1298 {
1299         u8 *status = data;
1300
1301         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1302         mgmt_pending_remove(cmd);
1303 }
1304
1305 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1306 {
1307         if (cmd->cmd_complete) {
1308                 u8 *status = data;
1309
1310                 cmd->cmd_complete(cmd, *status);
1311                 mgmt_pending_remove(cmd);
1312
1313                 return;
1314         }
1315
1316         cmd_status_rsp(cmd, data);
1317 }
1318
1319 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1320 {
1321         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1322                                  cmd->param, cmd->param_len);
1323 }
1324
1325 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1326 {
1327         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1328                                  cmd->param, sizeof(struct mgmt_addr_info));
1329 }
1330
1331 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1332 {
1333         if (!lmp_bredr_capable(hdev))
1334                 return MGMT_STATUS_NOT_SUPPORTED;
1335         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1336                 return MGMT_STATUS_REJECTED;
1337         else
1338                 return MGMT_STATUS_SUCCESS;
1339 }
1340
1341 static u8 mgmt_le_support(struct hci_dev *hdev)
1342 {
1343         if (!lmp_le_capable(hdev))
1344                 return MGMT_STATUS_NOT_SUPPORTED;
1345         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1346                 return MGMT_STATUS_REJECTED;
1347         else
1348                 return MGMT_STATUS_SUCCESS;
1349 }
1350
1351 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1352 {
1353         struct mgmt_pending_cmd *cmd;
1354
1355         bt_dev_dbg(hdev, "status 0x%02x", status);
1356
1357         hci_dev_lock(hdev);
1358
1359         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1360         if (!cmd)
1361                 goto unlock;
1362
1363         if (status) {
1364                 u8 mgmt_err = mgmt_status(status);
1365                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1366                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1367                 goto remove_cmd;
1368         }
1369
1370         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1371             hdev->discov_timeout > 0) {
1372                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1373                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1374         }
1375
1376         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1377         new_settings(hdev, cmd->sk);
1378
1379 remove_cmd:
1380         mgmt_pending_remove(cmd);
1381
1382 unlock:
1383         hci_dev_unlock(hdev);
1384 }
1385
1386 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1387                             u16 len)
1388 {
1389         struct mgmt_cp_set_discoverable *cp = data;
1390         struct mgmt_pending_cmd *cmd;
1391         u16 timeout;
1392         int err;
1393
1394         bt_dev_dbg(hdev, "sock %p", sk);
1395
1396         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1397             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1398                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1399                                        MGMT_STATUS_REJECTED);
1400
1401         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1402                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1403                                        MGMT_STATUS_INVALID_PARAMS);
1404
1405         timeout = __le16_to_cpu(cp->timeout);
1406
1407         /* Disabling discoverable requires that no timeout is set,
1408          * and enabling limited discoverable requires a timeout.
1409          */
1410         if ((cp->val == 0x00 && timeout > 0) ||
1411             (cp->val == 0x02 && timeout == 0))
1412                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1413                                        MGMT_STATUS_INVALID_PARAMS);
1414
1415         hci_dev_lock(hdev);
1416
1417         if (!hdev_is_powered(hdev) && timeout > 0) {
1418                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1419                                       MGMT_STATUS_NOT_POWERED);
1420                 goto failed;
1421         }
1422
1423         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1424             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1425                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1426                                       MGMT_STATUS_BUSY);
1427                 goto failed;
1428         }
1429
1430         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1431                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1432                                       MGMT_STATUS_REJECTED);
1433                 goto failed;
1434         }
1435
1436         if (hdev->advertising_paused) {
1437                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1438                                       MGMT_STATUS_BUSY);
1439                 goto failed;
1440         }
1441
1442         if (!hdev_is_powered(hdev)) {
1443                 bool changed = false;
1444
1445                 /* Setting limited discoverable when powered off is
1446                  * not a valid operation since it requires a timeout
1447                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1448                  */
1449                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1450                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1451                         changed = true;
1452                 }
1453
1454                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1455                 if (err < 0)
1456                         goto failed;
1457
1458                 if (changed)
1459                         err = new_settings(hdev, sk);
1460
1461                 goto failed;
1462         }
1463
1464         /* If the current mode is the same, then just update the timeout
1465          * value with the new value. And if only the timeout gets updated,
1466          * then no need for any HCI transactions.
1467          */
1468         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1469             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1470                                                    HCI_LIMITED_DISCOVERABLE)) {
1471                 cancel_delayed_work(&hdev->discov_off);
1472                 hdev->discov_timeout = timeout;
1473
1474                 if (cp->val && hdev->discov_timeout > 0) {
1475                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1476                         queue_delayed_work(hdev->req_workqueue,
1477                                            &hdev->discov_off, to);
1478                 }
1479
1480                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1481                 goto failed;
1482         }
1483
1484         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1485         if (!cmd) {
1486                 err = -ENOMEM;
1487                 goto failed;
1488         }
1489
1490         /* Cancel any potential discoverable timeout that might be
1491          * still active and store new timeout value. The arming of
1492          * the timeout happens in the complete handler.
1493          */
1494         cancel_delayed_work(&hdev->discov_off);
1495         hdev->discov_timeout = timeout;
1496
1497         if (cp->val)
1498                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1499         else
1500                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1501
1502         /* Limited discoverable mode */
1503         if (cp->val == 0x02)
1504                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1505         else
1506                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1507
1508         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1509         err = 0;
1510
1511 failed:
1512         hci_dev_unlock(hdev);
1513         return err;
1514 }
1515
1516 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1517 {
1518         struct mgmt_pending_cmd *cmd;
1519
1520         bt_dev_dbg(hdev, "status 0x%02x", status);
1521
1522         hci_dev_lock(hdev);
1523
1524         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1525         if (!cmd)
1526                 goto unlock;
1527
1528         if (status) {
1529                 u8 mgmt_err = mgmt_status(status);
1530                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1531                 goto remove_cmd;
1532         }
1533
1534         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1535         new_settings(hdev, cmd->sk);
1536
1537 remove_cmd:
1538         mgmt_pending_remove(cmd);
1539
1540 unlock:
1541         hci_dev_unlock(hdev);
1542 }
1543
1544 static int set_connectable_update_settings(struct hci_dev *hdev,
1545                                            struct sock *sk, u8 val)
1546 {
1547         bool changed = false;
1548         int err;
1549
1550         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1551                 changed = true;
1552
1553         if (val) {
1554                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1555         } else {
1556                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1557                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1558         }
1559
1560         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1561         if (err < 0)
1562                 return err;
1563
1564         if (changed) {
1565                 hci_req_update_scan(hdev);
1566                 hci_update_background_scan(hdev);
1567                 return new_settings(hdev, sk);
1568         }
1569
1570         return 0;
1571 }
1572
1573 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1574                            u16 len)
1575 {
1576         struct mgmt_mode *cp = data;
1577         struct mgmt_pending_cmd *cmd;
1578         int err;
1579
1580         bt_dev_dbg(hdev, "sock %p", sk);
1581
1582         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1583             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1584                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1585                                        MGMT_STATUS_REJECTED);
1586
1587         if (cp->val != 0x00 && cp->val != 0x01)
1588                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1589                                        MGMT_STATUS_INVALID_PARAMS);
1590
1591         hci_dev_lock(hdev);
1592
1593         if (!hdev_is_powered(hdev)) {
1594                 err = set_connectable_update_settings(hdev, sk, cp->val);
1595                 goto failed;
1596         }
1597
1598         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1599             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1600                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1601                                       MGMT_STATUS_BUSY);
1602                 goto failed;
1603         }
1604
1605         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1606         if (!cmd) {
1607                 err = -ENOMEM;
1608                 goto failed;
1609         }
1610
1611         if (cp->val) {
1612                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1613         } else {
1614                 if (hdev->discov_timeout > 0)
1615                         cancel_delayed_work(&hdev->discov_off);
1616
1617                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1618                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1619                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1620         }
1621
1622         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1623         err = 0;
1624
1625 failed:
1626         hci_dev_unlock(hdev);
1627         return err;
1628 }
1629
1630 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1631                         u16 len)
1632 {
1633         struct mgmt_mode *cp = data;
1634         bool changed;
1635         int err;
1636
1637         bt_dev_dbg(hdev, "sock %p", sk);
1638
1639         if (cp->val != 0x00 && cp->val != 0x01)
1640                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1641                                        MGMT_STATUS_INVALID_PARAMS);
1642
1643         hci_dev_lock(hdev);
1644
1645         if (cp->val)
1646                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1647         else
1648                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1649
1650         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1651         if (err < 0)
1652                 goto unlock;
1653
1654         if (changed) {
1655                 /* In limited privacy mode the change of bondable mode
1656                  * may affect the local advertising address.
1657                  */
1658                 if (hdev_is_powered(hdev) &&
1659                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1660                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1661                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1662                         queue_work(hdev->req_workqueue,
1663                                    &hdev->discoverable_update);
1664
1665                 err = new_settings(hdev, sk);
1666         }
1667
1668 unlock:
1669         hci_dev_unlock(hdev);
1670         return err;
1671 }
1672
1673 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1674                              u16 len)
1675 {
1676         struct mgmt_mode *cp = data;
1677         struct mgmt_pending_cmd *cmd;
1678         u8 val, status;
1679         int err;
1680
1681         bt_dev_dbg(hdev, "sock %p", sk);
1682
1683         status = mgmt_bredr_support(hdev);
1684         if (status)
1685                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1686                                        status);
1687
1688         if (cp->val != 0x00 && cp->val != 0x01)
1689                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1690                                        MGMT_STATUS_INVALID_PARAMS);
1691
1692         hci_dev_lock(hdev);
1693
1694         if (!hdev_is_powered(hdev)) {
1695                 bool changed = false;
1696
1697                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1698                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1699                         changed = true;
1700                 }
1701
1702                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1703                 if (err < 0)
1704                         goto failed;
1705
1706                 if (changed)
1707                         err = new_settings(hdev, sk);
1708
1709                 goto failed;
1710         }
1711
1712         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1713                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1714                                       MGMT_STATUS_BUSY);
1715                 goto failed;
1716         }
1717
1718         val = !!cp->val;
1719
1720         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1721                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1722                 goto failed;
1723         }
1724
1725         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1726         if (!cmd) {
1727                 err = -ENOMEM;
1728                 goto failed;
1729         }
1730
1731         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1732         if (err < 0) {
1733                 mgmt_pending_remove(cmd);
1734                 goto failed;
1735         }
1736
1737 failed:
1738         hci_dev_unlock(hdev);
1739         return err;
1740 }
1741
1742 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1743 {
1744         struct mgmt_mode *cp = data;
1745         struct mgmt_pending_cmd *cmd;
1746         u8 status;
1747         int err;
1748
1749         bt_dev_dbg(hdev, "sock %p", sk);
1750
1751         status = mgmt_bredr_support(hdev);
1752         if (status)
1753                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1754
1755         if (!lmp_ssp_capable(hdev))
1756                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1757                                        MGMT_STATUS_NOT_SUPPORTED);
1758
1759         if (cp->val != 0x00 && cp->val != 0x01)
1760                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1761                                        MGMT_STATUS_INVALID_PARAMS);
1762
1763         hci_dev_lock(hdev);
1764
1765         if (!hdev_is_powered(hdev)) {
1766                 bool changed;
1767
1768                 if (cp->val) {
1769                         changed = !hci_dev_test_and_set_flag(hdev,
1770                                                              HCI_SSP_ENABLED);
1771                 } else {
1772                         changed = hci_dev_test_and_clear_flag(hdev,
1773                                                               HCI_SSP_ENABLED);
1774                         if (!changed)
1775                                 changed = hci_dev_test_and_clear_flag(hdev,
1776                                                                       HCI_HS_ENABLED);
1777                         else
1778                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1779                 }
1780
1781                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1782                 if (err < 0)
1783                         goto failed;
1784
1785                 if (changed)
1786                         err = new_settings(hdev, sk);
1787
1788                 goto failed;
1789         }
1790
1791         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1792                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1793                                       MGMT_STATUS_BUSY);
1794                 goto failed;
1795         }
1796
1797         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1798                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1799                 goto failed;
1800         }
1801
1802         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1803         if (!cmd) {
1804                 err = -ENOMEM;
1805                 goto failed;
1806         }
1807
1808         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1809                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1810                              sizeof(cp->val), &cp->val);
1811
1812         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1813         if (err < 0) {
1814                 mgmt_pending_remove(cmd);
1815                 goto failed;
1816         }
1817
1818 failed:
1819         hci_dev_unlock(hdev);
1820         return err;
1821 }
1822
1823 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1824 {
1825         struct mgmt_mode *cp = data;
1826         bool changed;
1827         u8 status;
1828         int err;
1829
1830         bt_dev_dbg(hdev, "sock %p", sk);
1831
1832         if (!IS_ENABLED(CONFIG_BT_HS))
1833                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1834                                        MGMT_STATUS_NOT_SUPPORTED);
1835
1836         status = mgmt_bredr_support(hdev);
1837         if (status)
1838                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1839
1840         if (!lmp_ssp_capable(hdev))
1841                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1842                                        MGMT_STATUS_NOT_SUPPORTED);
1843
1844         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1845                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1846                                        MGMT_STATUS_REJECTED);
1847
1848         if (cp->val != 0x00 && cp->val != 0x01)
1849                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1850                                        MGMT_STATUS_INVALID_PARAMS);
1851
1852         hci_dev_lock(hdev);
1853
1854         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1855                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1856                                       MGMT_STATUS_BUSY);
1857                 goto unlock;
1858         }
1859
1860         if (cp->val) {
1861                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1862         } else {
1863                 if (hdev_is_powered(hdev)) {
1864                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1865                                               MGMT_STATUS_REJECTED);
1866                         goto unlock;
1867                 }
1868
1869                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1870         }
1871
1872         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1873         if (err < 0)
1874                 goto unlock;
1875
1876         if (changed)
1877                 err = new_settings(hdev, sk);
1878
1879 unlock:
1880         hci_dev_unlock(hdev);
1881         return err;
1882 }
1883
1884 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1885 {
1886         struct cmd_lookup match = { NULL, hdev };
1887
1888         hci_dev_lock(hdev);
1889
1890         if (status) {
1891                 u8 mgmt_err = mgmt_status(status);
1892
1893                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1894                                      &mgmt_err);
1895                 goto unlock;
1896         }
1897
1898         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1899
1900         new_settings(hdev, match.sk);
1901
1902         if (match.sk)
1903                 sock_put(match.sk);
1904
1905         /* Make sure the controller has a good default for
1906          * advertising data. Restrict the update to when LE
1907          * has actually been enabled. During power on, the
1908          * update in powered_update_hci will take care of it.
1909          */
1910         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1911                 struct hci_request req;
1912                 hci_req_init(&req, hdev);
1913                 if (ext_adv_capable(hdev)) {
1914                         int err;
1915
1916                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1917                         if (!err)
1918                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1919                 } else {
1920                         __hci_req_update_adv_data(&req, 0x00);
1921                         __hci_req_update_scan_rsp_data(&req, 0x00);
1922                 }
1923                 hci_req_run(&req, NULL);
1924                 hci_update_background_scan(hdev);
1925         }
1926
1927 unlock:
1928         hci_dev_unlock(hdev);
1929 }
1930
1931 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1932 {
1933         struct mgmt_mode *cp = data;
1934         struct hci_cp_write_le_host_supported hci_cp;
1935         struct mgmt_pending_cmd *cmd;
1936         struct hci_request req;
1937         int err;
1938         u8 val, enabled;
1939
1940         bt_dev_dbg(hdev, "sock %p", sk);
1941
1942         if (!lmp_le_capable(hdev))
1943                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1944                                        MGMT_STATUS_NOT_SUPPORTED);
1945
1946         if (cp->val != 0x00 && cp->val != 0x01)
1947                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1948                                        MGMT_STATUS_INVALID_PARAMS);
1949
1950         /* Bluetooth single mode LE only controllers or dual-mode
1951          * controllers configured as LE only devices, do not allow
1952          * switching LE off. These have either LE enabled explicitly
1953          * or BR/EDR has been previously switched off.
1954          *
1955          * When trying to enable an already enabled LE, then gracefully
1956          * send a positive response. Trying to disable it however will
1957          * result into rejection.
1958          */
1959         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1960                 if (cp->val == 0x01)
1961                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1962
1963                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1964                                        MGMT_STATUS_REJECTED);
1965         }
1966
1967         hci_dev_lock(hdev);
1968
1969         val = !!cp->val;
1970         enabled = lmp_host_le_capable(hdev);
1971
1972         if (!val)
1973                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1974
1975         if (!hdev_is_powered(hdev) || val == enabled) {
1976                 bool changed = false;
1977
1978                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1979                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1980                         changed = true;
1981                 }
1982
1983                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1984                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1985                         changed = true;
1986                 }
1987
1988                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1989                 if (err < 0)
1990                         goto unlock;
1991
1992                 if (changed)
1993                         err = new_settings(hdev, sk);
1994
1995                 goto unlock;
1996         }
1997
1998         if (pending_find(MGMT_OP_SET_LE, hdev) ||
1999             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2000                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2001                                       MGMT_STATUS_BUSY);
2002                 goto unlock;
2003         }
2004
2005         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2006         if (!cmd) {
2007                 err = -ENOMEM;
2008                 goto unlock;
2009         }
2010
2011         hci_req_init(&req, hdev);
2012
2013         memset(&hci_cp, 0, sizeof(hci_cp));
2014
2015         if (val) {
2016                 hci_cp.le = val;
2017                 hci_cp.simul = 0x00;
2018         } else {
2019                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2020                         __hci_req_disable_advertising(&req);
2021
2022                 if (ext_adv_capable(hdev))
2023                         __hci_req_clear_ext_adv_sets(&req);
2024         }
2025
2026         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2027                     &hci_cp);
2028
2029         err = hci_req_run(&req, le_enable_complete);
2030         if (err < 0)
2031                 mgmt_pending_remove(cmd);
2032
2033 unlock:
2034         hci_dev_unlock(hdev);
2035         return err;
2036 }
2037
2038 /* This is a helper function to test for pending mgmt commands that can
2039  * cause CoD or EIR HCI commands. We can only allow one such pending
2040  * mgmt command at a time since otherwise we cannot easily track what
2041  * the current values are, will be, and based on that calculate if a new
2042  * HCI command needs to be sent and if yes with what value.
2043  */
2044 static bool pending_eir_or_class(struct hci_dev *hdev)
2045 {
2046         struct mgmt_pending_cmd *cmd;
2047
2048         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2049                 switch (cmd->opcode) {
2050                 case MGMT_OP_ADD_UUID:
2051                 case MGMT_OP_REMOVE_UUID:
2052                 case MGMT_OP_SET_DEV_CLASS:
2053                 case MGMT_OP_SET_POWERED:
2054                         return true;
2055                 }
2056         }
2057
2058         return false;
2059 }
2060
2061 static const u8 bluetooth_base_uuid[] = {
2062                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2063                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2064 };
2065
2066 static u8 get_uuid_size(const u8 *uuid)
2067 {
2068         u32 val;
2069
2070         if (memcmp(uuid, bluetooth_base_uuid, 12))
2071                 return 128;
2072
2073         val = get_unaligned_le32(&uuid[12]);
2074         if (val > 0xffff)
2075                 return 32;
2076
2077         return 16;
2078 }
2079
2080 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2081 {
2082         struct mgmt_pending_cmd *cmd;
2083
2084         hci_dev_lock(hdev);
2085
2086         cmd = pending_find(mgmt_op, hdev);
2087         if (!cmd)
2088                 goto unlock;
2089
2090         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2091                           mgmt_status(status), hdev->dev_class, 3);
2092
2093         mgmt_pending_remove(cmd);
2094
2095 unlock:
2096         hci_dev_unlock(hdev);
2097 }
2098
2099 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2100 {
2101         bt_dev_dbg(hdev, "status 0x%02x", status);
2102
2103         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2104 }
2105
2106 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2107 {
2108         struct mgmt_cp_add_uuid *cp = data;
2109         struct mgmt_pending_cmd *cmd;
2110         struct hci_request req;
2111         struct bt_uuid *uuid;
2112         int err;
2113
2114         bt_dev_dbg(hdev, "sock %p", sk);
2115
2116         hci_dev_lock(hdev);
2117
2118         if (pending_eir_or_class(hdev)) {
2119                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2120                                       MGMT_STATUS_BUSY);
2121                 goto failed;
2122         }
2123
2124         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2125         if (!uuid) {
2126                 err = -ENOMEM;
2127                 goto failed;
2128         }
2129
2130         memcpy(uuid->uuid, cp->uuid, 16);
2131         uuid->svc_hint = cp->svc_hint;
2132         uuid->size = get_uuid_size(cp->uuid);
2133
2134         list_add_tail(&uuid->list, &hdev->uuids);
2135
2136         hci_req_init(&req, hdev);
2137
2138         __hci_req_update_class(&req);
2139         __hci_req_update_eir(&req);
2140
2141         err = hci_req_run(&req, add_uuid_complete);
2142         if (err < 0) {
2143                 if (err != -ENODATA)
2144                         goto failed;
2145
2146                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2147                                         hdev->dev_class, 3);
2148                 goto failed;
2149         }
2150
2151         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2152         if (!cmd) {
2153                 err = -ENOMEM;
2154                 goto failed;
2155         }
2156
2157         err = 0;
2158
2159 failed:
2160         hci_dev_unlock(hdev);
2161         return err;
2162 }
2163
2164 static bool enable_service_cache(struct hci_dev *hdev)
2165 {
2166         if (!hdev_is_powered(hdev))
2167                 return false;
2168
2169         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2170                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2171                                    CACHE_TIMEOUT);
2172                 return true;
2173         }
2174
2175         return false;
2176 }
2177
2178 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2179 {
2180         bt_dev_dbg(hdev, "status 0x%02x", status);
2181
2182         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2183 }
2184
2185 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2186                        u16 len)
2187 {
2188         struct mgmt_cp_remove_uuid *cp = data;
2189         struct mgmt_pending_cmd *cmd;
2190         struct bt_uuid *match, *tmp;
2191         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2192         struct hci_request req;
2193         int err, found;
2194
2195         bt_dev_dbg(hdev, "sock %p", sk);
2196
2197         hci_dev_lock(hdev);
2198
2199         if (pending_eir_or_class(hdev)) {
2200                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2201                                       MGMT_STATUS_BUSY);
2202                 goto unlock;
2203         }
2204
2205         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2206                 hci_uuids_clear(hdev);
2207
2208                 if (enable_service_cache(hdev)) {
2209                         err = mgmt_cmd_complete(sk, hdev->id,
2210                                                 MGMT_OP_REMOVE_UUID,
2211                                                 0, hdev->dev_class, 3);
2212                         goto unlock;
2213                 }
2214
2215                 goto update_class;
2216         }
2217
2218         found = 0;
2219
2220         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2221                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2222                         continue;
2223
2224                 list_del(&match->list);
2225                 kfree(match);
2226                 found++;
2227         }
2228
2229         if (found == 0) {
2230                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2231                                       MGMT_STATUS_INVALID_PARAMS);
2232                 goto unlock;
2233         }
2234
2235 update_class:
2236         hci_req_init(&req, hdev);
2237
2238         __hci_req_update_class(&req);
2239         __hci_req_update_eir(&req);
2240
2241         err = hci_req_run(&req, remove_uuid_complete);
2242         if (err < 0) {
2243                 if (err != -ENODATA)
2244                         goto unlock;
2245
2246                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2247                                         hdev->dev_class, 3);
2248                 goto unlock;
2249         }
2250
2251         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2252         if (!cmd) {
2253                 err = -ENOMEM;
2254                 goto unlock;
2255         }
2256
2257         err = 0;
2258
2259 unlock:
2260         hci_dev_unlock(hdev);
2261         return err;
2262 }
2263
2264 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2265 {
2266         bt_dev_dbg(hdev, "status 0x%02x", status);
2267
2268         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2269 }
2270
2271 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2272                          u16 len)
2273 {
2274         struct mgmt_cp_set_dev_class *cp = data;
2275         struct mgmt_pending_cmd *cmd;
2276         struct hci_request req;
2277         int err;
2278
2279         bt_dev_dbg(hdev, "sock %p", sk);
2280
2281         if (!lmp_bredr_capable(hdev))
2282                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2283                                        MGMT_STATUS_NOT_SUPPORTED);
2284
2285         hci_dev_lock(hdev);
2286
2287         if (pending_eir_or_class(hdev)) {
2288                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2289                                       MGMT_STATUS_BUSY);
2290                 goto unlock;
2291         }
2292
2293         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2294                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2295                                       MGMT_STATUS_INVALID_PARAMS);
2296                 goto unlock;
2297         }
2298
2299         hdev->major_class = cp->major;
2300         hdev->minor_class = cp->minor;
2301
2302         if (!hdev_is_powered(hdev)) {
2303                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2304                                         hdev->dev_class, 3);
2305                 goto unlock;
2306         }
2307
2308         hci_req_init(&req, hdev);
2309
2310         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2311                 hci_dev_unlock(hdev);
2312                 cancel_delayed_work_sync(&hdev->service_cache);
2313                 hci_dev_lock(hdev);
2314                 __hci_req_update_eir(&req);
2315         }
2316
2317         __hci_req_update_class(&req);
2318
2319         err = hci_req_run(&req, set_class_complete);
2320         if (err < 0) {
2321                 if (err != -ENODATA)
2322                         goto unlock;
2323
2324                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2325                                         hdev->dev_class, 3);
2326                 goto unlock;
2327         }
2328
2329         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2330         if (!cmd) {
2331                 err = -ENOMEM;
2332                 goto unlock;
2333         }
2334
2335         err = 0;
2336
2337 unlock:
2338         hci_dev_unlock(hdev);
2339         return err;
2340 }
2341
2342 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2343                           u16 len)
2344 {
2345         struct mgmt_cp_load_link_keys *cp = data;
2346         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2347                                    sizeof(struct mgmt_link_key_info));
2348         u16 key_count, expected_len;
2349         bool changed;
2350         int i;
2351
2352         bt_dev_dbg(hdev, "sock %p", sk);
2353
2354         if (!lmp_bredr_capable(hdev))
2355                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2356                                        MGMT_STATUS_NOT_SUPPORTED);
2357
2358         key_count = __le16_to_cpu(cp->key_count);
2359         if (key_count > max_key_count) {
2360                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2361                            key_count);
2362                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2363                                        MGMT_STATUS_INVALID_PARAMS);
2364         }
2365
2366         expected_len = struct_size(cp, keys, key_count);
2367         if (expected_len != len) {
2368                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2369                            expected_len, len);
2370                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2371                                        MGMT_STATUS_INVALID_PARAMS);
2372         }
2373
2374         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2375                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2376                                        MGMT_STATUS_INVALID_PARAMS);
2377
2378         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2379                    key_count);
2380
2381         for (i = 0; i < key_count; i++) {
2382                 struct mgmt_link_key_info *key = &cp->keys[i];
2383
2384                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2385                         return mgmt_cmd_status(sk, hdev->id,
2386                                                MGMT_OP_LOAD_LINK_KEYS,
2387                                                MGMT_STATUS_INVALID_PARAMS);
2388         }
2389
2390         hci_dev_lock(hdev);
2391
2392         hci_link_keys_clear(hdev);
2393
2394         if (cp->debug_keys)
2395                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2396         else
2397                 changed = hci_dev_test_and_clear_flag(hdev,
2398                                                       HCI_KEEP_DEBUG_KEYS);
2399
2400         if (changed)
2401                 new_settings(hdev, NULL);
2402
2403         for (i = 0; i < key_count; i++) {
2404                 struct mgmt_link_key_info *key = &cp->keys[i];
2405
2406                 if (hci_is_blocked_key(hdev,
2407                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2408                                        key->val)) {
2409                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2410                                     &key->addr.bdaddr);
2411                         continue;
2412                 }
2413
2414                 /* Always ignore debug keys and require a new pairing if
2415                  * the user wants to use them.
2416                  */
2417                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2418                         continue;
2419
2420                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2421                                  key->type, key->pin_len, NULL);
2422         }
2423
2424         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2425
2426         hci_dev_unlock(hdev);
2427
2428         return 0;
2429 }
2430
2431 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2432                            u8 addr_type, struct sock *skip_sk)
2433 {
2434         struct mgmt_ev_device_unpaired ev;
2435
2436         bacpy(&ev.addr.bdaddr, bdaddr);
2437         ev.addr.type = addr_type;
2438
2439         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2440                           skip_sk);
2441 }
2442
2443 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2444                          u16 len)
2445 {
2446         struct mgmt_cp_unpair_device *cp = data;
2447         struct mgmt_rp_unpair_device rp;
2448         struct hci_conn_params *params;
2449         struct mgmt_pending_cmd *cmd;
2450         struct hci_conn *conn;
2451         u8 addr_type;
2452         int err;
2453
2454         memset(&rp, 0, sizeof(rp));
2455         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2456         rp.addr.type = cp->addr.type;
2457
2458         if (!bdaddr_type_is_valid(cp->addr.type))
2459                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2460                                          MGMT_STATUS_INVALID_PARAMS,
2461                                          &rp, sizeof(rp));
2462
2463         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2464                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2465                                          MGMT_STATUS_INVALID_PARAMS,
2466                                          &rp, sizeof(rp));
2467
2468         hci_dev_lock(hdev);
2469
2470         if (!hdev_is_powered(hdev)) {
2471                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2472                                         MGMT_STATUS_NOT_POWERED, &rp,
2473                                         sizeof(rp));
2474                 goto unlock;
2475         }
2476
2477         if (cp->addr.type == BDADDR_BREDR) {
2478                 /* If disconnection is requested, then look up the
2479                  * connection. If the remote device is connected, it
2480                  * will be later used to terminate the link.
2481                  *
2482                  * Setting it to NULL explicitly will cause no
2483                  * termination of the link.
2484                  */
2485                 if (cp->disconnect)
2486                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2487                                                        &cp->addr.bdaddr);
2488                 else
2489                         conn = NULL;
2490
2491                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2492                 if (err < 0) {
2493                         err = mgmt_cmd_complete(sk, hdev->id,
2494                                                 MGMT_OP_UNPAIR_DEVICE,
2495                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2496                                                 sizeof(rp));
2497                         goto unlock;
2498                 }
2499
2500                 goto done;
2501         }
2502
2503         /* LE address type */
2504         addr_type = le_addr_type(cp->addr.type);
2505
2506         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2507         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2508         if (err < 0) {
2509                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2510                                         MGMT_STATUS_NOT_PAIRED, &rp,
2511                                         sizeof(rp));
2512                 goto unlock;
2513         }
2514
2515         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2516         if (!conn) {
2517                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2518                 goto done;
2519         }
2520
2521
2522         /* Defer clearing up the connection parameters until closing to
2523          * give a chance of keeping them if a repairing happens.
2524          */
2525         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2526
2527         /* Disable auto-connection parameters if present */
2528         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2529         if (params) {
2530                 if (params->explicit_connect)
2531                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2532                 else
2533                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2534         }
2535
2536         /* If disconnection is not requested, then clear the connection
2537          * variable so that the link is not terminated.
2538          */
2539         if (!cp->disconnect)
2540                 conn = NULL;
2541
2542 done:
2543         /* If the connection variable is set, then termination of the
2544          * link is requested.
