net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #ifdef TIZEN_BT
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #endif
  38
  39 #include "hci_request.h"
  40 #include "smp.h"
  41 #include "mgmt_util.h"
  42 #include "mgmt_config.h"
  43 #include "msft.h"
  44
  45 #define MGMT_VERSION    1
  46 #define MGMT_REVISION   18
  47
  48 static const u16 mgmt_commands[] = {
  49         MGMT_OP_READ_INDEX_LIST,
  50         MGMT_OP_READ_INFO,
  51         MGMT_OP_SET_POWERED,
  52         MGMT_OP_SET_DISCOVERABLE,
  53         MGMT_OP_SET_CONNECTABLE,
  54         MGMT_OP_SET_FAST_CONNECTABLE,
  55         MGMT_OP_SET_BONDABLE,
  56         MGMT_OP_SET_LINK_SECURITY,
  57         MGMT_OP_SET_SSP,
  58         MGMT_OP_SET_HS,
  59         MGMT_OP_SET_LE,
  60         MGMT_OP_SET_DEV_CLASS,
  61         MGMT_OP_SET_LOCAL_NAME,
  62         MGMT_OP_ADD_UUID,
  63         MGMT_OP_REMOVE_UUID,
  64         MGMT_OP_LOAD_LINK_KEYS,
  65         MGMT_OP_LOAD_LONG_TERM_KEYS,
  66         MGMT_OP_DISCONNECT,
  67         MGMT_OP_GET_CONNECTIONS,
  68         MGMT_OP_PIN_CODE_REPLY,
  69         MGMT_OP_PIN_CODE_NEG_REPLY,
  70         MGMT_OP_SET_IO_CAPABILITY,
  71         MGMT_OP_PAIR_DEVICE,
  72         MGMT_OP_CANCEL_PAIR_DEVICE,
  73         MGMT_OP_UNPAIR_DEVICE,
  74         MGMT_OP_USER_CONFIRM_REPLY,
  75         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  76         MGMT_OP_USER_PASSKEY_REPLY,
  77         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  78         MGMT_OP_READ_LOCAL_OOB_DATA,
  79         MGMT_OP_ADD_REMOTE_OOB_DATA,
  80         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  81         MGMT_OP_START_DISCOVERY,
  82         MGMT_OP_STOP_DISCOVERY,
  83         MGMT_OP_CONFIRM_NAME,
  84         MGMT_OP_BLOCK_DEVICE,
  85         MGMT_OP_UNBLOCK_DEVICE,
  86         MGMT_OP_SET_DEVICE_ID,
  87         MGMT_OP_SET_ADVERTISING,
  88         MGMT_OP_SET_BREDR,
  89         MGMT_OP_SET_STATIC_ADDRESS,
  90         MGMT_OP_SET_SCAN_PARAMS,
  91         MGMT_OP_SET_SECURE_CONN,
  92         MGMT_OP_SET_DEBUG_KEYS,
  93         MGMT_OP_SET_PRIVACY,
  94         MGMT_OP_LOAD_IRKS,
  95         MGMT_OP_GET_CONN_INFO,
  96         MGMT_OP_GET_CLOCK_INFO,
  97         MGMT_OP_ADD_DEVICE,
  98         MGMT_OP_REMOVE_DEVICE,
  99         MGMT_OP_LOAD_CONN_PARAM,
 100         MGMT_OP_READ_UNCONF_INDEX_LIST,
 101         MGMT_OP_READ_CONFIG_INFO,
 102         MGMT_OP_SET_EXTERNAL_CONFIG,
 103         MGMT_OP_SET_PUBLIC_ADDRESS,
 104         MGMT_OP_START_SERVICE_DISCOVERY,
 105         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 106         MGMT_OP_READ_EXT_INDEX_LIST,
 107         MGMT_OP_READ_ADV_FEATURES,
 108         MGMT_OP_ADD_ADVERTISING,
 109         MGMT_OP_REMOVE_ADVERTISING,
 110         MGMT_OP_GET_ADV_SIZE_INFO,
 111         MGMT_OP_START_LIMITED_DISCOVERY,
 112         MGMT_OP_READ_EXT_INFO,
 113         MGMT_OP_SET_APPEARANCE,
 114         MGMT_OP_SET_BLOCKED_KEYS,
 115         MGMT_OP_SET_WIDEBAND_SPEECH,
 116         MGMT_OP_READ_SECURITY_INFO,
 117         MGMT_OP_READ_EXP_FEATURES_INFO,
 118         MGMT_OP_SET_EXP_FEATURE,
 119         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 120         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 121         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 122         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 123         MGMT_OP_GET_DEVICE_FLAGS,
 124         MGMT_OP_SET_DEVICE_FLAGS,
 125         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 126         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 127         MGMT_OP_REMOVE_ADV_MONITOR,
 128 };
 129
 130 static const u16 mgmt_events[] = {
 131         MGMT_EV_CONTROLLER_ERROR,
 132         MGMT_EV_INDEX_ADDED,
 133         MGMT_EV_INDEX_REMOVED,
 134         MGMT_EV_NEW_SETTINGS,
 135         MGMT_EV_CLASS_OF_DEV_CHANGED,
 136         MGMT_EV_LOCAL_NAME_CHANGED,
 137         MGMT_EV_NEW_LINK_KEY,
 138         MGMT_EV_NEW_LONG_TERM_KEY,
 139         MGMT_EV_DEVICE_CONNECTED,
 140         MGMT_EV_DEVICE_DISCONNECTED,
 141         MGMT_EV_CONNECT_FAILED,
 142         MGMT_EV_PIN_CODE_REQUEST,
 143         MGMT_EV_USER_CONFIRM_REQUEST,
 144         MGMT_EV_USER_PASSKEY_REQUEST,
 145         MGMT_EV_AUTH_FAILED,
 146         MGMT_EV_DEVICE_FOUND,
 147         MGMT_EV_DISCOVERING,
 148         MGMT_EV_DEVICE_BLOCKED,
 149         MGMT_EV_DEVICE_UNBLOCKED,
 150         MGMT_EV_DEVICE_UNPAIRED,
 151         MGMT_EV_PASSKEY_NOTIFY,
 152         MGMT_EV_NEW_IRK,
 153         MGMT_EV_NEW_CSRK,
 154         MGMT_EV_DEVICE_ADDED,
 155         MGMT_EV_DEVICE_REMOVED,
 156         MGMT_EV_NEW_CONN_PARAM,
 157         MGMT_EV_UNCONF_INDEX_ADDED,
 158         MGMT_EV_UNCONF_INDEX_REMOVED,
 159         MGMT_EV_NEW_CONFIG_OPTIONS,
 160         MGMT_EV_EXT_INDEX_ADDED,
 161         MGMT_EV_EXT_INDEX_REMOVED,
 162         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 163         MGMT_EV_ADVERTISING_ADDED,
 164         MGMT_EV_ADVERTISING_REMOVED,
 165         MGMT_EV_EXT_INFO_CHANGED,
 166         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 167         MGMT_EV_EXP_FEATURE_CHANGED,
 168         MGMT_EV_DEVICE_FLAGS_CHANGED,
 169         MGMT_EV_CONTROLLER_SUSPEND,
 170         MGMT_EV_CONTROLLER_RESUME,
 171 };
 172
 173 static const u16 mgmt_untrusted_commands[] = {
 174         MGMT_OP_READ_INDEX_LIST,
 175         MGMT_OP_READ_INFO,
 176         MGMT_OP_READ_UNCONF_INDEX_LIST,
 177         MGMT_OP_READ_CONFIG_INFO,
 178         MGMT_OP_READ_EXT_INDEX_LIST,
 179         MGMT_OP_READ_EXT_INFO,
 180         MGMT_OP_READ_SECURITY_INFO,
 181         MGMT_OP_READ_EXP_FEATURES_INFO,
 182         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 183         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 184 };
 185
 186 static const u16 mgmt_untrusted_events[] = {
 187         MGMT_EV_INDEX_ADDED,
 188         MGMT_EV_INDEX_REMOVED,
 189         MGMT_EV_NEW_SETTINGS,
 190         MGMT_EV_CLASS_OF_DEV_CHANGED,
 191         MGMT_EV_LOCAL_NAME_CHANGED,
 192         MGMT_EV_UNCONF_INDEX_ADDED,
 193         MGMT_EV_UNCONF_INDEX_REMOVED,
 194         MGMT_EV_NEW_CONFIG_OPTIONS,
 195         MGMT_EV_EXT_INDEX_ADDED,
 196         MGMT_EV_EXT_INDEX_REMOVED,
 197         MGMT_EV_EXT_INFO_CHANGED,
 198         MGMT_EV_EXP_FEATURE_CHANGED,
 199         MGMT_EV_ADV_MONITOR_ADDED,
 200         MGMT_EV_ADV_MONITOR_REMOVED,
 201 };
 202
 203 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 204
 205 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 206                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 207
 208 /* HCI to MGMT error code conversion table */
 209 static const u8 mgmt_status_table[] = {
 210         MGMT_STATUS_SUCCESS,
 211         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 212         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 213         MGMT_STATUS_FAILED,             /* Hardware Failure */
 214         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 215         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 216         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 217         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 218         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 219         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 220         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 221         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 222         MGMT_STATUS_BUSY,               /* Command Disallowed */
 223         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 224         MGMT_STATUS_REJECTED,           /* Rejected Security */
 225         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 226         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 227         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 228         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 229         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 230         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 231         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 232         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 233         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 234         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 235         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 236         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 237         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 238         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 239         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 240         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 241         MGMT_STATUS_FAILED,             /* Unspecified Error */
 242         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 243         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 244         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 245         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 246         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 247         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 248         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 249         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 250         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 251         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 252         MGMT_STATUS_FAILED,             /* Transaction Collision */
 253         MGMT_STATUS_FAILED,             /* Reserved for future use */
 254         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 255         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 256         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 257         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 258         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 259         MGMT_STATUS_FAILED,             /* Reserved for future use */
 260         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 261         MGMT_STATUS_FAILED,             /* Reserved for future use */
 262         MGMT_STATUS_FAILED,             /* Slot Violation */
 263         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 264         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 265         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 266         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 267         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 268         MGMT_STATUS_BUSY,               /* Controller Busy */
 269         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 270         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 271         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 272         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 273         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 274 };
 275
 276 static u8 mgmt_status(u8 hci_status)
 277 {
 278         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 279                 return mgmt_status_table[hci_status];
 280
 281         return MGMT_STATUS_FAILED;
 282 }
 283
 284 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 285                             u16 len, int flag)
 286 {
 287         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 288                                flag, NULL);
 289 }
 290
 291 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 292                               u16 len, int flag, struct sock *skip_sk)
 293 {
 294         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 295                                flag, skip_sk);
 296 }
 297
 298 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 299                       struct sock *skip_sk)
 300 {
 301         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 302                                HCI_SOCK_TRUSTED, skip_sk);
 303 }
 304
 305 static u8 le_addr_type(u8 mgmt_addr_type)
 306 {
 307         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 308                 return ADDR_LE_DEV_PUBLIC;
 309         else
 310                 return ADDR_LE_DEV_RANDOM;
 311 }
 312
 313 void mgmt_fill_version_info(void *ver)
 314 {
 315         struct mgmt_rp_read_version *rp = ver;
 316
 317         rp->version = MGMT_VERSION;
 318         rp->revision = cpu_to_le16(MGMT_REVISION);
 319 }
 320
 321 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 322                         u16 data_len)
 323 {
 324         struct mgmt_rp_read_version rp;
 325
 326         bt_dev_dbg(hdev, "sock %p", sk);
 327
 328         mgmt_fill_version_info(&rp);
 329
 330         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 331                                  &rp, sizeof(rp));
 332 }
 333
 334 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 335                          u16 data_len)
 336 {
 337         struct mgmt_rp_read_commands *rp;
 338         u16 num_commands, num_events;
 339         size_t rp_size;
 340         int i, err;
 341
 342         bt_dev_dbg(hdev, "sock %p", sk);
 343
 344         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 345                 num_commands = ARRAY_SIZE(mgmt_commands);
 346                 num_events = ARRAY_SIZE(mgmt_events);
 347         } else {
 348                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 349                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 350         }
 351
 352         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 353
 354         rp = kmalloc(rp_size, GFP_KERNEL);
 355         if (!rp)
 356                 return -ENOMEM;
 357
 358         rp->num_commands = cpu_to_le16(num_commands);
 359         rp->num_events = cpu_to_le16(num_events);
 360
 361         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 362                 __le16 *opcode = rp->opcodes;
 363
 364                 for (i = 0; i < num_commands; i++, opcode++)
 365                         put_unaligned_le16(mgmt_commands[i], opcode);
 366
 367                 for (i = 0; i < num_events; i++, opcode++)
 368                         put_unaligned_le16(mgmt_events[i], opcode);
 369         } else {
 370                 __le16 *opcode = rp->opcodes;
 371
 372                 for (i = 0; i < num_commands; i++, opcode++)
 373                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 374
 375                 for (i = 0; i < num_events; i++, opcode++)
 376                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 377         }
 378
 379         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 380                                 rp, rp_size);
 381         kfree(rp);
 382
 383         return err;
 384 }
 385
 386 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 387                            u16 data_len)
 388 {
 389         struct mgmt_rp_read_index_list *rp;
 390         struct hci_dev *d;
 391         size_t rp_len;
 392         u16 count;
 393         int err;
 394
 395         bt_dev_dbg(hdev, "sock %p", sk);
 396
 397         read_lock(&hci_dev_list_lock);
 398
 399         count = 0;
 400         list_for_each_entry(d, &hci_dev_list, list) {
 401                 if (d->dev_type == HCI_PRIMARY &&
 402                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 403                         count++;
 404         }
 405
 406         rp_len = sizeof(*rp) + (2 * count);
 407         rp = kmalloc(rp_len, GFP_ATOMIC);
 408         if (!rp) {
 409                 read_unlock(&hci_dev_list_lock);
 410                 return -ENOMEM;
 411         }
 412
 413         count = 0;
 414         list_for_each_entry(d, &hci_dev_list, list) {
 415                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 416                     hci_dev_test_flag(d, HCI_CONFIG) ||
 417                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 418                         continue;
 419
 420                 /* Devices marked as raw-only are neither configured
 421                  * nor unconfigured controllers.
 422                  */
 423                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 424                         continue;
 425
 426                 if (d->dev_type == HCI_PRIMARY &&
 427                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 428                         rp->index[count++] = cpu_to_le16(d->id);
 429                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 430                 }
 431         }
 432
 433         rp->num_controllers = cpu_to_le16(count);
 434         rp_len = sizeof(*rp) + (2 * count);
 435
 436         read_unlock(&hci_dev_list_lock);
 437
 438         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 439                                 0, rp, rp_len);
 440
 441         kfree(rp);
 442
 443         return err;
 444 }
 445
 446 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 447                                   void *data, u16 data_len)
 448 {
 449         struct mgmt_rp_read_unconf_index_list *rp;
 450         struct hci_dev *d;
 451         size_t rp_len;
 452         u16 count;
 453         int err;
 454
 455         bt_dev_dbg(hdev, "sock %p", sk);
 456
 457         read_lock(&hci_dev_list_lock);
 458
 459         count = 0;
 460         list_for_each_entry(d, &hci_dev_list, list) {
 461                 if (d->dev_type == HCI_PRIMARY &&
 462                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 463                         count++;
 464         }
 465
 466         rp_len = sizeof(*rp) + (2 * count);
 467         rp = kmalloc(rp_len, GFP_ATOMIC);
 468         if (!rp) {
 469                 read_unlock(&hci_dev_list_lock);
 470                 return -ENOMEM;
 471         }
 472
 473         count = 0;
 474         list_for_each_entry(d, &hci_dev_list, list) {
 475                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 476                     hci_dev_test_flag(d, HCI_CONFIG) ||
 477                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 478                         continue;
 479
 480                 /* Devices marked as raw-only are neither configured
 481                  * nor unconfigured controllers.
 482                  */
 483                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 484                         continue;
 485
 486                 if (d->dev_type == HCI_PRIMARY &&
 487                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 488                         rp->index[count++] = cpu_to_le16(d->id);
 489                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 490                 }
 491         }
 492
 493         rp->num_controllers = cpu_to_le16(count);
 494         rp_len = sizeof(*rp) + (2 * count);
 495
 496         read_unlock(&hci_dev_list_lock);
 497
 498         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 499                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 500
 501         kfree(rp);
 502
 503         return err;
 504 }
 505
 506 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 507                                void *data, u16 data_len)
 508 {
 509         struct mgmt_rp_read_ext_index_list *rp;
 510         struct hci_dev *d;
 511         u16 count;
 512         int err;
 513
 514         bt_dev_dbg(hdev, "sock %p", sk);
 515
 516         read_lock(&hci_dev_list_lock);
 517
 518         count = 0;
 519         list_for_each_entry(d, &hci_dev_list, list) {
 520                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 521                         count++;
 522         }
 523
 524         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 525         if (!rp) {
 526                 read_unlock(&hci_dev_list_lock);
 527                 return -ENOMEM;
 528         }
 529
 530         count = 0;
 531         list_for_each_entry(d, &hci_dev_list, list) {
 532                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 533                     hci_dev_test_flag(d, HCI_CONFIG) ||
 534                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 535                         continue;
 536
 537                 /* Devices marked as raw-only are neither configured
 538                  * nor unconfigured controllers.
 539                  */
 540                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 541                         continue;
 542
 543                 if (d->dev_type == HCI_PRIMARY) {
 544                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 545                                 rp->entry[count].type = 0x01;
 546                         else
 547                                 rp->entry[count].type = 0x00;
 548                 } else if (d->dev_type == HCI_AMP) {
 549                         rp->entry[count].type = 0x02;
 550                 } else {
 551                         continue;
 552                 }
 553
 554                 rp->entry[count].bus = d->bus;
 555                 rp->entry[count++].index = cpu_to_le16(d->id);
 556                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 557         }
 558
 559         rp->num_controllers = cpu_to_le16(count);
 560
 561         read_unlock(&hci_dev_list_lock);
 562
 563         /* If this command is called at least once, then all the
 564          * default index and unconfigured index events are disabled
 565          * and from now on only extended index events are used.
 566          */
 567         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 568         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 569         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 570
 571         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 572                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 573                                 struct_size(rp, entry, count));
 574
 575         kfree(rp);
 576
 577         return err;
 578 }
 579
 580 static bool is_configured(struct hci_dev *hdev)
 581 {
 582         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 583             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 584                 return false;
 585
 586         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 587              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 588             !bacmp(&hdev->public_addr, BDADDR_ANY))
 589                 return false;
 590
 591         return true;
 592 }
 593
 594 static __le32 get_missing_options(struct hci_dev *hdev)
 595 {
 596         u32 options = 0;
 597
 598         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 599             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 600                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 601
 602         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 603              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 604             !bacmp(&hdev->public_addr, BDADDR_ANY))
 605                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 606
 607         return cpu_to_le32(options);
 608 }
 609
 610 static int new_options(struct hci_dev *hdev, struct sock *skip)
 611 {
 612         __le32 options = get_missing_options(hdev);
 613
 614         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 615                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 616 }
 617
 618 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 619 {
 620         __le32 options = get_missing_options(hdev);
 621
 622         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 623                                  sizeof(options));
 624 }
 625
 626 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 627                             void *data, u16 data_len)
 628 {
 629         struct mgmt_rp_read_config_info rp;
 630         u32 options = 0;
 631
 632         bt_dev_dbg(hdev, "sock %p", sk);
 633
 634         hci_dev_lock(hdev);
 635
 636         memset(&rp, 0, sizeof(rp));
 637         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 638
 639         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 640                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 641
 642         if (hdev->set_bdaddr)
 643                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 644
 645         rp.supported_options = cpu_to_le32(options);
 646         rp.missing_options = get_missing_options(hdev);
 647
 648         hci_dev_unlock(hdev);
 649
 650         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 651                                  &rp, sizeof(rp));
 652 }
 653
 654 static u32 get_supported_phys(struct hci_dev *hdev)
 655 {
 656         u32 supported_phys = 0;
 657
 658         if (lmp_bredr_capable(hdev)) {
 659                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 660
 661                 if (hdev->features[0][0] & LMP_3SLOT)
 662                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 663
 664                 if (hdev->features[0][0] & LMP_5SLOT)
 665                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 666
 667                 if (lmp_edr_2m_capable(hdev)) {
 668                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 669
 670                         if (lmp_edr_3slot_capable(hdev))
 671                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 672
 673                         if (lmp_edr_5slot_capable(hdev))
 674                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 675
 676                         if (lmp_edr_3m_capable(hdev)) {
 677                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 678
 679                                 if (lmp_edr_3slot_capable(hdev))
 680                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 681
 682                                 if (lmp_edr_5slot_capable(hdev))
 683                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 684                         }
 685                 }
 686         }
 687
 688         if (lmp_le_capable(hdev)) {
 689                 supported_phys |= MGMT_PHY_LE_1M_TX;
 690                 supported_phys |= MGMT_PHY_LE_1M_RX;
 691
 692                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 693                         supported_phys |= MGMT_PHY_LE_2M_TX;
 694                         supported_phys |= MGMT_PHY_LE_2M_RX;
 695                 }
 696
 697                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 698                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 699                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 700                 }
 701         }
 702
 703         return supported_phys;
 704 }
 705
 706 static u32 get_selected_phys(struct hci_dev *hdev)
 707 {
 708         u32 selected_phys = 0;
 709
 710         if (lmp_bredr_capable(hdev)) {
 711                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 712
 713                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 714                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 715
 716                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 717                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 718
 719                 if (lmp_edr_2m_capable(hdev)) {
 720                         if (!(hdev->pkt_type & HCI_2DH1))
 721                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 722
 723                         if (lmp_edr_3slot_capable(hdev) &&
 724                             !(hdev->pkt_type & HCI_2DH3))
 725                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 726
 727                         if (lmp_edr_5slot_capable(hdev) &&
 728                             !(hdev->pkt_type & HCI_2DH5))
 729                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 730
 731                         if (lmp_edr_3m_capable(hdev)) {
 732                                 if (!(hdev->pkt_type & HCI_3DH1))
 733                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 734
 735                                 if (lmp_edr_3slot_capable(hdev) &&
 736                                     !(hdev->pkt_type & HCI_3DH3))
 737                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 738
 739                                 if (lmp_edr_5slot_capable(hdev) &&
 740                                     !(hdev->pkt_type & HCI_3DH5))
 741                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 742                         }
 743                 }
 744         }
 745
 746         if (lmp_le_capable(hdev)) {
 747                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 748                         selected_phys |= MGMT_PHY_LE_1M_TX;
 749
 750                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 751                         selected_phys |= MGMT_PHY_LE_1M_RX;
 752
 753                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 754                         selected_phys |= MGMT_PHY_LE_2M_TX;
 755
 756                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 757                         selected_phys |= MGMT_PHY_LE_2M_RX;
 758
 759                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 760                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 761
 762                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 763                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 764         }
 765
 766         return selected_phys;
 767 }
 768
 769 static u32 get_configurable_phys(struct hci_dev *hdev)
 770 {
 771         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 772                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 773 }
 774
 775 static u32 get_supported_settings(struct hci_dev *hdev)
 776 {
 777         u32 settings = 0;
 778
 779         settings |= MGMT_SETTING_POWERED;
 780         settings |= MGMT_SETTING_BONDABLE;
 781         settings |= MGMT_SETTING_DEBUG_KEYS;
 782         settings |= MGMT_SETTING_CONNECTABLE;
 783         settings |= MGMT_SETTING_DISCOVERABLE;
 784
 785         if (lmp_bredr_capable(hdev)) {
 786                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 787                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 788                 settings |= MGMT_SETTING_BREDR;
 789                 settings |= MGMT_SETTING_LINK_SECURITY;
 790
 791                 if (lmp_ssp_capable(hdev)) {
 792                         settings |= MGMT_SETTING_SSP;
 793                         if (IS_ENABLED(CONFIG_BT_HS))
 794                                 settings |= MGMT_SETTING_HS;
 795                 }
 796
 797                 if (lmp_sc_capable(hdev))
 798                         settings |= MGMT_SETTING_SECURE_CONN;
 799
 800                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 801                              &hdev->quirks))
 802                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 803         }
 804
 805         if (lmp_le_capable(hdev)) {
 806                 settings |= MGMT_SETTING_LE;
 807                 settings |= MGMT_SETTING_SECURE_CONN;
 808                 settings |= MGMT_SETTING_PRIVACY;
 809                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 810
 811                 /* When the experimental feature for LL Privacy support is
 812                  * enabled, then advertising is no longer supported.