2545          */
2546         if (!conn) {
2547                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2548                                         &rp, sizeof(rp));
2549                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2550                 goto unlock;
2551         }
2552
2553         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2554                                sizeof(*cp));
2555         if (!cmd) {
2556                 err = -ENOMEM;
2557                 goto unlock;
2558         }
2559
2560         cmd->cmd_complete = addr_cmd_complete;
2561
2562         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2563         if (err < 0)
2564                 mgmt_pending_remove(cmd);
2565
2566 unlock:
2567         hci_dev_unlock(hdev);
2568         return err;
2569 }
2570
2571 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2572                       u16 len)
2573 {
2574         struct mgmt_cp_disconnect *cp = data;
2575         struct mgmt_rp_disconnect rp;
2576         struct mgmt_pending_cmd *cmd;
2577         struct hci_conn *conn;
2578         int err;
2579
2580         bt_dev_dbg(hdev, "sock %p", sk);
2581
2582         memset(&rp, 0, sizeof(rp));
2583         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2584         rp.addr.type = cp->addr.type;
2585
2586         if (!bdaddr_type_is_valid(cp->addr.type))
2587                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2588                                          MGMT_STATUS_INVALID_PARAMS,
2589                                          &rp, sizeof(rp));
2590
2591         hci_dev_lock(hdev);
2592
2593         if (!test_bit(HCI_UP, &hdev->flags)) {
2594                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2595                                         MGMT_STATUS_NOT_POWERED, &rp,
2596                                         sizeof(rp));
2597                 goto failed;
2598         }
2599
2600         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2601                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2602                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2603                 goto failed;
2604         }
2605
2606         if (cp->addr.type == BDADDR_BREDR)
2607                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2608                                                &cp->addr.bdaddr);
2609         else
2610                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2611                                                le_addr_type(cp->addr.type));
2612
2613         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2614                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2615                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2616                                         sizeof(rp));
2617                 goto failed;
2618         }
2619
2620         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2621         if (!cmd) {
2622                 err = -ENOMEM;
2623                 goto failed;
2624         }
2625
2626         cmd->cmd_complete = generic_cmd_complete;
2627
2628         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2629         if (err < 0)
2630                 mgmt_pending_remove(cmd);
2631
2632 failed:
2633         hci_dev_unlock(hdev);
2634         return err;
2635 }
2636
2637 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2638 {
2639         switch (link_type) {
2640         case LE_LINK:
2641                 switch (addr_type) {
2642                 case ADDR_LE_DEV_PUBLIC:
2643                         return BDADDR_LE_PUBLIC;
2644
2645                 default:
2646                         /* Fallback to LE Random address type */
2647                         return BDADDR_LE_RANDOM;
2648                 }
2649
2650         default:
2651                 /* Fallback to BR/EDR type */
2652                 return BDADDR_BREDR;
2653         }
2654 }
2655
2656 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2657                            u16 data_len)
2658 {
2659         struct mgmt_rp_get_connections *rp;
2660         struct hci_conn *c;
2661         int err;
2662         u16 i;
2663
2664         bt_dev_dbg(hdev, "sock %p", sk);
2665
2666         hci_dev_lock(hdev);
2667
2668         if (!hdev_is_powered(hdev)) {
2669                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2670                                       MGMT_STATUS_NOT_POWERED);
2671                 goto unlock;
2672         }
2673
2674         i = 0;
2675         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2676                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2677                         i++;
2678         }
2679
2680         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2681         if (!rp) {
2682                 err = -ENOMEM;
2683                 goto unlock;
2684         }
2685
2686         i = 0;
2687         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2688                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2689                         continue;
2690                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2691                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2692                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2693                         continue;
2694                 i++;
2695         }
2696
2697         rp->conn_count = cpu_to_le16(i);
2698
2699         /* Recalculate length in case of filtered SCO connections, etc */
2700         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2701                                 struct_size(rp, addr, i));
2702
2703         kfree(rp);
2704
2705 unlock:
2706         hci_dev_unlock(hdev);
2707         return err;
2708 }
2709
2710 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2711                                    struct mgmt_cp_pin_code_neg_reply *cp)
2712 {
2713         struct mgmt_pending_cmd *cmd;
2714         int err;
2715
2716         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2717                                sizeof(*cp));
2718         if (!cmd)
2719                 return -ENOMEM;
2720
2721         cmd->cmd_complete = addr_cmd_complete;
2722
2723         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2724                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2725         if (err < 0)
2726                 mgmt_pending_remove(cmd);
2727
2728         return err;
2729 }
2730
2731 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2732                           u16 len)
2733 {
2734         struct hci_conn *conn;
2735         struct mgmt_cp_pin_code_reply *cp = data;
2736         struct hci_cp_pin_code_reply reply;
2737         struct mgmt_pending_cmd *cmd;
2738         int err;
2739
2740         bt_dev_dbg(hdev, "sock %p", sk);
2741
2742         hci_dev_lock(hdev);
2743
2744         if (!hdev_is_powered(hdev)) {
2745                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2746                                       MGMT_STATUS_NOT_POWERED);
2747                 goto failed;
2748         }
2749
2750         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2751         if (!conn) {
2752                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2753                                       MGMT_STATUS_NOT_CONNECTED);
2754                 goto failed;
2755         }
2756
2757         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2758                 struct mgmt_cp_pin_code_neg_reply ncp;
2759
2760                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2761
2762                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2763
2764                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2765                 if (err >= 0)
2766                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2767                                               MGMT_STATUS_INVALID_PARAMS);
2768
2769                 goto failed;
2770         }
2771
2772         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2773         if (!cmd) {
2774                 err = -ENOMEM;
2775                 goto failed;
2776         }
2777
2778         cmd->cmd_complete = addr_cmd_complete;
2779
2780         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2781         reply.pin_len = cp->pin_len;
2782         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2783
2784         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2785         if (err < 0)
2786                 mgmt_pending_remove(cmd);
2787
2788 failed:
2789         hci_dev_unlock(hdev);
2790         return err;
2791 }
2792
2793 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2794                              u16 len)
2795 {
2796         struct mgmt_cp_set_io_capability *cp = data;
2797
2798         bt_dev_dbg(hdev, "sock %p", sk);
2799
2800         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2801                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2802                                        MGMT_STATUS_INVALID_PARAMS);
2803
2804         hci_dev_lock(hdev);
2805
2806         hdev->io_capability = cp->io_capability;
2807
2808         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
2809
2810         hci_dev_unlock(hdev);
2811
2812         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2813                                  NULL, 0);
2814 }
2815
2816 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2817 {
2818         struct hci_dev *hdev = conn->hdev;
2819         struct mgmt_pending_cmd *cmd;
2820
2821         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2822                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2823                         continue;
2824
2825                 if (cmd->user_data != conn)
2826                         continue;
2827
2828                 return cmd;
2829         }
2830
2831         return NULL;
2832 }
2833
2834 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2835 {
2836         struct mgmt_rp_pair_device rp;
2837         struct hci_conn *conn = cmd->user_data;
2838         int err;
2839
2840         bacpy(&rp.addr.bdaddr, &conn->dst);
2841         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2842
2843         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2844                                 status, &rp, sizeof(rp));
2845
2846         /* So we don't get further callbacks for this connection */
2847         conn->connect_cfm_cb = NULL;
2848         conn->security_cfm_cb = NULL;
2849         conn->disconn_cfm_cb = NULL;
2850
2851         hci_conn_drop(conn);
2852
2853         /* The device is paired so there is no need to remove
2854          * its connection parameters anymore.
2855          */
2856         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2857
2858         hci_conn_put(conn);
2859
2860         return err;
2861 }
2862
2863 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2864 {
2865         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2866         struct mgmt_pending_cmd *cmd;
2867
2868         cmd = find_pairing(conn);
2869         if (cmd) {
2870                 cmd->cmd_complete(cmd, status);
2871                 mgmt_pending_remove(cmd);
2872         }
2873 }
2874
2875 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2876 {
2877         struct mgmt_pending_cmd *cmd;
2878
2879         BT_DBG("status %u", status);
2880
2881         cmd = find_pairing(conn);
2882         if (!cmd) {
2883                 BT_DBG("Unable to find a pending command");
2884                 return;
2885         }
2886
2887         cmd->cmd_complete(cmd, mgmt_status(status));
2888         mgmt_pending_remove(cmd);
2889 }
2890
2891 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2892 {
2893         struct mgmt_pending_cmd *cmd;
2894
2895         BT_DBG("status %u", status);
2896
2897         if (!status)
2898                 return;
2899
2900         cmd = find_pairing(conn);
2901         if (!cmd) {
2902                 BT_DBG("Unable to find a pending command");
2903                 return;
2904         }
2905
2906         cmd->cmd_complete(cmd, mgmt_status(status));
2907         mgmt_pending_remove(cmd);
2908 }
2909
2910 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2911                        u16 len)
2912 {
2913         struct mgmt_cp_pair_device *cp = data;
2914         struct mgmt_rp_pair_device rp;
2915         struct mgmt_pending_cmd *cmd;
2916         u8 sec_level, auth_type;
2917         struct hci_conn *conn;
2918         int err;
2919
2920         bt_dev_dbg(hdev, "sock %p", sk);
2921
2922         memset(&rp, 0, sizeof(rp));
2923         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2924         rp.addr.type = cp->addr.type;
2925
2926         if (!bdaddr_type_is_valid(cp->addr.type))
2927                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2928                                          MGMT_STATUS_INVALID_PARAMS,
2929                                          &rp, sizeof(rp));
2930
2931         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2932                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2933                                          MGMT_STATUS_INVALID_PARAMS,
2934                                          &rp, sizeof(rp));
2935
2936         hci_dev_lock(hdev);
2937
2938         if (!hdev_is_powered(hdev)) {
2939                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2940                                         MGMT_STATUS_NOT_POWERED, &rp,
2941                                         sizeof(rp));
2942                 goto unlock;
2943         }
2944
2945         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2946                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2947                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2948                                         sizeof(rp));
2949                 goto unlock;
2950         }
2951
2952         sec_level = BT_SECURITY_MEDIUM;
2953         auth_type = HCI_AT_DEDICATED_BONDING;
2954
2955         if (cp->addr.type == BDADDR_BREDR) {
2956                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2957                                        auth_type, CONN_REASON_PAIR_DEVICE);
2958         } else {
2959                 u8 addr_type = le_addr_type(cp->addr.type);
2960                 struct hci_conn_params *p;
2961
2962                 /* When pairing a new device, it is expected to remember
2963                  * this device for future connections. Adding the connection
2964                  * parameter information ahead of time allows tracking
2965                  * of the peripheral preferred values and will speed up any
2966                  * further connection establishment.
2967                  *
2968                  * If connection parameters already exist, then they
2969                  * will be kept and this function does nothing.
2970                  */
2971                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2972
2973                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2974                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2975
2976                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
2977                                            sec_level, HCI_LE_CONN_TIMEOUT,
2978                                            CONN_REASON_PAIR_DEVICE);
2979         }
2980
2981         if (IS_ERR(conn)) {
2982                 int status;
2983
2984                 if (PTR_ERR(conn) == -EBUSY)
2985                         status = MGMT_STATUS_BUSY;
2986                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2987                         status = MGMT_STATUS_NOT_SUPPORTED;
2988                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2989                         status = MGMT_STATUS_REJECTED;
2990                 else
2991                         status = MGMT_STATUS_CONNECT_FAILED;
2992
2993                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2994                                         status, &rp, sizeof(rp));
2995                 goto unlock;
2996         }
2997
2998         if (conn->connect_cfm_cb) {
2999                 hci_conn_drop(conn);
3000                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3001                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3002                 goto unlock;
3003         }
3004
3005         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3006         if (!cmd) {
3007                 err = -ENOMEM;
3008                 hci_conn_drop(conn);
3009                 goto unlock;
3010         }
3011
3012         cmd->cmd_complete = pairing_complete;
3013
3014         /* For LE, just connecting isn't a proof that the pairing finished */
3015         if (cp->addr.type == BDADDR_BREDR) {
3016                 conn->connect_cfm_cb = pairing_complete_cb;
3017                 conn->security_cfm_cb = pairing_complete_cb;
3018                 conn->disconn_cfm_cb = pairing_complete_cb;
3019         } else {
3020                 conn->connect_cfm_cb = le_pairing_complete_cb;
3021                 conn->security_cfm_cb = le_pairing_complete_cb;
3022                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3023         }
3024
3025         conn->io_capability = cp->io_cap;
3026         cmd->user_data = hci_conn_get(conn);
3027
3028         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3029             hci_conn_security(conn, sec_level, auth_type, true)) {
3030                 cmd->cmd_complete(cmd, 0);
3031                 mgmt_pending_remove(cmd);
3032         }
3033
3034         err = 0;
3035
3036 unlock:
3037         hci_dev_unlock(hdev);
3038         return err;
3039 }
3040
3041 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3042                               u16 len)
3043 {
3044         struct mgmt_addr_info *addr = data;
3045         struct mgmt_pending_cmd *cmd;
3046         struct hci_conn *conn;
3047         int err;
3048
3049         bt_dev_dbg(hdev, "sock %p", sk);
3050
3051         hci_dev_lock(hdev);
3052
3053         if (!hdev_is_powered(hdev)) {
3054                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3055                                       MGMT_STATUS_NOT_POWERED);
3056                 goto unlock;
3057         }
3058
3059         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3060         if (!cmd) {
3061                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3062                                       MGMT_STATUS_INVALID_PARAMS);
3063                 goto unlock;
3064         }
3065
3066         conn = cmd->user_data;
3067
3068         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3069                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3070                                       MGMT_STATUS_INVALID_PARAMS);
3071                 goto unlock;
3072         }
3073
3074         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3075         mgmt_pending_remove(cmd);
3076
3077         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3078                                 addr, sizeof(*addr));
3079
3080         /* Since user doesn't want to proceed with the connection, abort any
3081          * ongoing pairing and then terminate the link if it was created
3082          * because of the pair device action.
3083          */
3084         if (addr->type == BDADDR_BREDR)
3085                 hci_remove_link_key(hdev, &addr->bdaddr);
3086         else
3087                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3088                                               le_addr_type(addr->type));
3089
3090         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3091                 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3092
3093 unlock:
3094         hci_dev_unlock(hdev);
3095         return err;
3096 }
3097
3098 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3099                              struct mgmt_addr_info *addr, u16 mgmt_op,
3100                              u16 hci_op, __le32 passkey)
3101 {
3102         struct mgmt_pending_cmd *cmd;
3103         struct hci_conn *conn;
3104         int err;
3105
3106         hci_dev_lock(hdev);
3107
3108         if (!hdev_is_powered(hdev)) {
3109                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3110                                         MGMT_STATUS_NOT_POWERED, addr,
3111                                         sizeof(*addr));
3112                 goto done;
3113         }
3114
3115         if (addr->type == BDADDR_BREDR)
3116                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3117         else
3118                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3119                                                le_addr_type(addr->type));
3120
3121         if (!conn) {
3122                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3123                                         MGMT_STATUS_NOT_CONNECTED, addr,
3124                                         sizeof(*addr));
3125                 goto done;
3126         }
3127
3128         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3129                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3130                 if (!err)
3131                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3132                                                 MGMT_STATUS_SUCCESS, addr,
3133                                                 sizeof(*addr));
3134                 else
3135                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3136                                                 MGMT_STATUS_FAILED, addr,
3137                                                 sizeof(*addr));
3138
3139                 goto done;
3140         }
3141
3142         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3143         if (!cmd) {
3144                 err = -ENOMEM;
3145                 goto done;
3146         }
3147
3148         cmd->cmd_complete = addr_cmd_complete;
3149
3150         /* Continue with pairing via HCI */
3151         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3152                 struct hci_cp_user_passkey_reply cp;
3153
3154                 bacpy(&cp.bdaddr, &addr->bdaddr);
3155                 cp.passkey = passkey;
3156                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3157         } else
3158                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3159                                    &addr->bdaddr);
3160
3161         if (err < 0)
3162                 mgmt_pending_remove(cmd);
3163
3164 done:
3165         hci_dev_unlock(hdev);
3166         return err;
3167 }
3168
3169 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3170                               void *data, u16 len)
3171 {
3172         struct mgmt_cp_pin_code_neg_reply *cp = data;
3173
3174         bt_dev_dbg(hdev, "sock %p", sk);
3175
3176         return user_pairing_resp(sk, hdev, &cp->addr,
3177                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3178                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3179 }
3180
3181 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3182                               u16 len)
3183 {
3184         struct mgmt_cp_user_confirm_reply *cp = data;
3185
3186         bt_dev_dbg(hdev, "sock %p", sk);
3187
3188         if (len != sizeof(*cp))
3189                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3190                                        MGMT_STATUS_INVALID_PARAMS);
3191
3192         return user_pairing_resp(sk, hdev, &cp->addr,
3193                                  MGMT_OP_USER_CONFIRM_REPLY,
3194                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3195 }
3196
3197 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3198                                   void *data, u16 len)
3199 {
3200         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3201
3202         bt_dev_dbg(hdev, "sock %p", sk);
3203
3204         return user_pairing_resp(sk, hdev, &cp->addr,
3205                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3206                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3207 }
3208
3209 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3210                               u16 len)
3211 {
3212         struct mgmt_cp_user_passkey_reply *cp = data;
3213
3214         bt_dev_dbg(hdev, "sock %p", sk);
3215
3216         return user_pairing_resp(sk, hdev, &cp->addr,
3217                                  MGMT_OP_USER_PASSKEY_REPLY,
3218                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3219 }
3220
3221 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3222                                   void *data, u16 len)
3223 {
3224         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3225
3226         bt_dev_dbg(hdev, "sock %p", sk);
3227
3228         return user_pairing_resp(sk, hdev, &cp->addr,
3229                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3230                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3231 }
3232
3233 static void adv_expire(struct hci_dev *hdev, u32 flags)
3234 {
3235         struct adv_info *adv_instance;
3236         struct hci_request req;
3237         int err;
3238
3239         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3240         if (!adv_instance)
3241                 return;
3242
3243         /* stop if current instance doesn't need to be changed */
3244         if (!(adv_instance->flags & flags))
3245                 return;
3246
3247         cancel_adv_timeout(hdev);
3248
3249         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3250         if (!adv_instance)
3251                 return;
3252
3253         hci_req_init(&req, hdev);
3254         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3255                                               true);
3256         if (err)
3257                 return;
3258
3259         hci_req_run(&req, NULL);
3260 }
3261
3262 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3263 {
3264         struct mgmt_cp_set_local_name *cp;
3265         struct mgmt_pending_cmd *cmd;
3266
3267         bt_dev_dbg(hdev, "status 0x%02x", status);
3268
3269         hci_dev_lock(hdev);
3270
3271         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3272         if (!cmd)
3273                 goto unlock;
3274
3275         cp = cmd->param;
3276
3277         if (status) {
3278                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3279                                 mgmt_status(status));
3280         } else {
3281                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3282                                   cp, sizeof(*cp));
3283
3284                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3285                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3286         }
3287
3288         mgmt_pending_remove(cmd);
3289
3290 unlock:
3291         hci_dev_unlock(hdev);
3292 }
3293
3294 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3295                           u16 len)
3296 {
3297         struct mgmt_cp_set_local_name *cp = data;
3298         struct mgmt_pending_cmd *cmd;
3299         struct hci_request req;
3300         int err;
3301
3302         bt_dev_dbg(hdev, "sock %p", sk);
3303
3304         hci_dev_lock(hdev);
3305
3306         /* If the old values are the same as the new ones just return a
3307          * direct command complete event.
3308          */
3309         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3310             !memcmp(hdev->short_name, cp->short_name,
3311                     sizeof(hdev->short_name))) {
3312                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3313                                         data, len);
3314                 goto failed;
3315         }
3316
3317         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3318
3319         if (!hdev_is_powered(hdev)) {
3320                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3321
3322                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3323                                         data, len);
3324                 if (err < 0)
3325                         goto failed;
3326
3327                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3328                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3329                 ext_info_changed(hdev, sk);
3330
3331                 goto failed;
3332         }
3333
3334         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3335         if (!cmd) {
3336                 err = -ENOMEM;
3337                 goto failed;
3338         }
3339
3340         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3341
3342         hci_req_init(&req, hdev);
3343
3344         if (lmp_bredr_capable(hdev)) {
3345                 __hci_req_update_name(&req);
3346                 __hci_req_update_eir(&req);
3347         }
3348
3349         /* The name is stored in the scan response data and so
3350          * no need to update the advertising data here.
3351          */
3352         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3353                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3354
3355         err = hci_req_run(&req, set_name_complete);
3356         if (err < 0)
3357                 mgmt_pending_remove(cmd);
3358
3359 failed:
3360         hci_dev_unlock(hdev);
3361         return err;
3362 }
3363
3364 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3365                           u16 len)
3366 {
3367         struct mgmt_cp_set_appearance *cp = data;
3368         u16 appearance;
3369         int err;
3370
3371         bt_dev_dbg(hdev, "sock %p", sk);
3372
3373         if (!lmp_le_capable(hdev))
3374                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3375                                        MGMT_STATUS_NOT_SUPPORTED);
3376
3377         appearance = le16_to_cpu(cp->appearance);
3378
3379         hci_dev_lock(hdev);
3380
3381         if (hdev->appearance != appearance) {
3382                 hdev->appearance = appearance;
3383
3384                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3385                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3386
3387                 ext_info_changed(hdev, sk);
3388         }
3389
3390         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3391                                 0);
3392
3393         hci_dev_unlock(hdev);
3394
3395         return err;
3396 }
3397
3398 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3399                                  void *data, u16 len)
3400 {
3401         struct mgmt_rp_get_phy_configuration rp;
3402
3403         bt_dev_dbg(hdev, "sock %p", sk);
3404
3405         hci_dev_lock(hdev);
3406
3407         memset(&rp, 0, sizeof(rp));
3408
3409         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3410         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3411         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3412
3413         hci_dev_unlock(hdev);
3414
3415         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3416                                  &rp, sizeof(rp));
3417 }
3418
3419 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3420 {
3421         struct mgmt_ev_phy_configuration_changed ev;
3422
3423         memset(&ev, 0, sizeof(ev));
3424
3425         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3426
3427         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3428                           sizeof(ev), skip);
3429 }
3430
3431 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3432                                      u16 opcode, struct sk_buff *skb)
3433 {
3434         struct mgmt_pending_cmd *cmd;
3435
3436         bt_dev_dbg(hdev, "status 0x%02x", status);
3437
3438         hci_dev_lock(hdev);
3439
3440         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3441         if (!cmd)
3442                 goto unlock;
3443
3444         if (status) {
3445                 mgmt_cmd_status(cmd->sk, hdev->id,
3446                                 MGMT_OP_SET_PHY_CONFIGURATION,
3447                                 mgmt_status(status));
3448         } else {
3449                 mgmt_cmd_complete(cmd->sk, hdev->id,
3450                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3451                                   NULL, 0);
3452
3453                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3454         }
3455
3456         mgmt_pending_remove(cmd);
3457
3458 unlock:
3459         hci_dev_unlock(hdev);
3460 }
3461
3462 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3463                                  void *data, u16 len)
3464 {
3465         struct mgmt_cp_set_phy_configuration *cp = data;
3466         struct hci_cp_le_set_default_phy cp_phy;
3467         struct mgmt_pending_cmd *cmd;
3468         struct hci_request req;
3469         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3470         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3471         bool changed = false;
3472         int err;
3473
3474         bt_dev_dbg(hdev, "sock %p", sk);
3475
3476         configurable_phys = get_configurable_phys(hdev);
3477         supported_phys = get_supported_phys(hdev);
3478         selected_phys = __le32_to_cpu(cp->selected_phys);
3479
3480         if (selected_phys & ~supported_phys)
3481                 return mgmt_cmd_status(sk, hdev->id,
3482                                        MGMT_OP_SET_PHY_CONFIGURATION,
3483                                        MGMT_STATUS_INVALID_PARAMS);
3484
3485         unconfigure_phys = supported_phys & ~configurable_phys;
3486
3487         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3488                 return mgmt_cmd_status(sk, hdev->id,
3489                                        MGMT_OP_SET_PHY_CONFIGURATION,
3490                                        MGMT_STATUS_INVALID_PARAMS);
3491
3492         if (selected_phys == get_selected_phys(hdev))
3493                 return mgmt_cmd_complete(sk, hdev->id,
3494                                          MGMT_OP_SET_PHY_CONFIGURATION,
3495                                          0, NULL, 0);
3496
3497         hci_dev_lock(hdev);
3498
3499         if (!hdev_is_powered(hdev)) {
3500                 err = mgmt_cmd_status(sk, hdev->id,
3501                                       MGMT_OP_SET_PHY_CONFIGURATION,
3502                                       MGMT_STATUS_REJECTED);
3503                 goto unlock;
3504         }
3505
3506         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3507                 err = mgmt_cmd_status(sk, hdev->id,
3508                                       MGMT_OP_SET_PHY_CONFIGURATION,
3509                                       MGMT_STATUS_BUSY);
3510                 goto unlock;
3511         }
3512
3513         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3514                 pkt_type |= (HCI_DH3 | HCI_DM3);
3515         else
3516                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3517
3518         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3519                 pkt_type |= (HCI_DH5 | HCI_DM5);
3520         else
3521                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3522
3523         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3524                 pkt_type &= ~HCI_2DH1;
3525         else
3526                 pkt_type |= HCI_2DH1;
3527
3528         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3529                 pkt_type &= ~HCI_2DH3;
3530         else
3531                 pkt_type |= HCI_2DH3;
3532
3533         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3534                 pkt_type &= ~HCI_2DH5;
3535         else
3536                 pkt_type |= HCI_2DH5;
3537
3538         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3539                 pkt_type &= ~HCI_3DH1;
3540         else
3541                 pkt_type |= HCI_3DH1;
3542
3543         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3544                 pkt_type &= ~HCI_3DH3;
3545         else
3546                 pkt_type |= HCI_3DH3;
3547
3548         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3549                 pkt_type &= ~HCI_3DH5;
3550         else
3551                 pkt_type |= HCI_3DH5;
3552
3553         if (pkt_type != hdev->pkt_type) {
3554                 hdev->pkt_type = pkt_type;
3555                 changed = true;
3556         }
3557
3558         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3559             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3560                 if (changed)
3561                         mgmt_phy_configuration_changed(hdev, sk);
3562
3563                 err = mgmt_cmd_complete(sk, hdev->id,
3564                                         MGMT_OP_SET_PHY_CONFIGURATION,
3565                                         0, NULL, 0);
3566
3567                 goto unlock;
3568         }
3569
3570         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3571                                len);
3572         if (!cmd) {
3573                 err = -ENOMEM;
3574                 goto unlock;
3575         }
3576
3577         hci_req_init(&req, hdev);
3578
3579         memset(&cp_phy, 0, sizeof(cp_phy));
3580
3581         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3582                 cp_phy.all_phys |= 0x01;
3583
3584         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3585                 cp_phy.all_phys |= 0x02;
3586
3587         if (selected_phys & MGMT_PHY_LE_1M_TX)
3588                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3589
3590         if (selected_phys & MGMT_PHY_LE_2M_TX)
3591                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3592
3593         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3594                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3595
3596         if (selected_phys & MGMT_PHY_LE_1M_RX)
3597                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3598
3599         if (selected_phys & MGMT_PHY_LE_2M_RX)
3600                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3601
3602         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3603                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3604
3605         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3606
3607         err = hci_req_run_skb(&req, set_default_phy_complete);
3608         if (err < 0)
3609                 mgmt_pending_remove(cmd);
3610
3611 unlock:
3612         hci_dev_unlock(hdev);
3613
3614         return err;
3615 }
3616
3617 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3618                             u16 len)
3619 {
3620         int err = MGMT_STATUS_SUCCESS;
3621         struct mgmt_cp_set_blocked_keys *keys = data;
3622         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
3623                                    sizeof(struct mgmt_blocked_key_info));
3624         u16 key_count, expected_len;
3625         int i;
3626
3627         bt_dev_dbg(hdev, "sock %p", sk);
3628
3629         key_count = __le16_to_cpu(keys->key_count);
3630         if (key_count > max_key_count) {
3631                 bt_dev_err(hdev, "too big key_count value %u", key_count);
3632                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3633                                        MGMT_STATUS_INVALID_PARAMS);
3634         }
3635
3636         expected_len = struct_size(keys, keys, key_count);
3637         if (expected_len != len) {
3638                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
3639                            expected_len, len);
3640                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3641                                        MGMT_STATUS_INVALID_PARAMS);
3642         }
3643
3644         hci_dev_lock(hdev);
3645
3646         hci_blocked_keys_clear(hdev);
3647
3648         for (i = 0; i < keys->key_count; ++i) {
3649                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
3650
3651                 if (!b) {
3652                         err = MGMT_STATUS_NO_RESOURCES;
3653                         break;
3654                 }
3655
3656                 b->type = keys->keys[i].type;
3657                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
3658                 list_add_rcu(&b->list, &hdev->blocked_keys);
3659         }
3660         hci_dev_unlock(hdev);
3661
3662         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3663                                 err, NULL, 0);
3664 }
3665
3666 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
3667                                void *data, u16 len)
3668 {
3669         struct mgmt_mode *cp = data;
3670         int err;
3671         bool changed = false;
3672
3673         bt_dev_dbg(hdev, "sock %p", sk);
3674
3675         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
3676                 return mgmt_cmd_status(sk, hdev->id,
3677                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3678                                        MGMT_STATUS_NOT_SUPPORTED);
3679
3680         if (cp->val != 0x00 && cp->val != 0x01)
3681                 return mgmt_cmd_status(sk, hdev->id,
3682                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3683                                        MGMT_STATUS_INVALID_PARAMS);
3684
3685         hci_dev_lock(hdev);
3686
3687         if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) {
3688                 err = mgmt_cmd_status(sk, hdev->id,
3689                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3690                                       MGMT_STATUS_BUSY);
3691                 goto unlock;
3692         }
3693
3694         if (hdev_is_powered(hdev) &&
3695             !!cp->val != hci_dev_test_flag(hdev,
3696                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
3697                 err = mgmt_cmd_status(sk, hdev->id,
3698                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3699                                       MGMT_STATUS_REJECTED);
3700                 goto unlock;
3701         }
3702
3703         if (cp->val)
3704                 changed = !hci_dev_test_and_set_flag(hdev,
3705                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3706         else
3707                 changed = hci_dev_test_and_clear_flag(hdev,
3708                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3709
3710         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
3711         if (err < 0)
3712                 goto unlock;
3713
3714         if (changed)
3715                 err = new_settings(hdev, sk);
3716
3717 unlock:
3718         hci_dev_unlock(hdev);
3719         return err;
3720 }
3721
3722 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
3723                                void *data, u16 data_len)
3724 {
3725         char buf[20];
3726         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
3727         u16 cap_len = 0;
3728         u8 flags = 0;
3729         u8 tx_power_range[2];
3730
3731         bt_dev_dbg(hdev, "sock %p", sk);
3732
3733         memset(&buf, 0, sizeof(buf));
3734
3735         hci_dev_lock(hdev);
3736
3737         /* When the Read Simple Pairing Options command is supported, then
3738          * the remote public key validation is supported.
3739          *
3740          * Alternatively, when Microsoft extensions are available, they can
3741          * indicate support for public key validation as well.
3742          */
3743         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
3744                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
3745
3746         flags |= 0x02;          /* Remote public key validation (LE) */
3747
3748         /* When the Read Encryption Key Size command is supported, then the
3749          * encryption key size is enforced.
3750          */
3751         if (hdev->commands[20] & 0x10)
3752                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
3753
3754         flags |= 0x08;          /* Encryption key size enforcement (LE) */
3755
3756         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
3757                                   &flags, 1);
3758
3759         /* When the Read Simple Pairing Options command is supported, then
3760          * also max encryption key size information is provided.
3761          */
3762         if (hdev->commands[41] & 0x08)
3763                 cap_len = eir_append_le16(rp->cap, cap_len,
3764                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
3765                                           hdev->max_enc_key_size);
3766
3767         cap_len = eir_append_le16(rp->cap, cap_len,
3768                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
3769                                   SMP_MAX_ENC_KEY_SIZE);
3770
3771         /* Append the min/max LE tx power parameters if we were able to fetch
3772          * it from the controller
3773          */
3774         if (hdev->commands[38] & 0x80) {
3775                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
3776                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
3777                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
3778                                           tx_power_range, 2);
3779         }
3780
3781         rp->cap_len = cpu_to_le16(cap_len);
3782
3783         hci_dev_unlock(hdev);
3784
3785         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
3786                                  rp, sizeof(*rp) + cap_len);
3787 }
3788
3789 #ifdef CONFIG_BT_FEATURE_DEBUG
3790 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
3791 static const u8 debug_uuid[16] = {
3792         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
3793         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
3794 };
3795 #endif
3796
3797 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
3798 static const u8 simult_central_periph_uuid[16] = {
3799         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
3800         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
3801 };
3802
3803 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
3804 static const u8 rpa_resolution_uuid[16] = {
3805         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
3806         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
3807 };
3808
3809 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
3810                                   void *data, u16 data_len)
3811 {
3812         char buf[62];   /* Enough space for 3 features */
3813         struct mgmt_rp_read_exp_features_info *rp = (void *)buf;
3814         u16 idx = 0;
3815         u32 flags;
3816
3817         bt_dev_dbg(hdev, "sock %p", sk);
3818
3819         memset(&buf, 0, sizeof(buf));
3820
3821 #ifdef CONFIG_BT_FEATURE_DEBUG
3822         if (!hdev) {
3823                 flags = bt_dbg_get() ? BIT(0) : 0;
3824
3825                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
3826                 rp->features[idx].flags = cpu_to_le32(flags);
3827                 idx++;
3828         }
3829 #endif
3830
3831         if (hdev) {
3832                 if (test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) &&
3833                     (hdev->le_states[4] & 0x08) &&      /* Central */
3834                     (hdev->le_states[4] & 0x40) &&      /* Peripheral */
3835                     (hdev->le_states[3] & 0x10))        /* Simultaneous */
3836                         flags = BIT(0);
3837                 else
3838                         flags = 0;
3839
3840                 memcpy(rp->features[idx].uuid, simult_central_periph_uuid, 16);
3841                 rp->features[idx].flags = cpu_to_le32(flags);
3842                 idx++;
3843         }
3844
3845         if (hdev && use_ll_privacy(hdev)) {
3846                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
3847                         flags = BIT(0) | BIT(1);
3848                 else
3849                         flags = BIT(1);
3850
3851                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
3852                 rp->features[idx].flags = cpu_to_le32(flags);
3853                 idx++;
3854         }
3855
3856         rp->feature_count = cpu_to_le16(idx);
3857
3858         /* After reading the experimental features information, enable
3859          * the events to update client on any future change.