 813                  */
 814                 if (!hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
 815                         settings |= MGMT_SETTING_ADVERTISING;
 816         }
 817
 818         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 819             hdev->set_bdaddr)
 820                 settings |= MGMT_SETTING_CONFIGURATION;
 821
 822         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 823
 824         return settings;
 825 }
 826
 827 static u32 get_current_settings(struct hci_dev *hdev)
 828 {
 829         u32 settings = 0;
 830
 831         if (hdev_is_powered(hdev))
 832                 settings |= MGMT_SETTING_POWERED;
 833
 834         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 835                 settings |= MGMT_SETTING_CONNECTABLE;
 836
 837         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 838                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 839
 840         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 841                 settings |= MGMT_SETTING_DISCOVERABLE;
 842
 843         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 844                 settings |= MGMT_SETTING_BONDABLE;
 845
 846         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 847                 settings |= MGMT_SETTING_BREDR;
 848
 849         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 850                 settings |= MGMT_SETTING_LE;
 851
 852         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 853                 settings |= MGMT_SETTING_LINK_SECURITY;
 854
 855         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 856                 settings |= MGMT_SETTING_SSP;
 857
 858         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 859                 settings |= MGMT_SETTING_HS;
 860
 861         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 862                 settings |= MGMT_SETTING_ADVERTISING;
 863
 864         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 865                 settings |= MGMT_SETTING_SECURE_CONN;
 866
 867         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 868                 settings |= MGMT_SETTING_DEBUG_KEYS;
 869
 870         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 871                 settings |= MGMT_SETTING_PRIVACY;
 872
 873         /* The current setting for static address has two purposes. The
 874          * first is to indicate if the static address will be used and
 875          * the second is to indicate if it is actually set.
 876          *
 877          * This means if the static address is not configured, this flag
 878          * will never be set. If the address is configured, then if the
 879          * address is actually used decides if the flag is set or not.
 880          *
 881          * For single mode LE only controllers and dual-mode controllers
 882          * with BR/EDR disabled, the existence of the static address will
 883          * be evaluated.
 884          */
 885         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 886             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 887             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 888                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 889                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 890         }
 891
 892         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 893                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 894
 895         return settings;
 896 }
 897
 898 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 899 {
 900         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 901 }
 902
 903 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 904                                                   struct hci_dev *hdev,
 905                                                   const void *data)
 906 {
 907         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 908 }
 909
 910 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 911 {
 912         struct mgmt_pending_cmd *cmd;
 913
 914         /* If there's a pending mgmt command the flags will not yet have
 915          * their final values, so check for this first.
 916          */
 917         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 918         if (cmd) {
 919                 struct mgmt_mode *cp = cmd->param;
 920                 if (cp->val == 0x01)
 921                         return LE_AD_GENERAL;
 922                 else if (cp->val == 0x02)
 923                         return LE_AD_LIMITED;
 924         } else {
 925                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 926                         return LE_AD_LIMITED;
 927                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 928                         return LE_AD_GENERAL;
 929         }
 930
 931         return 0;
 932 }
 933
 934 bool mgmt_get_connectable(struct hci_dev *hdev)
 935 {
 936         struct mgmt_pending_cmd *cmd;
 937
 938         /* If there's a pending mgmt command the flag will not yet have
 939          * it's final value, so check for this first.
 940          */
 941         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 942         if (cmd) {
 943                 struct mgmt_mode *cp = cmd->param;
 944
 945                 return cp->val;
 946         }
 947
 948         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 949 }
 950
 951 static void service_cache_off(struct work_struct *work)
 952 {
 953         struct hci_dev *hdev = container_of(work, struct hci_dev,
 954                                             service_cache.work);
 955         struct hci_request req;
 956
 957         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 958                 return;
 959
 960         hci_req_init(&req, hdev);
 961
 962         hci_dev_lock(hdev);
 963
 964         __hci_req_update_eir(&req);
 965         __hci_req_update_class(&req);
 966
 967         hci_dev_unlock(hdev);
 968
 969         hci_req_run(&req, NULL);
 970 }
 971
 972 static void rpa_expired(struct work_struct *work)
 973 {
 974         struct hci_dev *hdev = container_of(work, struct hci_dev,
 975                                             rpa_expired.work);
 976         struct hci_request req;
 977
 978         bt_dev_dbg(hdev, "");
 979
 980         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 981
 982         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 983                 return;
 984
 985         /* The generation of a new RPA and programming it into the
 986          * controller happens in the hci_req_enable_advertising()
 987          * function.
 988          */
 989         hci_req_init(&req, hdev);
 990         if (ext_adv_capable(hdev))
 991                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 992         else
 993                 __hci_req_enable_advertising(&req);
 994         hci_req_run(&req, NULL);
 995 }
 996
 997 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 998 {
 999         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1000                 return;
1001
1002         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1003         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1004
1005         /* Non-mgmt controlled devices get this bit set
1006          * implicitly so that pairing works for them, however
1007          * for mgmt we require user-space to explicitly enable
1008          * it
1009          */
1010         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1011 }
1012
1013 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1014                                 void *data, u16 data_len)
1015 {
1016         struct mgmt_rp_read_info rp;
1017
1018         bt_dev_dbg(hdev, "sock %p", sk);
1019
1020         hci_dev_lock(hdev);
1021
1022         memset(&rp, 0, sizeof(rp));
1023
1024         bacpy(&rp.bdaddr, &hdev->bdaddr);
1025
1026         rp.version = hdev->hci_ver;
1027         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1028
1029         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1030         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1031
1032         memcpy(rp.dev_class, hdev->dev_class, 3);
1033
1034         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1035         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1036
1037         hci_dev_unlock(hdev);
1038
1039         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1040                                  sizeof(rp));
1041 }
1042
1043 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1044 {
1045         u16 eir_len = 0;
1046         size_t name_len;
1047
1048         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1049                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1050                                           hdev->dev_class, 3);
1051
1052         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1053                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1054                                           hdev->appearance);
1055
1056         name_len = strlen(hdev->dev_name);
1057         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1058                                   hdev->dev_name, name_len);
1059
1060         name_len = strlen(hdev->short_name);
1061         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1062                                   hdev->short_name, name_len);
1063
1064         return eir_len;
1065 }
1066
1067 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1068                                     void *data, u16 data_len)
1069 {
1070         char buf[512];
1071         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1072         u16 eir_len;
1073
1074         bt_dev_dbg(hdev, "sock %p", sk);
1075
1076         memset(&buf, 0, sizeof(buf));
1077
1078         hci_dev_lock(hdev);
1079
1080         bacpy(&rp->bdaddr, &hdev->bdaddr);
1081
1082         rp->version = hdev->hci_ver;
1083         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1084
1085         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1086         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1087
1088
1089         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1090         rp->eir_len = cpu_to_le16(eir_len);
1091
1092         hci_dev_unlock(hdev);
1093
1094         /* If this command is called at least once, then the events
1095          * for class of device and local name changes are disabled
1096          * and only the new extended controller information event
1097          * is used.
1098          */
1099         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1100         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1101         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1102
1103         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1104                                  sizeof(*rp) + eir_len);
1105 }
1106
1107 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1108 {
1109         char buf[512];
1110         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1111         u16 eir_len;
1112
1113         memset(buf, 0, sizeof(buf));
1114
1115         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1116         ev->eir_len = cpu_to_le16(eir_len);
1117
1118         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1119                                   sizeof(*ev) + eir_len,
1120                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1121 }
1122
1123 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1124 {
1125         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1126
1127         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1128                                  sizeof(settings));
1129 }
1130
1131 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1132 {
1133         bt_dev_dbg(hdev, "status 0x%02x", status);
1134
1135         if (hci_conn_count(hdev) == 0) {
1136                 cancel_delayed_work(&hdev->power_off);
1137                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1138         }
1139 }
1140
1141 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1142 {
1143         struct mgmt_ev_advertising_added ev;
1144
1145         ev.instance = instance;
1146
1147         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1148 }
1149
1150 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1151                               u8 instance)
1152 {
1153         struct mgmt_ev_advertising_removed ev;
1154
1155         ev.instance = instance;
1156
1157         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1158 }
1159
1160 static void cancel_adv_timeout(struct hci_dev *hdev)
1161 {
1162         if (hdev->adv_instance_timeout) {
1163                 hdev->adv_instance_timeout = 0;
1164                 cancel_delayed_work(&hdev->adv_instance_expire);
1165         }
1166 }
1167
1168 static int clean_up_hci_state(struct hci_dev *hdev)
1169 {
1170         struct hci_request req;
1171         struct hci_conn *conn;
1172         bool discov_stopped;
1173         int err;
1174
1175         hci_req_init(&req, hdev);
1176
1177         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1178             test_bit(HCI_PSCAN, &hdev->flags)) {
1179                 u8 scan = 0x00;
1180                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1181         }
1182
1183         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1184
1185         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1186                 __hci_req_disable_advertising(&req);
1187
1188         discov_stopped = hci_req_stop_discovery(&req);
1189
1190         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1191                 /* 0x15 == Terminated due to Power Off */
1192                 __hci_abort_conn(&req, conn, 0x15);
1193         }
1194
1195         err = hci_req_run(&req, clean_up_hci_complete);
1196         if (!err && discov_stopped)
1197                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1198
1199         return err;
1200 }
1201
1202 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1203                        u16 len)
1204 {
1205         struct mgmt_mode *cp = data;
1206         struct mgmt_pending_cmd *cmd;
1207         int err;
1208
1209         bt_dev_dbg(hdev, "sock %p", sk);
1210
1211         if (cp->val != 0x00 && cp->val != 0x01)
1212                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1213                                        MGMT_STATUS_INVALID_PARAMS);
1214
1215         hci_dev_lock(hdev);
1216
1217         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1218                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1219                                       MGMT_STATUS_BUSY);
1220                 goto failed;
1221         }
1222
1223         if (!!cp->val == hdev_is_powered(hdev)) {
1224                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1225                 goto failed;
1226         }
1227
1228         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1229         if (!cmd) {
1230                 err = -ENOMEM;
1231                 goto failed;
1232         }
1233
1234         if (cp->val) {
1235                 queue_work(hdev->req_workqueue, &hdev->power_on);
1236                 err = 0;
1237         } else {
1238                 /* Disconnect connections, stop scans, etc */
1239                 err = clean_up_hci_state(hdev);
1240                 if (!err)
1241                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1242                                            HCI_POWER_OFF_TIMEOUT);
1243
1244                 /* ENODATA means there were no HCI commands queued */
1245                 if (err == -ENODATA) {
1246                         cancel_delayed_work(&hdev->power_off);
1247                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1248                         err = 0;
1249                 }
1250         }
1251
1252 failed:
1253         hci_dev_unlock(hdev);
1254         return err;
1255 }
1256
1257 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1258 {
1259         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1260
1261         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1262                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1263 }
1264
1265 int mgmt_new_settings(struct hci_dev *hdev)
1266 {
1267         return new_settings(hdev, NULL);
1268 }
1269
1270 struct cmd_lookup {
1271         struct sock *sk;
1272         struct hci_dev *hdev;
1273         u8 mgmt_status;
1274 };
1275
1276 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1277 {
1278         struct cmd_lookup *match = data;
1279
1280         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1281
1282         list_del(&cmd->list);
1283
1284         if (match->sk == NULL) {
1285                 match->sk = cmd->sk;
1286                 sock_hold(match->sk);
1287         }
1288
1289         mgmt_pending_free(cmd);
1290 }
1291
1292 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1293 {
1294         u8 *status = data;
1295
1296         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1297         mgmt_pending_remove(cmd);
1298 }
1299
1300 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1301 {
1302         if (cmd->cmd_complete) {
1303                 u8 *status = data;
1304
1305                 cmd->cmd_complete(cmd, *status);
1306                 mgmt_pending_remove(cmd);
1307
1308                 return;
1309         }
1310
1311         cmd_status_rsp(cmd, data);
1312 }
1313
1314 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1315 {
1316         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1317                                  cmd->param, cmd->param_len);
1318 }
1319
1320 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1321 {
1322         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1323                                  cmd->param, sizeof(struct mgmt_addr_info));
1324 }
1325
1326 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1327 {
1328         if (!lmp_bredr_capable(hdev))
1329                 return MGMT_STATUS_NOT_SUPPORTED;
1330         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1331                 return MGMT_STATUS_REJECTED;
1332         else
1333                 return MGMT_STATUS_SUCCESS;
1334 }
1335
1336 static u8 mgmt_le_support(struct hci_dev *hdev)
1337 {
1338         if (!lmp_le_capable(hdev))
1339                 return MGMT_STATUS_NOT_SUPPORTED;
1340         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1341                 return MGMT_STATUS_REJECTED;
1342         else
1343                 return MGMT_STATUS_SUCCESS;
1344 }
1345
1346 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1347 {
1348         struct mgmt_pending_cmd *cmd;
1349
1350         bt_dev_dbg(hdev, "status 0x%02x", status);
1351
1352         hci_dev_lock(hdev);
1353
1354         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1355         if (!cmd)
1356                 goto unlock;
1357
1358         if (status) {
1359                 u8 mgmt_err = mgmt_status(status);
1360                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1361                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1362                 goto remove_cmd;
1363         }
1364
1365         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1366             hdev->discov_timeout > 0) {
1367                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1368                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1369         }
1370
1371         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1372         new_settings(hdev, cmd->sk);
1373
1374 remove_cmd:
1375         mgmt_pending_remove(cmd);
1376
1377 unlock:
1378         hci_dev_unlock(hdev);
1379 }
1380
1381 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1382                             u16 len)
1383 {
1384         struct mgmt_cp_set_discoverable *cp = data;
1385         struct mgmt_pending_cmd *cmd;
1386         u16 timeout;
1387         int err;
1388
1389         bt_dev_dbg(hdev, "sock %p", sk);
1390
1391         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1392             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1393                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1394                                        MGMT_STATUS_REJECTED);
1395
1396         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1397                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1398                                        MGMT_STATUS_INVALID_PARAMS);
1399
1400         timeout = __le16_to_cpu(cp->timeout);
1401
1402         /* Disabling discoverable requires that no timeout is set,
1403          * and enabling limited discoverable requires a timeout.
1404          */
1405         if ((cp->val == 0x00 && timeout > 0) ||
1406             (cp->val == 0x02 && timeout == 0))
1407                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1408                                        MGMT_STATUS_INVALID_PARAMS);
1409
1410         hci_dev_lock(hdev);
1411
1412         if (!hdev_is_powered(hdev) && timeout > 0) {
1413                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1414                                       MGMT_STATUS_NOT_POWERED);
1415                 goto failed;
1416         }
1417
1418         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1419             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1420                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1421                                       MGMT_STATUS_BUSY);
1422                 goto failed;
1423         }
1424
1425         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1426                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1427                                       MGMT_STATUS_REJECTED);
1428                 goto failed;
1429         }
1430
1431         if (hdev->advertising_paused) {
1432                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1433                                       MGMT_STATUS_BUSY);
1434                 goto failed;
1435         }
1436
1437         if (!hdev_is_powered(hdev)) {
1438                 bool changed = false;
1439
1440                 /* Setting limited discoverable when powered off is
1441                  * not a valid operation since it requires a timeout
1442                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1443                  */
1444                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1445                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1446                         changed = true;
1447                 }
1448
1449                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1450                 if (err < 0)
1451                         goto failed;
1452
1453                 if (changed)
1454                         err = new_settings(hdev, sk);
1455
1456                 goto failed;
1457         }
1458
1459         /* If the current mode is the same, then just update the timeout
1460          * value with the new value. And if only the timeout gets updated,
1461          * then no need for any HCI transactions.
1462          */
1463         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1464             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1465                                                    HCI_LIMITED_DISCOVERABLE)) {
1466                 cancel_delayed_work(&hdev->discov_off);
1467                 hdev->discov_timeout = timeout;
1468
1469                 if (cp->val && hdev->discov_timeout > 0) {
1470                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1471                         queue_delayed_work(hdev->req_workqueue,
1472                                            &hdev->discov_off, to);
1473                 }
1474
1475                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1476                 goto failed;
1477         }
1478
1479         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1480         if (!cmd) {
1481                 err = -ENOMEM;
1482                 goto failed;
1483         }
1484
1485         /* Cancel any potential discoverable timeout that might be
1486          * still active and store new timeout value. The arming of
1487          * the timeout happens in the complete handler.
1488          */
1489         cancel_delayed_work(&hdev->discov_off);
1490         hdev->discov_timeout = timeout;
1491
1492         if (cp->val)
1493                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1494         else
1495                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1496
1497         /* Limited discoverable mode */
1498         if (cp->val == 0x02)
1499                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1500         else
1501                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1502
1503         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1504         err = 0;
1505
1506 failed:
1507         hci_dev_unlock(hdev);
1508         return err;
1509 }
1510
1511 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1512 {
1513         struct mgmt_pending_cmd *cmd;
1514
1515         bt_dev_dbg(hdev, "status 0x%02x", status);
1516
1517         hci_dev_lock(hdev);
1518
1519         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1520         if (!cmd)
1521                 goto unlock;
1522
1523         if (status) {
1524                 u8 mgmt_err = mgmt_status(status);
1525                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1526                 goto remove_cmd;
1527         }
1528
1529         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1530         new_settings(hdev, cmd->sk);
1531
1532 remove_cmd:
1533         mgmt_pending_remove(cmd);
1534
1535 unlock:
1536         hci_dev_unlock(hdev);
1537 }
1538
1539 static int set_connectable_update_settings(struct hci_dev *hdev,
1540                                            struct sock *sk, u8 val)
1541 {
1542         bool changed = false;
1543         int err;
1544
1545         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1546                 changed = true;
1547
1548         if (val) {
1549                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1550         } else {
1551                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1552                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1553         }
1554
1555         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1556         if (err < 0)
1557                 return err;
1558
1559         if (changed) {
1560                 hci_req_update_scan(hdev);
1561                 hci_update_background_scan(hdev);
1562                 return new_settings(hdev, sk);
1563         }
1564
1565         return 0;
1566 }
1567
1568 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1569                            u16 len)
1570 {
1571         struct mgmt_mode *cp = data;
1572         struct mgmt_pending_cmd *cmd;
1573         int err;
1574
1575         bt_dev_dbg(hdev, "sock %p", sk);
1576
1577         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1578             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1579                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1580                                        MGMT_STATUS_REJECTED);
1581
1582         if (cp->val != 0x00 && cp->val != 0x01)
1583                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1584                                        MGMT_STATUS_INVALID_PARAMS);
1585
1586         hci_dev_lock(hdev);
1587
1588         if (!hdev_is_powered(hdev)) {
1589                 err = set_connectable_update_settings(hdev, sk, cp->val);
1590                 goto failed;
1591         }
1592
1593         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1594             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1595                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1596                                       MGMT_STATUS_BUSY);
1597                 goto failed;
1598         }
1599
1600         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1601         if (!cmd) {
1602                 err = -ENOMEM;
1603                 goto failed;
1604         }
1605
1606         if (cp->val) {
1607                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1608         } else {
1609                 if (hdev->discov_timeout > 0)
1610                         cancel_delayed_work(&hdev->discov_off);
1611
1612                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1613                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1614                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1615         }
1616
1617         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1618         err = 0;
1619
1620 failed:
1621         hci_dev_unlock(hdev);
1622         return err;
1623 }
1624
1625 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1626                         u16 len)
1627 {
1628         struct mgmt_mode *cp = data;
1629         bool changed;
1630         int err;
1631
1632         bt_dev_dbg(hdev, "sock %p", sk);
1633
1634         if (cp->val != 0x00 && cp->val != 0x01)
1635                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1636                                        MGMT_STATUS_INVALID_PARAMS);
1637
1638         hci_dev_lock(hdev);
1639
1640         if (cp->val)
1641                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1642         else
1643                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1644
1645         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1646         if (err < 0)
1647                 goto unlock;
1648
1649         if (changed) {
1650                 /* In limited privacy mode the change of bondable mode
1651                  * may affect the local advertising address.
1652                  */
1653                 if (hdev_is_powered(hdev) &&
1654                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1655                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1656                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1657                         queue_work(hdev->req_workqueue,
1658                                    &hdev->discoverable_update);
1659
1660                 err = new_settings(hdev, sk);
1661         }
1662
1663 unlock:
1664         hci_dev_unlock(hdev);
1665         return err;
1666 }
1667
1668 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1669                              u16 len)
1670 {
1671         struct mgmt_mode *cp = data;
1672         struct mgmt_pending_cmd *cmd;
1673         u8 val, status;
1674         int err;
1675
1676         bt_dev_dbg(hdev, "sock %p", sk);
1677
1678         status = mgmt_bredr_support(hdev);
1679         if (status)
1680                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1681                                        status);
1682
1683         if (cp->val != 0x00 && cp->val != 0x01)
1684                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1685                                        MGMT_STATUS_INVALID_PARAMS);
1686
1687         hci_dev_lock(hdev);
1688
1689         if (!hdev_is_powered(hdev)) {
1690                 bool changed = false;
1691
1692                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1693                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1694                         changed = true;
1695                 }
1696
1697                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1698                 if (err < 0)
1699                         goto failed;
1700
1701                 if (changed)
1702                         err = new_settings(hdev, sk);
1703
1704                 goto failed;
1705         }
1706
1707         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1708                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1709                                       MGMT_STATUS_BUSY);
1710                 goto failed;
1711         }
1712
1713         val = !!cp->val;
1714
1715         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1716                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1717                 goto failed;
1718         }
1719
1720         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1721         if (!cmd) {
1722                 err = -ENOMEM;
1723                 goto failed;
1724         }
1725
1726         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1727         if (err < 0) {
1728                 mgmt_pending_remove(cmd);
1729                 goto failed;
1730         }
1731
1732 failed:
1733         hci_dev_unlock(hdev);
1734         return err;
1735 }
1736
1737 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1738 {
1739         struct mgmt_mode *cp = data;
1740         struct mgmt_pending_cmd *cmd;
1741         u8 status;
1742         int err;
1743
1744         bt_dev_dbg(hdev, "sock %p", sk);
1745
1746         status = mgmt_bredr_support(hdev);
1747         if (status)
1748                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1749
1750         if (!lmp_ssp_capable(hdev))
1751                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1752                                        MGMT_STATUS_NOT_SUPPORTED);
1753
1754         if (cp->val != 0x00 && cp->val != 0x01)
1755                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1756                                        MGMT_STATUS_INVALID_PARAMS);
1757
1758         hci_dev_lock(hdev);
1759
1760         if (!hdev_is_powered(hdev)) {
1761                 bool changed;
1762
1763                 if (cp->val) {
1764                         changed = !hci_dev_test_and_set_flag(hdev,
1765                                                              HCI_SSP_ENABLED);
1766                 } else {
1767                         changed = hci_dev_test_and_clear_flag(hdev,
1768                                                               HCI_SSP_ENABLED);
1769                         if (!changed)
1770                                 changed = hci_dev_test_and_clear_flag(hdev,
1771                                                                       HCI_HS_ENABLED);
1772                         else
1773                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1774                 }
1775
1776                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1777                 if (err < 0)
1778                         goto failed;
1779
1780                 if (changed)
1781                         err = new_settings(hdev, sk);
1782
1783                 goto failed;
1784         }
1785
1786         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1787                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1788                                       MGMT_STATUS_BUSY);
1789                 goto failed;
1790         }
1791
1792         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1793                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1794                 goto failed;
1795         }
1796
1797         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1798         if (!cmd) {
1799                 err = -ENOMEM;
1800                 goto failed;
1801         }
1802
1803         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1804                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1805                              sizeof(cp->val), &cp->val);
1806
1807         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1808         if (err < 0) {
1809                 mgmt_pending_remove(cmd);
1810                 goto failed;
1811         }
1812
1813 failed:
1814         hci_dev_unlock(hdev);
1815         return err;
1816 }
1817
1818 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1819 {
1820         struct mgmt_mode *cp = data;
1821         bool changed;
1822         u8 status;
1823         int err;
1824
1825         bt_dev_dbg(hdev, "sock %p", sk);
1826
1827         if (!IS_ENABLED(CONFIG_BT_HS))
1828                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1829                                        MGMT_STATUS_NOT_SUPPORTED);
1830
1831         status = mgmt_bredr_support(hdev);
1832         if (status)
1833                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1834
1835         if (!lmp_ssp_capable(hdev))
1836                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1837                                        MGMT_STATUS_NOT_SUPPORTED);
1838
1839         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1840                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1841                                        MGMT_STATUS_REJECTED);
1842
1843         if (cp->val != 0x00 && cp->val != 0x01)
1844                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1845                                        MGMT_STATUS_INVALID_PARAMS);
1846
1847         hci_dev_lock(hdev);
1848
1849         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1850                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1851                                       MGMT_STATUS_BUSY);
1852                 goto unlock;
1853         }
1854
1855         if (cp->val) {
1856                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1857         } else {
1858                 if (hdev_is_powered(hdev)) {
1859                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1860                                               MGMT_STATUS_REJECTED);
1861                         goto unlock;
1862                 }
1863
1864                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1865         }
1866
1867         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1868         if (err < 0)
1869                 goto unlock;
1870
1871         if (changed)
1872                 err = new_settings(hdev, sk);
1873
1874 unlock:
1875         hci_dev_unlock(hdev);
1876         return err;
1877 }
1878
1879 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1880 {
1881         struct cmd_lookup match = { NULL, hdev };
1882
1883         hci_dev_lock(hdev);
1884
1885         if (status) {
1886                 u8 mgmt_err = mgmt_status(status);
1887
1888                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1889                                      &mgmt_err);
1890                 goto unlock;
1891         }
1892
1893         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1894
1895         new_settings(hdev, match.sk);
1896
1897         if (match.sk)
1898                 sock_put(match.sk);
1899
1900         /* Make sure the controller has a good default for
1901          * advertising data. Restrict the update to when LE
1902          * has actually been enabled. During power on, the
1903          * update in powered_update_hci will take care of it.