3860          */
3861         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3862
3863         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3864                                  MGMT_OP_READ_EXP_FEATURES_INFO,
3865                                  0, rp, sizeof(*rp) + (20 * idx));
3866 }
3867
3868 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
3869                                           struct sock *skip)
3870 {
3871         struct mgmt_ev_exp_feature_changed ev;
3872
3873         memset(&ev, 0, sizeof(ev));
3874         memcpy(ev.uuid, rpa_resolution_uuid, 16);
3875         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
3876
3877         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
3878                                   &ev, sizeof(ev),
3879                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3880
3881 }
3882
3883 #ifdef CONFIG_BT_FEATURE_DEBUG
3884 static int exp_debug_feature_changed(bool enabled, struct sock *skip)
3885 {
3886         struct mgmt_ev_exp_feature_changed ev;
3887
3888         memset(&ev, 0, sizeof(ev));
3889         memcpy(ev.uuid, debug_uuid, 16);
3890         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
3891
3892         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL,
3893                                   &ev, sizeof(ev),
3894                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3895 }
3896 #endif
3897
3898 #define EXP_FEAT(_uuid, _set_func)      \
3899 {                                       \
3900         .uuid = _uuid,                  \
3901         .set_func = _set_func,          \
3902 }
3903
3904 /* The zero key uuid is special. Multiple exp features are set through it. */
3905 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
3906                              struct mgmt_cp_set_exp_feature *cp, u16 data_len)
3907 {
3908         struct mgmt_rp_set_exp_feature rp;
3909
3910         memset(rp.uuid, 0, 16);
3911         rp.flags = cpu_to_le32(0);
3912
3913 #ifdef CONFIG_BT_FEATURE_DEBUG
3914         if (!hdev) {
3915                 bool changed = bt_dbg_get();
3916
3917                 bt_dbg_set(false);
3918
3919                 if (changed)
3920                         exp_debug_feature_changed(false, sk);
3921         }
3922 #endif
3923
3924         if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
3925                 bool changed;
3926
3927                 changed = hci_dev_test_and_clear_flag(hdev,
3928                                                       HCI_ENABLE_LL_PRIVACY);
3929                 if (changed)
3930                         exp_ll_privacy_feature_changed(false, hdev, sk);
3931         }
3932
3933         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3934
3935         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3936                                  MGMT_OP_SET_EXP_FEATURE, 0,
3937                                  &rp, sizeof(rp));
3938 }
3939
3940 #ifdef CONFIG_BT_FEATURE_DEBUG
3941 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
3942                           struct mgmt_cp_set_exp_feature *cp, u16 data_len)
3943 {
3944         struct mgmt_rp_set_exp_feature rp;
3945
3946         bool val, changed;
3947         int err;
3948
3949         /* Command requires to use the non-controller index */
3950         if (hdev)
3951                 return mgmt_cmd_status(sk, hdev->id,
3952                                        MGMT_OP_SET_EXP_FEATURE,
3953                                        MGMT_STATUS_INVALID_INDEX);
3954
3955         /* Parameters are limited to a single octet */
3956         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3957                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3958                                        MGMT_OP_SET_EXP_FEATURE,
3959                                        MGMT_STATUS_INVALID_PARAMS);
3960
3961         /* Only boolean on/off is supported */
3962         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3963                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3964                                        MGMT_OP_SET_EXP_FEATURE,
3965                                        MGMT_STATUS_INVALID_PARAMS);
3966
3967         val = !!cp->param[0];
3968         changed = val ? !bt_dbg_get() : bt_dbg_get();
3969         bt_dbg_set(val);
3970
3971         memcpy(rp.uuid, debug_uuid, 16);
3972         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
3973
3974         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3975
3976         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
3977                                 MGMT_OP_SET_EXP_FEATURE, 0,
3978                                 &rp, sizeof(rp));
3979
3980         if (changed)
3981                 exp_debug_feature_changed(val, sk);
3982
3983         return err;
3984 }
3985 #endif
3986
3987 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev,
3988                                    struct mgmt_cp_set_exp_feature *cp,
3989                                    u16 data_len)
3990 {
3991         struct mgmt_rp_set_exp_feature rp;
3992         bool val, changed;
3993         int err;
3994         u32 flags;
3995
3996         /* Command requires to use the controller index */
3997         if (!hdev)
3998                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3999                                        MGMT_OP_SET_EXP_FEATURE,
4000                                        MGMT_STATUS_INVALID_INDEX);
4001
4002         /* Changes can only be made when controller is powered down */
4003         if (hdev_is_powered(hdev))
4004                 return mgmt_cmd_status(sk, hdev->id,
4005                                        MGMT_OP_SET_EXP_FEATURE,
4006                                        MGMT_STATUS_REJECTED);
4007
4008         /* Parameters are limited to a single octet */
4009         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4010                 return mgmt_cmd_status(sk, hdev->id,
4011                                        MGMT_OP_SET_EXP_FEATURE,
4012                                        MGMT_STATUS_INVALID_PARAMS);
4013
4014         /* Only boolean on/off is supported */
4015         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4016                 return mgmt_cmd_status(sk, hdev->id,
4017                                        MGMT_OP_SET_EXP_FEATURE,
4018                                        MGMT_STATUS_INVALID_PARAMS);
4019
4020         val = !!cp->param[0];
4021
4022         if (val) {
4023                 changed = !hci_dev_test_and_set_flag(hdev,
4024                                                      HCI_ENABLE_LL_PRIVACY);
4025                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4026
4027                 /* Enable LL privacy + supported settings changed */
4028                 flags = BIT(0) | BIT(1);
4029         } else {
4030                 changed = hci_dev_test_and_clear_flag(hdev,
4031                                                       HCI_ENABLE_LL_PRIVACY);
4032
4033                 /* Disable LL privacy + supported settings changed */
4034                 flags = BIT(1);
4035         }
4036
4037         memcpy(rp.uuid, rpa_resolution_uuid, 16);
4038         rp.flags = cpu_to_le32(flags);
4039
4040         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4041
4042         err = mgmt_cmd_complete(sk, hdev->id,
4043                                 MGMT_OP_SET_EXP_FEATURE, 0,
4044                                 &rp, sizeof(rp));
4045
4046         if (changed)
4047                 exp_ll_privacy_feature_changed(val, hdev, sk);
4048
4049         return err;
4050 }
4051
4052 static const struct mgmt_exp_feature {
4053         const u8 *uuid;
4054         int (*set_func)(struct sock *sk, struct hci_dev *hdev,
4055                         struct mgmt_cp_set_exp_feature *cp, u16 data_len);
4056 } exp_features[] = {
4057         EXP_FEAT(ZERO_KEY, set_zero_key_func),
4058 #ifdef CONFIG_BT_FEATURE_DEBUG
4059         EXP_FEAT(debug_uuid, set_debug_func),
4060 #endif
4061         EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func),
4062
4063         /* end with a null feature */
4064         EXP_FEAT(NULL, NULL)
4065 };
4066
4067 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
4068                            void *data, u16 data_len)
4069 {
4070         struct mgmt_cp_set_exp_feature *cp = data;
4071         size_t i = 0;
4072
4073         bt_dev_dbg(hdev, "sock %p", sk);
4074
4075         for (i = 0; exp_features[i].uuid; i++) {
4076                 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
4077                         return exp_features[i].set_func(sk, hdev, cp, data_len);
4078         }
4079
4080         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4081                                MGMT_OP_SET_EXP_FEATURE,
4082                                MGMT_STATUS_NOT_SUPPORTED);
4083 }
4084
4085 #define SUPPORTED_DEVICE_FLAGS() ((1U << HCI_CONN_FLAG_MAX) - 1)
4086
4087 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4088                             u16 data_len)
4089 {
4090         struct mgmt_cp_get_device_flags *cp = data;
4091         struct mgmt_rp_get_device_flags rp;
4092         struct bdaddr_list_with_flags *br_params;
4093         struct hci_conn_params *params;
4094         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4095         u32 current_flags = 0;
4096         u8 status = MGMT_STATUS_INVALID_PARAMS;
4097
4098         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
4099                    &cp->addr.bdaddr, cp->addr.type);
4100
4101         hci_dev_lock(hdev);
4102
4103         memset(&rp, 0, sizeof(rp));
4104
4105         if (cp->addr.type == BDADDR_BREDR) {
4106                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4107                                                               &cp->addr.bdaddr,
4108                                                               cp->addr.type);
4109                 if (!br_params)
4110                         goto done;
4111
4112                 current_flags = br_params->current_flags;
4113         } else {
4114                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4115                                                 le_addr_type(cp->addr.type));
4116
4117                 if (!params)
4118                         goto done;
4119
4120                 current_flags = params->current_flags;
4121         }
4122
4123         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4124         rp.addr.type = cp->addr.type;
4125         rp.supported_flags = cpu_to_le32(supported_flags);
4126         rp.current_flags = cpu_to_le32(current_flags);
4127
4128         status = MGMT_STATUS_SUCCESS;
4129
4130 done:
4131         hci_dev_unlock(hdev);
4132
4133         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
4134                                 &rp, sizeof(rp));
4135 }
4136
4137 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
4138                                  bdaddr_t *bdaddr, u8 bdaddr_type,
4139                                  u32 supported_flags, u32 current_flags)
4140 {
4141         struct mgmt_ev_device_flags_changed ev;
4142
4143         bacpy(&ev.addr.bdaddr, bdaddr);
4144         ev.addr.type = bdaddr_type;
4145         ev.supported_flags = cpu_to_le32(supported_flags);
4146         ev.current_flags = cpu_to_le32(current_flags);
4147
4148         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
4149 }
4150
4151 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4152                             u16 len)
4153 {
4154         struct mgmt_cp_set_device_flags *cp = data;
4155         struct bdaddr_list_with_flags *br_params;
4156         struct hci_conn_params *params;
4157         u8 status = MGMT_STATUS_INVALID_PARAMS;
4158         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4159         u32 current_flags = __le32_to_cpu(cp->current_flags);
4160
4161         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
4162                    &cp->addr.bdaddr, cp->addr.type,
4163                    __le32_to_cpu(current_flags));
4164
4165         if ((supported_flags | current_flags) != supported_flags) {
4166                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
4167                             current_flags, supported_flags);
4168                 goto done;
4169         }
4170
4171         hci_dev_lock(hdev);
4172
4173         if (cp->addr.type == BDADDR_BREDR) {
4174                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4175                                                               &cp->addr.bdaddr,
4176                                                               cp->addr.type);
4177
4178                 if (br_params) {
4179                         br_params->current_flags = current_flags;
4180                         status = MGMT_STATUS_SUCCESS;
4181                 } else {
4182                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
4183                                     &cp->addr.bdaddr, cp->addr.type);
4184                 }
4185         } else {
4186                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4187                                                 le_addr_type(cp->addr.type));
4188                 if (params) {
4189                         params->current_flags = current_flags;
4190                         status = MGMT_STATUS_SUCCESS;
4191                 } else {
4192                         bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
4193                                     &cp->addr.bdaddr,
4194                                     le_addr_type(cp->addr.type));
4195                 }
4196         }
4197
4198 done:
4199         hci_dev_unlock(hdev);
4200
4201         if (status == MGMT_STATUS_SUCCESS)
4202                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
4203                                      supported_flags, current_flags);
4204
4205         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
4206                                  &cp->addr, sizeof(cp->addr));
4207 }
4208
4209 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
4210                                    u16 handle)
4211 {
4212         struct mgmt_ev_adv_monitor_added ev;
4213
4214         ev.monitor_handle = cpu_to_le16(handle);
4215
4216         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
4217 }
4218
4219 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
4220 {
4221         struct mgmt_ev_adv_monitor_removed ev;
4222         struct mgmt_pending_cmd *cmd;
4223         struct sock *sk_skip = NULL;
4224         struct mgmt_cp_remove_adv_monitor *cp;
4225
4226         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4227         if (cmd) {
4228                 cp = cmd->param;
4229
4230                 if (cp->monitor_handle)
4231                         sk_skip = cmd->sk;
4232         }
4233
4234         ev.monitor_handle = cpu_to_le16(handle);
4235
4236         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
4237 }
4238
4239 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
4240                                  void *data, u16 len)
4241 {
4242         struct adv_monitor *monitor = NULL;
4243         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
4244         int handle, err;
4245         size_t rp_size = 0;
4246         __u32 supported = 0;
4247         __u32 enabled = 0;
4248         __u16 num_handles = 0;
4249         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
4250
4251         BT_DBG("request for %s", hdev->name);
4252
4253         hci_dev_lock(hdev);
4254
4255         if (msft_monitor_supported(hdev))
4256                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
4257
4258         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
4259                 handles[num_handles++] = monitor->handle;
4260
4261         hci_dev_unlock(hdev);
4262
4263         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
4264         rp = kmalloc(rp_size, GFP_KERNEL);
4265         if (!rp)
4266                 return -ENOMEM;
4267
4268         /* All supported features are currently enabled */
4269         enabled = supported;
4270
4271         rp->supported_features = cpu_to_le32(supported);
4272         rp->enabled_features = cpu_to_le32(enabled);
4273         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
4274         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
4275         rp->num_handles = cpu_to_le16(num_handles);
4276         if (num_handles)
4277                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
4278
4279         err = mgmt_cmd_complete(sk, hdev->id,
4280                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
4281                                 MGMT_STATUS_SUCCESS, rp, rp_size);
4282
4283         kfree(rp);
4284
4285         return err;
4286 }
4287
4288 int mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status)
4289 {
4290         struct mgmt_rp_add_adv_patterns_monitor rp;
4291         struct mgmt_pending_cmd *cmd;
4292         struct adv_monitor *monitor;
4293         int err = 0;
4294
4295         hci_dev_lock(hdev);
4296
4297         cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev);
4298         if (!cmd) {
4299                 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev);
4300                 if (!cmd)
4301                         goto done;
4302         }
4303
4304         monitor = cmd->user_data;
4305         rp.monitor_handle = cpu_to_le16(monitor->handle);
4306
4307         if (!status) {
4308                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
4309                 hdev->adv_monitors_cnt++;
4310                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
4311                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
4312                 hci_update_background_scan(hdev);
4313         }
4314
4315         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4316                                 mgmt_status(status), &rp, sizeof(rp));
4317         mgmt_pending_remove(cmd);
4318
4319 done:
4320         hci_dev_unlock(hdev);
4321         bt_dev_dbg(hdev, "add monitor %d complete, status %u",
4322                    rp.monitor_handle, status);
4323
4324         return err;
4325 }
4326
4327 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4328                                       struct adv_monitor *m, u8 status,
4329                                       void *data, u16 len, u16 op)
4330 {
4331         struct mgmt_rp_add_adv_patterns_monitor rp;
4332         struct mgmt_pending_cmd *cmd;
4333         int err;
4334         bool pending;
4335
4336         hci_dev_lock(hdev);
4337
4338         if (status)
4339                 goto unlock;
4340
4341         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4342             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4343             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
4344             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
4345                 status = MGMT_STATUS_BUSY;
4346                 goto unlock;
4347         }
4348
4349         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4350         if (!cmd) {
4351                 status = MGMT_STATUS_NO_RESOURCES;
4352                 goto unlock;
4353         }
4354
4355         cmd->user_data = m;
4356         pending = hci_add_adv_monitor(hdev, m, &err);
4357         if (err) {
4358                 if (err == -ENOSPC || err == -ENOMEM)
4359                         status = MGMT_STATUS_NO_RESOURCES;
4360                 else if (err == -EINVAL)
4361                         status = MGMT_STATUS_INVALID_PARAMS;
4362                 else
4363                         status = MGMT_STATUS_FAILED;
4364
4365                 mgmt_pending_remove(cmd);
4366                 goto unlock;
4367         }
4368
4369         if (!pending) {
4370                 mgmt_pending_remove(cmd);
4371                 rp.monitor_handle = cpu_to_le16(m->handle);
4372                 mgmt_adv_monitor_added(sk, hdev, m->handle);
4373                 m->state = ADV_MONITOR_STATE_REGISTERED;
4374                 hdev->adv_monitors_cnt++;
4375
4376                 hci_dev_unlock(hdev);
4377                 return mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_SUCCESS,
4378                                          &rp, sizeof(rp));
4379         }
4380
4381         hci_dev_unlock(hdev);
4382
4383         return 0;
4384
4385 unlock:
4386         hci_free_adv_monitor(hdev, m);
4387         hci_dev_unlock(hdev);
4388         return mgmt_cmd_status(sk, hdev->id, op, status);
4389 }
4390
4391 static void parse_adv_monitor_rssi(struct adv_monitor *m,
4392                                    struct mgmt_adv_rssi_thresholds *rssi)
4393 {
4394         if (rssi) {
4395                 m->rssi.low_threshold = rssi->low_threshold;
4396                 m->rssi.low_threshold_timeout =
4397                     __le16_to_cpu(rssi->low_threshold_timeout);
4398                 m->rssi.high_threshold = rssi->high_threshold;
4399                 m->rssi.high_threshold_timeout =
4400                     __le16_to_cpu(rssi->high_threshold_timeout);
4401                 m->rssi.sampling_period = rssi->sampling_period;
4402         } else {
4403                 /* Default values. These numbers are the least constricting
4404                  * parameters for MSFT API to work, so it behaves as if there
4405                  * are no rssi parameter to consider. May need to be changed
4406                  * if other API are to be supported.
4407                  */
4408                 m->rssi.low_threshold = -127;
4409                 m->rssi.low_threshold_timeout = 60;
4410                 m->rssi.high_threshold = -127;
4411                 m->rssi.high_threshold_timeout = 0;
4412                 m->rssi.sampling_period = 0;
4413         }
4414 }
4415
4416 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
4417                                     struct mgmt_adv_pattern *patterns)
4418 {
4419         u8 offset = 0, length = 0;
4420         struct adv_pattern *p = NULL;
4421         int i;
4422
4423         for (i = 0; i < pattern_count; i++) {
4424                 offset = patterns[i].offset;
4425                 length = patterns[i].length;
4426                 if (offset >= HCI_MAX_AD_LENGTH ||
4427                     length > HCI_MAX_AD_LENGTH ||
4428                     (offset + length) > HCI_MAX_AD_LENGTH)
4429                         return MGMT_STATUS_INVALID_PARAMS;
4430
4431                 p = kmalloc(sizeof(*p), GFP_KERNEL);
4432                 if (!p)
4433                         return MGMT_STATUS_NO_RESOURCES;
4434
4435                 p->ad_type = patterns[i].ad_type;
4436                 p->offset = patterns[i].offset;
4437                 p->length = patterns[i].length;
4438                 memcpy(p->value, patterns[i].value, p->length);
4439
4440                 INIT_LIST_HEAD(&p->list);
4441                 list_add(&p->list, &m->patterns);
4442         }
4443
4444         return MGMT_STATUS_SUCCESS;
4445 }
4446
4447 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4448                                     void *data, u16 len)
4449 {
4450         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
4451         struct adv_monitor *m = NULL;
4452         u8 status = MGMT_STATUS_SUCCESS;
4453         size_t expected_size = sizeof(*cp);
4454
4455         BT_DBG("request for %s", hdev->name);
4456
4457         if (len <= sizeof(*cp)) {
4458                 status = MGMT_STATUS_INVALID_PARAMS;
4459                 goto done;
4460         }
4461
4462         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4463         if (len != expected_size) {
4464                 status = MGMT_STATUS_INVALID_PARAMS;
4465                 goto done;
4466         }
4467
4468         m = kzalloc(sizeof(*m), GFP_KERNEL);
4469         if (!m) {
4470                 status = MGMT_STATUS_NO_RESOURCES;
4471                 goto done;
4472         }
4473
4474         INIT_LIST_HEAD(&m->patterns);
4475
4476         parse_adv_monitor_rssi(m, NULL);
4477         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4478
4479 done:
4480         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4481                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
4482 }
4483
4484 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
4485                                          void *data, u16 len)
4486 {
4487         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
4488         struct adv_monitor *m = NULL;
4489         u8 status = MGMT_STATUS_SUCCESS;
4490         size_t expected_size = sizeof(*cp);
4491
4492         BT_DBG("request for %s", hdev->name);
4493
4494         if (len <= sizeof(*cp)) {
4495                 status = MGMT_STATUS_INVALID_PARAMS;
4496                 goto done;
4497         }
4498
4499         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4500         if (len != expected_size) {
4501                 status = MGMT_STATUS_INVALID_PARAMS;
4502                 goto done;
4503         }
4504
4505         m = kzalloc(sizeof(*m), GFP_KERNEL);
4506         if (!m) {
4507                 status = MGMT_STATUS_NO_RESOURCES;
4508                 goto done;
4509         }
4510
4511         INIT_LIST_HEAD(&m->patterns);
4512
4513         parse_adv_monitor_rssi(m, &cp->rssi);
4514         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4515
4516 done:
4517         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4518                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
4519 }
4520
4521 int mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status)
4522 {
4523         struct mgmt_rp_remove_adv_monitor rp;
4524         struct mgmt_cp_remove_adv_monitor *cp;
4525         struct mgmt_pending_cmd *cmd;
4526         int err = 0;
4527
4528         hci_dev_lock(hdev);
4529
4530         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4531         if (!cmd)
4532                 goto done;
4533
4534         cp = cmd->param;
4535         rp.monitor_handle = cp->monitor_handle;
4536
4537         if (!status)
4538                 hci_update_background_scan(hdev);
4539
4540         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4541                                 mgmt_status(status), &rp, sizeof(rp));
4542         mgmt_pending_remove(cmd);
4543
4544 done:
4545         hci_dev_unlock(hdev);
4546         bt_dev_dbg(hdev, "remove monitor %d complete, status %u",
4547                    rp.monitor_handle, status);
4548
4549         return err;
4550 }
4551
4552 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
4553                               void *data, u16 len)
4554 {
4555         struct mgmt_cp_remove_adv_monitor *cp = data;
4556         struct mgmt_rp_remove_adv_monitor rp;
4557         struct mgmt_pending_cmd *cmd;
4558         u16 handle = __le16_to_cpu(cp->monitor_handle);
4559         int err, status;
4560         bool pending;
4561
4562         BT_DBG("request for %s", hdev->name);
4563         rp.monitor_handle = cp->monitor_handle;
4564
4565         hci_dev_lock(hdev);
4566
4567         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4568             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
4569             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4570             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
4571                 status = MGMT_STATUS_BUSY;
4572                 goto unlock;
4573         }
4574
4575         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
4576         if (!cmd) {
4577                 status = MGMT_STATUS_NO_RESOURCES;
4578                 goto unlock;
4579         }
4580
4581         if (handle)
4582                 pending = hci_remove_single_adv_monitor(hdev, handle, &err);
4583         else
4584                 pending = hci_remove_all_adv_monitor(hdev, &err);
4585
4586         if (err) {
4587                 mgmt_pending_remove(cmd);
4588
4589                 if (err == -ENOENT)
4590                         status = MGMT_STATUS_INVALID_INDEX;
4591                 else
4592                         status = MGMT_STATUS_FAILED;
4593
4594                 goto unlock;
4595         }
4596
4597         /* monitor can be removed without forwarding request to controller */
4598         if (!pending) {
4599                 mgmt_pending_remove(cmd);
4600                 hci_dev_unlock(hdev);
4601
4602                 return mgmt_cmd_complete(sk, hdev->id,
4603                                          MGMT_OP_REMOVE_ADV_MONITOR,
4604                                          MGMT_STATUS_SUCCESS,
4605                                          &rp, sizeof(rp));
4606         }
4607
4608         hci_dev_unlock(hdev);
4609         return 0;
4610
4611 unlock:
4612         hci_dev_unlock(hdev);
4613         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4614                                status);
4615 }
4616
4617 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
4618                                          u16 opcode, struct sk_buff *skb)
4619 {
4620         struct mgmt_rp_read_local_oob_data mgmt_rp;
4621         size_t rp_size = sizeof(mgmt_rp);
4622         struct mgmt_pending_cmd *cmd;
4623
4624         bt_dev_dbg(hdev, "status %u", status);
4625
4626         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4627         if (!cmd)
4628                 return;
4629
4630         if (status || !skb) {
4631                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4632                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
4633                 goto remove;
4634         }
4635
4636         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
4637
4638         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
4639                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
4640
4641                 if (skb->len < sizeof(*rp)) {
4642                         mgmt_cmd_status(cmd->sk, hdev->id,
4643                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4644                                         MGMT_STATUS_FAILED);
4645                         goto remove;
4646                 }
4647
4648                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
4649                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
4650
4651                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
4652         } else {
4653                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
4654
4655                 if (skb->len < sizeof(*rp)) {
4656                         mgmt_cmd_status(cmd->sk, hdev->id,
4657                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4658                                         MGMT_STATUS_FAILED);
4659                         goto remove;
4660                 }
4661
4662                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
4663                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
4664
4665                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
4666                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
4667         }
4668
4669         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4670                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
4671
4672 remove:
4673         mgmt_pending_remove(cmd);
4674 }
4675
4676 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
4677                                void *data, u16 data_len)
4678 {
4679         struct mgmt_pending_cmd *cmd;
4680         struct hci_request req;
4681         int err;
4682
4683         bt_dev_dbg(hdev, "sock %p", sk);
4684
4685         hci_dev_lock(hdev);
4686
4687         if (!hdev_is_powered(hdev)) {
4688                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4689                                       MGMT_STATUS_NOT_POWERED);
4690                 goto unlock;
4691         }
4692
4693         if (!lmp_ssp_capable(hdev)) {
4694                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4695                                       MGMT_STATUS_NOT_SUPPORTED);
4696                 goto unlock;
4697         }
4698
4699         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
4700                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4701                                       MGMT_STATUS_BUSY);
4702                 goto unlock;
4703         }
4704
4705         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
4706         if (!cmd) {
4707                 err = -ENOMEM;
4708                 goto unlock;
4709         }
4710
4711         hci_req_init(&req, hdev);
4712
4713         if (bredr_sc_enabled(hdev))
4714                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4715         else
4716                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4717
4718         err = hci_req_run_skb(&req, read_local_oob_data_complete);
4719         if (err < 0)
4720                 mgmt_pending_remove(cmd);
4721
4722 unlock:
4723         hci_dev_unlock(hdev);
4724         return err;
4725 }
4726
4727 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4728                                void *data, u16 len)
4729 {
4730         struct mgmt_addr_info *addr = data;
4731         int err;
4732
4733         bt_dev_dbg(hdev, "sock %p", sk);
4734
4735         if (!bdaddr_type_is_valid(addr->type))
4736                 return mgmt_cmd_complete(sk, hdev->id,
4737                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
4738                                          MGMT_STATUS_INVALID_PARAMS,
4739                                          addr, sizeof(*addr));
4740
4741         hci_dev_lock(hdev);
4742
4743         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4744                 struct mgmt_cp_add_remote_oob_data *cp = data;
4745                 u8 status;
4746
4747                 if (cp->addr.type != BDADDR_BREDR) {
4748                         err = mgmt_cmd_complete(sk, hdev->id,
4749                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
4750                                                 MGMT_STATUS_INVALID_PARAMS,
4751                                                 &cp->addr, sizeof(cp->addr));
4752                         goto unlock;
4753                 }
4754
4755                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4756                                               cp->addr.type, cp->hash,
4757                                               cp->rand, NULL, NULL);
4758                 if (err < 0)
4759                         status = MGMT_STATUS_FAILED;
4760                 else
4761                         status = MGMT_STATUS_SUCCESS;
4762
4763                 err = mgmt_cmd_complete(sk, hdev->id,
4764                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4765                                         &cp->addr, sizeof(cp->addr));
4766         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4767                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
4768                 u8 *rand192, *hash192, *rand256, *hash256;
4769                 u8 status;
4770
4771                 if (bdaddr_type_is_le(cp->addr.type)) {
4772                         /* Enforce zero-valued 192-bit parameters as
4773                          * long as legacy SMP OOB isn't implemented.
4774                          */
4775                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4776                             memcmp(cp->hash192, ZERO_KEY, 16)) {
4777                                 err = mgmt_cmd_complete(sk, hdev->id,
4778                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4779                                                         MGMT_STATUS_INVALID_PARAMS,
4780                                                         addr, sizeof(*addr));
4781                                 goto unlock;
4782                         }
4783
4784                         rand192 = NULL;
4785                         hash192 = NULL;
4786                 } else {
4787                         /* In case one of the P-192 values is set to zero,
4788                          * then just disable OOB data for P-192.
4789                          */
4790                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4791                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
4792                                 rand192 = NULL;
4793                                 hash192 = NULL;
4794                         } else {
4795                                 rand192 = cp->rand192;
4796                                 hash192 = cp->hash192;
4797                         }
4798                 }
4799
4800                 /* In case one of the P-256 values is set to zero, then just
4801                  * disable OOB data for P-256.
4802                  */
4803                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4804                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
4805                         rand256 = NULL;
4806                         hash256 = NULL;
4807                 } else {
4808                         rand256 = cp->rand256;
4809                         hash256 = cp->hash256;
4810                 }
4811
4812                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4813                                               cp->addr.type, hash192, rand192,
4814                                               hash256, rand256);
4815                 if (err < 0)
4816                         status = MGMT_STATUS_FAILED;
4817                 else
4818                         status = MGMT_STATUS_SUCCESS;
4819
4820                 err = mgmt_cmd_complete(sk, hdev->id,
4821                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4822                                         status, &cp->addr, sizeof(cp->addr));
4823         } else {
4824                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
4825                            len);
4826                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4827                                       MGMT_STATUS_INVALID_PARAMS);
4828         }
4829
4830 unlock:
4831         hci_dev_unlock(hdev);
4832         return err;
4833 }
4834
4835 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4836                                   void *data, u16 len)
4837 {
4838         struct mgmt_cp_remove_remote_oob_data *cp = data;
4839         u8 status;
4840         int err;
4841
4842         bt_dev_dbg(hdev, "sock %p", sk);
4843
4844         if (cp->addr.type != BDADDR_BREDR)
4845                 return mgmt_cmd_complete(sk, hdev->id,
4846                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4847                                          MGMT_STATUS_INVALID_PARAMS,
4848                                          &cp->addr, sizeof(cp->addr));
4849
4850         hci_dev_lock(hdev);
4851
4852         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4853                 hci_remote_oob_data_clear(hdev);
4854                 status = MGMT_STATUS_SUCCESS;
4855                 goto done;
4856         }
4857
4858         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
4859         if (err < 0)
4860                 status = MGMT_STATUS_INVALID_PARAMS;
4861         else
4862                 status = MGMT_STATUS_SUCCESS;
4863
4864 done:
4865         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4866                                 status, &cp->addr, sizeof(cp->addr));
4867
4868         hci_dev_unlock(hdev);
4869         return err;
4870 }
4871
4872 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
4873 {
4874         struct mgmt_pending_cmd *cmd;
4875
4876         bt_dev_dbg(hdev, "status %u", status);
4877
4878         hci_dev_lock(hdev);
4879
4880         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4881         if (!cmd)
4882                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4883
4884         if (!cmd)
4885                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
4886
4887         if (cmd) {
4888                 cmd->cmd_complete(cmd, mgmt_status(status));
4889                 mgmt_pending_remove(cmd);
4890         }
4891
4892         hci_dev_unlock(hdev);
4893
4894         /* Handle suspend notifier */
4895         if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY,
4896                                hdev->suspend_tasks)) {
4897                 bt_dev_dbg(hdev, "Unpaused discovery");
4898                 wake_up(&hdev->suspend_wait_q);
4899         }
4900 }
4901
4902 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
4903                                     uint8_t *mgmt_status)
4904 {
4905         switch (type) {
4906         case DISCOV_TYPE_LE:
4907                 *mgmt_status = mgmt_le_support(hdev);
4908                 if (*mgmt_status)
4909                         return false;
4910                 break;
4911         case DISCOV_TYPE_INTERLEAVED:
4912                 *mgmt_status = mgmt_le_support(hdev);
4913                 if (*mgmt_status)
4914                         return false;
4915                 fallthrough;
4916         case DISCOV_TYPE_BREDR:
4917                 *mgmt_status = mgmt_bredr_support(hdev);
4918                 if (*mgmt_status)
4919                         return false;
4920                 break;
4921         default:
4922                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
4923                 return false;
4924         }
4925
4926         return true;
4927 }
4928
4929 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
4930                                     u16 op, void *data, u16 len)
4931 {
4932         struct mgmt_cp_start_discovery *cp = data;
4933         struct mgmt_pending_cmd *cmd;
4934         u8 status;
4935         int err;
4936
4937         bt_dev_dbg(hdev, "sock %p", sk);
4938
4939         hci_dev_lock(hdev);
4940
4941         if (!hdev_is_powered(hdev)) {
4942                 err = mgmt_cmd_complete(sk, hdev->id, op,
4943                                         MGMT_STATUS_NOT_POWERED,
4944                                         &cp->type, sizeof(cp->type));
4945                 goto failed;
4946         }
4947
4948         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4949             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4950                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4951                                         &cp->type, sizeof(cp->type));
4952                 goto failed;
4953         }
4954
4955         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4956                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
4957                                         &cp->type, sizeof(cp->type));
4958                 goto failed;
4959         }
4960
4961         /* Can't start discovery when it is paused */
4962         if (hdev->discovery_paused) {
4963                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4964                                         &cp->type, sizeof(cp->type));
4965                 goto failed;
4966         }
4967
4968         /* Clear the discovery filter first to free any previously
4969          * allocated memory for the UUID list.
4970          */
4971         hci_discovery_filter_clear(hdev);
4972
4973         hdev->discovery.type = cp->type;
4974         hdev->discovery.report_invalid_rssi = false;
4975         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
4976                 hdev->discovery.limited = true;
4977         else
4978                 hdev->discovery.limited = false;
4979
4980         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4981         if (!cmd) {
4982                 err = -ENOMEM;
4983                 goto failed;
4984         }
4985
4986         cmd->cmd_complete = generic_cmd_complete;
4987
4988         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4989         queue_work(hdev->req_workqueue, &hdev->discov_update);
4990         err = 0;
4991
4992 failed:
4993         hci_dev_unlock(hdev);
4994         return err;
4995 }
4996
4997 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4998                            void *data, u16 len)
4999 {
5000         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
5001                                         data, len);
5002 }
5003
5004 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
5005                                    void *data, u16 len)
5006 {
5007         return start_discovery_internal(sk, hdev,
5008                                         MGMT_OP_START_LIMITED_DISCOVERY,
5009                                         data, len);
5010 }
5011
5012 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
5013                                           u8 status)
5014 {
5015         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
5016                                  cmd->param, 1);
5017 }
5018
5019 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
5020                                    void *data, u16 len)
5021 {
5022         struct mgmt_cp_start_service_discovery *cp = data;
5023         struct mgmt_pending_cmd *cmd;
5024         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
5025         u16 uuid_count, expected_len;
5026         u8 status;
5027         int err;
5028
5029         bt_dev_dbg(hdev, "sock %p", sk);
5030
5031         hci_dev_lock(hdev);
5032
5033         if (!hdev_is_powered(hdev)) {
5034                 err = mgmt_cmd_complete(sk, hdev->id,
5035                                         MGMT_OP_START_SERVICE_DISCOVERY,
5036                                         MGMT_STATUS_NOT_POWERED,
5037                                         &cp->type, sizeof(cp->type));
5038                 goto failed;
5039         }
5040
5041         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5042             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5043                 err = mgmt_cmd_complete(sk, hdev->id,
5044                                         MGMT_OP_START_SERVICE_DISCOVERY,
5045                                         MGMT_STATUS_BUSY, &cp->type,
5046                                         sizeof(cp->type));
5047                 goto failed;
5048         }
5049
5050         if (hdev->discovery_paused) {
5051                 err = mgmt_cmd_complete(sk, hdev->id,
5052                                         MGMT_OP_START_SERVICE_DISCOVERY,
5053                                         MGMT_STATUS_BUSY, &cp->type,
5054                                         sizeof(cp->type));
5055                 goto failed;
5056         }
5057
5058         uuid_count = __le16_to_cpu(cp->uuid_count);
5059         if (uuid_count > max_uuid_count) {
5060                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
5061                            uuid_count);
5062                 err = mgmt_cmd_complete(sk, hdev->id,
5063                                         MGMT_OP_START_SERVICE_DISCOVERY,
5064                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5065                                         sizeof(cp->type));
5066                 goto failed;
5067         }
5068
5069         expected_len = sizeof(*cp) + uuid_count * 16;
5070         if (expected_len != len) {
5071                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
5072                            expected_len, len);
5073                 err = mgmt_cmd_complete(sk, hdev->id,
5074                                         MGMT_OP_START_SERVICE_DISCOVERY,
5075                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5076                                         sizeof(cp->type));
5077                 goto failed;
5078         }
5079
5080         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5081                 err = mgmt_cmd_complete(sk, hdev->id,
5082                                         MGMT_OP_START_SERVICE_DISCOVERY,
5083                                         status, &cp->type, sizeof(cp->type));
5084                 goto failed;
5085         }
5086
5087         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
5088                                hdev, data, len);
5089         if (!cmd) {
5090                 err = -ENOMEM;
5091                 goto failed;
5092         }
5093
5094         cmd->cmd_complete = service_discovery_cmd_complete;
5095
5096         /* Clear the discovery filter first to free any previously
5097          * allocated memory for the UUID list.
5098          */
5099         hci_discovery_filter_clear(hdev);
5100
5101         hdev->discovery.result_filtering = true;
5102         hdev->discovery.type = cp->type;
5103         hdev->discovery.rssi = cp->rssi;
5104         hdev->discovery.uuid_count = uuid_count;
5105
5106         if (uuid_count > 0) {
5107                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
5108                                                 GFP_KERNEL);
5109                 if (!hdev->discovery.uuids) {
5110                         err = mgmt_cmd_complete(sk, hdev->id,
5111                                                 MGMT_OP_START_SERVICE_DISCOVERY,
5112                                                 MGMT_STATUS_FAILED,
5113                                                 &cp->type, sizeof(cp->type));
5114                         mgmt_pending_remove(cmd);
5115                         goto failed;
5116                 }
5117         }
5118
5119         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5120         queue_work(hdev->req_workqueue, &hdev->discov_update);
5121         err = 0;
5122
5123 failed:
5124         hci_dev_unlock(hdev);
5125         return err;
5126 }
5127
5128 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
5129 {
5130         struct mgmt_pending_cmd *cmd;
5131
5132         bt_dev_dbg(hdev, "status %u", status);
5133
5134         hci_dev_lock(hdev);
5135
5136         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
5137         if (cmd) {
5138                 cmd->cmd_complete(cmd, mgmt_status(status));
5139                 mgmt_pending_remove(cmd);
5140         }
5141
5142         hci_dev_unlock(hdev);
5143
5144         /* Handle suspend notifier */
5145         if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) {
5146                 bt_dev_dbg(hdev, "Paused discovery");
5147                 wake_up(&hdev->suspend_wait_q);
5148         }
5149 }
5150
5151 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
5152                           u16 len)
5153 {
5154         struct mgmt_cp_stop_discovery *mgmt_cp = data;
5155         struct mgmt_pending_cmd *cmd;
5156         int err;
5157
5158         bt_dev_dbg(hdev, "sock %p", sk);
5159
5160         hci_dev_lock(hdev);
5161
5162         if (!hci_discovery_active(hdev)) {
5163                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5164                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
5165                                         sizeof(mgmt_cp->type));
5166                 goto unlock;
5167         }
5168
5169         if (hdev->discovery.type != mgmt_cp->type) {
5170                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5171                                         MGMT_STATUS_INVALID_PARAMS,
5172                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
5173                 goto unlock;
5174         }
5175
5176         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
5177         if (!cmd) {
5178                 err = -ENOMEM;
5179                 goto unlock;
5180         }
5181
5182         cmd->cmd_complete = generic_cmd_complete;
5183
5184         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
5185         queue_work(hdev->req_workqueue, &hdev->discov_update);
5186         err = 0;
5187
5188 unlock:
5189         hci_dev_unlock(hdev);
5190         return err;
5191 }
5192
5193 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
5194                         u16 len)
5195 {
5196         struct mgmt_cp_confirm_name *cp = data;
5197         struct inquiry_entry *e;
5198         int err;
5199
5200         bt_dev_dbg(hdev, "sock %p", sk);
5201
5202         hci_dev_lock(hdev);
5203
5204         if (!hci_discovery_active(hdev)) {
5205                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5206                                         MGMT_STATUS_FAILED, &cp->addr,
5207                                         sizeof(cp->addr));
5208                 goto failed;
5209         }
5210
5211         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
5212         if (!e) {
5213                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5214                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
5215                                         sizeof(cp->addr));
5216                 goto failed;
5217         }
5218
5219         if (cp->name_known) {
5220                 e->name_state = NAME_KNOWN;
5221                 list_del(&e->list);
5222         } else {
5223                 e->name_state = NAME_NEEDED;
5224                 hci_inquiry_cache_update_resolve(hdev, e);
5225         }
5226
5227         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
5228                                 &cp->addr, sizeof(cp->addr));
5229
5230 failed:
5231         hci_dev_unlock(hdev);
5232         return err;
5233 }
5234
5235 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
5236                         u16 len)
5237 {
5238         struct mgmt_cp_block_device *cp = data;
5239         u8 status;
5240         int err;
5241
5242         bt_dev_dbg(hdev, "sock %p", sk);
5243
5244         if (!bdaddr_type_is_valid(cp->addr.type))
5245                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
5246                                          MGMT_STATUS_INVALID_PARAMS,
5247                                          &cp->addr, sizeof(cp->addr));
5248
5249         hci_dev_lock(hdev);
5250
5251         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
5252                                   cp->addr.type);
5253         if (err < 0) {
5254                 status = MGMT_STATUS_FAILED;
5255                 goto done;
5256         }
5257
5258         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5259                    sk);
5260         status = MGMT_STATUS_SUCCESS;
5261
5262 done:
5263         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
5264                                 &cp->addr, sizeof(cp->addr));
5265
5266         hci_dev_unlock(hdev);
5267
5268         return err;
5269 }
5270
5271 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
5272                           u16 len)
5273 {
5274         struct mgmt_cp_unblock_device *cp = data;
5275         u8 status;
5276         int err;
5277
5278         bt_dev_dbg(hdev, "sock %p", sk);
5279
5280         if (!bdaddr_type_is_valid(cp->addr.type))
5281                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
5282                                          MGMT_STATUS_INVALID_PARAMS,
5283                                          &cp->addr, sizeof(cp->addr));
5284
5285         hci_dev_lock(hdev);
5286
5287         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
5288                                   cp->addr.type);
5289         if (err < 0) {
5290                 status = MGMT_STATUS_INVALID_PARAMS;
5291                 goto done;
5292         }
5293
5294         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5295                    sk);
5296         status = MGMT_STATUS_SUCCESS;
5297
5298 done:
5299         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
5300                                 &cp->addr, sizeof(cp->addr));
5301
5302         hci_dev_unlock(hdev);
5303
5304         return err;
5305 }
5306
5307 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
5308                          u16 len)
5309 {
5310         struct mgmt_cp_set_device_id *cp = data;
5311         struct hci_request req;
5312         int err;
5313         __u16 source;
5314
5315         bt_dev_dbg(hdev, "sock %p", sk);
5316
5317         source = __le16_to_cpu(cp->source);
5318
5319         if (source > 0x0002)
5320                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
5321                                        MGMT_STATUS_INVALID_PARAMS);
5322
5323         hci_dev_lock(hdev);
5324
5325         hdev->devid_source = source;
5326         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
5327         hdev->devid_product = __le16_to_cpu(cp->product);
5328         hdev->devid_version = __le16_to_cpu(cp->version);
5329
5330         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
5331                                 NULL, 0);
5332
5333         hci_req_init(&req, hdev);
5334         __hci_req_update_eir(&req);
5335         hci_req_run(&req, NULL);
5336
5337         hci_dev_unlock(hdev);
5338
5339         return err;
5340 }
5341
5342 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
5343                                         u16 opcode)
5344 {
5345         bt_dev_dbg(hdev, "status %u", status);
5346 }
5347
5348 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
5349                                      u16 opcode)
5350 {
5351         struct cmd_lookup match = { NULL, hdev };
5352         struct hci_request req;
5353         u8 instance;
5354         struct adv_info *adv_instance;
5355         int err;
5356
5357         hci_dev_lock(hdev);
5358
5359         if (status) {
5360                 u8 mgmt_err = mgmt_status(status);
5361
5362                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
5363                                      cmd_status_rsp, &mgmt_err);
5364                 goto unlock;
5365         }
5366
5367         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
5368                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
5369         else
5370                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
5371
5372         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
5373                              &match);
5374
5375         new_settings(hdev, match.sk);
5376
5377         if (match.sk)
5378                 sock_put(match.sk);
5379
5380         /* Handle suspend notifier */
5381         if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING,
5382                                hdev->suspend_tasks)) {
5383                 bt_dev_dbg(hdev, "Paused advertising");
5384                 wake_up(&hdev->suspend_wait_q);
5385         } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING,
5386                                       hdev->suspend_tasks)) {
5387                 bt_dev_dbg(hdev, "Unpaused advertising");
5388                 wake_up(&hdev->suspend_wait_q);
5389         }
5390
5391         /* If "Set Advertising" was just disabled and instance advertising was
5392          * set up earlier, then re-enable multi-instance advertising.
5393          */
5394         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
5395             list_empty(&hdev->adv_instances))
5396                 goto unlock;
5397
5398         instance = hdev->cur_adv_instance;
5399         if (!instance) {
5400                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
5401                                                         struct adv_info, list);
5402                 if (!adv_instance)
5403                         goto unlock;
5404
5405                 instance = adv_instance->instance;
5406         }
5407
5408         hci_req_init(&req, hdev);
5409
5410         err = __hci_req_schedule_adv_instance(&req, instance, true);
5411
5412         if (!err)
5413                 err = hci_req_run(&req, enable_advertising_instance);
5414
5415         if (err)
5416                 bt_dev_err(hdev, "failed to re-configure advertising");
5417
5418 unlock:
5419         hci_dev_unlock(hdev);
5420 }
5421
5422 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
5423                            u16 len)
5424 {
5425         struct mgmt_mode *cp = data;
5426         struct mgmt_pending_cmd *cmd;
5427         struct hci_request req;
5428         u8 val, status;
5429         int err;
5430
5431         bt_dev_dbg(hdev, "sock %p", sk);
5432
5433         status = mgmt_le_support(hdev);
5434         if (status)
5435                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5436                                        status);
5437
5438         /* Enabling the experimental LL Privay support disables support for
5439          * advertising.
5440          */
5441         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
5442                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5443                                        MGMT_STATUS_NOT_SUPPORTED);
5444
5445         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5446                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5447                                        MGMT_STATUS_INVALID_PARAMS);
5448
5449         if (hdev->advertising_paused)
5450                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5451                                        MGMT_STATUS_BUSY);
5452
5453         hci_dev_lock(hdev);
5454
5455         val = !!cp->val;
5456
5457         /* The following conditions are ones which mean that we should
5458          * not do any HCI communication but directly send a mgmt
5459          * response to user space (after toggling the flag if
5460          * necessary).
5461          */
5462         if (!hdev_is_powered(hdev) ||
5463             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
5464              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
5465             hci_conn_num(hdev, LE_LINK) > 0 ||
5466             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5467              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
5468                 bool changed;
5469
5470                 if (cp->val) {
5471                         hdev->cur_adv_instance = 0x00;
5472                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
5473                         if (cp->val == 0x02)
5474                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5475                         else
5476                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5477                 } else {
5478                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
5479                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5480                 }
5481
5482                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
5483                 if (err < 0)
5484                         goto unlock;
5485
5486                 if (changed)
5487                         err = new_settings(hdev, sk);
5488
5489                 goto unlock;
5490         }
5491
5492         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
5493             pending_find(MGMT_OP_SET_LE, hdev)) {
5494                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5495                                       MGMT_STATUS_BUSY);
5496                 goto unlock;
5497         }
5498
5499         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
5500         if (!cmd) {
5501                 err = -ENOMEM;
5502                 goto unlock;
5503         }
5504
5505         hci_req_init(&req, hdev);
5506
5507         if (cp->val == 0x02)
5508                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5509         else
5510                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5511
5512         cancel_adv_timeout(hdev);
5513
5514         if (val) {
5515                 /* Switch to instance "0" for the Set Advertising setting.
5516                  * We cannot use update_[adv|scan_rsp]_data() here as the
5517                  * HCI_ADVERTISING flag is not yet set.
5518                  */
5519                 hdev->cur_adv_instance = 0x00;
5520
5521                 if (ext_adv_capable(hdev)) {
5522                         __hci_req_start_ext_adv(&req, 0x00);
5523                 } else {
5524                         __hci_req_update_adv_data(&req, 0x00);
5525                         __hci_req_update_scan_rsp_data(&req, 0x00);
5526                         __hci_req_enable_advertising(&req);
5527                 }
5528         } else {
5529                 __hci_req_disable_advertising(&req);
5530         }
5531
5532         err = hci_req_run(&req, set_advertising_complete);
5533         if (err < 0)
5534                 mgmt_pending_remove(cmd);
5535
5536 unlock:
5537         hci_dev_unlock(hdev);
5538         return err;
5539 }
5540
5541 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
5542                               void *data, u16 len)
5543 {
5544         struct mgmt_cp_set_static_address *cp = data;
5545         int err;
5546
5547         bt_dev_dbg(hdev, "sock %p", sk);
5548
5549         if (!lmp_le_capable(hdev))
5550                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5551                                        MGMT_STATUS_NOT_SUPPORTED);
5552
5553         if (hdev_is_powered(hdev))
5554                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5555                                        MGMT_STATUS_REJECTED);
5556
5557         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
5558                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
5559                         return mgmt_cmd_status(sk, hdev->id,
5560                                                MGMT_OP_SET_STATIC_ADDRESS,
5561                                                MGMT_STATUS_INVALID_PARAMS);
5562
5563                 /* Two most significant bits shall be set */
5564                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
5565                         return mgmt_cmd_status(sk, hdev->id,
5566                                                MGMT_OP_SET_STATIC_ADDRESS,
5567                                                MGMT_STATUS_INVALID_PARAMS);
5568         }
5569
5570         hci_dev_lock(hdev);
5571
5572         bacpy(&hdev->static_addr, &cp->bdaddr);
5573
5574         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
5575         if (err < 0)
5576                 goto unlock;
5577
5578         err = new_settings(hdev, sk);
5579
5580 unlock:
5581         hci_dev_unlock(hdev);
5582         return err;
5583 }
5584
5585 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5586                            void *data, u16 len)
5587 {
5588         struct mgmt_cp_set_scan_params *cp = data;
5589         __u16 interval, window;
5590         int err;
5591
5592         bt_dev_dbg(hdev, "sock %p", sk);
5593
5594         if (!lmp_le_capable(hdev))
5595                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5596                                        MGMT_STATUS_NOT_SUPPORTED);
5597
5598         interval = __le16_to_cpu(cp->interval);
5599
5600         if (interval < 0x0004 || interval > 0x4000)
5601                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5602                                        MGMT_STATUS_INVALID_PARAMS);
5603
5604         window = __le16_to_cpu(cp->window);
5605
5606         if (window < 0x0004 || window > 0x4000)
5607                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5608                                        MGMT_STATUS_INVALID_PARAMS);
5609
5610         if (window > interval)
5611                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5612                                        MGMT_STATUS_INVALID_PARAMS);
5613
5614         hci_dev_lock(hdev);
5615
5616         hdev->le_scan_interval = interval;
5617         hdev->le_scan_window = window;
5618
5619         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5620                                 NULL, 0);
5621
5622         /* If background scan is running, restart it so new parameters are
5623          * loaded.
5624          */
5625         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5626             hdev->discovery.state == DISCOVERY_STOPPED) {
5627                 struct hci_request req;
5628
5629                 hci_req_init(&req, hdev);
5630
5631                 hci_req_add_le_scan_disable(&req, false);
5632                 hci_req_add_le_passive_scan(&req);
5633
5634                 hci_req_run(&req, NULL);
5635         }
5636
5637         hci_dev_unlock(hdev);
5638
5639         return err;
5640 }
5641
5642 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5643                                       u16 opcode)
5644 {
5645         struct mgmt_pending_cmd *cmd;
5646
5647         bt_dev_dbg(hdev, "status 0x%02x", status);
5648
5649         hci_dev_lock(hdev);
5650
5651         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5652         if (!cmd)
5653                 goto unlock;
5654
5655         if (status) {
5656                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5657                                 mgmt_status(status));
5658         } else {
5659                 struct mgmt_mode *cp = cmd->param;
5660
5661                 if (cp->val)
5662                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
5663                 else
5664                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5665
5666                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5667                 new_settings(hdev, cmd->sk);
5668         }
5669
5670         mgmt_pending_remove(cmd);
5671
5672 unlock:
5673         hci_dev_unlock(hdev);
5674 }
5675
5676 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
5677                                 void *data, u16 len)
5678 {
5679         struct mgmt_mode *cp = data;
5680         struct mgmt_pending_cmd *cmd;
5681         struct hci_request req;
5682         int err;
5683
5684         bt_dev_dbg(hdev, "sock %p", sk);
5685
5686         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
5687             hdev->hci_ver < BLUETOOTH_VER_1_2)
5688                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5689                                        MGMT_STATUS_NOT_SUPPORTED);
5690
5691         if (cp->val != 0x00 && cp->val != 0x01)
5692                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5693                                        MGMT_STATUS_INVALID_PARAMS);
5694
5695         hci_dev_lock(hdev);
5696
5697         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
5698                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5699                                       MGMT_STATUS_BUSY);
5700                 goto unlock;
5701         }
5702
5703         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
5704                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5705                                         hdev);
5706                 goto unlock;
5707         }
5708
5709         if (!hdev_is_powered(hdev)) {
5710                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
5711                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5712                                         hdev);
5713                 new_settings(hdev, sk);
5714                 goto unlock;
5715         }
5716
5717         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5718                                data, len);
5719         if (!cmd) {
5720                 err = -ENOMEM;
5721                 goto unlock;
5722         }
5723
5724         hci_req_init(&req, hdev);
5725
5726         __hci_req_write_fast_connectable(&req, cp->val);
5727
5728         err = hci_req_run(&req, fast_connectable_complete);
5729         if (err < 0) {
5730                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5731                                       MGMT_STATUS_FAILED);
5732                 mgmt_pending_remove(cmd);
5733         }
5734
5735 unlock:
5736         hci_dev_unlock(hdev);
5737
5738         return err;
5739 }
5740
5741 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5742 {
5743         struct mgmt_pending_cmd *cmd;
5744
5745         bt_dev_dbg(hdev, "status 0x%02x", status);
5746
5747         hci_dev_lock(hdev);
5748
5749         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
5750         if (!cmd)
5751                 goto unlock;
5752
5753         if (status) {
5754                 u8 mgmt_err = mgmt_status(status);
5755
5756                 /* We need to restore the flag if related HCI commands
5757                  * failed.
5758                  */
5759                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
5760
5761                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5762         } else {
5763                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5764                 new_settings(hdev, cmd->sk);
5765         }
5766
5767         mgmt_pending_remove(cmd);
5768
5769 unlock:
5770         hci_dev_unlock(hdev);
5771 }
5772
5773 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5774 {
5775         struct mgmt_mode *cp = data;
5776         struct mgmt_pending_cmd *cmd;
5777         struct hci_request req;
5778         int err;
5779
5780         bt_dev_dbg(hdev, "sock %p", sk);
5781
5782         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5783                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5784                                        MGMT_STATUS_NOT_SUPPORTED);
5785
5786         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5787                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5788                                        MGMT_STATUS_REJECTED);
5789
5790         if (cp->val != 0x00 && cp->val != 0x01)
5791                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5792                                        MGMT_STATUS_INVALID_PARAMS);
5793
5794         hci_dev_lock(hdev);
5795
5796         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5797                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5798                 goto unlock;
5799         }
5800
5801         if (!hdev_is_powered(hdev)) {
5802                 if (!cp->val) {
5803                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5804                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5805                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5806                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5807                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5808                 }
5809
5810                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5811
5812                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5813                 if (err < 0)
5814                         goto unlock;
5815
5816                 err = new_settings(hdev, sk);
5817                 goto unlock;
5818         }
5819
5820         /* Reject disabling when powered on */
5821         if (!cp->val) {
5822                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5823                                       MGMT_STATUS_REJECTED);
5824                 goto unlock;
5825         } else {
5826                 /* When configuring a dual-mode controller to operate
5827                  * with LE only and using a static address, then switching
5828                  * BR/EDR back on is not allowed.
5829                  *
5830                  * Dual-mode controllers shall operate with the public
5831                  * address as its identity address for BR/EDR and LE. So
5832                  * reject the attempt to create an invalid configuration.
5833                  *
5834                  * The same restrictions applies when secure connections
5835                  * has been enabled. For BR/EDR this is a controller feature
5836                  * while for LE it is a host stack feature. This means that
5837                  * switching BR/EDR back on when secure connections has been
5838                  * enabled is not a supported transaction.
5839                  */
5840                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5841                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5842                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5843                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5844                                               MGMT_STATUS_REJECTED);
5845                         goto unlock;
5846                 }
5847         }
5848
5849         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5850                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5851                                       MGMT_STATUS_BUSY);
5852                 goto unlock;
5853         }
5854
5855         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5856         if (!cmd) {
5857                 err = -ENOMEM;
5858                 goto unlock;
5859         }
5860
5861         /* We need to flip the bit already here so that
5862          * hci_req_update_adv_data generates the correct flags.
5863          */
5864         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5865
5866         hci_req_init(&req, hdev);
5867
5868         __hci_req_write_fast_connectable(&req, false);
5869         __hci_req_update_scan(&req);
5870
5871         /* Since only the advertising data flags will change, there
5872          * is no need to update the scan response data.
5873          */
5874         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
5875
5876         err = hci_req_run(&req, set_bredr_complete);
5877         if (err < 0)
5878                 mgmt_pending_remove(cmd);
5879
5880 unlock:
5881         hci_dev_unlock(hdev);
5882         return err;
5883 }
5884
5885 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5886 {
5887         struct mgmt_pending_cmd *cmd;
5888         struct mgmt_mode *cp;
5889
5890         bt_dev_dbg(hdev, "status %u", status);
5891
5892         hci_dev_lock(hdev);
5893
5894         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5895         if (!cmd)
5896                 goto unlock;
5897
5898         if (status) {
5899                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5900                                 mgmt_status(status));
5901                 goto remove;
5902         }
5903
5904         cp = cmd->param;
5905
5906         switch (cp->val) {
5907         case 0x00:
5908                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5909                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5910                 break;
5911         case 0x01:
5912                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5913                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5914                 break;
5915         case 0x02:
5916                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5917                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5918                 break;
5919         }
5920
5921         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5922         new_settings(hdev, cmd->sk);
5923
5924 remove:
5925         mgmt_pending_remove(cmd);
5926 unlock:
5927         hci_dev_unlock(hdev);
5928 }
5929
5930 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5931                            void *data, u16 len)
5932 {
5933         struct mgmt_mode *cp = data;
5934         struct mgmt_pending_cmd *cmd;
5935         struct hci_request req;
5936         u8 val;
5937         int err;
5938
5939         bt_dev_dbg(hdev, "sock %p", sk);
5940
5941         if (!lmp_sc_capable(hdev) &&
5942             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5943                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5944                                        MGMT_STATUS_NOT_SUPPORTED);
5945
5946         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5947             lmp_sc_capable(hdev) &&
5948             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5949                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5950                                        MGMT_STATUS_REJECTED);
5951
5952         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5953                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5954                                   MGMT_STATUS_INVALID_PARAMS);
5955
5956         hci_dev_lock(hdev);
5957
5958         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5959             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5960                 bool changed;
5961
5962                 if (cp->val) {
5963                         changed = !hci_dev_test_and_set_flag(hdev,
5964                                                              HCI_SC_ENABLED);
5965                         if (cp->val == 0x02)
5966                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5967                         else
5968                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5969                 } else {
5970                         changed = hci_dev_test_and_clear_flag(hdev,
5971                                                               HCI_SC_ENABLED);
5972                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5973                 }
5974
5975                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5976                 if (err < 0)
5977                         goto failed;
5978
5979                 if (changed)
5980                         err = new_settings(hdev, sk);
5981
5982                 goto failed;
5983         }
5984
5985         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5986                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5987                                       MGMT_STATUS_BUSY);
5988                 goto failed;
5989         }
5990
5991         val = !!cp->val;
5992
5993         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5994             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5995                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5996                 goto failed;
5997         }
5998
5999         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
6000         if (!cmd) {
6001                 err = -ENOMEM;
6002                 goto failed;
6003         }
6004
6005         hci_req_init(&req, hdev);
6006         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
6007         err = hci_req_run(&req, sc_enable_complete);
6008         if (err < 0) {
6009                 mgmt_pending_remove(cmd);
6010                 goto failed;
6011         }
6012
6013 failed:
6014         hci_dev_unlock(hdev);
6015         return err;
6016 }
6017
6018 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
6019                           void *data, u16 len)
6020 {
6021         struct mgmt_mode *cp = data;
6022         bool changed, use_changed;
6023         int err;
6024
6025         bt_dev_dbg(hdev, "sock %p", sk);
6026
6027         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6028                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
6029                                        MGMT_STATUS_INVALID_PARAMS);
6030
6031         hci_dev_lock(hdev);
6032
6033         if (cp->val)
6034                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6035         else
6036                 changed = hci_dev_test_and_clear_flag(hdev,
6037                                                       HCI_KEEP_DEBUG_KEYS);
6038
6039         if (cp->val == 0x02)
6040                 use_changed = !hci_dev_test_and_set_flag(hdev,
6041                                                          HCI_USE_DEBUG_KEYS);
6042         else
6043                 use_changed = hci_dev_test_and_clear_flag(hdev,
6044                                                           HCI_USE_DEBUG_KEYS);
6045
6046         if (hdev_is_powered(hdev) && use_changed &&
6047             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6048                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6049                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6050                              sizeof(mode), &mode);
6051         }
6052
6053         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
6054         if (err < 0)
6055                 goto unlock;
6056
6057         if (changed)
6058                 err = new_settings(hdev, sk);
6059
6060 unlock:
6061         hci_dev_unlock(hdev);
6062         return err;
6063 }
6064
6065 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6066                        u16 len)
6067 {
6068         struct mgmt_cp_set_privacy *cp = cp_data;
6069         bool changed;
6070         int err;
6071
6072         bt_dev_dbg(hdev, "sock %p", sk);
6073
6074         if (!lmp_le_capable(hdev))
6075                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6076                                        MGMT_STATUS_NOT_SUPPORTED);
6077
6078         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
6079                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6080                                        MGMT_STATUS_INVALID_PARAMS);
6081
6082         if (hdev_is_powered(hdev))
6083                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6084                                        MGMT_STATUS_REJECTED);
6085
6086         hci_dev_lock(hdev);
6087
6088         /* If user space supports this command it is also expected to
6089          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
6090          */
6091         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6092
6093         if (cp->privacy) {
6094                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
6095                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
6096                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
6097                 hci_adv_instances_set_rpa_expired(hdev, true);
6098                 if (cp->privacy == 0x02)
6099                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
6100                 else
6101                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6102         } else {
6103                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
6104                 memset(hdev->irk, 0, sizeof(hdev->irk));
6105                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
6106                 hci_adv_instances_set_rpa_expired(hdev, false);
6107                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6108         }
6109
6110         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
6111         if (err < 0)
6112                 goto unlock;
6113
6114         if (changed)
6115                 err = new_settings(hdev, sk);
6116
6117 unlock:
6118         hci_dev_unlock(hdev);
6119         return err;
6120 }
6121
6122 static bool irk_is_valid(struct mgmt_irk_info *irk)
6123 {
6124         switch (irk->addr.type) {
6125         case BDADDR_LE_PUBLIC:
6126                 return true;
6127
6128         case BDADDR_LE_RANDOM:
6129                 /* Two most significant bits shall be set */
6130                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6131                         return false;
6132                 return true;
6133         }
6134
6135         return false;
6136 }
6137
6138 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6139                      u16 len)
6140 {
6141         struct mgmt_cp_load_irks *cp = cp_data;
6142         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
6143                                    sizeof(struct mgmt_irk_info));
6144         u16 irk_count, expected_len;
6145         int i, err;
6146
6147         bt_dev_dbg(hdev, "sock %p", sk);
6148
6149         if (!lmp_le_capable(hdev))
6150                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6151                                        MGMT_STATUS_NOT_SUPPORTED);
6152
6153         irk_count = __le16_to_cpu(cp->irk_count);
6154         if (irk_count > max_irk_count) {
6155                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
6156                            irk_count);
6157                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6158                                        MGMT_STATUS_INVALID_PARAMS);
6159         }
6160
6161         expected_len = struct_size(cp, irks, irk_count);
6162         if (expected_len != len) {
6163                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
6164                            expected_len, len);
6165                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6166                                        MGMT_STATUS_INVALID_PARAMS);
6167         }
6168
6169         bt_dev_dbg(hdev, "irk_count %u", irk_count);
6170
6171         for (i = 0; i < irk_count; i++) {
6172                 struct mgmt_irk_info *key = &cp->irks[i];
6173
6174                 if (!irk_is_valid(key))
6175                         return mgmt_cmd_status(sk, hdev->id,
6176                                                MGMT_OP_LOAD_IRKS,
6177                                                MGMT_STATUS_INVALID_PARAMS);
6178         }
6179
6180         hci_dev_lock(hdev);
6181
6182         hci_smp_irks_clear(hdev);
6183
6184         for (i = 0; i < irk_count; i++) {
6185                 struct mgmt_irk_info *irk = &cp->irks[i];
6186
6187                 if (hci_is_blocked_key(hdev,
6188                                        HCI_BLOCKED_KEY_TYPE_IRK,
6189                                        irk->val)) {
6190                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
6191                                     &irk->addr.bdaddr);
6192                         continue;
6193                 }
6194
6195                 hci_add_irk(hdev, &irk->addr.bdaddr,
6196                             le_addr_type(irk->addr.type), irk->val,
6197                             BDADDR_ANY);
6198         }