1904          */
1905         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1906                 struct hci_request req;
1907                 hci_req_init(&req, hdev);
1908                 if (ext_adv_capable(hdev)) {
1909                         int err;
1910
1911                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1912                         if (!err)
1913                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1914                 } else {
1915                         __hci_req_update_adv_data(&req, 0x00);
1916                         __hci_req_update_scan_rsp_data(&req, 0x00);
1917                 }
1918                 hci_req_run(&req, NULL);
1919                 hci_update_background_scan(hdev);
1920         }
1921
1922 unlock:
1923         hci_dev_unlock(hdev);
1924 }
1925
1926 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1927 {
1928         struct mgmt_mode *cp = data;
1929         struct hci_cp_write_le_host_supported hci_cp;
1930         struct mgmt_pending_cmd *cmd;
1931         struct hci_request req;
1932         int err;
1933         u8 val, enabled;
1934
1935         bt_dev_dbg(hdev, "sock %p", sk);
1936
1937         if (!lmp_le_capable(hdev))
1938                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1939                                        MGMT_STATUS_NOT_SUPPORTED);
1940
1941         if (cp->val != 0x00 && cp->val != 0x01)
1942                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1943                                        MGMT_STATUS_INVALID_PARAMS);
1944
1945         /* Bluetooth single mode LE only controllers or dual-mode
1946          * controllers configured as LE only devices, do not allow
1947          * switching LE off. These have either LE enabled explicitly
1948          * or BR/EDR has been previously switched off.
1949          *
1950          * When trying to enable an already enabled LE, then gracefully
1951          * send a positive response. Trying to disable it however will
1952          * result into rejection.
1953          */
1954         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1955                 if (cp->val == 0x01)
1956                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1957
1958                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1959                                        MGMT_STATUS_REJECTED);
1960         }
1961
1962         hci_dev_lock(hdev);
1963
1964         val = !!cp->val;
1965         enabled = lmp_host_le_capable(hdev);
1966
1967         if (!val)
1968                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1969
1970         if (!hdev_is_powered(hdev) || val == enabled) {
1971                 bool changed = false;
1972
1973                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1974                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1975                         changed = true;
1976                 }
1977
1978                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1979                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1980                         changed = true;
1981                 }
1982
1983                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1984                 if (err < 0)
1985                         goto unlock;
1986
1987                 if (changed)
1988                         err = new_settings(hdev, sk);
1989
1990                 goto unlock;
1991         }
1992
1993         if (pending_find(MGMT_OP_SET_LE, hdev) ||
1994             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1995                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1996                                       MGMT_STATUS_BUSY);
1997                 goto unlock;
1998         }
1999
2000         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2001         if (!cmd) {
2002                 err = -ENOMEM;
2003                 goto unlock;
2004         }
2005
2006         hci_req_init(&req, hdev);
2007
2008         memset(&hci_cp, 0, sizeof(hci_cp));
2009
2010         if (val) {
2011                 hci_cp.le = val;
2012                 hci_cp.simul = 0x00;
2013         } else {
2014                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2015                         __hci_req_disable_advertising(&req);
2016
2017                 if (ext_adv_capable(hdev))
2018                         __hci_req_clear_ext_adv_sets(&req);
2019         }
2020
2021         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2022                     &hci_cp);
2023
2024         err = hci_req_run(&req, le_enable_complete);
2025         if (err < 0)
2026                 mgmt_pending_remove(cmd);
2027
2028 unlock:
2029         hci_dev_unlock(hdev);
2030         return err;
2031 }
2032
2033 /* This is a helper function to test for pending mgmt commands that can
2034  * cause CoD or EIR HCI commands. We can only allow one such pending
2035  * mgmt command at a time since otherwise we cannot easily track what
2036  * the current values are, will be, and based on that calculate if a new
2037  * HCI command needs to be sent and if yes with what value.
2038  */
2039 static bool pending_eir_or_class(struct hci_dev *hdev)
2040 {
2041         struct mgmt_pending_cmd *cmd;
2042
2043         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2044                 switch (cmd->opcode) {
2045                 case MGMT_OP_ADD_UUID:
2046                 case MGMT_OP_REMOVE_UUID:
2047                 case MGMT_OP_SET_DEV_CLASS:
2048                 case MGMT_OP_SET_POWERED:
2049                         return true;
2050                 }
2051         }
2052
2053         return false;
2054 }
2055
2056 static const u8 bluetooth_base_uuid[] = {
2057                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2058                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2059 };
2060
2061 static u8 get_uuid_size(const u8 *uuid)
2062 {
2063         u32 val;
2064
2065         if (memcmp(uuid, bluetooth_base_uuid, 12))
2066                 return 128;
2067
2068         val = get_unaligned_le32(&uuid[12]);
2069         if (val > 0xffff)
2070                 return 32;
2071
2072         return 16;
2073 }
2074
2075 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2076 {
2077         struct mgmt_pending_cmd *cmd;
2078
2079         hci_dev_lock(hdev);
2080
2081         cmd = pending_find(mgmt_op, hdev);
2082         if (!cmd)
2083                 goto unlock;
2084
2085         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2086                           mgmt_status(status), hdev->dev_class, 3);
2087
2088         mgmt_pending_remove(cmd);
2089
2090 unlock:
2091         hci_dev_unlock(hdev);
2092 }
2093
2094 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2095 {
2096         bt_dev_dbg(hdev, "status 0x%02x", status);
2097
2098         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2099 }
2100
2101 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2102 {
2103         struct mgmt_cp_add_uuid *cp = data;
2104         struct mgmt_pending_cmd *cmd;
2105         struct hci_request req;
2106         struct bt_uuid *uuid;
2107         int err;
2108
2109         bt_dev_dbg(hdev, "sock %p", sk);
2110
2111         hci_dev_lock(hdev);
2112
2113         if (pending_eir_or_class(hdev)) {
2114                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2115                                       MGMT_STATUS_BUSY);
2116                 goto failed;
2117         }
2118
2119         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2120         if (!uuid) {
2121                 err = -ENOMEM;
2122                 goto failed;
2123         }
2124
2125         memcpy(uuid->uuid, cp->uuid, 16);
2126         uuid->svc_hint = cp->svc_hint;
2127         uuid->size = get_uuid_size(cp->uuid);
2128
2129         list_add_tail(&uuid->list, &hdev->uuids);
2130
2131         hci_req_init(&req, hdev);
2132
2133         __hci_req_update_class(&req);
2134         __hci_req_update_eir(&req);
2135
2136         err = hci_req_run(&req, add_uuid_complete);
2137         if (err < 0) {
2138                 if (err != -ENODATA)
2139                         goto failed;
2140
2141                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2142                                         hdev->dev_class, 3);
2143                 goto failed;
2144         }
2145
2146         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2147         if (!cmd) {
2148                 err = -ENOMEM;
2149                 goto failed;
2150         }
2151
2152         err = 0;
2153
2154 failed:
2155         hci_dev_unlock(hdev);
2156         return err;
2157 }
2158
2159 static bool enable_service_cache(struct hci_dev *hdev)
2160 {
2161         if (!hdev_is_powered(hdev))
2162                 return false;
2163
2164         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2165                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2166                                    CACHE_TIMEOUT);
2167                 return true;
2168         }
2169
2170         return false;
2171 }
2172
2173 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2174 {
2175         bt_dev_dbg(hdev, "status 0x%02x", status);
2176
2177         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2178 }
2179
2180 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2181                        u16 len)
2182 {
2183         struct mgmt_cp_remove_uuid *cp = data;
2184         struct mgmt_pending_cmd *cmd;
2185         struct bt_uuid *match, *tmp;
2186         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2187         struct hci_request req;
2188         int err, found;
2189
2190         bt_dev_dbg(hdev, "sock %p", sk);
2191
2192         hci_dev_lock(hdev);
2193
2194         if (pending_eir_or_class(hdev)) {
2195                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2196                                       MGMT_STATUS_BUSY);
2197                 goto unlock;
2198         }
2199
2200         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2201                 hci_uuids_clear(hdev);
2202
2203                 if (enable_service_cache(hdev)) {
2204                         err = mgmt_cmd_complete(sk, hdev->id,
2205                                                 MGMT_OP_REMOVE_UUID,
2206                                                 0, hdev->dev_class, 3);
2207                         goto unlock;
2208                 }
2209
2210                 goto update_class;
2211         }
2212
2213         found = 0;
2214
2215         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2216                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2217                         continue;
2218
2219                 list_del(&match->list);
2220                 kfree(match);
2221                 found++;
2222         }
2223
2224         if (found == 0) {
2225                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2226                                       MGMT_STATUS_INVALID_PARAMS);
2227                 goto unlock;
2228         }
2229
2230 update_class:
2231         hci_req_init(&req, hdev);
2232
2233         __hci_req_update_class(&req);
2234         __hci_req_update_eir(&req);
2235
2236         err = hci_req_run(&req, remove_uuid_complete);
2237         if (err < 0) {
2238                 if (err != -ENODATA)
2239                         goto unlock;
2240
2241                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2242                                         hdev->dev_class, 3);
2243                 goto unlock;
2244         }
2245
2246         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2247         if (!cmd) {
2248                 err = -ENOMEM;
2249                 goto unlock;
2250         }
2251
2252         err = 0;
2253
2254 unlock:
2255         hci_dev_unlock(hdev);
2256         return err;
2257 }
2258
2259 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2260 {
2261         bt_dev_dbg(hdev, "status 0x%02x", status);
2262
2263         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2264 }
2265
2266 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2267                          u16 len)
2268 {
2269         struct mgmt_cp_set_dev_class *cp = data;
2270         struct mgmt_pending_cmd *cmd;
2271         struct hci_request req;
2272         int err;
2273
2274         bt_dev_dbg(hdev, "sock %p", sk);
2275
2276         if (!lmp_bredr_capable(hdev))
2277                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2278                                        MGMT_STATUS_NOT_SUPPORTED);
2279
2280         hci_dev_lock(hdev);
2281
2282         if (pending_eir_or_class(hdev)) {
2283                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2284                                       MGMT_STATUS_BUSY);
2285                 goto unlock;
2286         }
2287
2288         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2289                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2290                                       MGMT_STATUS_INVALID_PARAMS);
2291                 goto unlock;
2292         }
2293
2294         hdev->major_class = cp->major;
2295         hdev->minor_class = cp->minor;
2296
2297         if (!hdev_is_powered(hdev)) {
2298                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2299                                         hdev->dev_class, 3);
2300                 goto unlock;
2301         }
2302
2303         hci_req_init(&req, hdev);
2304
2305         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2306                 hci_dev_unlock(hdev);
2307                 cancel_delayed_work_sync(&hdev->service_cache);
2308                 hci_dev_lock(hdev);
2309                 __hci_req_update_eir(&req);
2310         }
2311
2312         __hci_req_update_class(&req);
2313
2314         err = hci_req_run(&req, set_class_complete);
2315         if (err < 0) {
2316                 if (err != -ENODATA)
2317                         goto unlock;
2318
2319                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2320                                         hdev->dev_class, 3);
2321                 goto unlock;
2322         }
2323
2324         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2325         if (!cmd) {
2326                 err = -ENOMEM;
2327                 goto unlock;
2328         }
2329
2330         err = 0;
2331
2332 unlock:
2333         hci_dev_unlock(hdev);
2334         return err;
2335 }
2336
2337 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2338                           u16 len)
2339 {
2340         struct mgmt_cp_load_link_keys *cp = data;
2341         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2342                                    sizeof(struct mgmt_link_key_info));
2343         u16 key_count, expected_len;
2344         bool changed;
2345         int i;
2346
2347         bt_dev_dbg(hdev, "sock %p", sk);
2348
2349         if (!lmp_bredr_capable(hdev))
2350                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2351                                        MGMT_STATUS_NOT_SUPPORTED);
2352
2353         key_count = __le16_to_cpu(cp->key_count);
2354         if (key_count > max_key_count) {
2355                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2356                            key_count);
2357                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2358                                        MGMT_STATUS_INVALID_PARAMS);
2359         }
2360
2361         expected_len = struct_size(cp, keys, key_count);
2362         if (expected_len != len) {
2363                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2364                            expected_len, len);
2365                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2366                                        MGMT_STATUS_INVALID_PARAMS);
2367         }
2368
2369         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2370                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2371                                        MGMT_STATUS_INVALID_PARAMS);
2372
2373         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2374                    key_count);
2375
2376         for (i = 0; i < key_count; i++) {
2377                 struct mgmt_link_key_info *key = &cp->keys[i];
2378
2379                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2380                         return mgmt_cmd_status(sk, hdev->id,
2381                                                MGMT_OP_LOAD_LINK_KEYS,
2382                                                MGMT_STATUS_INVALID_PARAMS);
2383         }
2384
2385         hci_dev_lock(hdev);
2386
2387         hci_link_keys_clear(hdev);
2388
2389         if (cp->debug_keys)
2390                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2391         else
2392                 changed = hci_dev_test_and_clear_flag(hdev,
2393                                                       HCI_KEEP_DEBUG_KEYS);
2394
2395         if (changed)
2396                 new_settings(hdev, NULL);
2397
2398         for (i = 0; i < key_count; i++) {
2399                 struct mgmt_link_key_info *key = &cp->keys[i];
2400
2401                 if (hci_is_blocked_key(hdev,
2402                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2403                                        key->val)) {
2404                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2405                                     &key->addr.bdaddr);
2406                         continue;
2407                 }
2408
2409                 /* Always ignore debug keys and require a new pairing if
2410                  * the user wants to use them.
2411                  */
2412                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2413                         continue;
2414
2415                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2416                                  key->type, key->pin_len, NULL);
2417         }
2418
2419         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2420
2421         hci_dev_unlock(hdev);
2422
2423         return 0;
2424 }
2425
2426 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2427                            u8 addr_type, struct sock *skip_sk)
2428 {
2429         struct mgmt_ev_device_unpaired ev;
2430
2431         bacpy(&ev.addr.bdaddr, bdaddr);
2432         ev.addr.type = addr_type;
2433
2434         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2435                           skip_sk);
2436 }
2437
2438 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2439                          u16 len)
2440 {
2441         struct mgmt_cp_unpair_device *cp = data;
2442         struct mgmt_rp_unpair_device rp;
2443         struct hci_conn_params *params;
2444         struct mgmt_pending_cmd *cmd;
2445         struct hci_conn *conn;
2446         u8 addr_type;
2447         int err;
2448
2449         memset(&rp, 0, sizeof(rp));
2450         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2451         rp.addr.type = cp->addr.type;
2452
2453         if (!bdaddr_type_is_valid(cp->addr.type))
2454                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2455                                          MGMT_STATUS_INVALID_PARAMS,
2456                                          &rp, sizeof(rp));
2457
2458         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2459                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2460                                          MGMT_STATUS_INVALID_PARAMS,
2461                                          &rp, sizeof(rp));
2462
2463         hci_dev_lock(hdev);
2464
2465         if (!hdev_is_powered(hdev)) {
2466                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2467                                         MGMT_STATUS_NOT_POWERED, &rp,
2468                                         sizeof(rp));
2469                 goto unlock;
2470         }
2471
2472         if (cp->addr.type == BDADDR_BREDR) {
2473                 /* If disconnection is requested, then look up the
2474                  * connection. If the remote device is connected, it
2475                  * will be later used to terminate the link.
2476                  *
2477                  * Setting it to NULL explicitly will cause no
2478                  * termination of the link.
2479                  */
2480                 if (cp->disconnect)
2481                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2482                                                        &cp->addr.bdaddr);
2483                 else
2484                         conn = NULL;
2485
2486                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2487                 if (err < 0) {
2488                         err = mgmt_cmd_complete(sk, hdev->id,
2489                                                 MGMT_OP_UNPAIR_DEVICE,
2490                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2491                                                 sizeof(rp));
2492                         goto unlock;
2493                 }
2494
2495                 goto done;
2496         }
2497
2498         /* LE address type */
2499         addr_type = le_addr_type(cp->addr.type);
2500
2501         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2502         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2503         if (err < 0) {
2504                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2505                                         MGMT_STATUS_NOT_PAIRED, &rp,
2506                                         sizeof(rp));
2507                 goto unlock;
2508         }
2509
2510         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2511         if (!conn) {
2512                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2513                 goto done;
2514         }
2515
2516
2517         /* Defer clearing up the connection parameters until closing to
2518          * give a chance of keeping them if a repairing happens.
2519          */
2520         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2521
2522         /* Disable auto-connection parameters if present */
2523         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2524         if (params) {
2525                 if (params->explicit_connect)
2526                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2527                 else
2528                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2529         }
2530
2531         /* If disconnection is not requested, then clear the connection
2532          * variable so that the link is not terminated.
2533          */
2534         if (!cp->disconnect)
2535                 conn = NULL;
2536
2537 done:
2538         /* If the connection variable is set, then termination of the
2539          * link is requested.
2540          */
2541         if (!conn) {
2542                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2543                                         &rp, sizeof(rp));
2544                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2545                 goto unlock;
2546         }
2547
2548         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2549                                sizeof(*cp));
2550         if (!cmd) {
2551                 err = -ENOMEM;
2552                 goto unlock;
2553         }
2554
2555         cmd->cmd_complete = addr_cmd_complete;
2556
2557         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2558         if (err < 0)
2559                 mgmt_pending_remove(cmd);
2560
2561 unlock:
2562         hci_dev_unlock(hdev);
2563         return err;
2564 }
2565
2566 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2567                       u16 len)
2568 {
2569         struct mgmt_cp_disconnect *cp = data;
2570         struct mgmt_rp_disconnect rp;
2571         struct mgmt_pending_cmd *cmd;
2572         struct hci_conn *conn;
2573         int err;
2574
2575         bt_dev_dbg(hdev, "sock %p", sk);
2576
2577         memset(&rp, 0, sizeof(rp));
2578         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2579         rp.addr.type = cp->addr.type;
2580
2581         if (!bdaddr_type_is_valid(cp->addr.type))
2582                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2583                                          MGMT_STATUS_INVALID_PARAMS,
2584                                          &rp, sizeof(rp));
2585
2586         hci_dev_lock(hdev);
2587
2588         if (!test_bit(HCI_UP, &hdev->flags)) {
2589                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2590                                         MGMT_STATUS_NOT_POWERED, &rp,
2591                                         sizeof(rp));
2592                 goto failed;
2593         }
2594
2595         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2596                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2597                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2598                 goto failed;
2599         }
2600
2601         if (cp->addr.type == BDADDR_BREDR)
2602                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2603                                                &cp->addr.bdaddr);
2604         else
2605                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2606                                                le_addr_type(cp->addr.type));
2607
2608         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2609                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2610                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2611                                         sizeof(rp));
2612                 goto failed;
2613         }
2614
2615         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2616         if (!cmd) {
2617                 err = -ENOMEM;
2618                 goto failed;
2619         }
2620
2621         cmd->cmd_complete = generic_cmd_complete;
2622
2623         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2624         if (err < 0)
2625                 mgmt_pending_remove(cmd);
2626
2627 failed:
2628         hci_dev_unlock(hdev);
2629         return err;
2630 }
2631
2632 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2633 {
2634         switch (link_type) {
2635         case LE_LINK:
2636                 switch (addr_type) {
2637                 case ADDR_LE_DEV_PUBLIC:
2638                         return BDADDR_LE_PUBLIC;
2639
2640                 default:
2641                         /* Fallback to LE Random address type */
2642                         return BDADDR_LE_RANDOM;
2643                 }
2644
2645         default:
2646                 /* Fallback to BR/EDR type */
2647                 return BDADDR_BREDR;
2648         }
2649 }
2650
2651 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2652                            u16 data_len)
2653 {
2654         struct mgmt_rp_get_connections *rp;
2655         struct hci_conn *c;
2656         int err;
2657         u16 i;
2658
2659         bt_dev_dbg(hdev, "sock %p", sk);
2660
2661         hci_dev_lock(hdev);
2662
2663         if (!hdev_is_powered(hdev)) {
2664                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2665                                       MGMT_STATUS_NOT_POWERED);
2666                 goto unlock;
2667         }
2668
2669         i = 0;
2670         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2671                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2672                         i++;
2673         }
2674
2675         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2676         if (!rp) {
2677                 err = -ENOMEM;
2678                 goto unlock;
2679         }
2680
2681         i = 0;
2682         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2683                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2684                         continue;
2685                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2686                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2687                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2688                         continue;
2689                 i++;
2690         }
2691
2692         rp->conn_count = cpu_to_le16(i);
2693
2694         /* Recalculate length in case of filtered SCO connections, etc */
2695         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2696                                 struct_size(rp, addr, i));
2697
2698         kfree(rp);
2699
2700 unlock:
2701         hci_dev_unlock(hdev);
2702         return err;
2703 }
2704
2705 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2706                                    struct mgmt_cp_pin_code_neg_reply *cp)
2707 {
2708         struct mgmt_pending_cmd *cmd;
2709         int err;
2710
2711         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2712                                sizeof(*cp));
2713         if (!cmd)
2714                 return -ENOMEM;
2715
2716         cmd->cmd_complete = addr_cmd_complete;
2717
2718         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2719                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2720         if (err < 0)
2721                 mgmt_pending_remove(cmd);
2722
2723         return err;
2724 }
2725
2726 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2727                           u16 len)
2728 {
2729         struct hci_conn *conn;
2730         struct mgmt_cp_pin_code_reply *cp = data;
2731         struct hci_cp_pin_code_reply reply;
2732         struct mgmt_pending_cmd *cmd;
2733         int err;
2734
2735         bt_dev_dbg(hdev, "sock %p", sk);
2736
2737         hci_dev_lock(hdev);
2738
2739         if (!hdev_is_powered(hdev)) {
2740                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2741                                       MGMT_STATUS_NOT_POWERED);
2742                 goto failed;
2743         }
2744
2745         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2746         if (!conn) {
2747                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2748                                       MGMT_STATUS_NOT_CONNECTED);
2749                 goto failed;
2750         }
2751
2752         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2753                 struct mgmt_cp_pin_code_neg_reply ncp;
2754
2755                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2756
2757                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2758
2759                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2760                 if (err >= 0)
2761                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2762                                               MGMT_STATUS_INVALID_PARAMS);
2763
2764                 goto failed;
2765         }
2766
2767         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2768         if (!cmd) {
2769                 err = -ENOMEM;
2770                 goto failed;
2771         }
2772
2773         cmd->cmd_complete = addr_cmd_complete;
2774
2775         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2776         reply.pin_len = cp->pin_len;
2777         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2778
2779         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2780         if (err < 0)
2781                 mgmt_pending_remove(cmd);
2782
2783 failed:
2784         hci_dev_unlock(hdev);
2785         return err;
2786 }
2787
2788 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2789                              u16 len)
2790 {
2791         struct mgmt_cp_set_io_capability *cp = data;
2792
2793         bt_dev_dbg(hdev, "sock %p", sk);
2794
2795         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2796                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2797                                        MGMT_STATUS_INVALID_PARAMS);
2798
2799         hci_dev_lock(hdev);
2800
2801         hdev->io_capability = cp->io_capability;
2802
2803         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
2804
2805         hci_dev_unlock(hdev);
2806
2807         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2808                                  NULL, 0);
2809 }
2810
2811 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2812 {
2813         struct hci_dev *hdev = conn->hdev;
2814         struct mgmt_pending_cmd *cmd;
2815
2816         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2817                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2818                         continue;
2819
2820                 if (cmd->user_data != conn)
2821                         continue;
2822
2823                 return cmd;
2824         }
2825
2826         return NULL;
2827 }
2828
2829 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2830 {
2831         struct mgmt_rp_pair_device rp;
2832         struct hci_conn *conn = cmd->user_data;
2833         int err;
2834
2835         bacpy(&rp.addr.bdaddr, &conn->dst);
2836         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2837
2838         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2839                                 status, &rp, sizeof(rp));
2840
2841         /* So we don't get further callbacks for this connection */
2842         conn->connect_cfm_cb = NULL;
2843         conn->security_cfm_cb = NULL;
2844         conn->disconn_cfm_cb = NULL;
2845
2846         hci_conn_drop(conn);
2847
2848         /* The device is paired so there is no need to remove
2849          * its connection parameters anymore.
2850          */
2851         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2852
2853         hci_conn_put(conn);
2854
2855         return err;
2856 }
2857
2858 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2859 {
2860         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2861         struct mgmt_pending_cmd *cmd;
2862
2863         cmd = find_pairing(conn);
2864         if (cmd) {
2865                 cmd->cmd_complete(cmd, status);
2866                 mgmt_pending_remove(cmd);
2867         }
2868 }
2869
2870 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2871 {
2872         struct mgmt_pending_cmd *cmd;
2873
2874         BT_DBG("status %u", status);
2875
2876         cmd = find_pairing(conn);
2877         if (!cmd) {
2878                 BT_DBG("Unable to find a pending command");
2879                 return;
2880         }
2881
2882         cmd->cmd_complete(cmd, mgmt_status(status));
2883         mgmt_pending_remove(cmd);
2884 }
2885
2886 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2887 {
2888         struct mgmt_pending_cmd *cmd;
2889
2890         BT_DBG("status %u", status);
2891
2892         if (!status)
2893                 return;
2894
2895         cmd = find_pairing(conn);
2896         if (!cmd) {
2897                 BT_DBG("Unable to find a pending command");
2898                 return;
2899         }
2900
2901         cmd->cmd_complete(cmd, mgmt_status(status));
2902         mgmt_pending_remove(cmd);
2903 }
2904
2905 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2906                        u16 len)
2907 {
2908         struct mgmt_cp_pair_device *cp = data;
2909         struct mgmt_rp_pair_device rp;
2910         struct mgmt_pending_cmd *cmd;
2911         u8 sec_level, auth_type;
2912         struct hci_conn *conn;
2913         int err;
2914
2915         bt_dev_dbg(hdev, "sock %p", sk);
2916
2917         memset(&rp, 0, sizeof(rp));
2918         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2919         rp.addr.type = cp->addr.type;
2920
2921         if (!bdaddr_type_is_valid(cp->addr.type))
2922                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2923                                          MGMT_STATUS_INVALID_PARAMS,
2924                                          &rp, sizeof(rp));
2925
2926         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2927                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2928                                          MGMT_STATUS_INVALID_PARAMS,
2929                                          &rp, sizeof(rp));
2930
2931         hci_dev_lock(hdev);
2932
2933         if (!hdev_is_powered(hdev)) {
2934                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2935                                         MGMT_STATUS_NOT_POWERED, &rp,
2936                                         sizeof(rp));
2937                 goto unlock;
2938         }
2939
2940         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2941                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2942                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2943                                         sizeof(rp));
2944                 goto unlock;
2945         }
2946
2947         sec_level = BT_SECURITY_MEDIUM;
2948         auth_type = HCI_AT_DEDICATED_BONDING;
2949
2950         if (cp->addr.type == BDADDR_BREDR) {
2951                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2952                                        auth_type, CONN_REASON_PAIR_DEVICE);
2953         } else {
2954                 u8 addr_type = le_addr_type(cp->addr.type);
2955                 struct hci_conn_params *p;
2956
2957                 /* When pairing a new device, it is expected to remember
2958                  * this device for future connections. Adding the connection
2959                  * parameter information ahead of time allows tracking
2960                  * of the slave preferred values and will speed up any
2961                  * further connection establishment.
2962                  *
2963                  * If connection parameters already exist, then they
2964                  * will be kept and this function does nothing.
2965                  */
2966                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2967
2968                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2969                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2970
2971                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
2972                                            sec_level, HCI_LE_CONN_TIMEOUT,
2973                                            CONN_REASON_PAIR_DEVICE);
2974         }
2975
2976         if (IS_ERR(conn)) {
2977                 int status;
2978
2979                 if (PTR_ERR(conn) == -EBUSY)
2980                         status = MGMT_STATUS_BUSY;
2981                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2982                         status = MGMT_STATUS_NOT_SUPPORTED;
2983                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2984                         status = MGMT_STATUS_REJECTED;
2985                 else
2986                         status = MGMT_STATUS_CONNECT_FAILED;
2987
2988                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2989                                         status, &rp, sizeof(rp));
2990                 goto unlock;
2991         }
2992
2993         if (conn->connect_cfm_cb) {
2994                 hci_conn_drop(conn);
2995                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2996                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2997                 goto unlock;
2998         }
2999
3000         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3001         if (!cmd) {
3002                 err = -ENOMEM;
3003                 hci_conn_drop(conn);
3004                 goto unlock;
3005         }
3006
3007         cmd->cmd_complete = pairing_complete;
3008
3009         /* For LE, just connecting isn't a proof that the pairing finished */
3010         if (cp->addr.type == BDADDR_BREDR) {
3011                 conn->connect_cfm_cb = pairing_complete_cb;
3012                 conn->security_cfm_cb = pairing_complete_cb;
3013                 conn->disconn_cfm_cb = pairing_complete_cb;
3014         } else {
3015                 conn->connect_cfm_cb = le_pairing_complete_cb;
3016                 conn->security_cfm_cb = le_pairing_complete_cb;
3017                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3018         }
3019
3020         conn->io_capability = cp->io_cap;
3021         cmd->user_data = hci_conn_get(conn);
3022
3023         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3024             hci_conn_security(conn, sec_level, auth_type, true)) {
3025                 cmd->cmd_complete(cmd, 0);
3026                 mgmt_pending_remove(cmd);
3027         }
3028
3029         err = 0;
3030
3031 unlock:
3032         hci_dev_unlock(hdev);
3033         return err;
3034 }
3035
3036 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3037                               u16 len)
3038 {
3039         struct mgmt_addr_info *addr = data;
3040         struct mgmt_pending_cmd *cmd;
3041         struct hci_conn *conn;
3042         int err;
3043
3044         bt_dev_dbg(hdev, "sock %p", sk);
3045
3046         hci_dev_lock(hdev);
3047
3048         if (!hdev_is_powered(hdev)) {
3049                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3050                                       MGMT_STATUS_NOT_POWERED);
3051                 goto unlock;
3052         }
3053
3054         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3055         if (!cmd) {
3056                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3057                                       MGMT_STATUS_INVALID_PARAMS);
3058                 goto unlock;
3059         }
3060
3061         conn = cmd->user_data;
3062
3063         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3064                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3065                                       MGMT_STATUS_INVALID_PARAMS);
3066                 goto unlock;
3067         }
3068
3069         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3070         mgmt_pending_remove(cmd);
3071
3072         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3073                                 addr, sizeof(*addr));
3074
3075         /* Since user doesn't want to proceed with the connection, abort any
3076          * ongoing pairing and then terminate the link if it was created
3077          * because of the pair device action.
3078          */
3079         if (addr->type == BDADDR_BREDR)
3080                 hci_remove_link_key(hdev, &addr->bdaddr);
3081         else
3082                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3083                                               le_addr_type(addr->type));
3084
3085         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3086                 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3087
3088 unlock:
3089         hci_dev_unlock(hdev);
3090         return err;
3091 }
3092
3093 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3094                              struct mgmt_addr_info *addr, u16 mgmt_op,
3095                              u16 hci_op, __le32 passkey)
3096 {
3097         struct mgmt_pending_cmd *cmd;
3098         struct hci_conn *conn;
3099         int err;
3100
3101         hci_dev_lock(hdev);
3102
3103         if (!hdev_is_powered(hdev)) {
3104                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3105                                         MGMT_STATUS_NOT_POWERED, addr,
3106                                         sizeof(*addr));
3107                 goto done;
3108         }
3109
3110         if (addr->type == BDADDR_BREDR)
3111                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3112         else
3113                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3114                                                le_addr_type(addr->type));
3115
3116         if (!conn) {
3117                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3118                                         MGMT_STATUS_NOT_CONNECTED, addr,
3119                                         sizeof(*addr));
3120                 goto done;
3121         }
3122
3123         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3124                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3125                 if (!err)
3126                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3127                                                 MGMT_STATUS_SUCCESS, addr,
3128                                                 sizeof(*addr));
3129                 else
3130                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3131                                                 MGMT_STATUS_FAILED, addr,
3132                                                 sizeof(*addr));
3133
3134                 goto done;
3135         }
3136
3137         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3138         if (!cmd) {
3139                 err = -ENOMEM;
3140                 goto done;
3141         }
3142
3143         cmd->cmd_complete = addr_cmd_complete;
3144
3145         /* Continue with pairing via HCI */
3146         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3147                 struct hci_cp_user_passkey_reply cp;
3148
3149                 bacpy(&cp.bdaddr, &addr->bdaddr);
3150                 cp.passkey = passkey;
3151                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3152         } else
3153                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3154                                    &addr->bdaddr);
3155
3156         if (err < 0)
3157                 mgmt_pending_remove(cmd);
3158
3159 done:
3160         hci_dev_unlock(hdev);
3161         return err;
3162 }
3163
3164 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3165                               void *data, u16 len)
3166 {
3167         struct mgmt_cp_pin_code_neg_reply *cp = data;
3168
3169         bt_dev_dbg(hdev, "sock %p", sk);
3170
3171         return user_pairing_resp(sk, hdev, &cp->addr,
3172                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3173                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3174 }
3175
3176 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3177                               u16 len)
3178 {
3179         struct mgmt_cp_user_confirm_reply *cp = data;
3180
3181         bt_dev_dbg(hdev, "sock %p", sk);
3182
3183         if (len != sizeof(*cp))
3184                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3185                                        MGMT_STATUS_INVALID_PARAMS);
3186
3187         return user_pairing_resp(sk, hdev, &cp->addr,
3188                                  MGMT_OP_USER_CONFIRM_REPLY,
3189                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3190 }
3191
3192 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3193                                   void *data, u16 len)
3194 {
3195         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3196
3197         bt_dev_dbg(hdev, "sock %p", sk);
3198
3199         return user_pairing_resp(sk, hdev, &cp->addr,
3200                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3201                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3202 }
3203
3204 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3205                               u16 len)
3206 {
3207         struct mgmt_cp_user_passkey_reply *cp = data;
3208
3209         bt_dev_dbg(hdev, "sock %p", sk);
3210
3211         return user_pairing_resp(sk, hdev, &cp->addr,
3212                                  MGMT_OP_USER_PASSKEY_REPLY,
3213                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3214 }
3215
3216 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3217                                   void *data, u16 len)
3218 {
3219         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3220
3221         bt_dev_dbg(hdev, "sock %p", sk);
3222
3223         return user_pairing_resp(sk, hdev, &cp->addr,
3224                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3225                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3226 }
3227
3228 static void adv_expire(struct hci_dev *hdev, u32 flags)
3229 {
3230         struct adv_info *adv_instance;
3231         struct hci_request req;
3232         int err;
3233
3234         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3235         if (!adv_instance)
3236                 return;
3237
3238         /* stop if current instance doesn't need to be changed */
3239         if (!(adv_instance->flags & flags))
3240                 return;
3241
3242         cancel_adv_timeout(hdev);
3243
3244         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3245         if (!adv_instance)
3246                 return;
3247
3248         hci_req_init(&req, hdev);
3249         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3250                                               true);
3251         if (err)
3252                 return;
3253
3254         hci_req_run(&req, NULL);
3255 }
3256
3257 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3258 {
3259         struct mgmt_cp_set_local_name *cp;
3260         struct mgmt_pending_cmd *cmd;
3261
3262         bt_dev_dbg(hdev, "status 0x%02x", status);
3263
3264         hci_dev_lock(hdev);
3265
3266         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3267         if (!cmd)
3268                 goto unlock;
3269
3270         cp = cmd->param;
3271
3272         if (status) {
3273                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3274                                 mgmt_status(status));
3275         } else {
3276                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3277                                   cp, sizeof(*cp));
3278
3279                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3280                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3281         }
3282
3283         mgmt_pending_remove(cmd);
3284
3285 unlock:
3286         hci_dev_unlock(hdev);
3287 }
3288
3289 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3290                           u16 len)
3291 {
3292         struct mgmt_cp_set_local_name *cp = data;
3293         struct mgmt_pending_cmd *cmd;
3294         struct hci_request req;
3295         int err;
3296
3297         bt_dev_dbg(hdev, "sock %p", sk);
3298
3299         hci_dev_lock(hdev);
3300
3301         /* If the old values are the same as the new ones just return a
3302          * direct command complete event.
3303          */
3304         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3305             !memcmp(hdev->short_name, cp->short_name,
3306                     sizeof(hdev->short_name))) {
3307                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3308                                         data, len);
3309                 goto failed;
3310         }
3311
3312         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3313
3314         if (!hdev_is_powered(hdev)) {
3315                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3316
3317                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3318                                         data, len);
3319                 if (err < 0)
3320                         goto failed;
3321
3322                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3323                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3324                 ext_info_changed(hdev, sk);
3325
3326                 goto failed;
3327         }
3328
3329         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3330         if (!cmd) {
3331                 err = -ENOMEM;
3332                 goto failed;
3333         }
3334
3335         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3336
3337         hci_req_init(&req, hdev);
3338
3339         if (lmp_bredr_capable(hdev)) {
3340                 __hci_req_update_name(&req);
3341                 __hci_req_update_eir(&req);
3342         }
3343
3344         /* The name is stored in the scan response data and so
3345          * no need to udpate the advertising data here.
3346          */
3347         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3348                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3349
3350         err = hci_req_run(&req, set_name_complete);
3351         if (err < 0)
3352                 mgmt_pending_remove(cmd);
3353
3354 failed:
3355         hci_dev_unlock(hdev);
3356         return err;
3357 }
3358
3359 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3360                           u16 len)
3361 {
3362         struct mgmt_cp_set_appearance *cp = data;
3363         u16 appearance;
3364         int err;
3365
3366         bt_dev_dbg(hdev, "sock %p", sk);
3367
3368         if (!lmp_le_capable(hdev))
3369                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3370                                        MGMT_STATUS_NOT_SUPPORTED);
3371
3372         appearance = le16_to_cpu(cp->appearance);
3373
3374         hci_dev_lock(hdev);
3375
3376         if (hdev->appearance != appearance) {
3377                 hdev->appearance = appearance;
3378
3379                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3380                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3381
3382                 ext_info_changed(hdev, sk);
3383         }
3384
3385         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3386                                 0);
3387
3388         hci_dev_unlock(hdev);
3389
3390         return err;
3391 }
3392
3393 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3394                                  void *data, u16 len)
3395 {
3396         struct mgmt_rp_get_phy_confguration rp;
3397
3398         bt_dev_dbg(hdev, "sock %p", sk);
3399
3400         hci_dev_lock(hdev);
3401
3402         memset(&rp, 0, sizeof(rp));
3403
3404         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3405         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3406         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3407
3408         hci_dev_unlock(hdev);
3409
3410         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3411                                  &rp, sizeof(rp));
3412 }
3413
3414 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3415 {
3416         struct mgmt_ev_phy_configuration_changed ev;
3417
3418         memset(&ev, 0, sizeof(ev));
3419
3420         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3421
3422         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3423                           sizeof(ev), skip);
3424 }
3425
3426 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3427                                      u16 opcode, struct sk_buff *skb)
3428 {
3429         struct mgmt_pending_cmd *cmd;
3430
3431         bt_dev_dbg(hdev, "status 0x%02x", status);
3432
3433         hci_dev_lock(hdev);
3434
3435         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3436         if (!cmd)
3437                 goto unlock;
3438
3439         if (status) {
3440                 mgmt_cmd_status(cmd->sk, hdev->id,
3441                                 MGMT_OP_SET_PHY_CONFIGURATION,
3442                                 mgmt_status(status));
3443         } else {
3444                 mgmt_cmd_complete(cmd->sk, hdev->id,
3445                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3446                                   NULL, 0);
3447
3448                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3449         }
3450
3451         mgmt_pending_remove(cmd);
3452
3453 unlock:
3454         hci_dev_unlock(hdev);
3455 }
3456
3457 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3458                                  void *data, u16 len)
3459 {
3460         struct mgmt_cp_set_phy_confguration *cp = data;
3461         struct hci_cp_le_set_default_phy cp_phy;
3462         struct mgmt_pending_cmd *cmd;
3463         struct hci_request req;
3464         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3465         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3466         bool changed = false;
3467         int err;
3468
3469         bt_dev_dbg(hdev, "sock %p", sk);
3470
3471         configurable_phys = get_configurable_phys(hdev);
3472         supported_phys = get_supported_phys(hdev);
3473         selected_phys = __le32_to_cpu(cp->selected_phys);
3474
3475         if (selected_phys & ~supported_phys)
3476                 return mgmt_cmd_status(sk, hdev->id,
3477                                        MGMT_OP_SET_PHY_CONFIGURATION,
3478                                        MGMT_STATUS_INVALID_PARAMS);
3479
3480         unconfigure_phys = supported_phys & ~configurable_phys;
3481
3482         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3483                 return mgmt_cmd_status(sk, hdev->id,
3484                                        MGMT_OP_SET_PHY_CONFIGURATION,
3485                                        MGMT_STATUS_INVALID_PARAMS);
3486
3487         if (selected_phys == get_selected_phys(hdev))
3488                 return mgmt_cmd_complete(sk, hdev->id,
3489                                          MGMT_OP_SET_PHY_CONFIGURATION,
3490                                          0, NULL, 0);
3491
3492         hci_dev_lock(hdev);
3493
3494         if (!hdev_is_powered(hdev)) {
3495                 err = mgmt_cmd_status(sk, hdev->id,
3496                                       MGMT_OP_SET_PHY_CONFIGURATION,
3497                                       MGMT_STATUS_REJECTED);
3498                 goto unlock;
3499         }
3500
3501         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3502                 err = mgmt_cmd_status(sk, hdev->id,
3503                                       MGMT_OP_SET_PHY_CONFIGURATION,
3504                                       MGMT_STATUS_BUSY);
3505                 goto unlock;
3506         }
3507
3508         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3509                 pkt_type |= (HCI_DH3 | HCI_DM3);
3510         else
3511                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3512
3513         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3514                 pkt_type |= (HCI_DH5 | HCI_DM5);
3515         else
3516                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3517
3518         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3519                 pkt_type &= ~HCI_2DH1;
3520         else
3521                 pkt_type |= HCI_2DH1;
3522
3523         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3524                 pkt_type &= ~HCI_2DH3;
3525         else
3526                 pkt_type |= HCI_2DH3;
3527
3528         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3529                 pkt_type &= ~HCI_2DH5;
3530         else
3531                 pkt_type |= HCI_2DH5;
3532
3533         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3534                 pkt_type &= ~HCI_3DH1;
3535         else
3536                 pkt_type |= HCI_3DH1;
3537
3538         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3539                 pkt_type &= ~HCI_3DH3;
3540         else
3541                 pkt_type |= HCI_3DH3;
3542
3543         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3544                 pkt_type &= ~HCI_3DH5;
3545         else
3546                 pkt_type |= HCI_3DH5;
3547
3548         if (pkt_type != hdev->pkt_type) {
3549                 hdev->pkt_type = pkt_type;
3550                 changed = true;
3551         }
3552
3553         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3554             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3555                 if (changed)
3556                         mgmt_phy_configuration_changed(hdev, sk);
3557
3558                 err = mgmt_cmd_complete(sk, hdev->id,
3559                                         MGMT_OP_SET_PHY_CONFIGURATION,
3560                                         0, NULL, 0);
3561
3562                 goto unlock;
3563         }
3564
3565         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3566                                len);
3567         if (!cmd) {
3568                 err = -ENOMEM;
3569                 goto unlock;
3570         }
3571
3572         hci_req_init(&req, hdev);
3573
3574         memset(&cp_phy, 0, sizeof(cp_phy));
3575
3576         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3577                 cp_phy.all_phys |= 0x01;
3578
3579         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3580                 cp_phy.all_phys |= 0x02;
3581
3582         if (selected_phys & MGMT_PHY_LE_1M_TX)
3583                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3584
3585         if (selected_phys & MGMT_PHY_LE_2M_TX)
3586                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3587
3588         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3589                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3590
3591         if (selected_phys & MGMT_PHY_LE_1M_RX)
3592                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3593
3594         if (selected_phys & MGMT_PHY_LE_2M_RX)
3595                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3596
3597         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3598                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3599
3600         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3601
3602         err = hci_req_run_skb(&req, set_default_phy_complete);
3603         if (err < 0)
3604                 mgmt_pending_remove(cmd);
3605
3606 unlock:
3607         hci_dev_unlock(hdev);
3608
3609         return err;
3610 }
3611
3612 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3613                             u16 len)
3614 {
3615         int err = MGMT_STATUS_SUCCESS;
3616         struct mgmt_cp_set_blocked_keys *keys = data;
3617         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
3618                                    sizeof(struct mgmt_blocked_key_info));
3619         u16 key_count, expected_len;
3620         int i;
3621
3622         bt_dev_dbg(hdev, "sock %p", sk);
3623
3624         key_count = __le16_to_cpu(keys->key_count);
3625         if (key_count > max_key_count) {
3626                 bt_dev_err(hdev, "too big key_count value %u", key_count);
3627                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3628                                        MGMT_STATUS_INVALID_PARAMS);
3629         }
3630
3631         expected_len = struct_size(keys, keys, key_count);
3632         if (expected_len != len) {
3633                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
3634                            expected_len, len);
3635                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3636                                        MGMT_STATUS_INVALID_PARAMS);
3637         }
3638
3639         hci_dev_lock(hdev);
3640
3641         hci_blocked_keys_clear(hdev);
3642
3643         for (i = 0; i < keys->key_count; ++i) {
3644                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
3645
3646                 if (!b) {
3647                         err = MGMT_STATUS_NO_RESOURCES;
3648                         break;
3649                 }
3650
3651                 b->type = keys->keys[i].type;
3652                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
3653                 list_add_rcu(&b->list, &hdev->blocked_keys);
3654         }
3655         hci_dev_unlock(hdev);
3656
3657         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3658                                 err, NULL, 0);
3659 }
3660
3661 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
3662                                void *data, u16 len)
3663 {
3664         struct mgmt_mode *cp = data;
3665         int err;
3666         bool changed = false;
3667
3668         bt_dev_dbg(hdev, "sock %p", sk);
3669
3670         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
3671                 return mgmt_cmd_status(sk, hdev->id,
3672                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3673                                        MGMT_STATUS_NOT_SUPPORTED);
3674
3675         if (cp->val != 0x00 && cp->val != 0x01)
3676                 return mgmt_cmd_status(sk, hdev->id,
3677                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3678                                        MGMT_STATUS_INVALID_PARAMS);
3679
3680         hci_dev_lock(hdev);
3681
3682         if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) {
3683                 err = mgmt_cmd_status(sk, hdev->id,
3684                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3685                                       MGMT_STATUS_BUSY);
3686                 goto unlock;
3687         }
3688
3689         if (hdev_is_powered(hdev) &&
3690             !!cp->val != hci_dev_test_flag(hdev,
3691                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
3692                 err = mgmt_cmd_status(sk, hdev->id,
3693                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3694                                       MGMT_STATUS_REJECTED);
3695                 goto unlock;
3696         }
3697
3698         if (cp->val)
3699                 changed = !hci_dev_test_and_set_flag(hdev,
3700                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3701         else
3702                 changed = hci_dev_test_and_clear_flag(hdev,
3703                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3704
3705         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
3706         if (err < 0)
3707                 goto unlock;
3708
3709         if (changed)
3710                 err = new_settings(hdev, sk);
3711
3712 unlock:
3713         hci_dev_unlock(hdev);
3714         return err;
3715 }
3716
3717 static int read_security_info(struct sock *sk, struct hci_dev *hdev,
3718                               void *data, u16 data_len)
3719 {
3720         char buf[16];
3721         struct mgmt_rp_read_security_info *rp = (void *)buf;
3722         u16 sec_len = 0;
3723         u8 flags = 0;
3724
3725         bt_dev_dbg(hdev, "sock %p", sk);
3726
3727         memset(&buf, 0, sizeof(buf));
3728
3729         hci_dev_lock(hdev);
3730
3731         /* When the Read Simple Pairing Options command is supported, then
3732          * the remote public key validation is supported.
3733          */
3734         if (hdev->commands[41] & 0x08)
3735                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
3736
3737         flags |= 0x02;          /* Remote public key validation (LE) */
3738
3739         /* When the Read Encryption Key Size command is supported, then the
3740          * encryption key size is enforced.
3741          */
3742         if (hdev->commands[20] & 0x10)
3743                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
3744
3745         flags |= 0x08;          /* Encryption key size enforcement (LE) */
3746
3747         sec_len = eir_append_data(rp->sec, sec_len, 0x01, &flags, 1);
3748
3749         /* When the Read Simple Pairing Options command is supported, then
3750          * also max encryption key size information is provided.