6199
6200         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6201
6202         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
6203
6204         hci_dev_unlock(hdev);
6205
6206         return err;
6207 }
6208
6209 #ifdef TIZEN_BT
6210 static int set_advertising_params(struct sock *sk, struct hci_dev *hdev,
6211                         void *data, u16 len)
6212 {
6213         struct mgmt_cp_set_advertising_params *cp = data;
6214         __u16 min_interval;
6215         __u16 max_interval;
6216         int err;
6217
6218         BT_DBG("%s", hdev->name);
6219
6220         if (!lmp_le_capable(hdev))
6221                 return mgmt_cmd_status(sk, hdev->id,
6222                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6223                                 MGMT_STATUS_NOT_SUPPORTED);
6224
6225         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6226                 return mgmt_cmd_status(sk, hdev->id,
6227                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6228                                 MGMT_STATUS_BUSY);
6229
6230         min_interval = __le16_to_cpu(cp->interval_min);
6231         max_interval = __le16_to_cpu(cp->interval_max);
6232
6233         if (min_interval > max_interval ||
6234             min_interval < 0x0020 || max_interval > 0x4000)
6235                 return mgmt_cmd_status(sk, hdev->id,
6236                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6237                                 MGMT_STATUS_INVALID_PARAMS);
6238
6239         hci_dev_lock(hdev);
6240
6241         hdev->le_adv_min_interval = min_interval;
6242         hdev->le_adv_max_interval = max_interval;
6243         hdev->adv_filter_policy = cp->filter_policy;
6244         hdev->adv_type = cp->type;
6245
6246         err = mgmt_cmd_complete(sk, hdev->id,
6247                         MGMT_OP_SET_ADVERTISING_PARAMS, 0, NULL, 0);
6248
6249         hci_dev_unlock(hdev);
6250
6251         return err;
6252 }
6253
6254 static void set_advertising_data_complete(struct hci_dev *hdev,
6255                         u8 status, u16 opcode)
6256 {
6257         struct mgmt_cp_set_advertising_data *cp;
6258         struct mgmt_pending_cmd *cmd;
6259
6260         BT_DBG("status 0x%02x", status);
6261
6262         hci_dev_lock(hdev);
6263
6264         cmd = pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev);
6265         if (!cmd)
6266                 goto unlock;
6267
6268         cp = cmd->param;
6269
6270         if (status)
6271                 mgmt_cmd_status(cmd->sk, hdev->id,
6272                                 MGMT_OP_SET_ADVERTISING_DATA,
6273                                 mgmt_status(status));
6274         else
6275                 mgmt_cmd_complete(cmd->sk, hdev->id,
6276                                 MGMT_OP_SET_ADVERTISING_DATA, 0,
6277                                 cp, sizeof(*cp));
6278
6279         mgmt_pending_remove(cmd);
6280
6281 unlock:
6282         hci_dev_unlock(hdev);
6283 }
6284
6285 static int set_advertising_data(struct sock *sk, struct hci_dev *hdev,
6286                         void *data, u16 len)
6287 {
6288         struct mgmt_pending_cmd *cmd;
6289         struct hci_request req;
6290         struct mgmt_cp_set_advertising_data *cp = data;
6291         struct hci_cp_le_set_adv_data adv;
6292         int err;
6293
6294         BT_DBG("%s", hdev->name);
6295
6296         if (!lmp_le_capable(hdev)) {
6297                 return mgmt_cmd_status(sk, hdev->id,
6298                                 MGMT_OP_SET_ADVERTISING_DATA,
6299                                 MGMT_STATUS_NOT_SUPPORTED);
6300         }
6301
6302         hci_dev_lock(hdev);
6303
6304         if (pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev)) {
6305                 err = mgmt_cmd_status(sk, hdev->id,
6306                                 MGMT_OP_SET_ADVERTISING_DATA,
6307                                 MGMT_STATUS_BUSY);
6308                 goto unlocked;
6309         }
6310
6311         if (len > HCI_MAX_AD_LENGTH) {
6312                 err = mgmt_cmd_status(sk, hdev->id,
6313                                 MGMT_OP_SET_ADVERTISING_DATA,
6314                                 MGMT_STATUS_INVALID_PARAMS);
6315                 goto unlocked;
6316         }
6317
6318         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING_DATA,
6319                                hdev, data, len);
6320         if (!cmd) {
6321                 err = -ENOMEM;
6322                 goto unlocked;
6323         }
6324
6325         hci_req_init(&req, hdev);
6326
6327         memset(&adv, 0, sizeof(adv));
6328         memcpy(adv.data, cp->data, len);
6329         adv.length = len;
6330
6331         hci_req_add(&req, HCI_OP_LE_SET_ADV_DATA, sizeof(adv), &adv);
6332
6333         err = hci_req_run(&req, set_advertising_data_complete);
6334         if (err < 0)
6335                 mgmt_pending_remove(cmd);
6336
6337 unlocked:
6338         hci_dev_unlock(hdev);
6339
6340         return err;
6341 }
6342
6343 static void set_scan_rsp_data_complete(struct hci_dev *hdev, u8 status,
6344                         u16 opcode)
6345 {
6346         struct mgmt_cp_set_scan_rsp_data *cp;
6347         struct mgmt_pending_cmd *cmd;
6348
6349         BT_DBG("status 0x%02x", status);
6350
6351         hci_dev_lock(hdev);
6352
6353         cmd = pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev);
6354         if (!cmd)
6355                 goto unlock;
6356
6357         cp = cmd->param;
6358
6359         if (status)
6360                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6361                                 mgmt_status(status));
6362         else
6363                 mgmt_cmd_complete(cmd->sk, hdev->id,
6364                                 MGMT_OP_SET_SCAN_RSP_DATA, 0,
6365                                 cp, sizeof(*cp));
6366
6367         mgmt_pending_remove(cmd);
6368
6369 unlock:
6370         hci_dev_unlock(hdev);
6371 }
6372
6373 static int set_scan_rsp_data(struct sock *sk, struct hci_dev *hdev, void *data,
6374                         u16 len)
6375 {
6376         struct mgmt_pending_cmd *cmd;
6377         struct hci_request req;
6378         struct mgmt_cp_set_scan_rsp_data *cp = data;
6379         struct hci_cp_le_set_scan_rsp_data rsp;
6380         int err;
6381
6382         BT_DBG("%s", hdev->name);
6383
6384         if (!lmp_le_capable(hdev))
6385                 return mgmt_cmd_status(sk, hdev->id,
6386                                 MGMT_OP_SET_SCAN_RSP_DATA,
6387                                 MGMT_STATUS_NOT_SUPPORTED);
6388
6389         hci_dev_lock(hdev);
6390
6391         if (pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev)) {
6392                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6393                                 MGMT_STATUS_BUSY);
6394                 goto unlocked;
6395         }
6396
6397         if (len > HCI_MAX_AD_LENGTH) {
6398                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6399                                 MGMT_STATUS_INVALID_PARAMS);
6400                 goto unlocked;
6401         }
6402
6403         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SCAN_RSP_DATA, hdev, data, len);
6404         if (!cmd) {
6405                 err = -ENOMEM;
6406                 goto unlocked;
6407         }
6408
6409         hci_req_init(&req, hdev);
6410
6411         memset(&rsp, 0, sizeof(rsp));
6412         memcpy(rsp.data, cp->data, len);
6413         rsp.length = len;
6414
6415         hci_req_add(&req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(rsp), &rsp);
6416
6417         err = hci_req_run(&req, set_scan_rsp_data_complete);
6418         if (err < 0)
6419                 mgmt_pending_remove(cmd);
6420
6421 unlocked:
6422         hci_dev_unlock(hdev);
6423
6424         return err;
6425 }
6426
6427 /* Adv White List feature */
6428 static void add_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6429 {
6430         struct mgmt_cp_add_dev_white_list *cp;
6431         struct mgmt_pending_cmd *cmd;
6432
6433         BT_DBG("status 0x%02x", status);
6434
6435         hci_dev_lock(hdev);
6436
6437         cmd = pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev);
6438         if (!cmd)
6439                 goto unlock;
6440
6441         cp = cmd->param;
6442
6443         if (status)
6444                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6445                            mgmt_status(status));
6446         else
6447                 mgmt_cmd_complete(cmd->sk, hdev->id,
6448                                 MGMT_OP_ADD_DEV_WHITE_LIST, 0, cp, sizeof(*cp));
6449
6450         mgmt_pending_remove(cmd);
6451
6452 unlock:
6453         hci_dev_unlock(hdev);
6454 }
6455
6456 static int add_white_list(struct sock *sk, struct hci_dev *hdev,
6457                            void *data, u16 len)
6458 {
6459         struct mgmt_pending_cmd *cmd;
6460         struct mgmt_cp_add_dev_white_list *cp = data;
6461         struct hci_request req;
6462         int err;
6463
6464         BT_DBG("%s", hdev->name);
6465
6466         if (!lmp_le_capable(hdev))
6467                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6468                                   MGMT_STATUS_NOT_SUPPORTED);
6469
6470         if (!hdev_is_powered(hdev))
6471                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6472                                   MGMT_STATUS_REJECTED);
6473
6474         hci_dev_lock(hdev);
6475
6476         if (pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev)) {
6477                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6478                                 MGMT_STATUS_BUSY);
6479                 goto unlocked;
6480         }
6481
6482         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEV_WHITE_LIST, hdev, data, len);
6483         if (!cmd) {
6484                 err = -ENOMEM;
6485                 goto unlocked;
6486         }
6487
6488         hci_req_init(&req, hdev);
6489
6490         hci_req_add(&req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(*cp), cp);
6491
6492         err = hci_req_run(&req, add_white_list_complete);
6493         if (err < 0) {
6494                 mgmt_pending_remove(cmd);
6495                 goto unlocked;
6496         }
6497
6498 unlocked:
6499         hci_dev_unlock(hdev);
6500
6501         return err;
6502 }
6503
6504 static void remove_from_white_list_complete(struct hci_dev *hdev,
6505                         u8 status, u16 opcode)
6506 {
6507         struct mgmt_cp_remove_dev_from_white_list *cp;
6508         struct mgmt_pending_cmd *cmd;
6509
6510         BT_DBG("status 0x%02x", status);
6511
6512         hci_dev_lock(hdev);
6513
6514         cmd = pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev);
6515         if (!cmd)
6516                 goto unlock;
6517
6518         cp = cmd->param;
6519
6520         if (status)
6521                 mgmt_cmd_status(cmd->sk, hdev->id,
6522                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6523                         mgmt_status(status));
6524         else
6525                 mgmt_cmd_complete(cmd->sk, hdev->id,
6526                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, 0,
6527                         cp, sizeof(*cp));
6528
6529         mgmt_pending_remove(cmd);
6530
6531 unlock:
6532         hci_dev_unlock(hdev);
6533 }
6534
6535 static int remove_from_white_list(struct sock *sk, struct hci_dev *hdev,
6536                            void *data, u16 len)
6537 {
6538         struct mgmt_pending_cmd *cmd;
6539         struct mgmt_cp_remove_dev_from_white_list *cp = data;
6540         struct hci_request req;
6541         int err;
6542
6543         BT_DBG("%s", hdev->name);
6544
6545         if (!lmp_le_capable(hdev))
6546                 return mgmt_cmd_status(sk, hdev->id,
6547                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6548                                 MGMT_STATUS_NOT_SUPPORTED);
6549
6550         if (!hdev_is_powered(hdev))
6551                 return mgmt_cmd_status(sk, hdev->id,
6552                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6553                                 MGMT_STATUS_REJECTED);
6554
6555         hci_dev_lock(hdev);
6556
6557         if (pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev)) {
6558                 err = mgmt_cmd_status(sk, hdev->id,
6559                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6560                                 MGMT_STATUS_BUSY);
6561                 goto unlocked;
6562         }
6563
6564         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6565                                 hdev, data, len);
6566         if (!cmd) {
6567                 err = -ENOMEM;
6568                 goto unlocked;
6569         }
6570
6571         hci_req_init(&req, hdev);
6572
6573         hci_req_add(&req, HCI_OP_LE_DEL_FROM_WHITE_LIST, sizeof(*cp), cp);
6574
6575         err = hci_req_run(&req, remove_from_white_list_complete);
6576         if (err < 0) {
6577                 mgmt_pending_remove(cmd);
6578                 goto unlocked;
6579         }
6580
6581 unlocked:
6582         hci_dev_unlock(hdev);
6583
6584         return err;
6585 }
6586
6587 static void clear_white_list_complete(struct hci_dev *hdev, u8 status,
6588                         u16 opcode)
6589 {
6590         struct mgmt_pending_cmd *cmd;
6591
6592         BT_DBG("status 0x%02x", status);
6593
6594         hci_dev_lock(hdev);
6595
6596         cmd = pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev);
6597         if (!cmd)
6598                 goto unlock;
6599
6600         if (status)
6601                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
6602                            mgmt_status(status));
6603         else
6604                 mgmt_cmd_complete(cmd->sk, hdev->id,
6605                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6606                                 0, NULL, 0);
6607
6608         mgmt_pending_remove(cmd);
6609
6610 unlock:
6611         hci_dev_unlock(hdev);
6612 }
6613
6614 static int clear_white_list(struct sock *sk, struct hci_dev *hdev,
6615                            void *data, u16 len)
6616 {
6617         struct mgmt_pending_cmd *cmd;
6618         struct hci_request req;
6619         int err;
6620
6621         BT_DBG("%s", hdev->name);
6622
6623         if (!lmp_le_capable(hdev))
6624                 return mgmt_cmd_status(sk, hdev->id,
6625                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6626                                 MGMT_STATUS_NOT_SUPPORTED);
6627
6628         if (!hdev_is_powered(hdev))
6629                 return mgmt_cmd_status(sk, hdev->id,
6630                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6631                                 MGMT_STATUS_REJECTED);
6632
6633         hci_dev_lock(hdev);
6634
6635         if (pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev)) {
6636                 err = mgmt_cmd_status(sk, hdev->id,
6637                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6638                                 MGMT_STATUS_BUSY);
6639                 goto unlocked;
6640         }
6641
6642         cmd = mgmt_pending_add(sk, MGMT_OP_CLEAR_DEV_WHITE_LIST,
6643                                 hdev, NULL, 0);
6644         if (!cmd) {
6645                 err = -ENOMEM;
6646                 goto unlocked;
6647         }
6648
6649         hci_req_init(&req, hdev);
6650
6651         hci_req_add(&req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
6652
6653         err = hci_req_run(&req, clear_white_list_complete);
6654         if (err < 0) {
6655                 mgmt_pending_remove(cmd);
6656                 goto unlocked;
6657         }
6658
6659 unlocked:
6660         hci_dev_unlock(hdev);
6661
6662         return err;
6663 }
6664
6665 static void set_rssi_threshold_complete(struct hci_dev *hdev,
6666                         u8 status, u16 opcode)
6667 {
6668         struct mgmt_pending_cmd *cmd;
6669
6670         BT_DBG("status 0x%02x", status);
6671
6672         hci_dev_lock(hdev);
6673
6674         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6675         if (!cmd)
6676                 goto unlock;
6677
6678         if (status)
6679                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6680                                 mgmt_status(status));
6681         else
6682                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
6683                                 NULL, 0);
6684
6685         mgmt_pending_remove(cmd);
6686
6687 unlock:
6688         hci_dev_unlock(hdev);
6689 }
6690
6691 static void set_rssi_disable_complete(struct hci_dev *hdev,
6692                         u8 status, u16 opcode)
6693 {
6694         struct mgmt_pending_cmd *cmd;
6695
6696         BT_DBG("status 0x%02x", status);
6697
6698         hci_dev_lock(hdev);
6699
6700         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6701         if (!cmd)
6702                 goto unlock;
6703
6704         if (status)
6705                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6706                                 mgmt_status(status));
6707         else
6708                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6709                                 0, NULL, 0);
6710
6711         mgmt_pending_remove(cmd);
6712
6713 unlock:
6714         hci_dev_unlock(hdev);
6715 }
6716
6717 int mgmt_set_rssi_threshold(struct sock *sk, struct hci_dev *hdev,
6718                 void *data, u16 len)
6719 {
6720         int err = 0;
6721         struct hci_cp_set_rssi_threshold th = { 0, };
6722         struct mgmt_cp_set_enable_rssi *cp = data;
6723         struct hci_conn *conn;
6724         struct mgmt_pending_cmd *cmd;
6725         struct hci_request req;
6726         __u8 dest_type;
6727
6728         hci_dev_lock(hdev);
6729
6730         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6731         if (!cmd) {
6732                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6733                                 MGMT_STATUS_FAILED);
6734                 goto unlocked;
6735         }
6736
6737         if (!lmp_le_capable(hdev)) {
6738                 mgmt_pending_remove(cmd);
6739                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6740                                 MGMT_STATUS_NOT_SUPPORTED);
6741                 goto unlocked;
6742         }
6743
6744         if (!hdev_is_powered(hdev)) {
6745                 BT_DBG("%s", hdev->name);
6746                 mgmt_pending_remove(cmd);
6747                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6748                                 MGMT_STATUS_NOT_POWERED);
6749                 goto unlocked;
6750         }
6751
6752         if (cp->link_type == 0x01)
6753                 dest_type = LE_LINK;
6754         else
6755                 dest_type = ACL_LINK;
6756
6757         /* Get LE/ACL link handle info */
6758         conn = hci_conn_hash_lookup_ba(hdev,
6759                         dest_type, &cp->bdaddr);
6760
6761         if (!conn) {
6762                 err = mgmt_cmd_complete(sk, hdev->id,
6763                                 MGMT_OP_SET_RSSI_ENABLE, 1, NULL, 0);
6764                 mgmt_pending_remove(cmd);
6765                 goto unlocked;
6766         }
6767
6768         hci_req_init(&req, hdev);
6769
6770         th.hci_le_ext_opcode = 0x0B;
6771         th.mode = 0x01;
6772         th.conn_handle = conn->handle;
6773         th.alert_mask = 0x07;
6774         th.low_th = cp->low_th;
6775         th.in_range_th = cp->in_range_th;
6776         th.high_th = cp->high_th;
6777
6778         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
6779         err = hci_req_run(&req, set_rssi_threshold_complete);
6780
6781         if (err < 0) {
6782                 mgmt_pending_remove(cmd);
6783                 BT_ERR("Error in requesting hci_req_run");
6784                 goto unlocked;
6785         }
6786
6787 unlocked:
6788         hci_dev_unlock(hdev);
6789         return err;
6790 }
6791
6792 void mgmt_rssi_enable_success(struct sock *sk, struct hci_dev *hdev,
6793                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6794 {
6795         struct mgmt_cc_rsp_enable_rssi mgmt_rp = { 0, };
6796         struct mgmt_cp_set_enable_rssi *cp = data;
6797         struct mgmt_pending_cmd *cmd;
6798
6799         if (!cp || !rp)
6800                 goto remove_cmd;
6801
6802         mgmt_rp.status = rp->status;
6803         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6804         mgmt_rp.bt_address = cp->bdaddr;
6805         mgmt_rp.link_type = cp->link_type;
6806
6807         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6808                         MGMT_STATUS_SUCCESS, &mgmt_rp,
6809                         sizeof(struct mgmt_cc_rsp_enable_rssi));
6810
6811         mgmt_event(MGMT_EV_RSSI_ENABLED, hdev, &mgmt_rp,
6812                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6813
6814         hci_conn_rssi_unset_all(hdev, mgmt_rp.link_type);
6815         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6816                         &mgmt_rp.bt_address, true);
6817
6818 remove_cmd:
6819         hci_dev_lock(hdev);
6820         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6821         if (cmd)
6822                 mgmt_pending_remove(cmd);
6823
6824         hci_dev_unlock(hdev);
6825 }
6826
6827 void mgmt_rssi_disable_success(struct sock *sk, struct hci_dev *hdev,
6828                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6829 {
6830         struct mgmt_cc_rp_disable_rssi mgmt_rp = { 0, };
6831         struct mgmt_cp_disable_rssi *cp = data;
6832         struct mgmt_pending_cmd *cmd;
6833
6834         if (!cp || !rp)
6835                 goto remove_cmd;
6836
6837         mgmt_rp.status = rp->status;
6838         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6839         mgmt_rp.bt_address = cp->bdaddr;
6840         mgmt_rp.link_type = cp->link_type;
6841
6842         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6843                         MGMT_STATUS_SUCCESS, &mgmt_rp,
6844                         sizeof(struct mgmt_cc_rsp_enable_rssi));
6845
6846         mgmt_event(MGMT_EV_RSSI_DISABLED, hdev, &mgmt_rp,
6847                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6848
6849         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6850                         &mgmt_rp.bt_address, false);
6851
6852 remove_cmd:
6853         hci_dev_lock(hdev);
6854         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6855         if (cmd)
6856                 mgmt_pending_remove(cmd);
6857
6858         hci_dev_unlock(hdev);
6859 }
6860
6861 static int mgmt_set_disable_rssi(struct sock *sk, struct hci_dev *hdev,
6862                 void *data, u16 len)
6863 {
6864         struct mgmt_pending_cmd *cmd;
6865         struct hci_request req;
6866         struct hci_cp_set_enable_rssi cp_en = { 0, };
6867         int err;
6868
6869         BT_DBG("Set Disable RSSI.");
6870
6871         cp_en.hci_le_ext_opcode = 0x01;
6872         cp_en.le_enable_cs_Features = 0x00;
6873         cp_en.data[0] = 0x00;
6874         cp_en.data[1] = 0x00;
6875         cp_en.data[2] = 0x00;
6876
6877         hci_dev_lock(hdev);
6878
6879         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6880         if (!cmd) {
6881                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6882                                 MGMT_STATUS_FAILED);
6883                 goto unlocked;
6884         }
6885
6886         if (!lmp_le_capable(hdev)) {
6887                 mgmt_pending_remove(cmd);
6888                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6889                                 MGMT_STATUS_NOT_SUPPORTED);
6890                 goto unlocked;
6891         }
6892
6893         if (!hdev_is_powered(hdev)) {
6894                 BT_DBG("%s", hdev->name);
6895                 mgmt_pending_remove(cmd);
6896                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6897                                 MGMT_STATUS_NOT_POWERED);
6898                 goto unlocked;
6899         }
6900
6901         hci_req_init(&req, hdev);
6902
6903         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
6904                         sizeof(struct hci_cp_set_enable_rssi),
6905                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
6906                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
6907
6908         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
6909         err = hci_req_run(&req, set_rssi_disable_complete);
6910
6911         if (err < 0) {
6912                 mgmt_pending_remove(cmd);
6913                 BT_ERR("Error in requesting hci_req_run");
6914                 goto unlocked;
6915         }
6916
6917 unlocked:
6918         hci_dev_unlock(hdev);
6919         return err;
6920 }
6921
6922 void mgmt_enable_rssi_cc(struct hci_dev *hdev, void *response, u8 status)
6923 {
6924         struct hci_cc_rsp_enable_rssi *rp = response;
6925         struct mgmt_pending_cmd *cmd_enable = NULL;
6926         struct mgmt_pending_cmd *cmd_disable = NULL;
6927         struct mgmt_cp_set_enable_rssi *cp_en;
6928         struct mgmt_cp_disable_rssi *cp_dis;
6929
6930         hci_dev_lock(hdev);
6931         cmd_enable = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6932         cmd_disable = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6933         hci_dev_unlock(hdev);
6934
6935         if (cmd_enable)
6936                 BT_DBG("Enable Request");
6937
6938         if (cmd_disable)
6939                 BT_DBG("Disable Request");
6940
6941         if (cmd_enable) {
6942                 cp_en = cmd_enable->param;
6943
6944                 if (status != 0x00)
6945                         return;
6946
6947                 switch (rp->le_ext_opcode) {
6948                 case 0x01:
6949                         BT_DBG("RSSI enabled.. Setting Threshold...");
6950                         mgmt_set_rssi_threshold(cmd_enable->sk, hdev,
6951                                         cp_en, sizeof(*cp_en));
6952                         break;
6953
6954                 case 0x0B:
6955                         BT_DBG("Sending RSSI enable success");
6956                         mgmt_rssi_enable_success(cmd_enable->sk, hdev,
6957                                         cp_en, rp, rp->status);
6958                         break;
6959                 }
6960
6961         } else if (cmd_disable) {
6962                 cp_dis = cmd_disable->param;
6963
6964                 if (status != 0x00)
6965                         return;
6966
6967                 switch (rp->le_ext_opcode) {
6968                 case 0x01:
6969                         BT_DBG("Sending RSSI disable success");
6970                         mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6971                                         cp_dis, rp, rp->status);
6972                         break;
6973
6974                 case 0x0B:
6975                         /*
6976                          * Only unset RSSI Threshold values for the Link if
6977                          * RSSI is monitored for other BREDR or LE Links
6978                          */
6979                         if (hci_conn_hash_lookup_rssi_count(hdev) > 1) {
6980                                 BT_DBG("Unset Threshold. Other links being monitored");
6981                                 mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6982                                                 cp_dis, rp, rp->status);
6983                         } else {
6984                                 BT_DBG("Unset Threshold. Disabling...");
6985                                 mgmt_set_disable_rssi(cmd_disable->sk, hdev,
6986                                                 cp_dis, sizeof(*cp_dis));
6987                         }
6988                         break;
6989                 }
6990         }
6991 }
6992
6993 static void set_rssi_enable_complete(struct hci_dev *hdev, u8 status,
6994                 u16 opcode)
6995 {
6996         struct mgmt_pending_cmd *cmd;
6997
6998         BT_DBG("status 0x%02x", status);
6999
7000         hci_dev_lock(hdev);
7001
7002         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7003         if (!cmd)
7004                 goto unlock;
7005
7006         if (status)
7007                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7008                                 mgmt_status(status));
7009         else
7010                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
7011                                 NULL, 0);
7012
7013         mgmt_pending_remove(cmd);
7014
7015 unlock:
7016         hci_dev_unlock(hdev);
7017 }
7018
7019 static int set_enable_rssi(struct sock *sk, struct hci_dev *hdev,
7020                 void *data, u16 len)
7021 {
7022         struct mgmt_pending_cmd *cmd;
7023         struct hci_request req;
7024         struct mgmt_cp_set_enable_rssi *cp = data;
7025         struct hci_cp_set_enable_rssi cp_en = { 0, };
7026         int err;
7027
7028         BT_DBG("Set Enable RSSI.");
7029
7030         cp_en.hci_le_ext_opcode = 0x01;
7031         cp_en.le_enable_cs_Features = 0x04;
7032         cp_en.data[0] = 0x00;
7033         cp_en.data[1] = 0x00;
7034         cp_en.data[2] = 0x00;
7035
7036         hci_dev_lock(hdev);
7037
7038         if (!lmp_le_capable(hdev)) {
7039                 err =  mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7040                                 MGMT_STATUS_NOT_SUPPORTED);
7041                 goto unlocked;
7042         }
7043
7044         if (!hdev_is_powered(hdev)) {
7045                 BT_DBG("%s", hdev->name);
7046                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7047                                 MGMT_STATUS_NOT_POWERED);
7048                 goto unlocked;
7049         }
7050
7051         if (pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev)) {
7052                 BT_DBG("%s", hdev->name);
7053                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7054                                 MGMT_STATUS_BUSY);
7055                 goto unlocked;
7056         }
7057
7058         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_ENABLE, hdev, cp,
7059                         sizeof(*cp));
7060         if (!cmd) {
7061                 BT_DBG("%s", hdev->name);
7062                 err = -ENOMEM;
7063                 goto unlocked;
7064         }
7065
7066         /* If RSSI is already enabled directly set Threshold values */
7067         if (hci_conn_hash_lookup_rssi_count(hdev) > 0) {
7068                 hci_dev_unlock(hdev);
7069                 BT_DBG("RSSI Enabled. Directly set Threshold");
7070                 err = mgmt_set_rssi_threshold(sk, hdev, cp, sizeof(*cp));
7071                 return err;
7072         }
7073
7074         hci_req_init(&req, hdev);
7075
7076         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
7077                         sizeof(struct hci_cp_set_enable_rssi),
7078                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
7079                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
7080
7081         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
7082         err = hci_req_run(&req, set_rssi_enable_complete);
7083
7084         if (err < 0) {
7085                 mgmt_pending_remove(cmd);
7086                 BT_ERR("Error in requesting hci_req_run");
7087                 goto unlocked;
7088         }
7089
7090 unlocked:
7091         hci_dev_unlock(hdev);
7092
7093         return err;
7094 }
7095
7096 static void get_raw_rssi_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7097 {
7098         struct mgmt_pending_cmd *cmd;
7099
7100         BT_DBG("status 0x%02x", status);
7101
7102         hci_dev_lock(hdev);
7103
7104         cmd = pending_find(MGMT_OP_GET_RAW_RSSI, hdev);
7105         if (!cmd)
7106                 goto unlock;
7107
7108         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7109                         MGMT_STATUS_SUCCESS, &status, 1);
7110
7111         mgmt_pending_remove(cmd);
7112
7113 unlock:
7114         hci_dev_unlock(hdev);
7115 }
7116
7117 static int get_raw_rssi(struct sock *sk, struct hci_dev *hdev, void *data,
7118                         u16 len)
7119 {
7120         struct mgmt_pending_cmd *cmd;
7121         struct hci_request req;
7122         struct mgmt_cp_get_raw_rssi *cp = data;
7123         struct hci_cp_get_raw_rssi hci_cp;
7124
7125         struct hci_conn *conn;
7126         int err;
7127         __u8 dest_type;
7128
7129         BT_DBG("Get Raw RSSI.");
7130
7131         hci_dev_lock(hdev);
7132
7133         if (!lmp_le_capable(hdev)) {
7134                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7135                                 MGMT_STATUS_NOT_SUPPORTED);
7136                 goto unlocked;
7137         }
7138
7139         if (cp->link_type == 0x01)
7140                 dest_type = LE_LINK;
7141         else
7142                 dest_type = ACL_LINK;
7143
7144         /* Get LE/BREDR link handle info */
7145         conn = hci_conn_hash_lookup_ba(hdev,
7146                         dest_type, &cp->bt_address);
7147         if (!conn) {
7148                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7149                                                    MGMT_STATUS_NOT_CONNECTED);
7150                 goto unlocked;
7151         }
7152         hci_cp.conn_handle = conn->handle;
7153
7154         if (!hdev_is_powered(hdev)) {
7155                 BT_DBG("%s", hdev->name);
7156                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7157                                 MGMT_STATUS_NOT_POWERED);
7158                 goto unlocked;
7159         }
7160
7161         if (pending_find(MGMT_OP_GET_RAW_RSSI, hdev)) {
7162                 BT_DBG("%s", hdev->name);
7163                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7164                                 MGMT_STATUS_BUSY);
7165                 goto unlocked;
7166         }
7167
7168         cmd = mgmt_pending_add(sk, MGMT_OP_GET_RAW_RSSI, hdev, data, len);
7169         if (!cmd) {
7170                 BT_DBG("%s", hdev->name);
7171                 err = -ENOMEM;
7172                 goto unlocked;
7173         }
7174
7175         hci_req_init(&req, hdev);
7176
7177         BT_DBG("Connection Handle [%d]", hci_cp.conn_handle);
7178         hci_req_add(&req, HCI_OP_GET_RAW_RSSI, sizeof(hci_cp), &hci_cp);
7179         err = hci_req_run(&req, get_raw_rssi_complete);
7180
7181         if (err < 0) {
7182                 mgmt_pending_remove(cmd);
7183                 BT_ERR("Error in requesting hci_req_run");
7184         }
7185
7186 unlocked:
7187         hci_dev_unlock(hdev);
7188
7189         return err;
7190 }
7191
7192 void mgmt_raw_rssi_response(struct hci_dev *hdev,
7193                 struct hci_cc_rp_get_raw_rssi *rp, int success)
7194 {
7195         struct mgmt_cc_rp_get_raw_rssi mgmt_rp = { 0, };
7196         struct hci_conn *conn;
7197
7198         mgmt_rp.status = rp->status;
7199         mgmt_rp.rssi_dbm = rp->rssi_dbm;
7200
7201         conn = hci_conn_hash_lookup_handle(hdev, rp->conn_handle);
7202         if (!conn)
7203                 return;
7204
7205         bacpy(&mgmt_rp.bt_address, &conn->dst);
7206         if (conn->type == LE_LINK)
7207                 mgmt_rp.link_type = 0x01;
7208         else
7209                 mgmt_rp.link_type = 0x00;
7210
7211         mgmt_event(MGMT_EV_RAW_RSSI, hdev, &mgmt_rp,
7212                         sizeof(struct mgmt_cc_rp_get_raw_rssi), NULL);
7213 }
7214
7215 static void set_disable_threshold_complete(struct hci_dev *hdev,
7216                         u8 status, u16 opcode)
7217 {
7218         struct mgmt_pending_cmd *cmd;
7219
7220         BT_DBG("status 0x%02x", status);
7221
7222         hci_dev_lock(hdev);
7223
7224         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7225         if (!cmd)
7226                 goto unlock;
7227
7228         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7229                         MGMT_STATUS_SUCCESS, &status, 1);
7230
7231         mgmt_pending_remove(cmd);
7232
7233 unlock:
7234         hci_dev_unlock(hdev);
7235 }
7236
7237 /** Removes monitoring for a link*/
7238 static int set_disable_threshold(struct sock *sk, struct hci_dev *hdev,
7239                 void *data, u16 len)
7240 {
7241         int err = 0;
7242         struct hci_cp_set_rssi_threshold th = { 0, };
7243         struct mgmt_cp_disable_rssi *cp = data;
7244         struct hci_conn *conn;
7245         struct mgmt_pending_cmd *cmd;
7246         struct hci_request req;
7247         __u8 dest_type;
7248
7249         BT_DBG("Set Disable RSSI.");
7250
7251         hci_dev_lock(hdev);
7252
7253         if (!lmp_le_capable(hdev)) {
7254                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7255                                 MGMT_STATUS_NOT_SUPPORTED);
7256                 goto unlocked;
7257         }
7258
7259         /* Get LE/ACL link handle info*/
7260         if (cp->link_type == 0x01)
7261                 dest_type = LE_LINK;
7262         else
7263                 dest_type = ACL_LINK;
7264
7265         conn = hci_conn_hash_lookup_ba(hdev, dest_type, &cp->bdaddr);
7266         if (!conn) {
7267                 err = mgmt_cmd_complete(sk, hdev->id,
7268                                 MGMT_OP_SET_RSSI_DISABLE, 1, NULL, 0);
7269                 goto unlocked;
7270         }
7271
7272         th.hci_le_ext_opcode = 0x0B;
7273         th.mode = 0x01;
7274         th.conn_handle = conn->handle;
7275         th.alert_mask = 0x00;
7276         th.low_th = 0x00;
7277         th.in_range_th = 0x00;
7278         th.high_th = 0x00;
7279
7280         if (!hdev_is_powered(hdev)) {
7281                 BT_DBG("%s", hdev->name);
7282                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7283                                 0, data, len);
7284                 goto unlocked;
7285         }
7286
7287         if (pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev)) {
7288                 BT_DBG("%s", hdev->name);
7289                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7290                                 MGMT_STATUS_BUSY);
7291                 goto unlocked;
7292         }
7293
7294         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_DISABLE, hdev, cp,
7295                         sizeof(*cp));
7296         if (!cmd) {
7297                 BT_DBG("%s", hdev->name);
7298                 err = -ENOMEM;
7299                 goto unlocked;
7300         }
7301
7302         hci_req_init(&req, hdev);
7303
7304         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
7305         err = hci_req_run(&req, set_disable_threshold_complete);
7306         if (err < 0) {
7307                 mgmt_pending_remove(cmd);
7308                 BT_ERR("Error in requesting hci_req_run");
7309                 goto unlocked;
7310         }
7311
7312 unlocked:
7313         hci_dev_unlock(hdev);
7314
7315         return err;
7316 }
7317
7318 void mgmt_rssi_alert_evt(struct hci_dev *hdev, struct sk_buff *skb)
7319 {
7320         struct hci_ev_vendor_specific_rssi_alert *ev = (void *)skb->data;
7321         struct mgmt_ev_vendor_specific_rssi_alert mgmt_ev;
7322         struct hci_conn *conn;
7323
7324         BT_DBG("RSSI alert [%2.2X %2.2X %2.2X]",
7325                         ev->conn_handle, ev->alert_type, ev->rssi_dbm);
7326
7327         conn = hci_conn_hash_lookup_handle(hdev, ev->conn_handle);
7328
7329         if (!conn) {
7330                 BT_ERR("RSSI alert Error: Device not found for handle");
7331                 return;
7332         }
7333         bacpy(&mgmt_ev.bdaddr, &conn->dst);
7334
7335         if (conn->type == LE_LINK)
7336                 mgmt_ev.link_type = 0x01;
7337         else
7338                 mgmt_ev.link_type = 0x00;
7339
7340         mgmt_ev.alert_type = ev->alert_type;
7341         mgmt_ev.rssi_dbm = ev->rssi_dbm;
7342
7343         mgmt_event(MGMT_EV_RSSI_ALERT, hdev, &mgmt_ev,
7344                         sizeof(struct mgmt_ev_vendor_specific_rssi_alert),
7345                         NULL);
7346 }
7347 #endif /* TIZEN_BT */
7348
7349 static bool ltk_is_valid(struct mgmt_ltk_info *key)
7350 {
7351         if (key->initiator != 0x00 && key->initiator != 0x01)
7352                 return false;
7353
7354         switch (key->addr.type) {
7355         case BDADDR_LE_PUBLIC:
7356                 return true;
7357
7358         case BDADDR_LE_RANDOM:
7359                 /* Two most significant bits shall be set */
7360                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7361                         return false;
7362                 return true;
7363         }
7364
7365         return false;
7366 }
7367
7368 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
7369                                void *cp_data, u16 len)
7370 {
7371         struct mgmt_cp_load_long_term_keys *cp = cp_data;
7372         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
7373                                    sizeof(struct mgmt_ltk_info));
7374         u16 key_count, expected_len;
7375         int i, err;
7376
7377         bt_dev_dbg(hdev, "sock %p", sk);
7378
7379         if (!lmp_le_capable(hdev))
7380                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7381                                        MGMT_STATUS_NOT_SUPPORTED);
7382
7383         key_count = __le16_to_cpu(cp->key_count);
7384         if (key_count > max_key_count) {
7385                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
7386                            key_count);
7387                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7388                                        MGMT_STATUS_INVALID_PARAMS);
7389         }
7390
7391         expected_len = struct_size(cp, keys, key_count);
7392         if (expected_len != len) {
7393                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
7394                            expected_len, len);
7395                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7396                                        MGMT_STATUS_INVALID_PARAMS);
7397         }
7398
7399         bt_dev_dbg(hdev, "key_count %u", key_count);
7400
7401         for (i = 0; i < key_count; i++) {
7402                 struct mgmt_ltk_info *key = &cp->keys[i];
7403
7404                 if (!ltk_is_valid(key))
7405                         return mgmt_cmd_status(sk, hdev->id,
7406                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
7407                                                MGMT_STATUS_INVALID_PARAMS);
7408         }
7409
7410         hci_dev_lock(hdev);
7411
7412         hci_smp_ltks_clear(hdev);
7413
7414         for (i = 0; i < key_count; i++) {
7415                 struct mgmt_ltk_info *key = &cp->keys[i];
7416                 u8 type, authenticated;
7417
7418                 if (hci_is_blocked_key(hdev,
7419                                        HCI_BLOCKED_KEY_TYPE_LTK,
7420                                        key->val)) {
7421                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
7422                                     &key->addr.bdaddr);
7423                         continue;
7424                 }
7425
7426                 switch (key->type) {
7427                 case MGMT_LTK_UNAUTHENTICATED:
7428                         authenticated = 0x00;
7429                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
7430                         break;
7431                 case MGMT_LTK_AUTHENTICATED:
7432                         authenticated = 0x01;
7433                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
7434                         break;
7435                 case MGMT_LTK_P256_UNAUTH:
7436                         authenticated = 0x00;
7437                         type = SMP_LTK_P256;
7438                         break;
7439                 case MGMT_LTK_P256_AUTH:
7440                         authenticated = 0x01;
7441                         type = SMP_LTK_P256;
7442                         break;
7443                 case MGMT_LTK_P256_DEBUG:
7444                         authenticated = 0x00;
7445                         type = SMP_LTK_P256_DEBUG;
7446                         fallthrough;
7447                 default:
7448                         continue;
7449                 }
7450
7451                 hci_add_ltk(hdev, &key->addr.bdaddr,
7452                             le_addr_type(key->addr.type), type, authenticated,
7453                             key->val, key->enc_size, key->ediv, key->rand);
7454         }
7455
7456         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
7457                            NULL, 0);
7458
7459         hci_dev_unlock(hdev);
7460
7461         return err;
7462 }
7463
7464 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
7465 {
7466         struct hci_conn *conn = cmd->user_data;
7467         struct mgmt_rp_get_conn_info rp;
7468         int err;
7469
7470         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
7471
7472         if (status == MGMT_STATUS_SUCCESS) {
7473                 rp.rssi = conn->rssi;
7474                 rp.tx_power = conn->tx_power;
7475                 rp.max_tx_power = conn->max_tx_power;
7476         } else {
7477                 rp.rssi = HCI_RSSI_INVALID;
7478                 rp.tx_power = HCI_TX_POWER_INVALID;
7479                 rp.max_tx_power = HCI_TX_POWER_INVALID;
7480         }
7481
7482         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
7483                                 status, &rp, sizeof(rp));
7484
7485         hci_conn_drop(conn);
7486         hci_conn_put(conn);
7487
7488         return err;
7489 }
7490
7491 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
7492                                        u16 opcode)
7493 {
7494         struct hci_cp_read_rssi *cp;
7495         struct mgmt_pending_cmd *cmd;
7496         struct hci_conn *conn;
7497         u16 handle;
7498         u8 status;
7499
7500         bt_dev_dbg(hdev, "status 0x%02x", hci_status);
7501
7502         hci_dev_lock(hdev);
7503
7504         /* Commands sent in request are either Read RSSI or Read Transmit Power
7505          * Level so we check which one was last sent to retrieve connection
7506          * handle.  Both commands have handle as first parameter so it's safe to
7507          * cast data on the same command struct.