3751          */
3752         if (hdev->commands[41] & 0x08)
3753                 sec_len = eir_append_le16(rp->sec, sec_len, 0x02,
3754                                           hdev->max_enc_key_size);
3755
3756         sec_len = eir_append_le16(rp->sec, sec_len, 0x03, SMP_MAX_ENC_KEY_SIZE);
3757
3758         rp->sec_len = cpu_to_le16(sec_len);
3759
3760         hci_dev_unlock(hdev);
3761
3762         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_SECURITY_INFO, 0,
3763                                  rp, sizeof(*rp) + sec_len);
3764 }
3765
3766 #ifdef CONFIG_BT_FEATURE_DEBUG
3767 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
3768 static const u8 debug_uuid[16] = {
3769         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
3770         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
3771 };
3772 #endif
3773
3774 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
3775 static const u8 simult_central_periph_uuid[16] = {
3776         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
3777         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
3778 };
3779
3780 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
3781 static const u8 rpa_resolution_uuid[16] = {
3782         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
3783         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
3784 };
3785
3786 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
3787                                   void *data, u16 data_len)
3788 {
3789         char buf[62];   /* Enough space for 3 features */
3790         struct mgmt_rp_read_exp_features_info *rp = (void *)buf;
3791         u16 idx = 0;
3792         u32 flags;
3793
3794         bt_dev_dbg(hdev, "sock %p", sk);
3795
3796         memset(&buf, 0, sizeof(buf));
3797
3798 #ifdef CONFIG_BT_FEATURE_DEBUG
3799         if (!hdev) {
3800                 flags = bt_dbg_get() ? BIT(0) : 0;
3801
3802                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
3803                 rp->features[idx].flags = cpu_to_le32(flags);
3804                 idx++;
3805         }
3806 #endif
3807
3808         if (hdev) {
3809                 if (test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) &&
3810                     (hdev->le_states[4] & 0x08) &&      /* Central */
3811                     (hdev->le_states[4] & 0x40) &&      /* Peripheral */
3812                     (hdev->le_states[3] & 0x10))        /* Simultaneous */
3813                         flags = BIT(0);
3814                 else
3815                         flags = 0;
3816
3817                 memcpy(rp->features[idx].uuid, simult_central_periph_uuid, 16);
3818                 rp->features[idx].flags = cpu_to_le32(flags);
3819                 idx++;
3820         }
3821
3822         if (hdev && use_ll_privacy(hdev)) {
3823                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
3824                         flags = BIT(0) | BIT(1);
3825                 else
3826                         flags = BIT(1);
3827
3828                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
3829                 rp->features[idx].flags = cpu_to_le32(flags);
3830                 idx++;
3831         }
3832
3833         rp->feature_count = cpu_to_le16(idx);
3834
3835         /* After reading the experimental features information, enable
3836          * the events to update client on any future change.
3837          */
3838         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3839
3840         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3841                                  MGMT_OP_READ_EXP_FEATURES_INFO,
3842                                  0, rp, sizeof(*rp) + (20 * idx));
3843 }
3844
3845 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
3846                                           struct sock *skip)
3847 {
3848         struct mgmt_ev_exp_feature_changed ev;
3849
3850         memset(&ev, 0, sizeof(ev));
3851         memcpy(ev.uuid, rpa_resolution_uuid, 16);
3852         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
3853
3854         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
3855                                   &ev, sizeof(ev),
3856                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3857
3858 }
3859
3860 #ifdef CONFIG_BT_FEATURE_DEBUG
3861 static int exp_debug_feature_changed(bool enabled, struct sock *skip)
3862 {
3863         struct mgmt_ev_exp_feature_changed ev;
3864
3865         memset(&ev, 0, sizeof(ev));
3866         memcpy(ev.uuid, debug_uuid, 16);
3867         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
3868
3869         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL,
3870                                   &ev, sizeof(ev),
3871                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3872 }
3873 #endif
3874
3875 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
3876                            void *data, u16 data_len)
3877 {
3878         struct mgmt_cp_set_exp_feature *cp = data;
3879         struct mgmt_rp_set_exp_feature rp;
3880
3881         bt_dev_dbg(hdev, "sock %p", sk);
3882
3883         if (!memcmp(cp->uuid, ZERO_KEY, 16)) {
3884                 memset(rp.uuid, 0, 16);
3885                 rp.flags = cpu_to_le32(0);
3886
3887 #ifdef CONFIG_BT_FEATURE_DEBUG
3888                 if (!hdev) {
3889                         bool changed = bt_dbg_get();
3890
3891                         bt_dbg_set(false);
3892
3893                         if (changed)
3894                                 exp_debug_feature_changed(false, sk);
3895                 }
3896 #endif
3897
3898                 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
3899                         bool changed = hci_dev_test_flag(hdev,
3900                                                          HCI_ENABLE_LL_PRIVACY);
3901
3902                         hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY);
3903
3904                         if (changed)
3905                                 exp_ll_privacy_feature_changed(false, hdev, sk);
3906                 }
3907
3908                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3909
3910                 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3911                                          MGMT_OP_SET_EXP_FEATURE, 0,
3912                                          &rp, sizeof(rp));
3913         }
3914
3915 #ifdef CONFIG_BT_FEATURE_DEBUG
3916         if (!memcmp(cp->uuid, debug_uuid, 16)) {
3917                 bool val, changed;
3918                 int err;
3919
3920                 /* Command requires to use the non-controller index */
3921                 if (hdev)
3922                         return mgmt_cmd_status(sk, hdev->id,
3923                                                MGMT_OP_SET_EXP_FEATURE,
3924                                                MGMT_STATUS_INVALID_INDEX);
3925
3926                 /* Parameters are limited to a single octet */
3927                 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3928                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3929                                                MGMT_OP_SET_EXP_FEATURE,
3930                                                MGMT_STATUS_INVALID_PARAMS);
3931
3932                 /* Only boolean on/off is supported */
3933                 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3934                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3935                                                MGMT_OP_SET_EXP_FEATURE,
3936                                                MGMT_STATUS_INVALID_PARAMS);
3937
3938                 val = !!cp->param[0];
3939                 changed = val ? !bt_dbg_get() : bt_dbg_get();
3940                 bt_dbg_set(val);
3941
3942                 memcpy(rp.uuid, debug_uuid, 16);
3943                 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
3944
3945                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3946
3947                 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
3948                                         MGMT_OP_SET_EXP_FEATURE, 0,
3949                                         &rp, sizeof(rp));
3950
3951                 if (changed)
3952                         exp_debug_feature_changed(val, sk);
3953
3954                 return err;
3955         }
3956 #endif
3957
3958         if (!memcmp(cp->uuid, rpa_resolution_uuid, 16)) {
3959                 bool val, changed;
3960                 int err;
3961                 u32 flags;
3962
3963                 /* Command requires to use the controller index */
3964                 if (!hdev)
3965                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3966                                                MGMT_OP_SET_EXP_FEATURE,
3967                                                MGMT_STATUS_INVALID_INDEX);
3968
3969                 /* Changes can only be made when controller is powered down */
3970                 if (hdev_is_powered(hdev))
3971                         return mgmt_cmd_status(sk, hdev->id,
3972                                                MGMT_OP_SET_EXP_FEATURE,
3973                                                MGMT_STATUS_NOT_POWERED);
3974
3975                 /* Parameters are limited to a single octet */
3976                 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3977                         return mgmt_cmd_status(sk, hdev->id,
3978                                                MGMT_OP_SET_EXP_FEATURE,
3979                                                MGMT_STATUS_INVALID_PARAMS);
3980
3981                 /* Only boolean on/off is supported */
3982                 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3983                         return mgmt_cmd_status(sk, hdev->id,
3984                                                MGMT_OP_SET_EXP_FEATURE,
3985                                                MGMT_STATUS_INVALID_PARAMS);
3986
3987                 val = !!cp->param[0];
3988
3989                 if (val) {
3990                         changed = !hci_dev_test_flag(hdev,
3991                                                      HCI_ENABLE_LL_PRIVACY);
3992                         hci_dev_set_flag(hdev, HCI_ENABLE_LL_PRIVACY);
3993                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
3994
3995                         /* Enable LL privacy + supported settings changed */
3996                         flags = BIT(0) | BIT(1);
3997                 } else {
3998                         changed = hci_dev_test_flag(hdev,
3999                                                     HCI_ENABLE_LL_PRIVACY);
4000                         hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY);
4001
4002                         /* Disable LL privacy + supported settings changed */
4003                         flags = BIT(1);
4004                 }
4005
4006                 memcpy(rp.uuid, rpa_resolution_uuid, 16);
4007                 rp.flags = cpu_to_le32(flags);
4008
4009                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4010
4011                 err = mgmt_cmd_complete(sk, hdev->id,
4012                                         MGMT_OP_SET_EXP_FEATURE, 0,
4013                                         &rp, sizeof(rp));
4014
4015                 if (changed)
4016                         exp_ll_privacy_feature_changed(val, hdev, sk);
4017
4018                 return err;
4019         }
4020
4021         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4022                                MGMT_OP_SET_EXP_FEATURE,
4023                                MGMT_STATUS_NOT_SUPPORTED);
4024 }
4025
4026 #define SUPPORTED_DEVICE_FLAGS() ((1U << HCI_CONN_FLAG_MAX) - 1)
4027
4028 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4029                             u16 data_len)
4030 {
4031         struct mgmt_cp_get_device_flags *cp = data;
4032         struct mgmt_rp_get_device_flags rp;
4033         struct bdaddr_list_with_flags *br_params;
4034         struct hci_conn_params *params;
4035         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4036         u32 current_flags = 0;
4037         u8 status = MGMT_STATUS_INVALID_PARAMS;
4038
4039         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
4040                    &cp->addr.bdaddr, cp->addr.type);
4041
4042         hci_dev_lock(hdev);
4043
4044         memset(&rp, 0, sizeof(rp));
4045
4046         if (cp->addr.type == BDADDR_BREDR) {
4047                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->whitelist,
4048                                                               &cp->addr.bdaddr,
4049                                                               cp->addr.type);
4050                 if (!br_params)
4051                         goto done;
4052
4053                 current_flags = br_params->current_flags;
4054         } else {
4055                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4056                                                 le_addr_type(cp->addr.type));
4057
4058                 if (!params)
4059                         goto done;
4060
4061                 current_flags = params->current_flags;
4062         }
4063
4064         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4065         rp.addr.type = cp->addr.type;
4066         rp.supported_flags = cpu_to_le32(supported_flags);
4067         rp.current_flags = cpu_to_le32(current_flags);
4068
4069         status = MGMT_STATUS_SUCCESS;
4070
4071 done:
4072         hci_dev_unlock(hdev);
4073
4074         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
4075                                 &rp, sizeof(rp));
4076 }
4077
4078 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
4079                                  bdaddr_t *bdaddr, u8 bdaddr_type,
4080                                  u32 supported_flags, u32 current_flags)
4081 {
4082         struct mgmt_ev_device_flags_changed ev;
4083
4084         bacpy(&ev.addr.bdaddr, bdaddr);
4085         ev.addr.type = bdaddr_type;
4086         ev.supported_flags = cpu_to_le32(supported_flags);
4087         ev.current_flags = cpu_to_le32(current_flags);
4088
4089         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
4090 }
4091
4092 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4093                             u16 len)
4094 {
4095         struct mgmt_cp_set_device_flags *cp = data;
4096         struct bdaddr_list_with_flags *br_params;
4097         struct hci_conn_params *params;
4098         u8 status = MGMT_STATUS_INVALID_PARAMS;
4099         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4100         u32 current_flags = __le32_to_cpu(cp->current_flags);
4101
4102         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
4103                    &cp->addr.bdaddr, cp->addr.type,
4104                    __le32_to_cpu(current_flags));
4105
4106         if ((supported_flags | current_flags) != supported_flags) {
4107                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
4108                             current_flags, supported_flags);
4109                 goto done;
4110         }
4111
4112         hci_dev_lock(hdev);
4113
4114         if (cp->addr.type == BDADDR_BREDR) {
4115                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->whitelist,
4116                                                               &cp->addr.bdaddr,
4117                                                               cp->addr.type);
4118
4119                 if (br_params) {
4120                         br_params->current_flags = current_flags;
4121                         status = MGMT_STATUS_SUCCESS;
4122                 } else {
4123                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
4124                                     &cp->addr.bdaddr, cp->addr.type);
4125                 }
4126         } else {
4127                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4128                                                 le_addr_type(cp->addr.type));
4129                 if (params) {
4130                         params->current_flags = current_flags;
4131                         status = MGMT_STATUS_SUCCESS;
4132                 } else {
4133                         bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
4134                                     &cp->addr.bdaddr,
4135                                     le_addr_type(cp->addr.type));
4136                 }
4137         }
4138
4139 done:
4140         hci_dev_unlock(hdev);
4141
4142         if (status == MGMT_STATUS_SUCCESS)
4143                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
4144                                      supported_flags, current_flags);
4145
4146         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
4147                                  &cp->addr, sizeof(cp->addr));
4148 }
4149
4150 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
4151                                    u16 handle)
4152 {
4153         struct mgmt_ev_adv_monitor_added ev;
4154
4155         ev.monitor_handle = cpu_to_le16(handle);
4156
4157         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
4158 }
4159
4160 static void mgmt_adv_monitor_removed(struct sock *sk, struct hci_dev *hdev,
4161                                      u16 handle)
4162 {
4163         struct mgmt_ev_adv_monitor_added ev;
4164
4165         ev.monitor_handle = cpu_to_le16(handle);
4166
4167         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk);
4168 }
4169
4170 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
4171                                  void *data, u16 len)
4172 {
4173         struct adv_monitor *monitor = NULL;
4174         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
4175         int handle, err;
4176         size_t rp_size = 0;
4177         __u32 supported = 0;
4178         __u16 num_handles = 0;
4179         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
4180
4181         BT_DBG("request for %s", hdev->name);
4182
4183         hci_dev_lock(hdev);
4184
4185         if (msft_get_features(hdev) & MSFT_FEATURE_MASK_LE_ADV_MONITOR)
4186                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
4187
4188         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) {
4189                 handles[num_handles++] = monitor->handle;
4190         }
4191
4192         hci_dev_unlock(hdev);
4193
4194         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
4195         rp = kmalloc(rp_size, GFP_KERNEL);
4196         if (!rp)
4197                 return -ENOMEM;
4198
4199         /* Once controller-based monitoring is in place, the enabled_features
4200          * should reflect the use.
4201          */
4202         rp->supported_features = cpu_to_le32(supported);
4203         rp->enabled_features = 0;
4204         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
4205         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
4206         rp->num_handles = cpu_to_le16(num_handles);
4207         if (num_handles)
4208                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
4209
4210         err = mgmt_cmd_complete(sk, hdev->id,
4211                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
4212                                 MGMT_STATUS_SUCCESS, rp, rp_size);
4213
4214         kfree(rp);
4215
4216         return err;
4217 }
4218
4219 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4220                                     void *data, u16 len)
4221 {
4222         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
4223         struct mgmt_rp_add_adv_patterns_monitor rp;
4224         struct adv_monitor *m = NULL;
4225         struct adv_pattern *p = NULL;
4226         unsigned int mp_cnt = 0, prev_adv_monitors_cnt;
4227         __u8 cp_ofst = 0, cp_len = 0;
4228         int err, i;
4229
4230         BT_DBG("request for %s", hdev->name);
4231
4232         if (len <= sizeof(*cp) || cp->pattern_count == 0) {
4233                 err = mgmt_cmd_status(sk, hdev->id,
4234                                       MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4235                                       MGMT_STATUS_INVALID_PARAMS);
4236                 goto failed;
4237         }
4238
4239         m = kmalloc(sizeof(*m), GFP_KERNEL);
4240         if (!m) {
4241                 err = -ENOMEM;
4242                 goto failed;
4243         }
4244
4245         INIT_LIST_HEAD(&m->patterns);
4246         m->active = false;
4247
4248         for (i = 0; i < cp->pattern_count; i++) {
4249                 if (++mp_cnt > HCI_MAX_ADV_MONITOR_NUM_PATTERNS) {
4250                         err = mgmt_cmd_status(sk, hdev->id,
4251                                               MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4252                                               MGMT_STATUS_INVALID_PARAMS);
4253                         goto failed;
4254                 }
4255
4256                 cp_ofst = cp->patterns[i].offset;
4257                 cp_len = cp->patterns[i].length;
4258                 if (cp_ofst >= HCI_MAX_AD_LENGTH ||
4259                     cp_len > HCI_MAX_AD_LENGTH ||
4260                     (cp_ofst + cp_len) > HCI_MAX_AD_LENGTH) {
4261                         err = mgmt_cmd_status(sk, hdev->id,
4262                                               MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4263                                               MGMT_STATUS_INVALID_PARAMS);
4264                         goto failed;
4265                 }
4266
4267                 p = kmalloc(sizeof(*p), GFP_KERNEL);
4268                 if (!p) {
4269                         err = -ENOMEM;
4270                         goto failed;
4271                 }
4272
4273                 p->ad_type = cp->patterns[i].ad_type;
4274                 p->offset = cp->patterns[i].offset;
4275                 p->length = cp->patterns[i].length;
4276                 memcpy(p->value, cp->patterns[i].value, p->length);
4277
4278                 INIT_LIST_HEAD(&p->list);
4279                 list_add(&p->list, &m->patterns);
4280         }
4281
4282         if (mp_cnt != cp->pattern_count) {
4283                 err = mgmt_cmd_status(sk, hdev->id,
4284                                       MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4285                                       MGMT_STATUS_INVALID_PARAMS);
4286                 goto failed;
4287         }
4288
4289         hci_dev_lock(hdev);
4290
4291         prev_adv_monitors_cnt = hdev->adv_monitors_cnt;
4292
4293         err = hci_add_adv_monitor(hdev, m);
4294         if (err) {
4295                 if (err == -ENOSPC) {
4296                         mgmt_cmd_status(sk, hdev->id,
4297                                         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4298                                         MGMT_STATUS_NO_RESOURCES);
4299                 }
4300                 goto unlock;
4301         }
4302
4303         if (hdev->adv_monitors_cnt > prev_adv_monitors_cnt)
4304                 mgmt_adv_monitor_added(sk, hdev, m->handle);
4305
4306         hci_dev_unlock(hdev);
4307
4308         rp.monitor_handle = cpu_to_le16(m->handle);
4309
4310         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4311                                  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
4312
4313 unlock:
4314         hci_dev_unlock(hdev);
4315
4316 failed:
4317         hci_free_adv_monitor(m);
4318         return err;
4319 }
4320
4321 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
4322                               void *data, u16 len)
4323 {
4324         struct mgmt_cp_remove_adv_monitor *cp = data;
4325         struct mgmt_rp_remove_adv_monitor rp;
4326         unsigned int prev_adv_monitors_cnt;
4327         u16 handle;
4328         int err;
4329
4330         BT_DBG("request for %s", hdev->name);
4331
4332         hci_dev_lock(hdev);
4333
4334         handle = __le16_to_cpu(cp->monitor_handle);
4335         prev_adv_monitors_cnt = hdev->adv_monitors_cnt;
4336
4337         err = hci_remove_adv_monitor(hdev, handle);
4338         if (err == -ENOENT) {
4339                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4340                                       MGMT_STATUS_INVALID_INDEX);
4341                 goto unlock;
4342         }
4343
4344         if (hdev->adv_monitors_cnt < prev_adv_monitors_cnt)
4345                 mgmt_adv_monitor_removed(sk, hdev, handle);
4346
4347         hci_dev_unlock(hdev);
4348
4349         rp.monitor_handle = cp->monitor_handle;
4350
4351         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4352                                  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
4353
4354 unlock:
4355         hci_dev_unlock(hdev);
4356         return err;
4357 }
4358
4359 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
4360                                          u16 opcode, struct sk_buff *skb)
4361 {
4362         struct mgmt_rp_read_local_oob_data mgmt_rp;
4363         size_t rp_size = sizeof(mgmt_rp);
4364         struct mgmt_pending_cmd *cmd;
4365
4366         bt_dev_dbg(hdev, "status %u", status);
4367
4368         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4369         if (!cmd)
4370                 return;
4371
4372         if (status || !skb) {
4373                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4374                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
4375                 goto remove;
4376         }
4377
4378         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
4379
4380         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
4381                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
4382
4383                 if (skb->len < sizeof(*rp)) {
4384                         mgmt_cmd_status(cmd->sk, hdev->id,
4385                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4386                                         MGMT_STATUS_FAILED);
4387                         goto remove;
4388                 }
4389
4390                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
4391                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
4392
4393                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
4394         } else {
4395                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
4396
4397                 if (skb->len < sizeof(*rp)) {
4398                         mgmt_cmd_status(cmd->sk, hdev->id,
4399                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4400                                         MGMT_STATUS_FAILED);
4401                         goto remove;
4402                 }
4403
4404                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
4405                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
4406
4407                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
4408                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
4409         }
4410
4411         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4412                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
4413
4414 remove:
4415         mgmt_pending_remove(cmd);
4416 }
4417
4418 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
4419                                void *data, u16 data_len)
4420 {
4421         struct mgmt_pending_cmd *cmd;
4422         struct hci_request req;
4423         int err;
4424
4425         bt_dev_dbg(hdev, "sock %p", sk);
4426
4427         hci_dev_lock(hdev);
4428
4429         if (!hdev_is_powered(hdev)) {
4430                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4431                                       MGMT_STATUS_NOT_POWERED);
4432                 goto unlock;
4433         }
4434
4435         if (!lmp_ssp_capable(hdev)) {
4436                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4437                                       MGMT_STATUS_NOT_SUPPORTED);
4438                 goto unlock;
4439         }
4440
4441         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
4442                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4443                                       MGMT_STATUS_BUSY);
4444                 goto unlock;
4445         }
4446
4447         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
4448         if (!cmd) {
4449                 err = -ENOMEM;
4450                 goto unlock;
4451         }
4452
4453         hci_req_init(&req, hdev);
4454
4455         if (bredr_sc_enabled(hdev))
4456                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4457         else
4458                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4459
4460         err = hci_req_run_skb(&req, read_local_oob_data_complete);
4461         if (err < 0)
4462                 mgmt_pending_remove(cmd);
4463
4464 unlock:
4465         hci_dev_unlock(hdev);
4466         return err;
4467 }
4468
4469 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4470                                void *data, u16 len)
4471 {
4472         struct mgmt_addr_info *addr = data;
4473         int err;
4474
4475         bt_dev_dbg(hdev, "sock %p", sk);
4476
4477         if (!bdaddr_type_is_valid(addr->type))
4478                 return mgmt_cmd_complete(sk, hdev->id,
4479                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
4480                                          MGMT_STATUS_INVALID_PARAMS,
4481                                          addr, sizeof(*addr));
4482
4483         hci_dev_lock(hdev);
4484
4485         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4486                 struct mgmt_cp_add_remote_oob_data *cp = data;
4487                 u8 status;
4488
4489                 if (cp->addr.type != BDADDR_BREDR) {
4490                         err = mgmt_cmd_complete(sk, hdev->id,
4491                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
4492                                                 MGMT_STATUS_INVALID_PARAMS,
4493                                                 &cp->addr, sizeof(cp->addr));
4494                         goto unlock;
4495                 }
4496
4497                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4498                                               cp->addr.type, cp->hash,
4499                                               cp->rand, NULL, NULL);
4500                 if (err < 0)
4501                         status = MGMT_STATUS_FAILED;
4502                 else
4503                         status = MGMT_STATUS_SUCCESS;
4504
4505                 err = mgmt_cmd_complete(sk, hdev->id,
4506                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4507                                         &cp->addr, sizeof(cp->addr));
4508         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4509                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
4510                 u8 *rand192, *hash192, *rand256, *hash256;
4511                 u8 status;
4512
4513                 if (bdaddr_type_is_le(cp->addr.type)) {
4514                         /* Enforce zero-valued 192-bit parameters as
4515                          * long as legacy SMP OOB isn't implemented.
4516                          */
4517                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4518                             memcmp(cp->hash192, ZERO_KEY, 16)) {
4519                                 err = mgmt_cmd_complete(sk, hdev->id,
4520                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4521                                                         MGMT_STATUS_INVALID_PARAMS,
4522                                                         addr, sizeof(*addr));
4523                                 goto unlock;
4524                         }
4525
4526                         rand192 = NULL;
4527                         hash192 = NULL;
4528                 } else {
4529                         /* In case one of the P-192 values is set to zero,
4530                          * then just disable OOB data for P-192.
4531                          */
4532                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4533                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
4534                                 rand192 = NULL;
4535                                 hash192 = NULL;
4536                         } else {
4537                                 rand192 = cp->rand192;
4538                                 hash192 = cp->hash192;
4539                         }
4540                 }
4541
4542                 /* In case one of the P-256 values is set to zero, then just
4543                  * disable OOB data for P-256.