7508          *
7509          * First command sent is always Read RSSI and we fail only if it fails.
7510          * In other case we simply override error to indicate success as we
7511          * already remembered if TX power value is actually valid.
7512          */
7513         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
7514         if (!cp) {
7515                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
7516                 status = MGMT_STATUS_SUCCESS;
7517         } else {
7518                 status = mgmt_status(hci_status);
7519         }
7520
7521         if (!cp) {
7522                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
7523                 goto unlock;
7524         }
7525
7526         handle = __le16_to_cpu(cp->handle);
7527         conn = hci_conn_hash_lookup_handle(hdev, handle);
7528         if (!conn) {
7529                 bt_dev_err(hdev, "unknown handle (%u) in conn_info response",
7530                            handle);
7531                 goto unlock;
7532         }
7533
7534         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
7535         if (!cmd)
7536                 goto unlock;
7537
7538         cmd->cmd_complete(cmd, status);
7539         mgmt_pending_remove(cmd);
7540
7541 unlock:
7542         hci_dev_unlock(hdev);
7543 }
7544
7545 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
7546                          u16 len)
7547 {
7548         struct mgmt_cp_get_conn_info *cp = data;
7549         struct mgmt_rp_get_conn_info rp;
7550         struct hci_conn *conn;
7551         unsigned long conn_info_age;
7552         int err = 0;
7553
7554         bt_dev_dbg(hdev, "sock %p", sk);
7555
7556         memset(&rp, 0, sizeof(rp));
7557         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7558         rp.addr.type = cp->addr.type;
7559
7560         if (!bdaddr_type_is_valid(cp->addr.type))
7561                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7562                                          MGMT_STATUS_INVALID_PARAMS,
7563                                          &rp, sizeof(rp));
7564
7565         hci_dev_lock(hdev);
7566
7567         if (!hdev_is_powered(hdev)) {
7568                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7569                                         MGMT_STATUS_NOT_POWERED, &rp,
7570                                         sizeof(rp));
7571                 goto unlock;
7572         }
7573
7574         if (cp->addr.type == BDADDR_BREDR)
7575                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7576                                                &cp->addr.bdaddr);
7577         else
7578                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7579
7580         if (!conn || conn->state != BT_CONNECTED) {
7581                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7582                                         MGMT_STATUS_NOT_CONNECTED, &rp,
7583                                         sizeof(rp));
7584                 goto unlock;
7585         }
7586
7587         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
7588                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7589                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
7590                 goto unlock;
7591         }
7592
7593         /* To avoid client trying to guess when to poll again for information we
7594          * calculate conn info age as random value between min/max set in hdev.
7595          */
7596         conn_info_age = hdev->conn_info_min_age +
7597                         prandom_u32_max(hdev->conn_info_max_age -
7598                                         hdev->conn_info_min_age);
7599
7600         /* Query controller to refresh cached values if they are too old or were
7601          * never read.
7602          */
7603         if (time_after(jiffies, conn->conn_info_timestamp +
7604                        msecs_to_jiffies(conn_info_age)) ||
7605             !conn->conn_info_timestamp) {
7606                 struct hci_request req;
7607                 struct hci_cp_read_tx_power req_txp_cp;
7608                 struct hci_cp_read_rssi req_rssi_cp;
7609                 struct mgmt_pending_cmd *cmd;
7610
7611                 hci_req_init(&req, hdev);
7612                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
7613                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
7614                             &req_rssi_cp);
7615
7616                 /* For LE links TX power does not change thus we don't need to
7617                  * query for it once value is known.
7618                  */
7619                 if (!bdaddr_type_is_le(cp->addr.type) ||
7620                     conn->tx_power == HCI_TX_POWER_INVALID) {
7621                         req_txp_cp.handle = cpu_to_le16(conn->handle);
7622                         req_txp_cp.type = 0x00;
7623                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
7624                                     sizeof(req_txp_cp), &req_txp_cp);
7625                 }
7626
7627                 /* Max TX power needs to be read only once per connection */
7628                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
7629                         req_txp_cp.handle = cpu_to_le16(conn->handle);
7630                         req_txp_cp.type = 0x01;
7631                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
7632                                     sizeof(req_txp_cp), &req_txp_cp);
7633                 }
7634
7635                 err = hci_req_run(&req, conn_info_refresh_complete);
7636                 if (err < 0)
7637                         goto unlock;
7638
7639                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
7640                                        data, len);
7641                 if (!cmd) {
7642                         err = -ENOMEM;
7643                         goto unlock;
7644                 }
7645
7646                 hci_conn_hold(conn);
7647                 cmd->user_data = hci_conn_get(conn);
7648                 cmd->cmd_complete = conn_info_cmd_complete;
7649
7650                 conn->conn_info_timestamp = jiffies;
7651         } else {
7652                 /* Cache is valid, just reply with values cached in hci_conn */
7653                 rp.rssi = conn->rssi;
7654                 rp.tx_power = conn->tx_power;
7655                 rp.max_tx_power = conn->max_tx_power;
7656
7657                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7658                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7659         }
7660
7661 unlock:
7662         hci_dev_unlock(hdev);
7663         return err;
7664 }
7665
7666 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
7667 {
7668         struct hci_conn *conn = cmd->user_data;
7669         struct mgmt_rp_get_clock_info rp;
7670         struct hci_dev *hdev;
7671         int err;
7672
7673         memset(&rp, 0, sizeof(rp));
7674         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
7675
7676         if (status)
7677                 goto complete;
7678
7679         hdev = hci_dev_get(cmd->index);
7680         if (hdev) {
7681                 rp.local_clock = cpu_to_le32(hdev->clock);
7682                 hci_dev_put(hdev);
7683         }
7684
7685         if (conn) {
7686                 rp.piconet_clock = cpu_to_le32(conn->clock);
7687                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
7688         }
7689
7690 complete:
7691         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
7692                                 sizeof(rp));
7693
7694         if (conn) {
7695                 hci_conn_drop(conn);
7696                 hci_conn_put(conn);
7697         }
7698
7699         return err;
7700 }
7701
7702 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7703 {
7704         struct hci_cp_read_clock *hci_cp;
7705         struct mgmt_pending_cmd *cmd;
7706         struct hci_conn *conn;
7707
7708         bt_dev_dbg(hdev, "status %u", status);
7709
7710         hci_dev_lock(hdev);
7711
7712         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
7713         if (!hci_cp)
7714                 goto unlock;
7715
7716         if (hci_cp->which) {
7717                 u16 handle = __le16_to_cpu(hci_cp->handle);
7718                 conn = hci_conn_hash_lookup_handle(hdev, handle);
7719         } else {
7720                 conn = NULL;
7721         }
7722
7723         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
7724         if (!cmd)
7725                 goto unlock;
7726
7727         cmd->cmd_complete(cmd, mgmt_status(status));
7728         mgmt_pending_remove(cmd);
7729
7730 unlock:
7731         hci_dev_unlock(hdev);
7732 }
7733
7734 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
7735                          u16 len)
7736 {
7737         struct mgmt_cp_get_clock_info *cp = data;
7738         struct mgmt_rp_get_clock_info rp;
7739         struct hci_cp_read_clock hci_cp;
7740         struct mgmt_pending_cmd *cmd;
7741         struct hci_request req;
7742         struct hci_conn *conn;
7743         int err;
7744
7745         bt_dev_dbg(hdev, "sock %p", sk);
7746
7747         memset(&rp, 0, sizeof(rp));
7748         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7749         rp.addr.type = cp->addr.type;
7750
7751         if (cp->addr.type != BDADDR_BREDR)
7752                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7753                                          MGMT_STATUS_INVALID_PARAMS,
7754                                          &rp, sizeof(rp));
7755
7756         hci_dev_lock(hdev);
7757
7758         if (!hdev_is_powered(hdev)) {
7759                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7760                                         MGMT_STATUS_NOT_POWERED, &rp,
7761                                         sizeof(rp));
7762                 goto unlock;
7763         }
7764
7765         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7766                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7767                                                &cp->addr.bdaddr);
7768                 if (!conn || conn->state != BT_CONNECTED) {
7769                         err = mgmt_cmd_complete(sk, hdev->id,
7770                                                 MGMT_OP_GET_CLOCK_INFO,
7771                                                 MGMT_STATUS_NOT_CONNECTED,
7772                                                 &rp, sizeof(rp));
7773                         goto unlock;
7774                 }
7775         } else {
7776                 conn = NULL;
7777         }
7778
7779         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
7780         if (!cmd) {
7781                 err = -ENOMEM;
7782                 goto unlock;
7783         }
7784
7785         cmd->cmd_complete = clock_info_cmd_complete;
7786
7787         hci_req_init(&req, hdev);
7788
7789         memset(&hci_cp, 0, sizeof(hci_cp));
7790         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
7791
7792         if (conn) {
7793                 hci_conn_hold(conn);
7794                 cmd->user_data = hci_conn_get(conn);
7795
7796                 hci_cp.handle = cpu_to_le16(conn->handle);
7797                 hci_cp.which = 0x01; /* Piconet clock */
7798                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
7799         }
7800
7801         err = hci_req_run(&req, get_clock_info_complete);
7802         if (err < 0)
7803                 mgmt_pending_remove(cmd);
7804
7805 unlock:
7806         hci_dev_unlock(hdev);
7807         return err;
7808 }
7809
7810 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
7811 {
7812         struct hci_conn *conn;
7813
7814         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
7815         if (!conn)
7816                 return false;
7817
7818         if (conn->dst_type != type)
7819                 return false;
7820
7821         if (conn->state != BT_CONNECTED)
7822                 return false;
7823
7824         return true;
7825 }
7826
7827 /* This function requires the caller holds hdev->lock */
7828 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
7829                                u8 addr_type, u8 auto_connect)
7830 {
7831         struct hci_conn_params *params;
7832
7833         params = hci_conn_params_add(hdev, addr, addr_type);
7834         if (!params)
7835                 return -EIO;
7836
7837         if (params->auto_connect == auto_connect)
7838                 return 0;
7839
7840         list_del_init(&params->action);
7841
7842         switch (auto_connect) {
7843         case HCI_AUTO_CONN_DISABLED:
7844         case HCI_AUTO_CONN_LINK_LOSS:
7845                 /* If auto connect is being disabled when we're trying to
7846                  * connect to device, keep connecting.
7847                  */
7848                 if (params->explicit_connect)
7849                         list_add(&params->action, &hdev->pend_le_conns);
7850                 break;
7851         case HCI_AUTO_CONN_REPORT:
7852                 if (params->explicit_connect)
7853                         list_add(&params->action, &hdev->pend_le_conns);
7854                 else
7855                         list_add(&params->action, &hdev->pend_le_reports);
7856                 break;
7857         case HCI_AUTO_CONN_DIRECT:
7858         case HCI_AUTO_CONN_ALWAYS:
7859                 if (!is_connected(hdev, addr, addr_type))
7860                         list_add(&params->action, &hdev->pend_le_conns);
7861                 break;
7862         }
7863
7864         params->auto_connect = auto_connect;
7865
7866         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
7867                    addr, addr_type, auto_connect);
7868
7869         return 0;
7870 }
7871
7872 static void device_added(struct sock *sk, struct hci_dev *hdev,
7873                          bdaddr_t *bdaddr, u8 type, u8 action)
7874 {
7875         struct mgmt_ev_device_added ev;
7876
7877         bacpy(&ev.addr.bdaddr, bdaddr);
7878         ev.addr.type = type;
7879         ev.action = action;
7880
7881         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
7882 }
7883
7884 static int add_device(struct sock *sk, struct hci_dev *hdev,
7885                       void *data, u16 len)
7886 {
7887         struct mgmt_cp_add_device *cp = data;
7888         u8 auto_conn, addr_type;
7889         struct hci_conn_params *params;
7890         int err;
7891         u32 current_flags = 0;
7892
7893         bt_dev_dbg(hdev, "sock %p", sk);
7894
7895         if (!bdaddr_type_is_valid(cp->addr.type) ||
7896             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
7897                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7898                                          MGMT_STATUS_INVALID_PARAMS,
7899                                          &cp->addr, sizeof(cp->addr));
7900
7901         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
7902                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7903                                          MGMT_STATUS_INVALID_PARAMS,
7904                                          &cp->addr, sizeof(cp->addr));
7905
7906         hci_dev_lock(hdev);
7907
7908         if (cp->addr.type == BDADDR_BREDR) {
7909                 /* Only incoming connections action is supported for now */
7910                 if (cp->action != 0x01) {
7911                         err = mgmt_cmd_complete(sk, hdev->id,
7912                                                 MGMT_OP_ADD_DEVICE,
7913                                                 MGMT_STATUS_INVALID_PARAMS,
7914                                                 &cp->addr, sizeof(cp->addr));
7915                         goto unlock;
7916                 }
7917
7918                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
7919                                                      &cp->addr.bdaddr,
7920                                                      cp->addr.type, 0);
7921                 if (err)
7922                         goto unlock;
7923
7924                 hci_req_update_scan(hdev);
7925
7926                 goto added;
7927         }
7928
7929         addr_type = le_addr_type(cp->addr.type);
7930
7931         if (cp->action == 0x02)
7932                 auto_conn = HCI_AUTO_CONN_ALWAYS;
7933         else if (cp->action == 0x01)
7934                 auto_conn = HCI_AUTO_CONN_DIRECT;
7935         else
7936                 auto_conn = HCI_AUTO_CONN_REPORT;
7937
7938         /* Kernel internally uses conn_params with resolvable private
7939          * address, but Add Device allows only identity addresses.
7940          * Make sure it is enforced before calling
7941          * hci_conn_params_lookup.
7942          */
7943         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7944                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7945                                         MGMT_STATUS_INVALID_PARAMS,
7946                                         &cp->addr, sizeof(cp->addr));
7947                 goto unlock;
7948         }
7949
7950         /* If the connection parameters don't exist for this device,
7951          * they will be created and configured with defaults.
7952          */
7953         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
7954                                 auto_conn) < 0) {
7955                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7956                                         MGMT_STATUS_FAILED, &cp->addr,
7957                                         sizeof(cp->addr));
7958                 goto unlock;
7959         } else {
7960                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7961                                                 addr_type);
7962                 if (params)
7963                         current_flags = params->current_flags;
7964         }
7965
7966         hci_update_background_scan(hdev);
7967
7968 added:
7969         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
7970         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
7971                              SUPPORTED_DEVICE_FLAGS(), current_flags);
7972
7973         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7974                                 MGMT_STATUS_SUCCESS, &cp->addr,
7975                                 sizeof(cp->addr));
7976
7977 unlock:
7978         hci_dev_unlock(hdev);
7979         return err;
7980 }
7981
7982 static void device_removed(struct sock *sk, struct hci_dev *hdev,
7983                            bdaddr_t *bdaddr, u8 type)
7984 {
7985         struct mgmt_ev_device_removed ev;
7986
7987         bacpy(&ev.addr.bdaddr, bdaddr);
7988         ev.addr.type = type;
7989
7990         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
7991 }
7992
7993 static int remove_device(struct sock *sk, struct hci_dev *hdev,
7994                          void *data, u16 len)
7995 {
7996         struct mgmt_cp_remove_device *cp = data;
7997         int err;
7998
7999         bt_dev_dbg(hdev, "sock %p", sk);
8000
8001         hci_dev_lock(hdev);
8002
8003         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8004                 struct hci_conn_params *params;
8005                 u8 addr_type;
8006
8007                 if (!bdaddr_type_is_valid(cp->addr.type)) {
8008                         err = mgmt_cmd_complete(sk, hdev->id,
8009                                                 MGMT_OP_REMOVE_DEVICE,
8010                                                 MGMT_STATUS_INVALID_PARAMS,
8011                                                 &cp->addr, sizeof(cp->addr));
8012                         goto unlock;
8013                 }
8014
8015                 if (cp->addr.type == BDADDR_BREDR) {
8016                         err = hci_bdaddr_list_del(&hdev->accept_list,
8017                                                   &cp->addr.bdaddr,
8018                                                   cp->addr.type);
8019                         if (err) {
8020                                 err = mgmt_cmd_complete(sk, hdev->id,
8021                                                         MGMT_OP_REMOVE_DEVICE,
8022                                                         MGMT_STATUS_INVALID_PARAMS,
8023                                                         &cp->addr,
8024                                                         sizeof(cp->addr));
8025                                 goto unlock;
8026                         }
8027
8028                         hci_req_update_scan(hdev);
8029
8030                         device_removed(sk, hdev, &cp->addr.bdaddr,
8031                                        cp->addr.type);
8032                         goto complete;
8033                 }
8034
8035                 addr_type = le_addr_type(cp->addr.type);
8036
8037                 /* Kernel internally uses conn_params with resolvable private
8038                  * address, but Remove Device allows only identity addresses.
8039                  * Make sure it is enforced before calling
8040                  * hci_conn_params_lookup.
8041                  */
8042                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
8043                         err = mgmt_cmd_complete(sk, hdev->id,
8044                                                 MGMT_OP_REMOVE_DEVICE,
8045                                                 MGMT_STATUS_INVALID_PARAMS,
8046                                                 &cp->addr, sizeof(cp->addr));
8047                         goto unlock;
8048                 }
8049
8050                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
8051                                                 addr_type);
8052                 if (!params) {
8053                         err = mgmt_cmd_complete(sk, hdev->id,
8054                                                 MGMT_OP_REMOVE_DEVICE,
8055                                                 MGMT_STATUS_INVALID_PARAMS,
8056                                                 &cp->addr, sizeof(cp->addr));
8057                         goto unlock;
8058                 }
8059
8060                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
8061                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
8062                         err = mgmt_cmd_complete(sk, hdev->id,
8063                                                 MGMT_OP_REMOVE_DEVICE,
8064                                                 MGMT_STATUS_INVALID_PARAMS,
8065                                                 &cp->addr, sizeof(cp->addr));
8066                         goto unlock;
8067                 }
8068
8069                 list_del(&params->action);
8070                 list_del(&params->list);
8071                 kfree(params);
8072                 hci_update_background_scan(hdev);
8073
8074                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
8075         } else {
8076                 struct hci_conn_params *p, *tmp;
8077                 struct bdaddr_list *b, *btmp;
8078
8079                 if (cp->addr.type) {
8080                         err = mgmt_cmd_complete(sk, hdev->id,
8081                                                 MGMT_OP_REMOVE_DEVICE,
8082                                                 MGMT_STATUS_INVALID_PARAMS,
8083                                                 &cp->addr, sizeof(cp->addr));
8084                         goto unlock;
8085                 }
8086
8087                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
8088                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
8089                         list_del(&b->list);
8090                         kfree(b);
8091                 }
8092
8093                 hci_req_update_scan(hdev);
8094
8095                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
8096                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
8097                                 continue;
8098                         device_removed(sk, hdev, &p->addr, p->addr_type);
8099                         if (p->explicit_connect) {
8100                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
8101                                 continue;
8102                         }
8103                         list_del(&p->action);
8104                         list_del(&p->list);
8105                         kfree(p);
8106                 }
8107
8108                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
8109
8110                 hci_update_background_scan(hdev);
8111         }
8112
8113 complete:
8114         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
8115                                 MGMT_STATUS_SUCCESS, &cp->addr,
8116                                 sizeof(cp->addr));
8117 unlock:
8118         hci_dev_unlock(hdev);
8119         return err;
8120 }
8121
8122 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
8123                            u16 len)
8124 {
8125         struct mgmt_cp_load_conn_param *cp = data;
8126         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
8127                                      sizeof(struct mgmt_conn_param));
8128         u16 param_count, expected_len;
8129         int i;
8130
8131         if (!lmp_le_capable(hdev))
8132                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8133                                        MGMT_STATUS_NOT_SUPPORTED);
8134
8135         param_count = __le16_to_cpu(cp->param_count);
8136         if (param_count > max_param_count) {
8137                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
8138                            param_count);
8139                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8140                                        MGMT_STATUS_INVALID_PARAMS);
8141         }
8142
8143         expected_len = struct_size(cp, params, param_count);
8144         if (expected_len != len) {
8145                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
8146                            expected_len, len);
8147                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8148                                        MGMT_STATUS_INVALID_PARAMS);
8149         }
8150
8151         bt_dev_dbg(hdev, "param_count %u", param_count);
8152
8153         hci_dev_lock(hdev);
8154
8155         hci_conn_params_clear_disabled(hdev);
8156
8157         for (i = 0; i < param_count; i++) {
8158                 struct mgmt_conn_param *param = &cp->params[i];
8159                 struct hci_conn_params *hci_param;
8160                 u16 min, max, latency, timeout;
8161                 u8 addr_type;
8162
8163                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
8164                            param->addr.type);
8165
8166                 if (param->addr.type == BDADDR_LE_PUBLIC) {
8167                         addr_type = ADDR_LE_DEV_PUBLIC;
8168                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
8169                         addr_type = ADDR_LE_DEV_RANDOM;
8170                 } else {
8171                         bt_dev_err(hdev, "ignoring invalid connection parameters");
8172                         continue;
8173                 }
8174
8175                 min = le16_to_cpu(param->min_interval);
8176                 max = le16_to_cpu(param->max_interval);
8177                 latency = le16_to_cpu(param->latency);
8178                 timeout = le16_to_cpu(param->timeout);
8179
8180                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
8181                            min, max, latency, timeout);
8182
8183                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
8184                         bt_dev_err(hdev, "ignoring invalid connection parameters");
8185                         continue;
8186                 }
8187
8188                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
8189                                                 addr_type);
8190                 if (!hci_param) {
8191                         bt_dev_err(hdev, "failed to add connection parameters");
8192                         continue;
8193                 }
8194
8195                 hci_param->conn_min_interval = min;
8196                 hci_param->conn_max_interval = max;
8197                 hci_param->conn_latency = latency;
8198                 hci_param->supervision_timeout = timeout;
8199         }
8200
8201         hci_dev_unlock(hdev);
8202
8203         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
8204                                  NULL, 0);
8205 }
8206
8207 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
8208                                void *data, u16 len)
8209 {
8210         struct mgmt_cp_set_external_config *cp = data;
8211         bool changed;
8212         int err;
8213
8214         bt_dev_dbg(hdev, "sock %p", sk);
8215
8216         if (hdev_is_powered(hdev))
8217                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8218                                        MGMT_STATUS_REJECTED);
8219
8220         if (cp->config != 0x00 && cp->config != 0x01)
8221                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8222                                          MGMT_STATUS_INVALID_PARAMS);
8223
8224         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
8225                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8226                                        MGMT_STATUS_NOT_SUPPORTED);
8227
8228         hci_dev_lock(hdev);
8229
8230         if (cp->config)
8231                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
8232         else
8233                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
8234
8235         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
8236         if (err < 0)
8237                 goto unlock;
8238
8239         if (!changed)
8240                 goto unlock;
8241
8242         err = new_options(hdev, sk);
8243
8244         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
8245                 mgmt_index_removed(hdev);
8246
8247                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
8248                         hci_dev_set_flag(hdev, HCI_CONFIG);
8249                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8250
8251                         queue_work(hdev->req_workqueue, &hdev->power_on);
8252                 } else {
8253                         set_bit(HCI_RAW, &hdev->flags);
8254                         mgmt_index_added(hdev);
8255                 }
8256         }
8257
8258 unlock:
8259         hci_dev_unlock(hdev);
8260         return err;
8261 }
8262
8263 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
8264                               void *data, u16 len)
8265 {
8266         struct mgmt_cp_set_public_address *cp = data;
8267         bool changed;
8268         int err;
8269
8270         bt_dev_dbg(hdev, "sock %p", sk);
8271
8272         if (hdev_is_powered(hdev))
8273                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8274                                        MGMT_STATUS_REJECTED);
8275
8276         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
8277                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8278                                        MGMT_STATUS_INVALID_PARAMS);
8279
8280         if (!hdev->set_bdaddr)
8281                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8282                                        MGMT_STATUS_NOT_SUPPORTED);
8283
8284         hci_dev_lock(hdev);
8285
8286         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
8287         bacpy(&hdev->public_addr, &cp->bdaddr);
8288
8289         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
8290         if (err < 0)
8291                 goto unlock;
8292
8293         if (!changed)
8294                 goto unlock;
8295
8296         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
8297                 err = new_options(hdev, sk);
8298
8299         if (is_configured(hdev)) {
8300                 mgmt_index_removed(hdev);
8301
8302                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
8303
8304                 hci_dev_set_flag(hdev, HCI_CONFIG);
8305                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8306
8307                 queue_work(hdev->req_workqueue, &hdev->power_on);
8308         }
8309
8310 unlock:
8311         hci_dev_unlock(hdev);
8312         return err;
8313 }
8314
8315 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
8316                                              u16 opcode, struct sk_buff *skb)
8317 {
8318         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
8319         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
8320         u8 *h192, *r192, *h256, *r256;
8321         struct mgmt_pending_cmd *cmd;
8322         u16 eir_len;
8323         int err;
8324
8325         bt_dev_dbg(hdev, "status %u", status);
8326
8327         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
8328         if (!cmd)
8329                 return;
8330
8331         mgmt_cp = cmd->param;
8332
8333         if (status) {
8334                 status = mgmt_status(status);
8335                 eir_len = 0;
8336
8337                 h192 = NULL;
8338                 r192 = NULL;
8339                 h256 = NULL;
8340                 r256 = NULL;
8341         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
8342                 struct hci_rp_read_local_oob_data *rp;
8343
8344                 if (skb->len != sizeof(*rp)) {
8345                         status = MGMT_STATUS_FAILED;
8346                         eir_len = 0;
8347                 } else {
8348                         status = MGMT_STATUS_SUCCESS;
8349                         rp = (void *)skb->data;
8350
8351                         eir_len = 5 + 18 + 18;
8352                         h192 = rp->hash;
8353                         r192 = rp->rand;
8354                         h256 = NULL;
8355                         r256 = NULL;
8356                 }
8357         } else {
8358                 struct hci_rp_read_local_oob_ext_data *rp;
8359
8360                 if (skb->len != sizeof(*rp)) {
8361                         status = MGMT_STATUS_FAILED;
8362                         eir_len = 0;
8363                 } else {
8364                         status = MGMT_STATUS_SUCCESS;
8365                         rp = (void *)skb->data;
8366
8367                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
8368                                 eir_len = 5 + 18 + 18;
8369                                 h192 = NULL;
8370                                 r192 = NULL;
8371                         } else {
8372                                 eir_len = 5 + 18 + 18 + 18 + 18;
8373                                 h192 = rp->hash192;
8374                                 r192 = rp->rand192;
8375                         }
8376
8377                         h256 = rp->hash256;
8378                         r256 = rp->rand256;
8379                 }
8380         }
8381
8382         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
8383         if (!mgmt_rp)
8384                 goto done;
8385
8386         if (eir_len == 0)
8387                 goto send_rsp;
8388
8389         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
8390                                   hdev->dev_class, 3);
8391
8392         if (h192 && r192) {
8393                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8394                                           EIR_SSP_HASH_C192, h192, 16);
8395                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8396                                           EIR_SSP_RAND_R192, r192, 16);
8397         }
8398
8399         if (h256 && r256) {
8400                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8401                                           EIR_SSP_HASH_C256, h256, 16);
8402                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8403                                           EIR_SSP_RAND_R256, r256, 16);
8404         }
8405
8406 send_rsp:
8407         mgmt_rp->type = mgmt_cp->type;
8408         mgmt_rp->eir_len = cpu_to_le16(eir_len);
8409
8410         err = mgmt_cmd_complete(cmd->sk, hdev->id,
8411                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
8412                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
8413         if (err < 0 || status)
8414                 goto done;
8415
8416         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
8417
8418         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8419                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
8420                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
8421 done:
8422         kfree(mgmt_rp);
8423         mgmt_pending_remove(cmd);
8424 }
8425
8426 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
8427                                   struct mgmt_cp_read_local_oob_ext_data *cp)
8428 {
8429         struct mgmt_pending_cmd *cmd;
8430         struct hci_request req;
8431         int err;
8432
8433         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
8434                                cp, sizeof(*cp));
8435         if (!cmd)
8436                 return -ENOMEM;
8437
8438         hci_req_init(&req, hdev);
8439
8440         if (bredr_sc_enabled(hdev))
8441                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
8442         else
8443                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
8444
8445         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
8446         if (err < 0) {
8447                 mgmt_pending_remove(cmd);
8448                 return err;
8449         }
8450
8451         return 0;
8452 }
8453
8454 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
8455                                    void *data, u16 data_len)
8456 {
8457         struct mgmt_cp_read_local_oob_ext_data *cp = data;
8458         struct mgmt_rp_read_local_oob_ext_data *rp;
8459         size_t rp_len;
8460         u16 eir_len;
8461         u8 status, flags, role, addr[7], hash[16], rand[16];
8462         int err;
8463
8464         bt_dev_dbg(hdev, "sock %p", sk);
8465
8466         if (hdev_is_powered(hdev)) {
8467                 switch (cp->type) {
8468                 case BIT(BDADDR_BREDR):
8469                         status = mgmt_bredr_support(hdev);
8470                         if (status)
8471                                 eir_len = 0;
8472                         else
8473                                 eir_len = 5;
8474                         break;
8475                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8476                         status = mgmt_le_support(hdev);
8477                         if (status)
8478                                 eir_len = 0;
8479                         else
8480                                 eir_len = 9 + 3 + 18 + 18 + 3;
8481                         break;
8482                 default:
8483                         status = MGMT_STATUS_INVALID_PARAMS;
8484                         eir_len = 0;
8485                         break;
8486                 }
8487         } else {
8488                 status = MGMT_STATUS_NOT_POWERED;
8489                 eir_len = 0;
8490         }
8491
8492         rp_len = sizeof(*rp) + eir_len;
8493         rp = kmalloc(rp_len, GFP_ATOMIC);
8494         if (!rp)
8495                 return -ENOMEM;
8496
8497         if (status)
8498                 goto complete;
8499
8500         hci_dev_lock(hdev);
8501
8502         eir_len = 0;
8503         switch (cp->type) {
8504         case BIT(BDADDR_BREDR):
8505                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
8506                         err = read_local_ssp_oob_req(hdev, sk, cp);
8507                         hci_dev_unlock(hdev);
8508                         if (!err)
8509                                 goto done;
8510
8511                         status = MGMT_STATUS_FAILED;
8512                         goto complete;
8513                 } else {
8514                         eir_len = eir_append_data(rp->eir, eir_len,
8515                                                   EIR_CLASS_OF_DEV,
8516                                                   hdev->dev_class, 3);
8517                 }
8518                 break;
8519         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8520                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
8521                     smp_generate_oob(hdev, hash, rand) < 0) {
8522                         hci_dev_unlock(hdev);
8523                         status = MGMT_STATUS_FAILED;
8524                         goto complete;
8525                 }
8526
8527                 /* This should return the active RPA, but since the RPA
8528                  * is only programmed on demand, it is really hard to fill
8529                  * this in at the moment. For now disallow retrieving
8530                  * local out-of-band data when privacy is in use.