4544                  */
4545                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4546                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
4547                         rand256 = NULL;
4548                         hash256 = NULL;
4549                 } else {
4550                         rand256 = cp->rand256;
4551                         hash256 = cp->hash256;
4552                 }
4553
4554                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4555                                               cp->addr.type, hash192, rand192,
4556                                               hash256, rand256);
4557                 if (err < 0)
4558                         status = MGMT_STATUS_FAILED;
4559                 else
4560                         status = MGMT_STATUS_SUCCESS;
4561
4562                 err = mgmt_cmd_complete(sk, hdev->id,
4563                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4564                                         status, &cp->addr, sizeof(cp->addr));
4565         } else {
4566                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
4567                            len);
4568                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4569                                       MGMT_STATUS_INVALID_PARAMS);
4570         }
4571
4572 unlock:
4573         hci_dev_unlock(hdev);
4574         return err;
4575 }
4576
4577 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4578                                   void *data, u16 len)
4579 {
4580         struct mgmt_cp_remove_remote_oob_data *cp = data;
4581         u8 status;
4582         int err;
4583
4584         bt_dev_dbg(hdev, "sock %p", sk);
4585
4586         if (cp->addr.type != BDADDR_BREDR)
4587                 return mgmt_cmd_complete(sk, hdev->id,
4588                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4589                                          MGMT_STATUS_INVALID_PARAMS,
4590                                          &cp->addr, sizeof(cp->addr));
4591
4592         hci_dev_lock(hdev);
4593
4594         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4595                 hci_remote_oob_data_clear(hdev);
4596                 status = MGMT_STATUS_SUCCESS;
4597                 goto done;
4598         }
4599
4600         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
4601         if (err < 0)
4602                 status = MGMT_STATUS_INVALID_PARAMS;
4603         else
4604                 status = MGMT_STATUS_SUCCESS;
4605
4606 done:
4607         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4608                                 status, &cp->addr, sizeof(cp->addr));
4609
4610         hci_dev_unlock(hdev);
4611         return err;
4612 }
4613
4614 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
4615 {
4616         struct mgmt_pending_cmd *cmd;
4617
4618         bt_dev_dbg(hdev, "status %d", status);
4619
4620         hci_dev_lock(hdev);
4621
4622         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4623         if (!cmd)
4624                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4625
4626         if (!cmd)
4627                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
4628
4629         if (cmd) {
4630                 cmd->cmd_complete(cmd, mgmt_status(status));
4631                 mgmt_pending_remove(cmd);
4632         }
4633
4634         hci_dev_unlock(hdev);
4635
4636         /* Handle suspend notifier */
4637         if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY,
4638                                hdev->suspend_tasks)) {
4639                 bt_dev_dbg(hdev, "Unpaused discovery");
4640                 wake_up(&hdev->suspend_wait_q);
4641         }
4642 }
4643
4644 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
4645                                     uint8_t *mgmt_status)
4646 {
4647         switch (type) {
4648         case DISCOV_TYPE_LE:
4649                 *mgmt_status = mgmt_le_support(hdev);
4650                 if (*mgmt_status)
4651                         return false;
4652                 break;
4653         case DISCOV_TYPE_INTERLEAVED:
4654                 *mgmt_status = mgmt_le_support(hdev);
4655                 if (*mgmt_status)
4656                         return false;
4657                 fallthrough;
4658         case DISCOV_TYPE_BREDR:
4659                 *mgmt_status = mgmt_bredr_support(hdev);
4660                 if (*mgmt_status)
4661                         return false;
4662                 break;
4663         default:
4664                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
4665                 return false;
4666         }
4667
4668         return true;
4669 }
4670
4671 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
4672                                     u16 op, void *data, u16 len)
4673 {
4674         struct mgmt_cp_start_discovery *cp = data;
4675         struct mgmt_pending_cmd *cmd;
4676         u8 status;
4677         int err;
4678
4679         bt_dev_dbg(hdev, "sock %p", sk);
4680
4681         hci_dev_lock(hdev);
4682
4683         if (!hdev_is_powered(hdev)) {
4684                 err = mgmt_cmd_complete(sk, hdev->id, op,
4685                                         MGMT_STATUS_NOT_POWERED,
4686                                         &cp->type, sizeof(cp->type));
4687                 goto failed;
4688         }
4689
4690         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4691             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4692                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4693                                         &cp->type, sizeof(cp->type));
4694                 goto failed;
4695         }
4696
4697         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4698                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
4699                                         &cp->type, sizeof(cp->type));
4700                 goto failed;
4701         }
4702
4703         /* Can't start discovery when it is paused */
4704         if (hdev->discovery_paused) {
4705                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4706                                         &cp->type, sizeof(cp->type));
4707                 goto failed;
4708         }
4709
4710         /* Clear the discovery filter first to free any previously
4711          * allocated memory for the UUID list.
4712          */
4713         hci_discovery_filter_clear(hdev);
4714
4715         hdev->discovery.type = cp->type;
4716         hdev->discovery.report_invalid_rssi = false;
4717         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
4718                 hdev->discovery.limited = true;
4719         else
4720                 hdev->discovery.limited = false;
4721
4722         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4723         if (!cmd) {
4724                 err = -ENOMEM;
4725                 goto failed;
4726         }
4727
4728         cmd->cmd_complete = generic_cmd_complete;
4729
4730         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4731         queue_work(hdev->req_workqueue, &hdev->discov_update);
4732         err = 0;
4733
4734 failed:
4735         hci_dev_unlock(hdev);
4736         return err;
4737 }
4738
4739 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4740                            void *data, u16 len)
4741 {
4742         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
4743                                         data, len);
4744 }
4745
4746 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
4747                                    void *data, u16 len)
4748 {
4749         return start_discovery_internal(sk, hdev,
4750                                         MGMT_OP_START_LIMITED_DISCOVERY,
4751                                         data, len);
4752 }
4753
4754 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4755                                           u8 status)
4756 {
4757         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4758                                  cmd->param, 1);
4759 }
4760
4761 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4762                                    void *data, u16 len)
4763 {
4764         struct mgmt_cp_start_service_discovery *cp = data;
4765         struct mgmt_pending_cmd *cmd;
4766         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4767         u16 uuid_count, expected_len;
4768         u8 status;
4769         int err;
4770
4771         bt_dev_dbg(hdev, "sock %p", sk);
4772
4773         hci_dev_lock(hdev);
4774
4775         if (!hdev_is_powered(hdev)) {
4776                 err = mgmt_cmd_complete(sk, hdev->id,
4777                                         MGMT_OP_START_SERVICE_DISCOVERY,
4778                                         MGMT_STATUS_NOT_POWERED,
4779                                         &cp->type, sizeof(cp->type));
4780                 goto failed;
4781         }
4782
4783         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4784             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4785                 err = mgmt_cmd_complete(sk, hdev->id,
4786                                         MGMT_OP_START_SERVICE_DISCOVERY,
4787                                         MGMT_STATUS_BUSY, &cp->type,
4788                                         sizeof(cp->type));
4789                 goto failed;
4790         }
4791
4792         uuid_count = __le16_to_cpu(cp->uuid_count);
4793         if (uuid_count > max_uuid_count) {
4794                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
4795                            uuid_count);
4796                 err = mgmt_cmd_complete(sk, hdev->id,
4797                                         MGMT_OP_START_SERVICE_DISCOVERY,
4798                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4799                                         sizeof(cp->type));
4800                 goto failed;
4801         }
4802
4803         expected_len = sizeof(*cp) + uuid_count * 16;
4804         if (expected_len != len) {
4805                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
4806                            expected_len, len);
4807                 err = mgmt_cmd_complete(sk, hdev->id,
4808                                         MGMT_OP_START_SERVICE_DISCOVERY,
4809                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4810                                         sizeof(cp->type));
4811                 goto failed;
4812         }
4813
4814         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4815                 err = mgmt_cmd_complete(sk, hdev->id,
4816                                         MGMT_OP_START_SERVICE_DISCOVERY,
4817                                         status, &cp->type, sizeof(cp->type));
4818                 goto failed;
4819         }
4820
4821         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4822                                hdev, data, len);
4823         if (!cmd) {
4824                 err = -ENOMEM;
4825                 goto failed;
4826         }
4827
4828         cmd->cmd_complete = service_discovery_cmd_complete;
4829
4830         /* Clear the discovery filter first to free any previously
4831          * allocated memory for the UUID list.
4832          */
4833         hci_discovery_filter_clear(hdev);
4834
4835         hdev->discovery.result_filtering = true;
4836         hdev->discovery.type = cp->type;
4837         hdev->discovery.rssi = cp->rssi;
4838         hdev->discovery.uuid_count = uuid_count;
4839
4840         if (uuid_count > 0) {
4841                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4842                                                 GFP_KERNEL);
4843                 if (!hdev->discovery.uuids) {
4844                         err = mgmt_cmd_complete(sk, hdev->id,
4845                                                 MGMT_OP_START_SERVICE_DISCOVERY,
4846                                                 MGMT_STATUS_FAILED,
4847                                                 &cp->type, sizeof(cp->type));
4848                         mgmt_pending_remove(cmd);
4849                         goto failed;
4850                 }
4851         }
4852
4853         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4854         queue_work(hdev->req_workqueue, &hdev->discov_update);
4855         err = 0;
4856
4857 failed:
4858         hci_dev_unlock(hdev);
4859         return err;
4860 }
4861
4862 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
4863 {
4864         struct mgmt_pending_cmd *cmd;
4865
4866         bt_dev_dbg(hdev, "status %d", status);
4867
4868         hci_dev_lock(hdev);
4869
4870         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4871         if (cmd) {
4872                 cmd->cmd_complete(cmd, mgmt_status(status));
4873                 mgmt_pending_remove(cmd);
4874         }
4875
4876         hci_dev_unlock(hdev);
4877
4878         /* Handle suspend notifier */
4879         if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) {
4880                 bt_dev_dbg(hdev, "Paused discovery");
4881                 wake_up(&hdev->suspend_wait_q);
4882         }
4883 }
4884
4885 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4886                           u16 len)
4887 {
4888         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4889         struct mgmt_pending_cmd *cmd;
4890         int err;
4891
4892         bt_dev_dbg(hdev, "sock %p", sk);
4893
4894         hci_dev_lock(hdev);
4895
4896         if (!hci_discovery_active(hdev)) {
4897                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4898                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
4899                                         sizeof(mgmt_cp->type));
4900                 goto unlock;
4901         }
4902
4903         if (hdev->discovery.type != mgmt_cp->type) {
4904                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4905                                         MGMT_STATUS_INVALID_PARAMS,
4906                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4907                 goto unlock;
4908         }
4909
4910         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4911         if (!cmd) {
4912                 err = -ENOMEM;
4913                 goto unlock;
4914         }
4915
4916         cmd->cmd_complete = generic_cmd_complete;
4917
4918         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4919         queue_work(hdev->req_workqueue, &hdev->discov_update);
4920         err = 0;
4921
4922 unlock:
4923         hci_dev_unlock(hdev);
4924         return err;
4925 }
4926
4927 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4928                         u16 len)
4929 {
4930         struct mgmt_cp_confirm_name *cp = data;
4931         struct inquiry_entry *e;
4932         int err;
4933
4934         bt_dev_dbg(hdev, "sock %p", sk);
4935
4936         hci_dev_lock(hdev);
4937
4938         if (!hci_discovery_active(hdev)) {
4939                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4940                                         MGMT_STATUS_FAILED, &cp->addr,
4941                                         sizeof(cp->addr));
4942                 goto failed;
4943         }
4944
4945         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4946         if (!e) {
4947                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4948                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4949                                         sizeof(cp->addr));
4950                 goto failed;
4951         }
4952
4953         if (cp->name_known) {
4954                 e->name_state = NAME_KNOWN;
4955                 list_del(&e->list);
4956         } else {
4957                 e->name_state = NAME_NEEDED;
4958                 hci_inquiry_cache_update_resolve(hdev, e);
4959         }
4960
4961         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4962                                 &cp->addr, sizeof(cp->addr));
4963
4964 failed:
4965         hci_dev_unlock(hdev);
4966         return err;
4967 }
4968
4969 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4970                         u16 len)
4971 {
4972         struct mgmt_cp_block_device *cp = data;
4973         u8 status;
4974         int err;
4975
4976         bt_dev_dbg(hdev, "sock %p", sk);
4977
4978         if (!bdaddr_type_is_valid(cp->addr.type))
4979                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4980                                          MGMT_STATUS_INVALID_PARAMS,
4981                                          &cp->addr, sizeof(cp->addr));
4982
4983         hci_dev_lock(hdev);
4984
4985         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4986                                   cp->addr.type);
4987         if (err < 0) {
4988                 status = MGMT_STATUS_FAILED;
4989                 goto done;
4990         }
4991
4992         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4993                    sk);
4994         status = MGMT_STATUS_SUCCESS;
4995
4996 done:
4997         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4998                                 &cp->addr, sizeof(cp->addr));
4999
5000         hci_dev_unlock(hdev);
5001
5002         return err;
5003 }
5004
5005 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
5006                           u16 len)
5007 {
5008         struct mgmt_cp_unblock_device *cp = data;
5009         u8 status;
5010         int err;
5011
5012         bt_dev_dbg(hdev, "sock %p", sk);
5013
5014         if (!bdaddr_type_is_valid(cp->addr.type))
5015                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
5016                                          MGMT_STATUS_INVALID_PARAMS,
5017                                          &cp->addr, sizeof(cp->addr));
5018
5019         hci_dev_lock(hdev);
5020
5021         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
5022                                   cp->addr.type);
5023         if (err < 0) {
5024                 status = MGMT_STATUS_INVALID_PARAMS;
5025                 goto done;
5026         }
5027
5028         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5029                    sk);
5030         status = MGMT_STATUS_SUCCESS;
5031
5032 done:
5033         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
5034                                 &cp->addr, sizeof(cp->addr));
5035
5036         hci_dev_unlock(hdev);
5037
5038         return err;
5039 }
5040
5041 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
5042                          u16 len)
5043 {
5044         struct mgmt_cp_set_device_id *cp = data;
5045         struct hci_request req;
5046         int err;
5047         __u16 source;
5048
5049         bt_dev_dbg(hdev, "sock %p", sk);
5050
5051         source = __le16_to_cpu(cp->source);
5052
5053         if (source > 0x0002)
5054                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
5055                                        MGMT_STATUS_INVALID_PARAMS);
5056
5057         hci_dev_lock(hdev);
5058
5059         hdev->devid_source = source;
5060         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
5061         hdev->devid_product = __le16_to_cpu(cp->product);
5062         hdev->devid_version = __le16_to_cpu(cp->version);
5063
5064         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
5065                                 NULL, 0);
5066
5067         hci_req_init(&req, hdev);
5068         __hci_req_update_eir(&req);
5069         hci_req_run(&req, NULL);
5070
5071         hci_dev_unlock(hdev);
5072
5073         return err;
5074 }
5075
5076 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
5077                                         u16 opcode)
5078 {
5079         bt_dev_dbg(hdev, "status %d", status);
5080 }
5081
5082 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
5083                                      u16 opcode)
5084 {
5085         struct cmd_lookup match = { NULL, hdev };
5086         struct hci_request req;
5087         u8 instance;
5088         struct adv_info *adv_instance;
5089         int err;
5090
5091         hci_dev_lock(hdev);
5092
5093         if (status) {
5094                 u8 mgmt_err = mgmt_status(status);
5095
5096                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
5097                                      cmd_status_rsp, &mgmt_err);
5098                 goto unlock;
5099         }
5100
5101         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
5102                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
5103         else
5104                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
5105
5106         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
5107                              &match);
5108
5109         new_settings(hdev, match.sk);
5110
5111         if (match.sk)
5112                 sock_put(match.sk);
5113
5114         /* Handle suspend notifier */
5115         if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING,
5116                                hdev->suspend_tasks)) {
5117                 bt_dev_dbg(hdev, "Paused advertising");
5118                 wake_up(&hdev->suspend_wait_q);
5119         } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING,
5120                                       hdev->suspend_tasks)) {
5121                 bt_dev_dbg(hdev, "Unpaused advertising");
5122                 wake_up(&hdev->suspend_wait_q);
5123         }
5124
5125         /* If "Set Advertising" was just disabled and instance advertising was
5126          * set up earlier, then re-enable multi-instance advertising.
5127          */
5128         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
5129             list_empty(&hdev->adv_instances))
5130                 goto unlock;
5131
5132         instance = hdev->cur_adv_instance;
5133         if (!instance) {
5134                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
5135                                                         struct adv_info, list);
5136                 if (!adv_instance)
5137                         goto unlock;
5138
5139                 instance = adv_instance->instance;
5140         }
5141
5142         hci_req_init(&req, hdev);
5143
5144         err = __hci_req_schedule_adv_instance(&req, instance, true);
5145
5146         if (!err)
5147                 err = hci_req_run(&req, enable_advertising_instance);
5148
5149         if (err)
5150                 bt_dev_err(hdev, "failed to re-configure advertising");
5151
5152 unlock:
5153         hci_dev_unlock(hdev);
5154 }
5155
5156 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
5157                            u16 len)
5158 {
5159         struct mgmt_mode *cp = data;
5160         struct mgmt_pending_cmd *cmd;
5161         struct hci_request req;
5162         u8 val, status;
5163         int err;
5164
5165         bt_dev_dbg(hdev, "sock %p", sk);
5166
5167         status = mgmt_le_support(hdev);
5168         if (status)
5169                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5170                                        status);
5171
5172         /* Enabling the experimental LL Privay support disables support for
5173          * advertising.
5174          */
5175         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
5176                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5177                                        MGMT_STATUS_NOT_SUPPORTED);
5178
5179         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5180                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5181                                        MGMT_STATUS_INVALID_PARAMS);
5182
5183         if (hdev->advertising_paused)
5184                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5185                                        MGMT_STATUS_BUSY);
5186
5187         hci_dev_lock(hdev);
5188
5189         val = !!cp->val;
5190
5191         /* The following conditions are ones which mean that we should
5192          * not do any HCI communication but directly send a mgmt
5193          * response to user space (after toggling the flag if
5194          * necessary).
5195          */
5196         if (!hdev_is_powered(hdev) ||
5197             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
5198              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
5199             hci_conn_num(hdev, LE_LINK) > 0 ||
5200             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5201              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
5202                 bool changed;
5203
5204                 if (cp->val) {
5205                         hdev->cur_adv_instance = 0x00;
5206                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
5207                         if (cp->val == 0x02)
5208                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5209                         else
5210                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5211                 } else {
5212                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
5213                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5214                 }
5215
5216                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
5217                 if (err < 0)
5218                         goto unlock;
5219
5220                 if (changed)
5221                         err = new_settings(hdev, sk);
5222
5223                 goto unlock;
5224         }
5225
5226         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
5227             pending_find(MGMT_OP_SET_LE, hdev)) {
5228                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5229                                       MGMT_STATUS_BUSY);
5230                 goto unlock;
5231         }
5232
5233         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
5234         if (!cmd) {
5235                 err = -ENOMEM;
5236                 goto unlock;
5237         }
5238
5239         hci_req_init(&req, hdev);
5240
5241         if (cp->val == 0x02)
5242                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5243         else
5244                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5245
5246         cancel_adv_timeout(hdev);
5247
5248         if (val) {
5249                 /* Switch to instance "0" for the Set Advertising setting.
5250                  * We cannot use update_[adv|scan_rsp]_data() here as the
5251                  * HCI_ADVERTISING flag is not yet set.
5252                  */
5253                 hdev->cur_adv_instance = 0x00;
5254
5255                 if (ext_adv_capable(hdev)) {
5256                         __hci_req_start_ext_adv(&req, 0x00);
5257                 } else {
5258                         __hci_req_update_adv_data(&req, 0x00);
5259                         __hci_req_update_scan_rsp_data(&req, 0x00);
5260                         __hci_req_enable_advertising(&req);
5261                 }
5262         } else {
5263                 __hci_req_disable_advertising(&req);
5264         }
5265
5266         err = hci_req_run(&req, set_advertising_complete);
5267         if (err < 0)
5268                 mgmt_pending_remove(cmd);
5269
5270 unlock:
5271         hci_dev_unlock(hdev);
5272         return err;
5273 }
5274
5275 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
5276                               void *data, u16 len)
5277 {
5278         struct mgmt_cp_set_static_address *cp = data;
5279         int err;
5280
5281         bt_dev_dbg(hdev, "sock %p", sk);
5282
5283         if (!lmp_le_capable(hdev))
5284                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5285                                        MGMT_STATUS_NOT_SUPPORTED);
5286
5287         if (hdev_is_powered(hdev))
5288                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5289                                        MGMT_STATUS_REJECTED);
5290
5291         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
5292                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
5293                         return mgmt_cmd_status(sk, hdev->id,
5294                                                MGMT_OP_SET_STATIC_ADDRESS,
5295                                                MGMT_STATUS_INVALID_PARAMS);
5296
5297                 /* Two most significant bits shall be set */
5298                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
5299                         return mgmt_cmd_status(sk, hdev->id,
5300                                                MGMT_OP_SET_STATIC_ADDRESS,
5301                                                MGMT_STATUS_INVALID_PARAMS);
5302         }
5303
5304         hci_dev_lock(hdev);
5305
5306         bacpy(&hdev->static_addr, &cp->bdaddr);
5307
5308         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
5309         if (err < 0)
5310                 goto unlock;
5311
5312         err = new_settings(hdev, sk);
5313
5314 unlock:
5315         hci_dev_unlock(hdev);
5316         return err;
5317 }
5318
5319 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5320                            void *data, u16 len)
5321 {
5322         struct mgmt_cp_set_scan_params *cp = data;
5323         __u16 interval, window;
5324         int err;
5325
5326         bt_dev_dbg(hdev, "sock %p", sk);
5327
5328         if (!lmp_le_capable(hdev))
5329                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5330                                        MGMT_STATUS_NOT_SUPPORTED);
5331
5332         interval = __le16_to_cpu(cp->interval);
5333
5334         if (interval < 0x0004 || interval > 0x4000)
5335                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5336                                        MGMT_STATUS_INVALID_PARAMS);
5337
5338         window = __le16_to_cpu(cp->window);
5339
5340         if (window < 0x0004 || window > 0x4000)
5341                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5342                                        MGMT_STATUS_INVALID_PARAMS);
5343
5344         if (window > interval)
5345                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5346                                        MGMT_STATUS_INVALID_PARAMS);
5347
5348         hci_dev_lock(hdev);
5349
5350         hdev->le_scan_interval = interval;
5351         hdev->le_scan_window = window;
5352
5353         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5354                                 NULL, 0);
5355
5356         /* If background scan is running, restart it so new parameters are
5357          * loaded.
5358          */
5359         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5360             hdev->discovery.state == DISCOVERY_STOPPED) {
5361                 struct hci_request req;
5362
5363                 hci_req_init(&req, hdev);
5364
5365                 hci_req_add_le_scan_disable(&req, false);
5366                 hci_req_add_le_passive_scan(&req);
5367
5368                 hci_req_run(&req, NULL);
5369         }
5370
5371         hci_dev_unlock(hdev);
5372
5373         return err;
5374 }
5375
5376 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5377                                       u16 opcode)
5378 {
5379         struct mgmt_pending_cmd *cmd;
5380
5381         bt_dev_dbg(hdev, "status 0x%02x", status);
5382
5383         hci_dev_lock(hdev);
5384
5385         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5386         if (!cmd)
5387                 goto unlock;
5388
5389         if (status) {
5390                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5391                                 mgmt_status(status));
5392         } else {
5393                 struct mgmt_mode *cp = cmd->param;
5394
5395                 if (cp->val)
5396                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
5397                 else
5398                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5399
5400                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5401                 new_settings(hdev, cmd->sk);
5402         }
5403
5404         mgmt_pending_remove(cmd);
5405
5406 unlock:
5407         hci_dev_unlock(hdev);
5408 }
5409
5410 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
5411                                 void *data, u16 len)
5412 {
5413         struct mgmt_mode *cp = data;
5414         struct mgmt_pending_cmd *cmd;
5415         struct hci_request req;
5416         int err;
5417
5418         bt_dev_dbg(hdev, "sock %p", sk);
5419
5420         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
5421             hdev->hci_ver < BLUETOOTH_VER_1_2)
5422                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5423                                        MGMT_STATUS_NOT_SUPPORTED);
5424
5425         if (cp->val != 0x00 && cp->val != 0x01)
5426                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5427                                        MGMT_STATUS_INVALID_PARAMS);
5428
5429         hci_dev_lock(hdev);
5430
5431         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
5432                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5433                                       MGMT_STATUS_BUSY);
5434                 goto unlock;
5435         }
5436
5437         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
5438                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5439                                         hdev);
5440                 goto unlock;
5441         }
5442
5443         if (!hdev_is_powered(hdev)) {
5444                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
5445                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5446                                         hdev);
5447                 new_settings(hdev, sk);
5448                 goto unlock;
5449         }
5450
5451         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5452                                data, len);
5453         if (!cmd) {
5454                 err = -ENOMEM;
5455                 goto unlock;
5456         }
5457
5458         hci_req_init(&req, hdev);
5459
5460         __hci_req_write_fast_connectable(&req, cp->val);
5461
5462         err = hci_req_run(&req, fast_connectable_complete);
5463         if (err < 0) {
5464                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5465                                       MGMT_STATUS_FAILED);
5466                 mgmt_pending_remove(cmd);
5467         }
5468
5469 unlock:
5470         hci_dev_unlock(hdev);
5471
5472         return err;
5473 }
5474
5475 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5476 {
5477         struct mgmt_pending_cmd *cmd;
5478
5479         bt_dev_dbg(hdev, "status 0x%02x", status);
5480
5481         hci_dev_lock(hdev);
5482
5483         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
5484         if (!cmd)
5485                 goto unlock;
5486
5487         if (status) {
5488                 u8 mgmt_err = mgmt_status(status);
5489
5490                 /* We need to restore the flag if related HCI commands
5491                  * failed.
5492                  */
5493                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
5494
5495                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5496         } else {
5497                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5498                 new_settings(hdev, cmd->sk);
5499         }
5500
5501         mgmt_pending_remove(cmd);
5502
5503 unlock:
5504         hci_dev_unlock(hdev);
5505 }
5506
5507 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5508 {
5509         struct mgmt_mode *cp = data;
5510         struct mgmt_pending_cmd *cmd;
5511         struct hci_request req;
5512         int err;
5513
5514         bt_dev_dbg(hdev, "sock %p", sk);
5515
5516         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5517                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5518                                        MGMT_STATUS_NOT_SUPPORTED);
5519
5520         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5521                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5522                                        MGMT_STATUS_REJECTED);
5523
5524         if (cp->val != 0x00 && cp->val != 0x01)
5525                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5526                                        MGMT_STATUS_INVALID_PARAMS);
5527
5528         hci_dev_lock(hdev);
5529
5530         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5531                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5532                 goto unlock;
5533         }
5534
5535         if (!hdev_is_powered(hdev)) {
5536                 if (!cp->val) {
5537                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5538                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5539                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5540                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5541                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5542                 }
5543
5544                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5545
5546                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5547                 if (err < 0)
5548                         goto unlock;
5549
5550                 err = new_settings(hdev, sk);
5551                 goto unlock;
5552         }
5553
5554         /* Reject disabling when powered on */
5555         if (!cp->val) {
5556                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5557                                       MGMT_STATUS_REJECTED);
5558                 goto unlock;
5559         } else {
5560                 /* When configuring a dual-mode controller to operate
5561                  * with LE only and using a static address, then switching
5562                  * BR/EDR back on is not allowed.
5563                  *
5564                  * Dual-mode controllers shall operate with the public
5565                  * address as its identity address for BR/EDR and LE. So
5566                  * reject the attempt to create an invalid configuration.
5567                  *
5568                  * The same restrictions applies when secure connections
5569                  * has been enabled. For BR/EDR this is a controller feature
5570                  * while for LE it is a host stack feature. This means that
5571                  * switching BR/EDR back on when secure connections has been
5572                  * enabled is not a supported transaction.
5573                  */
5574                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5575                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5576                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5577                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5578                                               MGMT_STATUS_REJECTED);
5579                         goto unlock;
5580                 }
5581         }
5582
5583         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5584                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5585                                       MGMT_STATUS_BUSY);
5586                 goto unlock;
5587         }
5588
5589         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5590         if (!cmd) {
5591                 err = -ENOMEM;
5592                 goto unlock;
5593         }
5594
5595         /* We need to flip the bit already here so that
5596          * hci_req_update_adv_data generates the correct flags.
5597          */
5598         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5599
5600         hci_req_init(&req, hdev);
5601
5602         __hci_req_write_fast_connectable(&req, false);
5603         __hci_req_update_scan(&req);
5604
5605         /* Since only the advertising data flags will change, there
5606          * is no need to update the scan response data.
5607          */
5608         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
5609
5610         err = hci_req_run(&req, set_bredr_complete);
5611         if (err < 0)
5612                 mgmt_pending_remove(cmd);
5613
5614 unlock:
5615         hci_dev_unlock(hdev);
5616         return err;
5617 }
5618
5619 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5620 {
5621         struct mgmt_pending_cmd *cmd;
5622         struct mgmt_mode *cp;
5623
5624         bt_dev_dbg(hdev, "status %u", status);
5625
5626         hci_dev_lock(hdev);
5627
5628         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5629         if (!cmd)
5630                 goto unlock;
5631
5632         if (status) {
5633                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5634                                 mgmt_status(status));
5635                 goto remove;
5636         }
5637
5638         cp = cmd->param;
5639
5640         switch (cp->val) {
5641         case 0x00:
5642                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5643                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5644                 break;
5645         case 0x01:
5646                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5647                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5648                 break;
5649         case 0x02:
5650                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5651                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5652                 break;
5653         }
5654
5655         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5656         new_settings(hdev, cmd->sk);
5657
5658 remove:
5659         mgmt_pending_remove(cmd);
5660 unlock:
5661         hci_dev_unlock(hdev);
5662 }
5663
5664 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5665                            void *data, u16 len)
5666 {
5667         struct mgmt_mode *cp = data;
5668         struct mgmt_pending_cmd *cmd;
5669         struct hci_request req;
5670         u8 val;
5671         int err;
5672
5673         bt_dev_dbg(hdev, "sock %p", sk);
5674
5675         if (!lmp_sc_capable(hdev) &&
5676             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5677                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5678                                        MGMT_STATUS_NOT_SUPPORTED);
5679
5680         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5681             lmp_sc_capable(hdev) &&
5682             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5683                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5684                                        MGMT_STATUS_REJECTED);
5685
5686         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5687                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5688                                   MGMT_STATUS_INVALID_PARAMS);
5689
5690         hci_dev_lock(hdev);
5691
5692         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5693             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5694                 bool changed;
5695
5696                 if (cp->val) {
5697                         changed = !hci_dev_test_and_set_flag(hdev,
5698                                                              HCI_SC_ENABLED);
5699                         if (cp->val == 0x02)
5700                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5701                         else
5702                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5703                 } else {
5704                         changed = hci_dev_test_and_clear_flag(hdev,
5705                                                               HCI_SC_ENABLED);
5706                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5707                 }
5708
5709                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5710                 if (err < 0)
5711                         goto failed;
5712
5713                 if (changed)
5714                         err = new_settings(hdev, sk);
5715
5716                 goto failed;
5717         }
5718
5719         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5720                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5721                                       MGMT_STATUS_BUSY);
5722                 goto failed;
5723         }
5724
5725         val = !!cp->val;
5726
5727         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5728             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5729                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5730                 goto failed;
5731         }
5732
5733         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5734         if (!cmd) {
5735                 err = -ENOMEM;
5736                 goto failed;
5737         }
5738
5739         hci_req_init(&req, hdev);
5740         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5741         err = hci_req_run(&req, sc_enable_complete);
5742         if (err < 0) {
5743                 mgmt_pending_remove(cmd);
5744                 goto failed;
5745         }
5746
5747 failed:
5748         hci_dev_unlock(hdev);
5749         return err;
5750 }
5751
5752 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5753                           void *data, u16 len)
5754 {
5755         struct mgmt_mode *cp = data;
5756         bool changed, use_changed;
5757         int err;
5758
5759         bt_dev_dbg(hdev, "sock %p", sk);
5760
5761         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5762                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5763                                        MGMT_STATUS_INVALID_PARAMS);
5764
5765         hci_dev_lock(hdev);
5766
5767         if (cp->val)
5768                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
5769         else
5770                 changed = hci_dev_test_and_clear_flag(hdev,
5771                                                       HCI_KEEP_DEBUG_KEYS);
5772
5773         if (cp->val == 0x02)
5774                 use_changed = !hci_dev_test_and_set_flag(hdev,
5775                                                          HCI_USE_DEBUG_KEYS);
5776         else
5777                 use_changed = hci_dev_test_and_clear_flag(hdev,
5778                                                           HCI_USE_DEBUG_KEYS);
5779
5780         if (hdev_is_powered(hdev) && use_changed &&
5781             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
5782                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5783                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5784                              sizeof(mode), &mode);
5785         }
5786
5787         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5788         if (err < 0)
5789                 goto unlock;
5790
5791         if (changed)
5792                 err = new_settings(hdev, sk);
5793
5794 unlock:
5795         hci_dev_unlock(hdev);
5796         return err;
5797 }
5798
5799 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5800                        u16 len)
5801 {
5802         struct mgmt_cp_set_privacy *cp = cp_data;
5803         bool changed;
5804         int err;
5805
5806         bt_dev_dbg(hdev, "sock %p", sk);
5807
5808         if (!lmp_le_capable(hdev))
5809                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5810                                        MGMT_STATUS_NOT_SUPPORTED);
5811
5812         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
5813                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5814                                        MGMT_STATUS_INVALID_PARAMS);
5815
5816         if (hdev_is_powered(hdev))
5817                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5818                                        MGMT_STATUS_REJECTED);
5819
5820         hci_dev_lock(hdev);
5821
5822         /* If user space supports this command it is also expected to
5823          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5824          */
5825         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5826
5827         if (cp->privacy) {
5828                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
5829                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
5830                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
5831                 hci_adv_instances_set_rpa_expired(hdev, true);
5832                 if (cp->privacy == 0x02)
5833                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
5834                 else
5835                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
5836         } else {
5837                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
5838                 memset(hdev->irk, 0, sizeof(hdev->irk));
5839                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
5840                 hci_adv_instances_set_rpa_expired(hdev, false);
5841                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
5842         }
5843
5844         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5845         if (err < 0)
5846                 goto unlock;
5847
5848         if (changed)
5849                 err = new_settings(hdev, sk);
5850
5851 unlock:
5852         hci_dev_unlock(hdev);
5853         return err;
5854 }
5855
5856 static bool irk_is_valid(struct mgmt_irk_info *irk)
5857 {
5858         switch (irk->addr.type) {
5859         case BDADDR_LE_PUBLIC:
5860                 return true;
5861
5862         case BDADDR_LE_RANDOM:
5863                 /* Two most significant bits shall be set */
5864                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5865                         return false;
5866                 return true;
5867         }
5868
5869         return false;
5870 }
5871
5872 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5873                      u16 len)
5874 {
5875         struct mgmt_cp_load_irks *cp = cp_data;
5876         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5877                                    sizeof(struct mgmt_irk_info));
5878         u16 irk_count, expected_len;
5879         int i, err;
5880
5881         bt_dev_dbg(hdev, "sock %p", sk);
5882
5883         if (!lmp_le_capable(hdev))
5884                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5885                                        MGMT_STATUS_NOT_SUPPORTED);
5886
5887         irk_count = __le16_to_cpu(cp->irk_count);
5888         if (irk_count > max_irk_count) {
5889                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
5890                            irk_count);
5891                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5892                                        MGMT_STATUS_INVALID_PARAMS);
5893         }
5894
5895         expected_len = struct_size(cp, irks, irk_count);
5896         if (expected_len != len) {
5897                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
5898                            expected_len, len);
5899                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5900                                        MGMT_STATUS_INVALID_PARAMS);
5901         }
5902
5903         bt_dev_dbg(hdev, "irk_count %u", irk_count);
5904
5905         for (i = 0; i < irk_count; i++) {
5906                 struct mgmt_irk_info *key = &cp->irks[i];
5907
5908                 if (!irk_is_valid(key))
5909                         return mgmt_cmd_status(sk, hdev->id,
5910                                                MGMT_OP_LOAD_IRKS,
5911                                                MGMT_STATUS_INVALID_PARAMS);
5912         }
5913
5914         hci_dev_lock(hdev);
5915
5916         hci_smp_irks_clear(hdev);
5917
5918         for (i = 0; i < irk_count; i++) {
5919                 struct mgmt_irk_info *irk = &cp->irks[i];
5920
5921                 if (hci_is_blocked_key(hdev,
5922                                        HCI_BLOCKED_KEY_TYPE_IRK,
5923                                        irk->val)) {
5924                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
5925                                     &irk->addr.bdaddr);
5926                         continue;
5927                 }
5928
5929                 hci_add_irk(hdev, &irk->addr.bdaddr,
5930                             le_addr_type(irk->addr.type), irk->val,
5931                             BDADDR_ANY);
5932         }
5933
5934         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5935
5936         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5937
5938         hci_dev_unlock(hdev);
5939
5940         return err;
5941 }
5942
5943 #ifdef TIZEN_BT
5944 static int set_advertising_params(struct sock *sk, struct hci_dev *hdev,
5945                         void *data, u16 len)
5946 {
5947         struct mgmt_cp_set_advertising_params *cp = data;
5948         __u16 min_interval;
5949         __u16 max_interval;
5950         int err;
5951
5952         BT_DBG("%s", hdev->name);
5953
5954         if (!lmp_le_capable(hdev))
5955                 return mgmt_cmd_status(sk, hdev->id,
5956                                 MGMT_OP_SET_ADVERTISING_PARAMS,
5957                                 MGMT_STATUS_NOT_SUPPORTED);
5958
5959         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
5960                 return mgmt_cmd_status(sk, hdev->id,
5961                                 MGMT_OP_SET_ADVERTISING_PARAMS,
5962                                 MGMT_STATUS_BUSY);
5963
5964         min_interval = __le16_to_cpu(cp->interval_min);
5965         max_interval = __le16_to_cpu(cp->interval_max);
5966
5967         if (min_interval > max_interval ||
5968             min_interval < 0x0020 || max_interval > 0x4000)
5969                 return mgmt_cmd_status(sk, hdev->id,
5970                                 MGMT_OP_SET_ADVERTISING_PARAMS,
5971                                 MGMT_STATUS_INVALID_PARAMS);
5972
5973         hci_dev_lock(hdev);
5974
5975         hdev->le_adv_min_interval = min_interval;
5976         hdev->le_adv_max_interval = max_interval;
5977         hdev->adv_filter_policy = cp->filter_policy;
5978         hdev->adv_type = cp->type;
5979
5980         err = mgmt_cmd_complete(sk, hdev->id,
5981                         MGMT_OP_SET_ADVERTISING_PARAMS, 0, NULL, 0);
5982
5983         hci_dev_unlock(hdev);
5984
5985         return err;
5986 }
5987
5988 static void set_advertising_data_complete(struct hci_dev *hdev,
5989                         u8 status, u16 opcode)
5990 {
5991         struct mgmt_cp_set_advertising_data *cp;
5992         struct mgmt_pending_cmd *cmd;
5993
5994         BT_DBG("status 0x%02x", status);
5995
5996         hci_dev_lock(hdev);
5997
5998         cmd = pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev);
5999         if (!cmd)
6000                 goto unlock;
6001
6002         cp = cmd->param;
6003
6004         if (status)
6005                 mgmt_cmd_status(cmd->sk, hdev->id,
6006                                 MGMT_OP_SET_ADVERTISING_DATA,
6007                                 mgmt_status(status));
6008         else
6009                 mgmt_cmd_complete(cmd->sk, hdev->id,
6010                                 MGMT_OP_SET_ADVERTISING_DATA, 0,
6011                                 cp, sizeof(*cp));
6012
6013         mgmt_pending_remove(cmd);
6014
6015 unlock:
6016         hci_dev_unlock(hdev);
6017 }
6018
6019 static int set_advertising_data(struct sock *sk, struct hci_dev *hdev,
6020                         void *data, u16 len)
6021 {
6022         struct mgmt_pending_cmd *cmd;
6023         struct hci_request req;
6024         struct mgmt_cp_set_advertising_data *cp = data;
6025         struct hci_cp_le_set_adv_data adv;
6026         int err;
6027
6028         BT_DBG("%s", hdev->name);
6029
6030         if (!lmp_le_capable(hdev)) {
6031                 return mgmt_cmd_status(sk, hdev->id,
6032                                 MGMT_OP_SET_ADVERTISING_DATA,
6033                                 MGMT_STATUS_NOT_SUPPORTED);
6034         }
6035
6036         hci_dev_lock(hdev);
6037
6038         if (pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev)) {
6039                 err = mgmt_cmd_status(sk, hdev->id,
6040                                 MGMT_OP_SET_ADVERTISING_DATA,
6041                                 MGMT_STATUS_BUSY);
6042                 goto unlocked;
6043         }
6044
6045         if (len > HCI_MAX_AD_LENGTH) {
6046                 err = mgmt_cmd_status(sk, hdev->id,
6047                                 MGMT_OP_SET_ADVERTISING_DATA,
6048                                 MGMT_STATUS_INVALID_PARAMS);
6049                 goto unlocked;
6050         }
6051
6052         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING_DATA,
6053                                hdev, data, len);
6054         if (!cmd) {
6055                 err = -ENOMEM;
6056                 goto unlocked;
6057         }
6058
6059         hci_req_init(&req, hdev);
6060
6061         memset(&adv, 0, sizeof(adv));
6062         memcpy(adv.data, cp->data, len);
6063         adv.length = len;
6064
6065         hci_req_add(&req, HCI_OP_LE_SET_ADV_DATA, sizeof(adv), &adv);
6066
6067         err = hci_req_run(&req, set_advertising_data_complete);
6068         if (err < 0)
6069                 mgmt_pending_remove(cmd);
6070
6071 unlocked:
6072         hci_dev_unlock(hdev);
6073
6074         return err;
6075 }
6076
6077 static void set_scan_rsp_data_complete(struct hci_dev *hdev, u8 status,
6078                         u16 opcode)
6079 {
6080         struct mgmt_cp_set_scan_rsp_data *cp;
6081         struct mgmt_pending_cmd *cmd;
6082
6083         BT_DBG("status 0x%02x", status);
6084
6085         hci_dev_lock(hdev);
6086
6087         cmd = pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev);
6088         if (!cmd)
6089                 goto unlock;
6090
6091         cp = cmd->param;
6092
6093         if (status)
6094                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6095                                 mgmt_status(status));
6096         else
6097                 mgmt_cmd_complete(cmd->sk, hdev->id,
6098                                 MGMT_OP_SET_SCAN_RSP_DATA, 0,
6099                                 cp, sizeof(*cp));
6100
6101         mgmt_pending_remove(cmd);
6102
6103 unlock:
6104         hci_dev_unlock(hdev);
6105 }
6106
6107 static int set_scan_rsp_data(struct sock *sk, struct hci_dev *hdev, void *data,
6108                         u16 len)
6109 {
6110         struct mgmt_pending_cmd *cmd;
6111         struct hci_request req;
6112         struct mgmt_cp_set_scan_rsp_data *cp = data;
6113         struct hci_cp_le_set_scan_rsp_data rsp;
6114         int err;
6115
6116         BT_DBG("%s", hdev->name);
6117
6118         if (!lmp_le_capable(hdev))
6119                 return mgmt_cmd_status(sk, hdev->id,
6120                                 MGMT_OP_SET_SCAN_RSP_DATA,
6121                                 MGMT_STATUS_NOT_SUPPORTED);
6122
6123         hci_dev_lock(hdev);
6124
6125         if (pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev)) {
6126                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6127                                 MGMT_STATUS_BUSY);
6128                 goto unlocked;
6129         }
6130
6131         if (len > HCI_MAX_AD_LENGTH) {
6132                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6133                                 MGMT_STATUS_INVALID_PARAMS);
6134                 goto unlocked;
6135         }
6136
6137         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SCAN_RSP_DATA, hdev, data, len);
6138         if (!cmd) {
6139                 err = -ENOMEM;
6140                 goto unlocked;
6141         }
6142
6143         hci_req_init(&req, hdev);
6144
6145         memset(&rsp, 0, sizeof(rsp));
6146         memcpy(rsp.data, cp->data, len);
6147         rsp.length = len;
6148
6149         hci_req_add(&req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(rsp), &rsp);
6150
6151         err = hci_req_run(&req, set_scan_rsp_data_complete);
6152         if (err < 0)
6153                 mgmt_pending_remove(cmd);
6154
6155 unlocked:
6156         hci_dev_unlock(hdev);
6157
6158         return err;
6159 }
6160
6161 /* Adv White List feature */
6162 static void add_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6163 {
6164         struct mgmt_cp_add_dev_white_list *cp;
6165         struct mgmt_pending_cmd *cmd;
6166
6167         BT_DBG("status 0x%02x", status);
6168
6169         hci_dev_lock(hdev);
6170
6171         cmd = pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev);
6172         if (!cmd)
6173                 goto unlock;
6174
6175         cp = cmd->param;
6176
6177         if (status)
6178                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6179                            mgmt_status(status));
6180         else
6181                 mgmt_cmd_complete(cmd->sk, hdev->id,
6182                                 MGMT_OP_ADD_DEV_WHITE_LIST, 0, cp, sizeof(*cp));
6183
6184         mgmt_pending_remove(cmd);
6185
6186 unlock:
6187         hci_dev_unlock(hdev);
6188 }
6189
6190 static int add_white_list(struct sock *sk, struct hci_dev *hdev,
6191                            void *data, u16 len)
6192 {
6193         struct mgmt_pending_cmd *cmd;
6194         struct mgmt_cp_add_dev_white_list *cp = data;
6195         struct hci_request req;
6196         int err;
6197
6198         BT_DBG("%s", hdev->name);
6199
6200         if (!lmp_le_capable(hdev))
6201                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6202                                   MGMT_STATUS_NOT_SUPPORTED);
6203
6204         if (!hdev_is_powered(hdev))
6205                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6206                                   MGMT_STATUS_REJECTED);
6207
6208         hci_dev_lock(hdev);
6209
6210         if (pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev)) {
6211                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6212                                 MGMT_STATUS_BUSY);
6213                 goto unlocked;
6214         }
6215
6216         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEV_WHITE_LIST, hdev, data, len);
6217         if (!cmd) {
6218                 err = -ENOMEM;
6219                 goto unlocked;
6220         }
6221
6222         hci_req_init(&req, hdev);
6223
6224         hci_req_add(&req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(*cp), cp);
6225
6226         err = hci_req_run(&req, add_white_list_complete);
6227         if (err < 0) {
6228                 mgmt_pending_remove(cmd);
6229                 goto unlocked;
6230         }
6231
6232 unlocked:
6233         hci_dev_unlock(hdev);
6234
6235         return err;
6236 }
6237
6238 static void remove_from_white_list_complete(struct hci_dev *hdev,
6239                         u8 status, u16 opcode)
6240 {
6241         struct mgmt_cp_remove_dev_from_white_list *cp;
6242         struct mgmt_pending_cmd *cmd;
6243
6244         BT_DBG("status 0x%02x", status);
6245
6246         hci_dev_lock(hdev);
6247
6248         cmd = pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev);
6249         if (!cmd)
6250                 goto unlock;
6251
6252         cp = cmd->param;
6253
6254         if (status)
6255                 mgmt_cmd_status(cmd->sk, hdev->id,
6256                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6257                         mgmt_status(status));
6258         else
6259                 mgmt_cmd_complete(cmd->sk, hdev->id,
6260                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, 0,
6261                         cp, sizeof(*cp));
6262
6263         mgmt_pending_remove(cmd);
6264
6265 unlock:
6266         hci_dev_unlock(hdev);
6267 }
6268
6269 static int remove_from_white_list(struct sock *sk, struct hci_dev *hdev,
6270                            void *data, u16 len)
6271 {
6272         struct mgmt_pending_cmd *cmd;
6273         struct mgmt_cp_remove_dev_from_white_list *cp = data;
6274         struct hci_request req;
6275         int err;
6276
6277         BT_DBG("%s", hdev->name);
6278
6279         if (!lmp_le_capable(hdev))
6280                 return mgmt_cmd_status(sk, hdev->id,