8531                  *
8532                  * Returning the identity address will not help here since
8533                  * pairing happens before the identity resolving key is
8534                  * known and thus the connection establishment happens
8535                  * based on the RPA and not the identity address.
8536                  */
8537                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
8538                         hci_dev_unlock(hdev);
8539                         status = MGMT_STATUS_REJECTED;
8540                         goto complete;
8541                 }
8542
8543                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
8544                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
8545                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
8546                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
8547                         memcpy(addr, &hdev->static_addr, 6);
8548                         addr[6] = 0x01;
8549                 } else {
8550                         memcpy(addr, &hdev->bdaddr, 6);
8551                         addr[6] = 0x00;
8552                 }
8553
8554                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
8555                                           addr, sizeof(addr));
8556
8557                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
8558                         role = 0x02;
8559                 else
8560                         role = 0x01;
8561
8562                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
8563                                           &role, sizeof(role));
8564
8565                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
8566                         eir_len = eir_append_data(rp->eir, eir_len,
8567                                                   EIR_LE_SC_CONFIRM,
8568                                                   hash, sizeof(hash));
8569
8570                         eir_len = eir_append_data(rp->eir, eir_len,
8571                                                   EIR_LE_SC_RANDOM,
8572                                                   rand, sizeof(rand));
8573                 }
8574
8575                 flags = mgmt_get_adv_discov_flags(hdev);
8576
8577                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
8578                         flags |= LE_AD_NO_BREDR;
8579
8580                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
8581                                           &flags, sizeof(flags));
8582                 break;
8583         }
8584
8585         hci_dev_unlock(hdev);
8586
8587         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
8588
8589         status = MGMT_STATUS_SUCCESS;
8590
8591 complete:
8592         rp->type = cp->type;
8593         rp->eir_len = cpu_to_le16(eir_len);
8594
8595         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
8596                                 status, rp, sizeof(*rp) + eir_len);
8597         if (err < 0 || status)
8598                 goto done;
8599
8600         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8601                                  rp, sizeof(*rp) + eir_len,
8602                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
8603
8604 done:
8605         kfree(rp);
8606
8607         return err;
8608 }
8609
8610 static u32 get_supported_adv_flags(struct hci_dev *hdev)
8611 {
8612         u32 flags = 0;
8613
8614         flags |= MGMT_ADV_FLAG_CONNECTABLE;
8615         flags |= MGMT_ADV_FLAG_DISCOV;
8616         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
8617         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
8618         flags |= MGMT_ADV_FLAG_APPEARANCE;
8619         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
8620         flags |= MGMT_ADV_PARAM_DURATION;
8621         flags |= MGMT_ADV_PARAM_TIMEOUT;
8622         flags |= MGMT_ADV_PARAM_INTERVALS;
8623         flags |= MGMT_ADV_PARAM_TX_POWER;
8624         flags |= MGMT_ADV_PARAM_SCAN_RSP;
8625
8626         /* In extended adv TX_POWER returned from Set Adv Param
8627          * will be always valid.
8628          */
8629         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
8630             ext_adv_capable(hdev))
8631                 flags |= MGMT_ADV_FLAG_TX_POWER;
8632
8633         if (ext_adv_capable(hdev)) {
8634                 flags |= MGMT_ADV_FLAG_SEC_1M;
8635                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
8636                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
8637
8638                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
8639                         flags |= MGMT_ADV_FLAG_SEC_2M;
8640
8641                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
8642                         flags |= MGMT_ADV_FLAG_SEC_CODED;
8643         }
8644
8645         return flags;
8646 }
8647
8648 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
8649                              void *data, u16 data_len)
8650 {
8651         struct mgmt_rp_read_adv_features *rp;
8652         size_t rp_len;
8653         int err;
8654         struct adv_info *adv_instance;
8655         u32 supported_flags;
8656         u8 *instance;
8657
8658         bt_dev_dbg(hdev, "sock %p", sk);
8659
8660         if (!lmp_le_capable(hdev))
8661                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8662                                        MGMT_STATUS_REJECTED);
8663
8664         /* Enabling the experimental LL Privay support disables support for
8665          * advertising.
8666          */
8667         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
8668                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8669                                        MGMT_STATUS_NOT_SUPPORTED);
8670
8671         hci_dev_lock(hdev);
8672
8673         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
8674         rp = kmalloc(rp_len, GFP_ATOMIC);
8675         if (!rp) {
8676                 hci_dev_unlock(hdev);
8677                 return -ENOMEM;
8678         }
8679
8680         supported_flags = get_supported_adv_flags(hdev);
8681
8682         rp->supported_flags = cpu_to_le32(supported_flags);
8683         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
8684         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
8685         rp->max_instances = hdev->le_num_of_adv_sets;
8686         rp->num_instances = hdev->adv_instance_cnt;
8687
8688         instance = rp->instance;
8689         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
8690                 *instance = adv_instance->instance;
8691                 instance++;
8692         }
8693
8694         hci_dev_unlock(hdev);
8695
8696         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8697                                 MGMT_STATUS_SUCCESS, rp, rp_len);
8698
8699         kfree(rp);
8700
8701         return err;
8702 }
8703
8704 static u8 calculate_name_len(struct hci_dev *hdev)
8705 {
8706         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
8707
8708         return append_local_name(hdev, buf, 0);
8709 }
8710
8711 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
8712                            bool is_adv_data)
8713 {
8714         u8 max_len = HCI_MAX_AD_LENGTH;
8715
8716         if (is_adv_data) {
8717                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
8718                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
8719                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
8720                         max_len -= 3;
8721
8722                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
8723                         max_len -= 3;
8724         } else {
8725                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
8726                         max_len -= calculate_name_len(hdev);
8727
8728                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
8729                         max_len -= 4;
8730         }
8731
8732         return max_len;
8733 }
8734
8735 static bool flags_managed(u32 adv_flags)
8736 {
8737         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
8738                             MGMT_ADV_FLAG_LIMITED_DISCOV |
8739                             MGMT_ADV_FLAG_MANAGED_FLAGS);
8740 }
8741
8742 static bool tx_power_managed(u32 adv_flags)
8743 {
8744         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
8745 }
8746
8747 static bool name_managed(u32 adv_flags)
8748 {
8749         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
8750 }
8751
8752 static bool appearance_managed(u32 adv_flags)
8753 {
8754         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
8755 }
8756
8757 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
8758                               u8 len, bool is_adv_data)
8759 {
8760         int i, cur_len;
8761         u8 max_len;
8762
8763         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
8764
8765         if (len > max_len)
8766                 return false;
8767
8768         /* Make sure that the data is correctly formatted. */
8769         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
8770                 cur_len = data[i];
8771
8772                 if (!cur_len)
8773                         continue;
8774
8775                 if (data[i + 1] == EIR_FLAGS &&
8776                     (!is_adv_data || flags_managed(adv_flags)))
8777                         return false;
8778
8779                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
8780                         return false;
8781
8782                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
8783                         return false;
8784
8785                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
8786                         return false;
8787
8788                 if (data[i + 1] == EIR_APPEARANCE &&
8789                     appearance_managed(adv_flags))
8790                         return false;
8791
8792                 /* If the current field length would exceed the total data
8793                  * length, then it's invalid.
8794                  */
8795                 if (i + cur_len >= len)
8796                         return false;
8797         }
8798
8799         return true;
8800 }
8801
8802 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
8803 {
8804         u32 supported_flags, phy_flags;
8805
8806         /* The current implementation only supports a subset of the specified
8807          * flags. Also need to check mutual exclusiveness of sec flags.
8808          */
8809         supported_flags = get_supported_adv_flags(hdev);
8810         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
8811         if (adv_flags & ~supported_flags ||
8812             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
8813                 return false;
8814
8815         return true;
8816 }
8817
8818 static bool adv_busy(struct hci_dev *hdev)
8819 {
8820         return (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
8821                 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
8822                 pending_find(MGMT_OP_SET_LE, hdev) ||
8823                 pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev) ||
8824                 pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev));
8825 }
8826
8827 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
8828                                      u16 opcode)
8829 {
8830         struct mgmt_pending_cmd *cmd;
8831         struct mgmt_cp_add_advertising *cp;
8832         struct mgmt_rp_add_advertising rp;
8833         struct adv_info *adv_instance, *n;
8834         u8 instance;
8835
8836         bt_dev_dbg(hdev, "status %u", status);
8837
8838         hci_dev_lock(hdev);
8839
8840         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
8841         if (!cmd)
8842                 cmd = pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev);
8843
8844         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
8845                 if (!adv_instance->pending)
8846                         continue;
8847
8848                 if (!status) {
8849                         adv_instance->pending = false;
8850                         continue;
8851                 }
8852
8853                 instance = adv_instance->instance;
8854
8855                 if (hdev->cur_adv_instance == instance)
8856                         cancel_adv_timeout(hdev);
8857
8858                 hci_remove_adv_instance(hdev, instance);
8859                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
8860         }
8861
8862         if (!cmd)
8863                 goto unlock;
8864
8865         cp = cmd->param;
8866         rp.instance = cp->instance;
8867
8868         if (status)
8869                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8870                                 mgmt_status(status));
8871         else
8872                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8873                                   mgmt_status(status), &rp, sizeof(rp));
8874
8875         mgmt_pending_remove(cmd);
8876
8877 unlock:
8878         hci_dev_unlock(hdev);
8879 }
8880
8881 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
8882                            void *data, u16 data_len)
8883 {
8884         struct mgmt_cp_add_advertising *cp = data;
8885         struct mgmt_rp_add_advertising rp;
8886         u32 flags;
8887         u8 status;
8888         u16 timeout, duration;
8889         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
8890         u8 schedule_instance = 0;
8891         struct adv_info *next_instance;
8892         int err;
8893         struct mgmt_pending_cmd *cmd;
8894         struct hci_request req;
8895
8896         bt_dev_dbg(hdev, "sock %p", sk);
8897
8898         status = mgmt_le_support(hdev);
8899         if (status)
8900                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8901                                        status);
8902
8903         /* Enabling the experimental LL Privay support disables support for
8904          * advertising.
8905          */
8906         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
8907                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8908                                        MGMT_STATUS_NOT_SUPPORTED);
8909
8910         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8911                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8912                                        MGMT_STATUS_INVALID_PARAMS);
8913
8914         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
8915                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8916                                        MGMT_STATUS_INVALID_PARAMS);
8917
8918         flags = __le32_to_cpu(cp->flags);
8919         timeout = __le16_to_cpu(cp->timeout);
8920         duration = __le16_to_cpu(cp->duration);
8921
8922         if (!requested_adv_flags_are_valid(hdev, flags))
8923                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8924                                        MGMT_STATUS_INVALID_PARAMS);
8925
8926         hci_dev_lock(hdev);
8927
8928         if (timeout && !hdev_is_powered(hdev)) {
8929                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8930                                       MGMT_STATUS_REJECTED);
8931                 goto unlock;
8932         }
8933
8934         if (adv_busy(hdev)) {
8935                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8936                                       MGMT_STATUS_BUSY);
8937                 goto unlock;
8938         }
8939
8940         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
8941             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
8942                                cp->scan_rsp_len, false)) {
8943                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8944                                       MGMT_STATUS_INVALID_PARAMS);
8945                 goto unlock;
8946         }
8947
8948         err = hci_add_adv_instance(hdev, cp->instance, flags,
8949                                    cp->adv_data_len, cp->data,
8950                                    cp->scan_rsp_len,
8951                                    cp->data + cp->adv_data_len,
8952                                    timeout, duration,
8953                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
8954                                    hdev->le_adv_min_interval,
8955                                    hdev->le_adv_max_interval);
8956         if (err < 0) {
8957                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8958                                       MGMT_STATUS_FAILED);
8959                 goto unlock;
8960         }
8961
8962         /* Only trigger an advertising added event if a new instance was
8963          * actually added.
8964          */
8965         if (hdev->adv_instance_cnt > prev_instance_cnt)
8966                 mgmt_advertising_added(sk, hdev, cp->instance);
8967
8968         if (hdev->cur_adv_instance == cp->instance) {
8969                 /* If the currently advertised instance is being changed then
8970                  * cancel the current advertising and schedule the next
8971                  * instance. If there is only one instance then the overridden
8972                  * advertising data will be visible right away.
8973                  */
8974                 cancel_adv_timeout(hdev);
8975
8976                 next_instance = hci_get_next_instance(hdev, cp->instance);
8977                 if (next_instance)
8978                         schedule_instance = next_instance->instance;
8979         } else if (!hdev->adv_instance_timeout) {
8980                 /* Immediately advertise the new instance if no other
8981                  * instance is currently being advertised.
8982                  */
8983                 schedule_instance = cp->instance;
8984         }
8985
8986         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
8987          * there is no instance to be advertised then we have no HCI
8988          * communication to make. Simply return.
8989          */
8990         if (!hdev_is_powered(hdev) ||
8991             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
8992             !schedule_instance) {
8993                 rp.instance = cp->instance;
8994                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8995                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8996                 goto unlock;
8997         }
8998
8999         /* We're good to go, update advertising data, parameters, and start
9000          * advertising.
9001          */
9002         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
9003                                data_len);
9004         if (!cmd) {
9005                 err = -ENOMEM;
9006                 goto unlock;
9007         }
9008
9009         hci_req_init(&req, hdev);
9010
9011         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
9012
9013         if (!err)
9014                 err = hci_req_run(&req, add_advertising_complete);
9015
9016         if (err < 0) {
9017                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9018                                       MGMT_STATUS_FAILED);
9019                 mgmt_pending_remove(cmd);
9020         }
9021
9022 unlock:
9023         hci_dev_unlock(hdev);
9024
9025         return err;
9026 }
9027
9028 static void add_ext_adv_params_complete(struct hci_dev *hdev, u8 status,
9029                                         u16 opcode)
9030 {
9031         struct mgmt_pending_cmd *cmd;
9032         struct mgmt_cp_add_ext_adv_params *cp;
9033         struct mgmt_rp_add_ext_adv_params rp;
9034         struct adv_info *adv_instance;
9035         u32 flags;
9036
9037         BT_DBG("%s", hdev->name);
9038
9039         hci_dev_lock(hdev);
9040
9041         cmd = pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev);
9042         if (!cmd)
9043                 goto unlock;
9044
9045         cp = cmd->param;
9046         adv_instance = hci_find_adv_instance(hdev, cp->instance);
9047         if (!adv_instance)
9048                 goto unlock;
9049
9050         rp.instance = cp->instance;
9051         rp.tx_power = adv_instance->tx_power;
9052
9053         /* While we're at it, inform userspace of the available space for this
9054          * advertisement, given the flags that will be used.
9055          */
9056         flags = __le32_to_cpu(cp->flags);
9057         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9058         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9059
9060         if (status) {
9061                 /* If this advertisement was previously advertising and we
9062                  * failed to update it, we signal that it has been removed and
9063                  * delete its structure
9064                  */
9065                 if (!adv_instance->pending)
9066                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
9067
9068                 hci_remove_adv_instance(hdev, cp->instance);
9069
9070                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9071                                 mgmt_status(status));
9072
9073         } else {
9074                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9075                                   mgmt_status(status), &rp, sizeof(rp));
9076         }
9077
9078 unlock:
9079         if (cmd)
9080                 mgmt_pending_remove(cmd);
9081
9082         hci_dev_unlock(hdev);
9083 }
9084
9085 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
9086                               void *data, u16 data_len)
9087 {
9088         struct mgmt_cp_add_ext_adv_params *cp = data;
9089         struct mgmt_rp_add_ext_adv_params rp;
9090         struct mgmt_pending_cmd *cmd = NULL;
9091         struct adv_info *adv_instance;
9092         struct hci_request req;
9093         u32 flags, min_interval, max_interval;
9094         u16 timeout, duration;
9095         u8 status;
9096         s8 tx_power;
9097         int err;
9098
9099         BT_DBG("%s", hdev->name);
9100
9101         status = mgmt_le_support(hdev);
9102         if (status)
9103                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9104                                        status);
9105
9106         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9107                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9108                                        MGMT_STATUS_INVALID_PARAMS);
9109
9110         /* The purpose of breaking add_advertising into two separate MGMT calls
9111          * for params and data is to allow more parameters to be added to this
9112          * structure in the future. For this reason, we verify that we have the
9113          * bare minimum structure we know of when the interface was defined. Any
9114          * extra parameters we don't know about will be ignored in this request.
9115          */
9116         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
9117                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9118                                        MGMT_STATUS_INVALID_PARAMS);
9119
9120         flags = __le32_to_cpu(cp->flags);
9121
9122         if (!requested_adv_flags_are_valid(hdev, flags))
9123                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9124                                        MGMT_STATUS_INVALID_PARAMS);
9125
9126         hci_dev_lock(hdev);
9127
9128         /* In new interface, we require that we are powered to register */
9129         if (!hdev_is_powered(hdev)) {
9130                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9131                                       MGMT_STATUS_REJECTED);
9132                 goto unlock;
9133         }
9134
9135         if (adv_busy(hdev)) {
9136                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9137                                       MGMT_STATUS_BUSY);
9138                 goto unlock;
9139         }
9140
9141         /* Parse defined parameters from request, use defaults otherwise */
9142         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
9143                   __le16_to_cpu(cp->timeout) : 0;
9144
9145         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
9146                    __le16_to_cpu(cp->duration) :
9147                    hdev->def_multi_adv_rotation_duration;
9148
9149         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
9150                        __le32_to_cpu(cp->min_interval) :
9151                        hdev->le_adv_min_interval;
9152
9153         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
9154                        __le32_to_cpu(cp->max_interval) :
9155                        hdev->le_adv_max_interval;
9156
9157         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
9158                    cp->tx_power :
9159                    HCI_ADV_TX_POWER_NO_PREFERENCE;
9160
9161         /* Create advertising instance with no advertising or response data */
9162         err = hci_add_adv_instance(hdev, cp->instance, flags,
9163                                    0, NULL, 0, NULL, timeout, duration,
9164                                    tx_power, min_interval, max_interval);
9165
9166         if (err < 0) {
9167                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9168                                       MGMT_STATUS_FAILED);
9169                 goto unlock;
9170         }
9171
9172         /* Submit request for advertising params if ext adv available */
9173         if (ext_adv_capable(hdev)) {
9174                 hci_req_init(&req, hdev);
9175                 adv_instance = hci_find_adv_instance(hdev, cp->instance);
9176
9177                 /* Updating parameters of an active instance will return a
9178                  * Command Disallowed error, so we must first disable the
9179                  * instance if it is active.
9180                  */
9181                 if (!adv_instance->pending)
9182                         __hci_req_disable_ext_adv_instance(&req, cp->instance);
9183
9184                 __hci_req_setup_ext_adv_instance(&req, cp->instance);
9185
9186                 err = hci_req_run(&req, add_ext_adv_params_complete);
9187
9188                 if (!err)
9189                         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_PARAMS,
9190                                                hdev, data, data_len);
9191                 if (!cmd) {
9192                         err = -ENOMEM;
9193                         hci_remove_adv_instance(hdev, cp->instance);
9194                         goto unlock;
9195                 }
9196
9197         } else {
9198                 rp.instance = cp->instance;
9199                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
9200                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9201                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9202                 err = mgmt_cmd_complete(sk, hdev->id,
9203                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
9204                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9205         }
9206
9207 unlock:
9208         hci_dev_unlock(hdev);
9209
9210         return err;
9211 }
9212
9213 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
9214                             u16 data_len)
9215 {
9216         struct mgmt_cp_add_ext_adv_data *cp = data;
9217         struct mgmt_rp_add_ext_adv_data rp;
9218         u8 schedule_instance = 0;
9219         struct adv_info *next_instance;
9220         struct adv_info *adv_instance;
9221         int err = 0;
9222         struct mgmt_pending_cmd *cmd;
9223         struct hci_request req;
9224
9225         BT_DBG("%s", hdev->name);
9226
9227         hci_dev_lock(hdev);
9228
9229         adv_instance = hci_find_adv_instance(hdev, cp->instance);
9230
9231         if (!adv_instance) {
9232                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9233                                       MGMT_STATUS_INVALID_PARAMS);
9234                 goto unlock;
9235         }
9236
9237         /* In new interface, we require that we are powered to register */
9238         if (!hdev_is_powered(hdev)) {
9239                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9240                                       MGMT_STATUS_REJECTED);
9241                 goto clear_new_instance;
9242         }
9243
9244         if (adv_busy(hdev)) {
9245                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9246                                       MGMT_STATUS_BUSY);
9247                 goto clear_new_instance;
9248         }
9249
9250         /* Validate new data */
9251         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
9252                                cp->adv_data_len, true) ||
9253             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
9254                                cp->adv_data_len, cp->scan_rsp_len, false)) {
9255                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9256                                       MGMT_STATUS_INVALID_PARAMS);
9257                 goto clear_new_instance;
9258         }
9259
9260         /* Set the data in the advertising instance */
9261         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
9262                                   cp->data, cp->scan_rsp_len,
9263                                   cp->data + cp->adv_data_len);
9264
9265         /* We're good to go, update advertising data, parameters, and start
9266          * advertising.
9267          */
9268
9269         hci_req_init(&req, hdev);
9270
9271         hci_req_add(&req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
9272
9273         if (ext_adv_capable(hdev)) {
9274                 __hci_req_update_adv_data(&req, cp->instance);
9275                 __hci_req_update_scan_rsp_data(&req, cp->instance);
9276                 __hci_req_enable_ext_advertising(&req, cp->instance);
9277
9278         } else {
9279                 /* If using software rotation, determine next instance to use */
9280
9281                 if (hdev->cur_adv_instance == cp->instance) {
9282                         /* If the currently advertised instance is being changed
9283                          * then cancel the current advertising and schedule the
9284                          * next instance. If there is only one instance then the
9285                          * overridden advertising data will be visible right
9286                          * away
9287                          */
9288                         cancel_adv_timeout(hdev);
9289
9290                         next_instance = hci_get_next_instance(hdev,
9291                                                               cp->instance);
9292                         if (next_instance)
9293                                 schedule_instance = next_instance->instance;
9294                 } else if (!hdev->adv_instance_timeout) {
9295                         /* Immediately advertise the new instance if no other
9296                          * instance is currently being advertised.
9297                          */
9298                         schedule_instance = cp->instance;
9299                 }
9300
9301                 /* If the HCI_ADVERTISING flag is set or there is no instance to
9302                  * be advertised then we have no HCI communication to make.
9303                  * Simply return.
9304                  */
9305                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
9306                     !schedule_instance) {
9307                         if (adv_instance->pending) {
9308                                 mgmt_advertising_added(sk, hdev, cp->instance);
9309                                 adv_instance->pending = false;
9310                         }
9311                         rp.instance = cp->instance;
9312                         err = mgmt_cmd_complete(sk, hdev->id,
9313                                                 MGMT_OP_ADD_EXT_ADV_DATA,
9314                                                 MGMT_STATUS_SUCCESS, &rp,
9315                                                 sizeof(rp));
9316                         goto unlock;
9317                 }
9318
9319                 err = __hci_req_schedule_adv_instance(&req, schedule_instance,
9320                                                       true);
9321         }
9322
9323         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
9324                                data_len);
9325         if (!cmd) {
9326                 err = -ENOMEM;
9327                 goto clear_new_instance;
9328         }
9329
9330         if (!err)
9331                 err = hci_req_run(&req, add_advertising_complete);
9332
9333         if (err < 0) {
9334                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9335                                       MGMT_STATUS_FAILED);
9336                 mgmt_pending_remove(cmd);
9337                 goto clear_new_instance;
9338         }
9339
9340         /* We were successful in updating data, so trigger advertising_added
9341          * event if this is an instance that wasn't previously advertising. If
9342          * a failure occurs in the requests we initiated, we will remove the
9343          * instance again in add_advertising_complete
9344          */
9345         if (adv_instance->pending)
9346                 mgmt_advertising_added(sk, hdev, cp->instance);
9347
9348         goto unlock;
9349
9350 clear_new_instance:
9351         hci_remove_adv_instance(hdev, cp->instance);
9352
9353 unlock:
9354         hci_dev_unlock(hdev);
9355
9356         return err;
9357 }
9358
9359 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
9360                                         u16 opcode)
9361 {
9362         struct mgmt_pending_cmd *cmd;
9363         struct mgmt_cp_remove_advertising *cp;
9364         struct mgmt_rp_remove_advertising rp;
9365
9366         bt_dev_dbg(hdev, "status %u", status);
9367
9368         hci_dev_lock(hdev);
9369
9370         /* A failure status here only means that we failed to disable
9371          * advertising. Otherwise, the advertising instance has been removed,
9372          * so report success.
9373          */
9374         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
9375         if (!cmd)
9376                 goto unlock;
9377
9378         cp = cmd->param;
9379         rp.instance = cp->instance;
9380
9381         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
9382                           &rp, sizeof(rp));
9383         mgmt_pending_remove(cmd);
9384
9385 unlock:
9386         hci_dev_unlock(hdev);
9387 }
9388
9389 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
9390                               void *data, u16 data_len)
9391 {
9392         struct mgmt_cp_remove_advertising *cp = data;
9393         struct mgmt_rp_remove_advertising rp;
9394         struct mgmt_pending_cmd *cmd;
9395         struct hci_request req;
9396         int err;
9397
9398         bt_dev_dbg(hdev, "sock %p", sk);
9399
9400         /* Enabling the experimental LL Privay support disables support for
9401          * advertising.
9402          */
9403         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
9404                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
9405                                        MGMT_STATUS_NOT_SUPPORTED);
9406
9407         hci_dev_lock(hdev);
9408
9409         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
9410                 err = mgmt_cmd_status(sk, hdev->id,
9411                                       MGMT_OP_REMOVE_ADVERTISING,
9412                                       MGMT_STATUS_INVALID_PARAMS);
9413                 goto unlock;
9414         }
9415
9416         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
9417             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
9418             pending_find(MGMT_OP_SET_LE, hdev)) {
9419                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9420                                       MGMT_STATUS_BUSY);
9421                 goto unlock;
9422         }
9423
9424         if (list_empty(&hdev->adv_instances)) {
9425                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9426                                       MGMT_STATUS_INVALID_PARAMS);
9427                 goto unlock;
9428         }
9429
9430         hci_req_init(&req, hdev);
9431
9432         /* If we use extended advertising, instance is disabled and removed */
9433         if (ext_adv_capable(hdev)) {
9434                 __hci_req_disable_ext_adv_instance(&req, cp->instance);
9435                 __hci_req_remove_ext_adv_instance(&req, cp->instance);
9436         }
9437
9438         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
9439
9440         if (list_empty(&hdev->adv_instances))
9441                 __hci_req_disable_advertising(&req);
9442
9443         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
9444          * flag is set or the device isn't powered then we have no HCI
9445          * communication to make. Simply return.
9446          */
9447         if (skb_queue_empty(&req.cmd_q) ||
9448             !hdev_is_powered(hdev) ||
9449             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
9450                 hci_req_purge(&req);
9451                 rp.instance = cp->instance;
9452                 err = mgmt_cmd_complete(sk, hdev->id,
9453                                         MGMT_OP_REMOVE_ADVERTISING,
9454                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9455                 goto unlock;
9456         }
9457
9458         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
9459                                data_len);
9460         if (!cmd) {
9461                 err = -ENOMEM;
9462                 goto unlock;
9463         }
9464
9465         err = hci_req_run(&req, remove_advertising_complete);
9466         if (err < 0)
9467                 mgmt_pending_remove(cmd);
9468
9469 unlock:
9470         hci_dev_unlock(hdev);
9471
9472         return err;
9473 }
9474
9475 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
9476                              void *data, u16 data_len)
9477 {
9478         struct mgmt_cp_get_adv_size_info *cp = data;
9479         struct mgmt_rp_get_adv_size_info rp;
9480         u32 flags, supported_flags;
9481         int err;
9482
9483         bt_dev_dbg(hdev, "sock %p", sk);
9484
9485         if (!lmp_le_capable(hdev))
9486                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9487                                        MGMT_STATUS_REJECTED);
9488
9489         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9490                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9491                                        MGMT_STATUS_INVALID_PARAMS);
9492
9493         flags = __le32_to_cpu(cp->flags);
9494
9495         /* The current implementation only supports a subset of the specified
9496          * flags.
9497          */
9498         supported_flags = get_supported_adv_flags(hdev);
9499         if (flags & ~supported_flags)
9500                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9501                                        MGMT_STATUS_INVALID_PARAMS);
9502
9503         rp.instance = cp->instance;
9504         rp.flags = cp->flags;
9505         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9506         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9507
9508         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9509                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9510
9511         return err;
9512 }
9513
9514 static const struct hci_mgmt_handler mgmt_handlers[] = {
9515         { NULL }, /* 0x0000 (no command) */
9516         { read_version,            MGMT_READ_VERSION_SIZE,
9517                                                 HCI_MGMT_NO_HDEV |
9518                                                 HCI_MGMT_UNTRUSTED },
9519         { read_commands,           MGMT_READ_COMMANDS_SIZE,
9520                                                 HCI_MGMT_NO_HDEV |
9521                                                 HCI_MGMT_UNTRUSTED },
9522         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
9523                                                 HCI_MGMT_NO_HDEV |
9524                                                 HCI_MGMT_UNTRUSTED },
9525         { read_controller_info,    MGMT_READ_INFO_SIZE,
9526                                                 HCI_MGMT_UNTRUSTED },
9527         { set_powered,             MGMT_SETTING_SIZE },
9528         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
9529         { set_connectable,         MGMT_SETTING_SIZE },
9530         { set_fast_connectable,    MGMT_SETTING_SIZE },
9531         { set_bondable,            MGMT_SETTING_SIZE },
9532         { set_link_security,       MGMT_SETTING_SIZE },
9533         { set_ssp,                 MGMT_SETTING_SIZE },
9534         { set_hs,                  MGMT_SETTING_SIZE },
9535         { set_le,                  MGMT_SETTING_SIZE },
9536         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
9537         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
9538         { add_uuid,                MGMT_ADD_UUID_SIZE },
9539         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
9540         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
9541                                                 HCI_MGMT_VAR_LEN },
9542         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
9543                                                 HCI_MGMT_VAR_LEN },
9544         { disconnect,              MGMT_DISCONNECT_SIZE },
9545         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
9546         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
9547         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
9548         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
9549         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
9550         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
9551         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
9552         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
9553         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
9554         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
9555         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
9556         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
9557         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
9558                                                 HCI_MGMT_VAR_LEN },
9559         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
9560         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
9561         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
9562         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
9563         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
9564         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
9565         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
9566         { set_advertising,         MGMT_SETTING_SIZE },
9567         { set_bredr,               MGMT_SETTING_SIZE },
9568         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
9569         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
9570         { set_secure_conn,         MGMT_SETTING_SIZE },
9571         { set_debug_keys,          MGMT_SETTING_SIZE },
9572         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
9573         { load_irks,               MGMT_LOAD_IRKS_SIZE,
9574                                                 HCI_MGMT_VAR_LEN },
9575         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
9576         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
9577         { add_device,              MGMT_ADD_DEVICE_SIZE },
9578         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
9579         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
9580                                                 HCI_MGMT_VAR_LEN },
9581         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
9582                                                 HCI_MGMT_NO_HDEV |
9583                                                 HCI_MGMT_UNTRUSTED },
9584         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
9585                                                 HCI_MGMT_UNCONFIGURED |
9586                                                 HCI_MGMT_UNTRUSTED },
9587         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
9588                                                 HCI_MGMT_UNCONFIGURED },
9589         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
9590                                                 HCI_MGMT_UNCONFIGURED },
9591         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
9592                                                 HCI_MGMT_VAR_LEN },
9593         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
9594         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
9595                                                 HCI_MGMT_NO_HDEV |
9596                                                 HCI_MGMT_UNTRUSTED },
9597         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
9598         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
9599                                                 HCI_MGMT_VAR_LEN },
9600         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
9601         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
9602         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
9603         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
9604                                                 HCI_MGMT_UNTRUSTED },
9605         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
9606         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
9607         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
9608         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
9609                                                 HCI_MGMT_VAR_LEN },
9610         { set_wideband_speech,     MGMT_SETTING_SIZE },
9611         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
9612                                                 HCI_MGMT_UNTRUSTED },
9613         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
9614                                                 HCI_MGMT_UNTRUSTED |
9615                                                 HCI_MGMT_HDEV_OPTIONAL },
9616         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
9617                                                 HCI_MGMT_VAR_LEN |
9618                                                 HCI_MGMT_HDEV_OPTIONAL },
9619         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
9620                                                 HCI_MGMT_UNTRUSTED },
9621         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
9622                                                 HCI_MGMT_VAR_LEN },
9623         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
9624                                                 HCI_MGMT_UNTRUSTED },
9625         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
9626                                                 HCI_MGMT_VAR_LEN },
9627         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
9628         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
9629         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
9630         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
9631                                                 HCI_MGMT_VAR_LEN },
9632         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
9633         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
9634                                                 HCI_MGMT_VAR_LEN },
9635         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
9636                                                 HCI_MGMT_VAR_LEN },
9637         { add_adv_patterns_monitor_rssi,
9638                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
9639                                                 HCI_MGMT_VAR_LEN },
9640 };
9641
9642 #ifdef TIZEN_BT
9643 static const struct hci_mgmt_handler tizen_mgmt_handlers[] = {
9644         { NULL }, /* 0x0000 (no command) */
9645         { set_advertising_params,  MGMT_SET_ADVERTISING_PARAMS_SIZE },
9646         { set_advertising_data,    MGMT_SET_ADV_MIN_APP_DATA_SIZE,
9647                                                 HCI_MGMT_VAR_LEN },
9648         { set_scan_rsp_data,       MGMT_SET_SCAN_RSP_MIN_APP_DATA_SIZE,
9649                                                 HCI_MGMT_VAR_LEN },
9650         { add_white_list,          MGMT_ADD_DEV_WHITE_LIST_SIZE },
9651         { remove_from_white_list,  MGMT_REMOVE_DEV_FROM_WHITE_LIST_SIZE },
9652         { clear_white_list,        MGMT_OP_CLEAR_DEV_WHITE_LIST_SIZE },
9653         { set_enable_rssi,         MGMT_SET_RSSI_ENABLE_SIZE },
9654         { get_raw_rssi,            MGMT_GET_RAW_RSSI_SIZE },
9655         { set_disable_threshold,   MGMT_SET_RSSI_DISABLE_SIZE },
9656 };
9657 #endif
9658
9659 void mgmt_index_added(struct hci_dev *hdev)
9660 {
9661         struct mgmt_ev_ext_index ev;
9662
9663         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
9664                 return;
9665
9666         switch (hdev->dev_type) {
9667         case HCI_PRIMARY:
9668                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9669                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
9670                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
9671                         ev.type = 0x01;
9672                 } else {
9673                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
9674                                          HCI_MGMT_INDEX_EVENTS);
9675                         ev.type = 0x00;
9676                 }
9677                 break;
9678         case HCI_AMP:
9679                 ev.type = 0x02;
9680                 break;
9681         default:
9682                 return;
9683         }
9684
9685         ev.bus = hdev->bus;
9686
9687         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
9688                          HCI_MGMT_EXT_INDEX_EVENTS);
9689 }
9690
9691 void mgmt_index_removed(struct hci_dev *hdev)
9692 {
9693         struct mgmt_ev_ext_index ev;
9694         u8 status = MGMT_STATUS_INVALID_INDEX;
9695
9696         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
9697                 return;
9698
9699         switch (hdev->dev_type) {
9700         case HCI_PRIMARY:
9701                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
9702
9703                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9704                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
9705                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
9706                         ev.type = 0x01;
9707                 } else {
9708                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
9709                                          HCI_MGMT_INDEX_EVENTS);
9710                         ev.type = 0x00;
9711                 }
9712                 break;
9713         case HCI_AMP:
9714                 ev.type = 0x02;
9715                 break;
9716         default:
9717                 return;
9718         }
9719
9720         ev.bus = hdev->bus;
9721
9722         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
9723                          HCI_MGMT_EXT_INDEX_EVENTS);
9724 }
9725
9726 /* This function requires the caller holds hdev->lock */
9727 static void restart_le_actions(struct hci_dev *hdev)
9728 {
9729         struct hci_conn_params *p;
9730
9731         list_for_each_entry(p, &hdev->le_conn_params, list) {
9732                 /* Needed for AUTO_OFF case where might not "really"
9733                  * have been powered off.
9734                  */
9735                 list_del_init(&p->action);
9736
9737                 switch (p->auto_connect) {
9738                 case HCI_AUTO_CONN_DIRECT:
9739                 case HCI_AUTO_CONN_ALWAYS:
9740                         list_add(&p->action, &hdev->pend_le_conns);
9741                         break;
9742                 case HCI_AUTO_CONN_REPORT:
9743                         list_add(&p->action, &hdev->pend_le_reports);
9744                         break;
9745                 default:
9746                         break;
9747                 }
9748         }
9749 }
9750
9751 void mgmt_power_on(struct hci_dev *hdev, int err)
9752 {
9753         struct cmd_lookup match = { NULL, hdev };
9754
9755         bt_dev_dbg(hdev, "err %d", err);
9756
9757         hci_dev_lock(hdev);
9758
9759         if (!err) {
9760                 restart_le_actions(hdev);
9761                 hci_update_background_scan(hdev);
9762         }
9763
9764         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9765
9766         new_settings(hdev, match.sk);
9767
9768         if (match.sk)
9769                 sock_put(match.sk);
9770
9771         hci_dev_unlock(hdev);
9772 }
9773
9774 void __mgmt_power_off(struct hci_dev *hdev)
9775 {
9776         struct cmd_lookup match = { NULL, hdev };
9777         u8 status, zero_cod[] = { 0, 0, 0 };
9778
9779         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9780
9781         /* If the power off is because of hdev unregistration let
9782          * use the appropriate INVALID_INDEX status. Otherwise use
9783          * NOT_POWERED. We cover both scenarios here since later in
9784          * mgmt_index_removed() any hci_conn callbacks will have already
9785          * been triggered, potentially causing misleading DISCONNECTED
9786          * status responses.
9787          */
9788         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
9789                 status = MGMT_STATUS_INVALID_INDEX;
9790         else
9791                 status = MGMT_STATUS_NOT_POWERED;
9792
9793         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
9794
9795         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
9796                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
9797                                    zero_cod, sizeof(zero_cod),
9798                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
9799                 ext_info_changed(hdev, NULL);
9800         }
9801
9802         new_settings(hdev, match.sk);
9803
9804         if (match.sk)
9805                 sock_put(match.sk);
9806 }
9807
9808 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
9809 {
9810         struct mgmt_pending_cmd *cmd;
9811         u8 status;
9812
9813         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
9814         if (!cmd)
9815                 return;
9816
9817         if (err == -ERFKILL)
9818                 status = MGMT_STATUS_RFKILLED;
9819         else
9820                 status = MGMT_STATUS_FAILED;
9821
9822         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
9823
9824         mgmt_pending_remove(cmd);
9825 }
9826
9827 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
9828                        bool persistent)
9829 {
9830         struct mgmt_ev_new_link_key ev;
9831
9832         memset(&ev, 0, sizeof(ev));
9833
9834         ev.store_hint = persistent;
9835         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9836         ev.key.addr.type = BDADDR_BREDR;
9837         ev.key.type = key->type;
9838         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
9839         ev.key.pin_len = key->pin_len;
9840
9841         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
9842 }
9843
9844 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
9845 {
9846         switch (ltk->type) {
9847         case SMP_LTK:
9848         case SMP_LTK_RESPONDER:
9849                 if (ltk->authenticated)
9850                         return MGMT_LTK_AUTHENTICATED;
9851                 return MGMT_LTK_UNAUTHENTICATED;
9852         case SMP_LTK_P256:
9853                 if (ltk->authenticated)
9854                         return MGMT_LTK_P256_AUTH;
9855                 return MGMT_LTK_P256_UNAUTH;
9856         case SMP_LTK_P256_DEBUG:
9857                 return MGMT_LTK_P256_DEBUG;
9858         }
9859
9860         return MGMT_LTK_UNAUTHENTICATED;
9861 }
9862
9863 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
9864 {
9865         struct mgmt_ev_new_long_term_key ev;
9866
9867         memset(&ev, 0, sizeof(ev));
9868
9869         /* Devices using resolvable or non-resolvable random addresses
9870          * without providing an identity resolving key don't require
9871          * to store long term keys. Their addresses will change the
9872          * next time around.
9873          *
9874          * Only when a remote device provides an identity address
9875          * make sure the long term key is stored. If the remote
9876          * identity is known, the long term keys are internally
9877          * mapped to the identity address. So allow static random
9878          * and public addresses here.
9879          */
9880         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9881             (key->bdaddr.b[5] & 0xc0) != 0xc0)
9882                 ev.store_hint = 0x00;
9883         else
9884                 ev.store_hint = persistent;
9885
9886         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9887         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
9888         ev.key.type = mgmt_ltk_type(key);
9889         ev.key.enc_size = key->enc_size;
9890         ev.key.ediv = key->ediv;
9891         ev.key.rand = key->rand;
9892
9893         if (key->type == SMP_LTK)
9894                 ev.key.initiator = 1;
9895
9896         /* Make sure we copy only the significant bytes based on the
9897          * encryption key size, and set the rest of the value to zeroes.
9898          */
9899         memcpy(ev.key.val, key->val, key->enc_size);
9900         memset(ev.key.val + key->enc_size, 0,
9901                sizeof(ev.key.val) - key->enc_size);
9902
9903         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
9904 }
9905
9906 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
9907 {
9908         struct mgmt_ev_new_irk ev;
9909
9910         memset(&ev, 0, sizeof(ev));
9911
9912         ev.store_hint = persistent;
9913
9914         bacpy(&ev.rpa, &irk->rpa);
9915         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
9916         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
9917         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
9918
9919         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
9920 }
9921
9922 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
9923                    bool persistent)
9924 {
9925         struct mgmt_ev_new_csrk ev;
9926
9927         memset(&ev, 0, sizeof(ev));
9928
9929         /* Devices using resolvable or non-resolvable random addresses
9930          * without providing an identity resolving key don't require
9931          * to store signature resolving keys. Their addresses will change
9932          * the next time around.
9933          *
9934          * Only when a remote device provides an identity address
9935          * make sure the signature resolving key is stored. So allow
9936          * static random and public addresses here.
9937          */
9938         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9939             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
9940                 ev.store_hint = 0x00;
9941         else
9942                 ev.store_hint = persistent;
9943
9944         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
9945         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
9946         ev.key.type = csrk->type;
9947         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
9948
9949         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
9950 }
9951
9952 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
9953                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
9954                          u16 max_interval, u16 latency, u16 timeout)
9955 {
9956         struct mgmt_ev_new_conn_param ev;
9957
9958         if (!hci_is_identity_address(bdaddr, bdaddr_type))
9959                 return;
9960
9961         memset(&ev, 0, sizeof(ev));
9962         bacpy(&ev.addr.bdaddr, bdaddr);
9963         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
9964         ev.store_hint = store_hint;
9965         ev.min_interval = cpu_to_le16(min_interval);
9966         ev.max_interval = cpu_to_le16(max_interval);
9967         ev.latency = cpu_to_le16(latency);
9968         ev.timeout = cpu_to_le16(timeout);
9969
9970         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
9971 }
9972
9973 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
9974                            u8 *name, u8 name_len)
9975 {
9976         char buf[512];
9977         struct mgmt_ev_device_connected *ev = (void *) buf;
9978         u16 eir_len = 0;
9979         u32 flags = 0;
9980
9981         bacpy(&ev->addr.bdaddr, &conn->dst);
9982         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9983
9984         if (conn->out)
9985                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
9986
9987         ev->flags = __cpu_to_le32(flags);
9988
9989         /* We must ensure that the EIR Data fields are ordered and
9990          * unique. Keep it simple for now and avoid the problem by not
9991          * adding any BR/EDR data to the LE adv.
9992          */
9993         if (conn->le_adv_data_len > 0) {
9994                 memcpy(&ev->eir[eir_len],
9995                        conn->le_adv_data, conn->le_adv_data_len);
9996                 eir_len = conn->le_adv_data_len;
9997         } else {
9998                 if (name_len > 0)
9999                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
10000                                                   name, name_len);
10001
10002                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
10003                         eir_len = eir_append_data(ev->eir, eir_len,
10004                                                   EIR_CLASS_OF_DEV,
10005                                                   conn->dev_class, 3);
10006         }
10007
10008         ev->eir_len = cpu_to_le16(eir_len);
10009
10010         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
10011                     sizeof(*ev) + eir_len, NULL);
10012 }
10013
10014 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
10015 {
10016         struct sock **sk = data;
10017
10018         cmd->cmd_complete(cmd, 0);
10019
10020         *sk = cmd->sk;
10021         sock_hold(*sk);
10022
10023         mgmt_pending_remove(cmd);
10024 }
10025
10026 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
10027 {
10028         struct hci_dev *hdev = data;
10029         struct mgmt_cp_unpair_device *cp = cmd->param;
10030
10031         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
10032
10033         cmd->cmd_complete(cmd, 0);
10034         mgmt_pending_remove(cmd);
10035 }
10036
10037 bool mgmt_powering_down(struct hci_dev *hdev)
10038 {
10039         struct mgmt_pending_cmd *cmd;
10040         struct mgmt_mode *cp;
10041
10042         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
10043         if (!cmd)
10044                 return false;
10045
10046         cp = cmd->param;
10047         if (!cp->val)
10048                 return true;
10049
10050         return false;
10051 }
10052
10053 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
10054                               u8 link_type, u8 addr_type, u8 reason,
10055                               bool mgmt_connected)
10056 {
10057         struct mgmt_ev_device_disconnected ev;
10058         struct sock *sk = NULL;
10059
10060         /* The connection is still in hci_conn_hash so test for 1
10061          * instead of 0 to know if this is the last one.
10062          */
10063         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
10064                 cancel_delayed_work(&hdev->power_off);
10065                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
10066         }
10067
10068         if (!mgmt_connected)
10069                 return;
10070
10071         if (link_type != ACL_LINK && link_type != LE_LINK)
10072                 return;
10073
10074         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
10075
10076         bacpy(&ev.addr.bdaddr, bdaddr);
10077         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10078         ev.reason = reason;
10079
10080         /* Report disconnects due to suspend */
10081         if (hdev->suspended)
10082                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
10083
10084         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
10085
10086         if (sk)
10087                 sock_put(sk);
10088
10089         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
10090                              hdev);
10091 }
10092
10093 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
10094                             u8 link_type, u8 addr_type, u8 status)
10095 {
10096         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
10097         struct mgmt_cp_disconnect *cp;
10098         struct mgmt_pending_cmd *cmd;
10099
10100         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
10101                              hdev);
10102
10103         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
10104         if (!cmd)
10105                 return;
10106
10107         cp = cmd->param;
10108
10109         if (bacmp(bdaddr, &cp->addr.bdaddr))
10110                 return;
10111
10112         if (cp->addr.type != bdaddr_type)
10113                 return;
10114
10115         cmd->cmd_complete(cmd, mgmt_status(status));
10116         mgmt_pending_remove(cmd);
10117 }
10118
10119 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10120                          u8 addr_type, u8 status)
10121 {
10122         struct mgmt_ev_connect_failed ev;
10123
10124         /* The connection is still in hci_conn_hash so test for 1
10125          * instead of 0 to know if this is the last one.
10126          */
10127         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
10128                 cancel_delayed_work(&hdev->power_off);
10129                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
10130         }
10131
10132         bacpy(&ev.addr.bdaddr, bdaddr);
10133         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10134         ev.status = mgmt_status(status);
10135
10136         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
10137 }
10138
10139 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
10140 {
10141         struct mgmt_ev_pin_code_request ev;
10142
10143         bacpy(&ev.addr.bdaddr, bdaddr);
10144         ev.addr.type = BDADDR_BREDR;
10145         ev.secure = secure;
10146
10147         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
10148 }
10149
10150 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10151                                   u8 status)
10152 {
10153         struct mgmt_pending_cmd *cmd;
10154
10155         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
10156         if (!cmd)
10157                 return;
10158
10159         cmd->cmd_complete(cmd, mgmt_status(status));
10160         mgmt_pending_remove(cmd);
10161 }
10162
10163 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10164                                       u8 status)
10165 {
10166         struct mgmt_pending_cmd *cmd;
10167
10168         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
10169         if (!cmd)
10170                 return;
10171
10172         cmd->cmd_complete(cmd, mgmt_status(status));
10173         mgmt_pending_remove(cmd);
10174 }
10175
10176 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
10177                               u8 link_type, u8 addr_type, u32 value,
10178                               u8 confirm_hint)
10179 {
10180         struct mgmt_ev_user_confirm_request ev;
10181
10182         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10183
10184         bacpy(&ev.addr.bdaddr, bdaddr);
10185         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10186         ev.confirm_hint = confirm_hint;
10187         ev.value = cpu_to_le32(value);
10188
10189         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
10190                           NULL);
10191 }
10192
10193 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
10194                               u8 link_type, u8 addr_type)
10195 {
10196         struct mgmt_ev_user_passkey_request ev;
10197
10198         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10199
10200         bacpy(&ev.addr.bdaddr, bdaddr);
10201         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10202
10203         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
10204                           NULL);
10205 }
10206
10207 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10208                                       u8 link_type, u8 addr_type, u8 status,
10209                                       u8 opcode)
10210 {
10211         struct mgmt_pending_cmd *cmd;
10212
10213         cmd = pending_find(opcode, hdev);
10214         if (!cmd)
10215                 return -ENOENT;
10216
10217         cmd->cmd_complete(cmd, mgmt_status(status));
10218         mgmt_pending_remove(cmd);
10219
10220         return 0;
10221 }
10222
10223 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10224                                      u8 link_type, u8 addr_type, u8 status)
10225 {
10226         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10227                                           status, MGMT_OP_USER_CONFIRM_REPLY);
10228 }
10229
10230 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10231                                          u8 link_type, u8 addr_type, u8 status)
10232 {
10233         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10234                                           status,
10235                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
10236 }
10237
10238 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10239                                      u8 link_type, u8 addr_type, u8 status)
10240 {
10241         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10242                                           status, MGMT_OP_USER_PASSKEY_REPLY);
10243 }
10244
10245 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10246                                          u8 link_type, u8 addr_type, u8 status)
10247 {
10248         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10249                                           status,
10250                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
10251 }
10252
10253 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
10254                              u8 link_type, u8 addr_type, u32 passkey,
10255                              u8 entered)
10256 {
10257         struct mgmt_ev_passkey_notify ev;
10258
10259         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10260
10261         bacpy(&ev.addr.bdaddr, bdaddr);
10262         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10263         ev.passkey = __cpu_to_le32(passkey);
10264         ev.entered = entered;
10265
10266         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
10267 }
10268
10269 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
10270 {
10271         struct mgmt_ev_auth_failed ev;
10272         struct mgmt_pending_cmd *cmd;
10273         u8 status = mgmt_status(hci_status);
10274
10275         bacpy(&ev.addr.bdaddr, &conn->dst);
10276         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10277         ev.status = status;
10278
10279         cmd = find_pairing(conn);
10280
10281         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
10282                     cmd ? cmd->sk : NULL);
10283
10284         if (cmd) {
10285                 cmd->cmd_complete(cmd, status);
10286                 mgmt_pending_remove(cmd);
10287         }
10288 }
10289
10290 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
10291 {
10292         struct cmd_lookup match = { NULL, hdev };
10293         bool changed;
10294
10295         if (status) {
10296                 u8 mgmt_err = mgmt_status(status);
10297                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
10298                                      cmd_status_rsp, &mgmt_err);
10299                 return;
10300         }
10301
10302         if (test_bit(HCI_AUTH, &hdev->flags))
10303                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
10304         else
10305                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
10306
10307         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
10308                              &match);
10309
10310         if (changed)
10311                 new_settings(hdev, match.sk);
10312
10313         if (match.sk)
10314                 sock_put(match.sk);
10315 }
10316
10317 static void clear_eir(struct hci_request *req)
10318 {
10319         struct hci_dev *hdev = req->hdev;
10320         struct hci_cp_write_eir cp;
10321
10322         if (!lmp_ext_inq_capable(hdev))
10323                 return;
10324
10325         memset(hdev->eir, 0, sizeof(hdev->eir));
10326
10327         memset(&cp, 0, sizeof(cp));
10328
10329         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
10330 }
10331
10332 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
10333 {
10334         struct cmd_lookup match = { NULL, hdev };
10335         struct hci_request req;
10336         bool changed = false;
10337
10338         if (status) {
10339                 u8 mgmt_err = mgmt_status(status);
10340
10341                 if (enable && hci_dev_test_and_clear_flag(hdev,
10342                                                           HCI_SSP_ENABLED)) {
10343                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
10344                         new_settings(hdev, NULL);
10345                 }
10346
10347                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
10348                                      &mgmt_err);
10349                 return;
10350         }
10351
10352         if (enable) {
10353                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
10354         } else {
10355                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
10356                 if (!changed)
10357                         changed = hci_dev_test_and_clear_flag(hdev,
10358                                                               HCI_HS_ENABLED);
10359                 else
10360                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
10361         }
10362
10363         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
10364
10365         if (changed)
10366                 new_settings(hdev, match.sk);
10367
10368         if (match.sk)
10369                 sock_put(match.sk);
10370
10371         hci_req_init(&req, hdev);
10372
10373         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
10374                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
10375                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
10376                                     sizeof(enable), &enable);
10377                 __hci_req_update_eir(&req);
10378         } else {
10379                 clear_eir(&req);
10380         }
10381
10382         hci_req_run(&req, NULL);
10383 }
10384
10385 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
10386 {
10387         struct cmd_lookup *match = data;
10388
10389         if (match->sk == NULL) {
10390                 match->sk = cmd->sk;
10391                 sock_hold(match->sk);
10392         }
10393 }
10394
10395 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
10396                                     u8 status)
10397 {
10398         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
10399
10400         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
10401         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
10402         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
10403
10404         if (!status) {
10405                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
10406                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
10407                 ext_info_changed(hdev, NULL);
10408         }
10409
10410         if (match.sk)
10411                 sock_put(match.sk);
10412 }
10413
10414 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
10415 {
10416         struct mgmt_cp_set_local_name ev;
10417         struct mgmt_pending_cmd *cmd;
10418
10419         if (status)
10420                 return;
10421
10422         memset(&ev, 0, sizeof(ev));
10423         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
10424         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
10425
10426         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
10427         if (!cmd) {
10428                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
10429
10430                 /* If this is a HCI command related to powering on the
10431                  * HCI dev don't send any mgmt signals.
10432                  */
10433                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
10434                         return;
10435         }
10436
10437         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
10438                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
10439         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
10440 }
10441
10442 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
10443 {
10444         int i;
10445
10446         for (i = 0; i < uuid_count; i++) {
10447                 if (!memcmp(uuid, uuids[i], 16))
10448                         return true;
10449         }
10450
10451         return false;
10452 }
10453
10454 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
10455 {
10456         u16 parsed = 0;
10457
10458         while (parsed < eir_len) {
10459                 u8 field_len = eir[0];
10460                 u8 uuid[16];
10461                 int i;
10462
10463                 if (field_len == 0)
10464                         break;
10465
10466                 if (eir_len - parsed < field_len + 1)
10467                         break;
10468
10469                 switch (eir[1]) {
10470                 case EIR_UUID16_ALL:
10471                 case EIR_UUID16_SOME:
10472                         for (i = 0; i + 3 <= field_len; i += 2) {
10473                                 memcpy(uuid, bluetooth_base_uuid, 16);
10474                                 uuid[13] = eir[i + 3];
10475                                 uuid[12] = eir[i + 2];
10476                                 if (has_uuid(uuid, uuid_count, uuids))
10477                                         return true;
10478                         }
10479                         break;
10480                 case EIR_UUID32_ALL:
10481                 case EIR_UUID32_SOME:
10482                         for (i = 0; i + 5 <= field_len; i += 4) {
10483                                 memcpy(uuid, bluetooth_base_uuid, 16);
10484                                 uuid[15] = eir[i + 5];
10485                                 uuid[14] = eir[i + 4];
10486                                 uuid[13] = eir[i + 3];
10487                                 uuid[12] = eir[i + 2];
10488                                 if (has_uuid(uuid, uuid_count, uuids))
10489                                         return true;
10490                         }
10491                         break;
10492                 case EIR_UUID128_ALL:
10493                 case EIR_UUID128_SOME:
10494                         for (i = 0; i + 17 <= field_len; i += 16) {
10495                                 memcpy(uuid, eir + i + 2, 16);
10496                                 if (has_uuid(uuid, uuid_count, uuids))
10497                                         return true;
10498                         }
10499                         break;
10500                 }
10501
10502                 parsed += field_len + 1;
10503                 eir += field_len + 1;
10504         }
10505
10506         return false;
10507 }
10508
10509 static void restart_le_scan(struct hci_dev *hdev)
10510 {
10511         /* If controller is not scanning we are done. */
10512         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
10513                 return;
10514
10515         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
10516                        hdev->discovery.scan_start +
10517                        hdev->discovery.scan_duration))
10518                 return;
10519
10520         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
10521                            DISCOV_LE_RESTART_DELAY);
10522 }
10523
10524 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
10525                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
10526 {
10527         /* If a RSSI threshold has been specified, and
10528          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
10529          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
10530          * is set, let it through for further processing, as we might need to
10531          * restart the scan.
10532          *
10533          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
10534          * the results are also dropped.
10535          */
10536         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10537             (rssi == HCI_RSSI_INVALID ||
10538             (rssi < hdev->discovery.rssi &&
10539              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
10540                 return  false;
10541
10542         if (hdev->discovery.uuid_count != 0) {
10543                 /* If a list of UUIDs is provided in filter, results with no
10544                  * matching UUID should be dropped.
10545                  */
10546                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
10547                                    hdev->discovery.uuids) &&
10548                     !eir_has_uuids(scan_rsp, scan_rsp_len,
10549                                    hdev->discovery.uuid_count,
10550                                    hdev->discovery.uuids))
10551                         return false;
10552         }
10553
10554         /* If duplicate filtering does not report RSSI changes, then restart
10555          * scanning to ensure updated result with updated RSSI values.
10556          */
10557         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
10558                 restart_le_scan(hdev);
10559
10560                 /* Validate RSSI value against the RSSI threshold once more. */
10561                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10562                     rssi < hdev->discovery.rssi)
10563                         return false;
10564         }
10565
10566         return true;
10567 }
10568
10569 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10570                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
10571                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
10572 {
10573         char buf[512];
10574         struct mgmt_ev_device_found *ev = (void *)buf;
10575         size_t ev_size;
10576
10577         /* Don't send events for a non-kernel initiated discovery. With
10578          * LE one exception is if we have pend_le_reports > 0 in which
10579          * case we're doing passive scanning and want these events.
10580          */
10581         if (!hci_discovery_active(hdev)) {
10582                 if (link_type == ACL_LINK)
10583                         return;
10584                 if (link_type == LE_LINK &&
10585                     list_empty(&hdev->pend_le_reports) &&
10586                     !hci_is_adv_monitoring(hdev)) {
10587                         return;
10588                 }
10589         }
10590
10591         if (hdev->discovery.result_filtering) {
10592                 /* We are using service discovery */
10593                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
10594                                      scan_rsp_len))
10595                         return;
10596         }
10597
10598         if (hdev->discovery.limited) {
10599                 /* Check for limited discoverable bit */
10600                 if (dev_class) {
10601                         if (!(dev_class[1] & 0x20))
10602                                 return;
10603                 } else {
10604                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
10605                         if (!flags || !(flags[0] & LE_AD_LIMITED))
10606                                 return;
10607                 }
10608         }
10609
10610         /* Make sure that the buffer is big enough. The 5 extra bytes
10611          * are for the potential CoD field.
10612          */
10613         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
10614                 return;
10615
10616         memset(buf, 0, sizeof(buf));
10617
10618         /* In case of device discovery with BR/EDR devices (pre 1.2), the
10619          * RSSI value was reported as 0 when not available. This behavior
10620          * is kept when using device discovery. This is required for full
10621          * backwards compatibility with the API.
10622          *
10623          * However when using service discovery, the value 127 will be
10624          * returned when the RSSI is not available.
10625          */
10626         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
10627             link_type == ACL_LINK)
10628                 rssi = 0;
10629
10630         bacpy(&ev->addr.bdaddr, bdaddr);
10631         ev->addr.type = link_to_bdaddr(link_type, addr_type);
10632         ev->rssi = rssi;
10633         ev->flags = cpu_to_le32(flags);
10634
10635         if (eir_len > 0)
10636                 /* Copy EIR or advertising data into event */
10637                 memcpy(ev->eir, eir, eir_len);
10638
10639         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
10640                                        NULL))
10641                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
10642                                           dev_class, 3);
10643
10644         if (scan_rsp_len > 0)
10645                 /* Append scan response data to event */
10646                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
10647
10648         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10649         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
10650
10651         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
10652 }
10653
10654 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10655                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
10656 {
10657         struct mgmt_ev_device_found *ev;
10658         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
10659         u16 eir_len;
10660
10661         ev = (struct mgmt_ev_device_found *) buf;
10662
10663         memset(buf, 0, sizeof(buf));
10664
10665         bacpy(&ev->addr.bdaddr, bdaddr);
10666         ev->addr.type = link_to_bdaddr(link_type, addr_type);
10667         ev->rssi = rssi;
10668
10669         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
10670                                   name_len);
10671
10672         ev->eir_len = cpu_to_le16(eir_len);
10673
10674         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
10675 }
10676
10677 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
10678 {
10679         struct mgmt_ev_discovering ev;
10680
10681         bt_dev_dbg(hdev, "discovering %u", discovering);
10682
10683         memset(&ev, 0, sizeof(ev));
10684         ev.type = hdev->discovery.type;
10685         ev.discovering = discovering;
10686
10687         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
10688 }
10689
10690 void mgmt_suspending(struct hci_dev *hdev, u8 state)
10691 {
10692         struct mgmt_ev_controller_suspend ev;
10693
10694         ev.suspend_state = state;
10695         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
10696 }
10697
10698 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
10699                    u8 addr_type)
10700 {
10701         struct mgmt_ev_controller_resume ev;
10702
10703         ev.wake_reason = reason;
10704         if (bdaddr) {
10705                 bacpy(&ev.addr.bdaddr, bdaddr);
10706                 ev.addr.type = addr_type;
10707         } else {
10708                 memset(&ev.addr, 0, sizeof(ev.addr));
10709         }
10710
10711         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
10712 }
10713
10714 static struct hci_mgmt_chan chan = {
10715         .channel        = HCI_CHANNEL_CONTROL,
10716         .handler_count  = ARRAY_SIZE(mgmt_handlers),
10717         .handlers       = mgmt_handlers,
10718 #ifdef TIZEN_BT
10719         .tizen_handler_count    = ARRAY_SIZE(tizen_mgmt_handlers),
10720         .tizen_handlers = tizen_mgmt_handlers,
10721 #endif
10722         .hdev_init      = mgmt_init_hdev,
10723 };
10724
10725 int mgmt_init(void)
10726 {
10727         return hci_mgmt_chan_register(&chan);
10728 }
10729
10730 void mgmt_exit(void)
10731 {
10732         hci_mgmt_chan_unregister(&chan);
10733 }