6281                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6282                                 MGMT_STATUS_NOT_SUPPORTED);
6283
6284         if (!hdev_is_powered(hdev))
6285                 return mgmt_cmd_status(sk, hdev->id,
6286                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6287                                 MGMT_STATUS_REJECTED);
6288
6289         hci_dev_lock(hdev);
6290
6291         if (pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev)) {
6292                 err = mgmt_cmd_status(sk, hdev->id,
6293                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6294                                 MGMT_STATUS_BUSY);
6295                 goto unlocked;
6296         }
6297
6298         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6299                                 hdev, data, len);
6300         if (!cmd) {
6301                 err = -ENOMEM;
6302                 goto unlocked;
6303         }
6304
6305         hci_req_init(&req, hdev);
6306
6307         hci_req_add(&req, HCI_OP_LE_DEL_FROM_WHITE_LIST, sizeof(*cp), cp);
6308
6309         err = hci_req_run(&req, remove_from_white_list_complete);
6310         if (err < 0) {
6311                 mgmt_pending_remove(cmd);
6312                 goto unlocked;
6313         }
6314
6315 unlocked:
6316         hci_dev_unlock(hdev);
6317
6318         return err;
6319 }
6320
6321 static void clear_white_list_complete(struct hci_dev *hdev, u8 status,
6322                         u16 opcode)
6323 {
6324         struct mgmt_pending_cmd *cmd;
6325
6326         BT_DBG("status 0x%02x", status);
6327
6328         hci_dev_lock(hdev);
6329
6330         cmd = pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev);
6331         if (!cmd)
6332                 goto unlock;
6333
6334         if (status)
6335                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
6336                            mgmt_status(status));
6337         else
6338                 mgmt_cmd_complete(cmd->sk, hdev->id,
6339                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6340                                 0, NULL, 0);
6341
6342         mgmt_pending_remove(cmd);
6343
6344 unlock:
6345         hci_dev_unlock(hdev);
6346 }
6347
6348 static int clear_white_list(struct sock *sk, struct hci_dev *hdev,
6349                            void *data, u16 len)
6350 {
6351         struct mgmt_pending_cmd *cmd;
6352         struct hci_request req;
6353         int err;
6354
6355         BT_DBG("%s", hdev->name);
6356
6357         if (!lmp_le_capable(hdev))
6358                 return mgmt_cmd_status(sk, hdev->id,
6359                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6360                                 MGMT_STATUS_NOT_SUPPORTED);
6361
6362         if (!hdev_is_powered(hdev))
6363                 return mgmt_cmd_status(sk, hdev->id,
6364                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6365                                 MGMT_STATUS_REJECTED);
6366
6367         hci_dev_lock(hdev);
6368
6369         if (pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev)) {
6370                 err = mgmt_cmd_status(sk, hdev->id,
6371                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6372                                 MGMT_STATUS_BUSY);
6373                 goto unlocked;
6374         }
6375
6376         cmd = mgmt_pending_add(sk, MGMT_OP_CLEAR_DEV_WHITE_LIST,
6377                                 hdev, NULL, 0);
6378         if (!cmd) {
6379                 err = -ENOMEM;
6380                 goto unlocked;
6381         }
6382
6383         hci_req_init(&req, hdev);
6384
6385         hci_req_add(&req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
6386
6387         err = hci_req_run(&req, clear_white_list_complete);
6388         if (err < 0) {
6389                 mgmt_pending_remove(cmd);
6390                 goto unlocked;
6391         }
6392
6393 unlocked:
6394         hci_dev_unlock(hdev);
6395
6396         return err;
6397 }
6398
6399 static void set_rssi_threshold_complete(struct hci_dev *hdev,
6400                         u8 status, u16 opcode)
6401 {
6402         struct mgmt_pending_cmd *cmd;
6403
6404         BT_DBG("status 0x%02x", status);
6405
6406         hci_dev_lock(hdev);
6407
6408         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6409         if (!cmd)
6410                 goto unlock;
6411
6412         if (status)
6413                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6414                                 mgmt_status(status));
6415         else
6416                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
6417                                 NULL, 0);
6418
6419         mgmt_pending_remove(cmd);
6420
6421 unlock:
6422         hci_dev_unlock(hdev);
6423 }
6424
6425 static void set_rssi_disable_complete(struct hci_dev *hdev,
6426                         u8 status, u16 opcode)
6427 {
6428         struct mgmt_pending_cmd *cmd;
6429
6430         BT_DBG("status 0x%02x", status);
6431
6432         hci_dev_lock(hdev);
6433
6434         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6435         if (!cmd)
6436                 goto unlock;
6437
6438         if (status)
6439                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6440                                 mgmt_status(status));
6441         else
6442                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6443                                 0, NULL, 0);
6444
6445         mgmt_pending_remove(cmd);
6446
6447 unlock:
6448         hci_dev_unlock(hdev);
6449 }
6450
6451 int mgmt_set_rssi_threshold(struct sock *sk, struct hci_dev *hdev,
6452                 void *data, u16 len)
6453 {
6454         int err = 0;
6455         struct hci_cp_set_rssi_threshold th = { 0, };
6456         struct mgmt_cp_set_enable_rssi *cp = data;
6457         struct hci_conn *conn;
6458         struct mgmt_pending_cmd *cmd;
6459         struct hci_request req;
6460         __u8 dest_type;
6461
6462         hci_dev_lock(hdev);
6463
6464         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6465         if (!cmd) {
6466                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6467                                 MGMT_STATUS_FAILED);
6468                 goto unlocked;
6469         }
6470
6471         if (!lmp_le_capable(hdev)) {
6472                 mgmt_pending_remove(cmd);
6473                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6474                                 MGMT_STATUS_NOT_SUPPORTED);
6475                 goto unlocked;
6476         }
6477
6478         if (!hdev_is_powered(hdev)) {
6479                 BT_DBG("%s", hdev->name);
6480                 mgmt_pending_remove(cmd);
6481                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6482                                 MGMT_STATUS_NOT_POWERED);
6483                 goto unlocked;
6484         }
6485
6486         if (cp->link_type == 0x01)
6487                 dest_type = LE_LINK;
6488         else
6489                 dest_type = ACL_LINK;
6490
6491         /* Get LE/ACL link handle info */
6492         conn = hci_conn_hash_lookup_ba(hdev,
6493                         dest_type, &cp->bdaddr);
6494
6495         if (!conn) {
6496                 err = mgmt_cmd_complete(sk, hdev->id,
6497                                 MGMT_OP_SET_RSSI_ENABLE, 1, NULL, 0);
6498                 mgmt_pending_remove(cmd);
6499                 goto unlocked;
6500         }
6501
6502         hci_req_init(&req, hdev);
6503
6504         th.hci_le_ext_opcode = 0x0B;
6505         th.mode = 0x01;
6506         th.conn_handle = conn->handle;
6507         th.alert_mask = 0x07;
6508         th.low_th = cp->low_th;
6509         th.in_range_th = cp->in_range_th;
6510         th.high_th = cp->high_th;
6511
6512         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
6513         err = hci_req_run(&req, set_rssi_threshold_complete);
6514
6515         if (err < 0) {
6516                 mgmt_pending_remove(cmd);
6517                 BT_ERR("Error in requesting hci_req_run");
6518                 goto unlocked;
6519         }
6520
6521 unlocked:
6522         hci_dev_unlock(hdev);
6523         return err;
6524 }
6525
6526 void mgmt_rssi_enable_success(struct sock *sk, struct hci_dev *hdev,
6527                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6528 {
6529         struct mgmt_cc_rsp_enable_rssi mgmt_rp = { 0, };
6530         struct mgmt_cp_set_enable_rssi *cp = data;
6531         struct mgmt_pending_cmd *cmd;
6532
6533         if (!cp || !rp)
6534                 goto remove_cmd;
6535
6536         mgmt_rp.status = rp->status;
6537         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6538         mgmt_rp.bt_address = cp->bdaddr;
6539         mgmt_rp.link_type = cp->link_type;
6540
6541         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6542                         MGMT_STATUS_SUCCESS, &mgmt_rp,
6543                         sizeof(struct mgmt_cc_rsp_enable_rssi));
6544
6545         mgmt_event(MGMT_EV_RSSI_ENABLED, hdev, &mgmt_rp,
6546                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6547
6548         hci_conn_rssi_unset_all(hdev, mgmt_rp.link_type);
6549         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6550                         &mgmt_rp.bt_address, true);
6551
6552 remove_cmd:
6553         hci_dev_lock(hdev);
6554         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6555         if (cmd)
6556                 mgmt_pending_remove(cmd);
6557
6558         hci_dev_unlock(hdev);
6559 }
6560
6561 void mgmt_rssi_disable_success(struct sock *sk, struct hci_dev *hdev,
6562                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6563 {
6564         struct mgmt_cc_rp_disable_rssi mgmt_rp = { 0, };
6565         struct mgmt_cp_disable_rssi *cp = data;
6566         struct mgmt_pending_cmd *cmd;
6567
6568         if (!cp || !rp)
6569                 goto remove_cmd;
6570
6571         mgmt_rp.status = rp->status;
6572         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6573         mgmt_rp.bt_address = cp->bdaddr;
6574         mgmt_rp.link_type = cp->link_type;
6575
6576         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6577                         MGMT_STATUS_SUCCESS, &mgmt_rp,
6578                         sizeof(struct mgmt_cc_rsp_enable_rssi));
6579
6580         mgmt_event(MGMT_EV_RSSI_DISABLED, hdev, &mgmt_rp,
6581                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6582
6583         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6584                         &mgmt_rp.bt_address, false);
6585
6586 remove_cmd:
6587         hci_dev_lock(hdev);
6588         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6589         if (cmd)
6590                 mgmt_pending_remove(cmd);
6591
6592         hci_dev_unlock(hdev);
6593 }
6594
6595 static int mgmt_set_disable_rssi(struct sock *sk, struct hci_dev *hdev,
6596                 void *data, u16 len)
6597 {
6598         struct mgmt_pending_cmd *cmd;
6599         struct hci_request req;
6600         struct hci_cp_set_enable_rssi cp_en = { 0, };
6601         int err;
6602
6603         BT_DBG("Set Disable RSSI.");
6604
6605         cp_en.hci_le_ext_opcode = 0x01;
6606         cp_en.le_enable_cs_Features = 0x00;
6607         cp_en.data[0] = 0x00;
6608         cp_en.data[1] = 0x00;
6609         cp_en.data[2] = 0x00;
6610
6611         hci_dev_lock(hdev);
6612
6613         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6614         if (!cmd) {
6615                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6616                                 MGMT_STATUS_FAILED);
6617                 goto unlocked;
6618         }
6619
6620         if (!lmp_le_capable(hdev)) {
6621                 mgmt_pending_remove(cmd);
6622                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6623                                 MGMT_STATUS_NOT_SUPPORTED);
6624                 goto unlocked;
6625         }
6626
6627         if (!hdev_is_powered(hdev)) {
6628                 BT_DBG("%s", hdev->name);
6629                 mgmt_pending_remove(cmd);
6630                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6631                                 MGMT_STATUS_NOT_POWERED);
6632                 goto unlocked;
6633         }
6634
6635         hci_req_init(&req, hdev);
6636
6637         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
6638                         sizeof(struct hci_cp_set_enable_rssi),
6639                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
6640                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
6641
6642         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
6643         err = hci_req_run(&req, set_rssi_disable_complete);
6644
6645         if (err < 0) {
6646                 mgmt_pending_remove(cmd);
6647                 BT_ERR("Error in requesting hci_req_run");
6648                 goto unlocked;
6649         }
6650
6651 unlocked:
6652         hci_dev_unlock(hdev);
6653         return err;
6654 }
6655
6656 void mgmt_enable_rssi_cc(struct hci_dev *hdev, void *response, u8 status)
6657 {
6658         struct hci_cc_rsp_enable_rssi *rp = response;
6659         struct mgmt_pending_cmd *cmd_enable = NULL;
6660         struct mgmt_pending_cmd *cmd_disable = NULL;
6661         struct mgmt_cp_set_enable_rssi *cp_en;
6662         struct mgmt_cp_disable_rssi *cp_dis;
6663
6664         hci_dev_lock(hdev);
6665         cmd_enable = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6666         cmd_disable = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6667         hci_dev_unlock(hdev);
6668
6669         if (cmd_enable)
6670                 BT_DBG("Enable Request");
6671
6672         if (cmd_disable)
6673                 BT_DBG("Disable Request");
6674
6675         if (cmd_enable) {
6676                 cp_en = cmd_enable->param;
6677
6678                 if (status != 0x00)
6679                         return;
6680
6681                 switch (rp->le_ext_opcode) {
6682                 case 0x01:
6683                         BT_DBG("RSSI enabled.. Setting Threshold...");
6684                         mgmt_set_rssi_threshold(cmd_enable->sk, hdev,
6685                                         cp_en, sizeof(*cp_en));
6686                         break;
6687
6688                 case 0x0B:
6689                         BT_DBG("Sending RSSI enable success");
6690                         mgmt_rssi_enable_success(cmd_enable->sk, hdev,
6691                                         cp_en, rp, rp->status);
6692                         break;
6693                 }
6694
6695         } else if (cmd_disable) {
6696                 cp_dis = cmd_disable->param;
6697
6698                 if (status != 0x00)
6699                         return;
6700
6701                 switch (rp->le_ext_opcode) {
6702                 case 0x01:
6703                         BT_DBG("Sending RSSI disable success");
6704                         mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6705                                         cp_dis, rp, rp->status);
6706                         break;
6707
6708                 case 0x0B:
6709                         /*
6710                          * Only unset RSSI Threshold values for the Link if
6711                          * RSSI is monitored for other BREDR or LE Links
6712                          */
6713                         if (hci_conn_hash_lookup_rssi_count(hdev) > 1) {
6714                                 BT_DBG("Unset Threshold. Other links being monitored");
6715                                 mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6716                                                 cp_dis, rp, rp->status);
6717                         } else {
6718                                 BT_DBG("Unset Threshold. Disabling...");
6719                                 mgmt_set_disable_rssi(cmd_disable->sk, hdev,
6720                                                 cp_dis, sizeof(*cp_dis));
6721                         }
6722                         break;
6723                 }
6724         }
6725 }
6726
6727 static void set_rssi_enable_complete(struct hci_dev *hdev, u8 status,
6728                 u16 opcode)
6729 {
6730         struct mgmt_pending_cmd *cmd;
6731
6732         BT_DBG("status 0x%02x", status);
6733
6734         hci_dev_lock(hdev);
6735
6736         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6737         if (!cmd)
6738                 goto unlock;
6739
6740         if (status)
6741                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6742                                 mgmt_status(status));
6743         else
6744                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
6745                                 NULL, 0);
6746
6747         mgmt_pending_remove(cmd);
6748
6749 unlock:
6750         hci_dev_unlock(hdev);
6751 }
6752
6753 static int set_enable_rssi(struct sock *sk, struct hci_dev *hdev,
6754                 void *data, u16 len)
6755 {
6756         struct mgmt_pending_cmd *cmd;
6757         struct hci_request req;
6758         struct mgmt_cp_set_enable_rssi *cp = data;
6759         struct hci_cp_set_enable_rssi cp_en = { 0, };
6760         int err;
6761
6762         BT_DBG("Set Enable RSSI.");
6763
6764         cp_en.hci_le_ext_opcode = 0x01;
6765         cp_en.le_enable_cs_Features = 0x04;
6766         cp_en.data[0] = 0x00;
6767         cp_en.data[1] = 0x00;
6768         cp_en.data[2] = 0x00;
6769
6770         hci_dev_lock(hdev);
6771
6772         if (!lmp_le_capable(hdev)) {
6773                 err =  mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6774                                 MGMT_STATUS_NOT_SUPPORTED);
6775                 goto unlocked;
6776         }
6777
6778         if (!hdev_is_powered(hdev)) {
6779                 BT_DBG("%s", hdev->name);
6780                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6781                                 MGMT_STATUS_NOT_POWERED);
6782                 goto unlocked;
6783         }
6784
6785         if (pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev)) {
6786                 BT_DBG("%s", hdev->name);
6787                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6788                                 MGMT_STATUS_BUSY);
6789                 goto unlocked;
6790         }
6791
6792         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_ENABLE, hdev, cp,
6793                         sizeof(*cp));
6794         if (!cmd) {
6795                 BT_DBG("%s", hdev->name);
6796                 err = -ENOMEM;
6797                 goto unlocked;
6798         }
6799
6800         /* If RSSI is already enabled directly set Threshold values */
6801         if (hci_conn_hash_lookup_rssi_count(hdev) > 0) {
6802                 hci_dev_unlock(hdev);
6803                 BT_DBG("RSSI Enabled. Directly set Threshold");
6804                 err = mgmt_set_rssi_threshold(sk, hdev, cp, sizeof(*cp));
6805                 return err;
6806         }
6807
6808         hci_req_init(&req, hdev);
6809
6810         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
6811                         sizeof(struct hci_cp_set_enable_rssi),
6812                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
6813                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
6814
6815         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
6816         err = hci_req_run(&req, set_rssi_enable_complete);
6817
6818         if (err < 0) {
6819                 mgmt_pending_remove(cmd);
6820                 BT_ERR("Error in requesting hci_req_run");
6821                 goto unlocked;
6822         }
6823
6824 unlocked:
6825         hci_dev_unlock(hdev);
6826
6827         return err;
6828 }
6829
6830 static void get_raw_rssi_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6831 {
6832         struct mgmt_pending_cmd *cmd;
6833
6834         BT_DBG("status 0x%02x", status);
6835
6836         hci_dev_lock(hdev);
6837
6838         cmd = pending_find(MGMT_OP_GET_RAW_RSSI, hdev);
6839         if (!cmd)
6840                 goto unlock;
6841
6842         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
6843                         MGMT_STATUS_SUCCESS, &status, 1);
6844
6845         mgmt_pending_remove(cmd);
6846
6847 unlock:
6848         hci_dev_unlock(hdev);
6849 }
6850
6851 static int get_raw_rssi(struct sock *sk, struct hci_dev *hdev, void *data,
6852                         u16 len)
6853 {
6854         struct mgmt_pending_cmd *cmd;
6855         struct hci_request req;
6856         struct mgmt_cp_get_raw_rssi *cp = data;
6857         struct hci_cp_get_raw_rssi hci_cp;
6858
6859         struct hci_conn *conn;
6860         int err;
6861         __u8 dest_type;
6862
6863         BT_DBG("Get Raw RSSI.");
6864
6865         hci_dev_lock(hdev);
6866
6867         if (!lmp_le_capable(hdev)) {
6868                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
6869                                 MGMT_STATUS_NOT_SUPPORTED);
6870                 goto unlocked;
6871         }
6872
6873         if (cp->link_type == 0x01)
6874                 dest_type = LE_LINK;
6875         else
6876                 dest_type = ACL_LINK;
6877
6878         /* Get LE/BREDR link handle info */
6879         conn = hci_conn_hash_lookup_ba(hdev,
6880                         dest_type, &cp->bt_address);
6881         if (!conn) {
6882                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
6883                                                    MGMT_STATUS_NOT_CONNECTED);
6884                 goto unlocked;
6885         }
6886         hci_cp.conn_handle = conn->handle;
6887
6888         if (!hdev_is_powered(hdev)) {
6889                 BT_DBG("%s", hdev->name);
6890                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
6891                                 MGMT_STATUS_NOT_POWERED);
6892                 goto unlocked;
6893         }
6894
6895         if (pending_find(MGMT_OP_GET_RAW_RSSI, hdev)) {
6896                 BT_DBG("%s", hdev->name);
6897                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
6898                                 MGMT_STATUS_BUSY);
6899                 goto unlocked;
6900         }
6901
6902         cmd = mgmt_pending_add(sk, MGMT_OP_GET_RAW_RSSI, hdev, data, len);
6903         if (!cmd) {
6904                 BT_DBG("%s", hdev->name);
6905                 err = -ENOMEM;
6906                 goto unlocked;
6907         }
6908
6909         hci_req_init(&req, hdev);
6910
6911         BT_DBG("Connection Handle [%d]", hci_cp.conn_handle);
6912         hci_req_add(&req, HCI_OP_GET_RAW_RSSI, sizeof(hci_cp), &hci_cp);
6913         err = hci_req_run(&req, get_raw_rssi_complete);
6914
6915         if (err < 0) {
6916                 mgmt_pending_remove(cmd);
6917                 BT_ERR("Error in requesting hci_req_run");
6918         }
6919
6920 unlocked:
6921         hci_dev_unlock(hdev);
6922
6923         return err;
6924 }
6925
6926 void mgmt_raw_rssi_response(struct hci_dev *hdev,
6927                 struct hci_cc_rp_get_raw_rssi *rp, int success)
6928 {
6929         struct mgmt_cc_rp_get_raw_rssi mgmt_rp = { 0, };
6930         struct hci_conn *conn;
6931
6932         mgmt_rp.status = rp->status;
6933         mgmt_rp.rssi_dbm = rp->rssi_dbm;
6934
6935         conn = hci_conn_hash_lookup_handle(hdev, rp->conn_handle);
6936         if (!conn)
6937                 return;
6938
6939         bacpy(&mgmt_rp.bt_address, &conn->dst);
6940         if (conn->type == LE_LINK)
6941                 mgmt_rp.link_type = 0x01;
6942         else
6943                 mgmt_rp.link_type = 0x00;
6944
6945         mgmt_event(MGMT_EV_RAW_RSSI, hdev, &mgmt_rp,
6946                         sizeof(struct mgmt_cc_rp_get_raw_rssi), NULL);
6947 }
6948
6949 static void set_disable_threshold_complete(struct hci_dev *hdev,
6950                         u8 status, u16 opcode)
6951 {
6952         struct mgmt_pending_cmd *cmd;
6953
6954         BT_DBG("status 0x%02x", status);
6955
6956         hci_dev_lock(hdev);
6957
6958         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6959         if (!cmd)
6960                 goto unlock;
6961
6962         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6963                         MGMT_STATUS_SUCCESS, &status, 1);
6964
6965         mgmt_pending_remove(cmd);
6966
6967 unlock:
6968         hci_dev_unlock(hdev);
6969 }
6970
6971 /** Removes monitoring for a link*/
6972 static int set_disable_threshold(struct sock *sk, struct hci_dev *hdev,
6973                 void *data, u16 len)
6974 {
6975         int err = 0;
6976         struct hci_cp_set_rssi_threshold th = { 0, };
6977         struct mgmt_cp_disable_rssi *cp = data;
6978         struct hci_conn *conn;
6979         struct mgmt_pending_cmd *cmd;
6980         struct hci_request req;
6981         __u8 dest_type;
6982
6983         BT_DBG("Set Disable RSSI.");
6984
6985         hci_dev_lock(hdev);
6986
6987         if (!lmp_le_capable(hdev)) {
6988                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6989                                 MGMT_STATUS_NOT_SUPPORTED);
6990                 goto unlocked;
6991         }
6992
6993         /* Get LE/ACL link handle info*/
6994         if (cp->link_type == 0x01)
6995                 dest_type = LE_LINK;
6996         else
6997                 dest_type = ACL_LINK;
6998
6999         conn = hci_conn_hash_lookup_ba(hdev, dest_type, &cp->bdaddr);
7000         if (!conn) {
7001                 err = mgmt_cmd_complete(sk, hdev->id,
7002                                 MGMT_OP_SET_RSSI_DISABLE, 1, NULL, 0);
7003                 goto unlocked;
7004         }
7005
7006         th.hci_le_ext_opcode = 0x0B;
7007         th.mode = 0x01;
7008         th.conn_handle = conn->handle;
7009         th.alert_mask = 0x00;
7010         th.low_th = 0x00;
7011         th.in_range_th = 0x00;
7012         th.high_th = 0x00;
7013
7014         if (!hdev_is_powered(hdev)) {
7015                 BT_DBG("%s", hdev->name);
7016                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7017                                 0, data, len);
7018                 goto unlocked;
7019         }
7020
7021         if (pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev)) {
7022                 BT_DBG("%s", hdev->name);
7023                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7024                                 MGMT_STATUS_BUSY);
7025                 goto unlocked;
7026         }
7027
7028         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_DISABLE, hdev, cp,
7029                         sizeof(*cp));
7030         if (!cmd) {
7031                 BT_DBG("%s", hdev->name);
7032                 err = -ENOMEM;
7033                 goto unlocked;
7034         }
7035
7036         hci_req_init(&req, hdev);
7037
7038         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
7039         err = hci_req_run(&req, set_disable_threshold_complete);
7040         if (err < 0) {
7041                 mgmt_pending_remove(cmd);
7042                 BT_ERR("Error in requesting hci_req_run");
7043                 goto unlocked;
7044         }
7045
7046 unlocked:
7047         hci_dev_unlock(hdev);
7048
7049         return err;
7050 }
7051
7052 void mgmt_rssi_alert_evt(struct hci_dev *hdev, struct sk_buff *skb)
7053 {
7054         struct hci_ev_vendor_specific_rssi_alert *ev = (void *)skb->data;
7055         struct mgmt_ev_vendor_specific_rssi_alert mgmt_ev;
7056         struct hci_conn *conn;
7057
7058         BT_DBG("RSSI alert [%2.2X %2.2X %2.2X]",
7059                         ev->conn_handle, ev->alert_type, ev->rssi_dbm);
7060
7061         conn = hci_conn_hash_lookup_handle(hdev, ev->conn_handle);
7062
7063         if (!conn) {
7064                 BT_ERR("RSSI alert Error: Device not found for handle");
7065                 return;
7066         }
7067         bacpy(&mgmt_ev.bdaddr, &conn->dst);
7068
7069         if (conn->type == LE_LINK)
7070                 mgmt_ev.link_type = 0x01;
7071         else
7072                 mgmt_ev.link_type = 0x00;
7073
7074         mgmt_ev.alert_type = ev->alert_type;
7075         mgmt_ev.rssi_dbm = ev->rssi_dbm;
7076
7077         mgmt_event(MGMT_EV_RSSI_ALERT, hdev, &mgmt_ev,
7078                         sizeof(struct mgmt_ev_vendor_specific_rssi_alert),
7079                         NULL);
7080 }
7081
7082 static int mgmt_start_le_discovery_failed(struct hci_dev *hdev, u8 status)
7083 {
7084         struct mgmt_pending_cmd *cmd;
7085         u8 type;
7086         int err;
7087
7088         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
7089
7090         cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
7091         if (!cmd)
7092                 return -ENOENT;
7093
7094         type = hdev->le_discovery.type;
7095
7096         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
7097                                 mgmt_status(status), &type, sizeof(type));
7098         mgmt_pending_remove(cmd);
7099
7100         return err;
7101 }
7102
7103 static void start_le_discovery_complete(struct hci_dev *hdev, u8 status,
7104                 u16 opcode)
7105 {
7106         unsigned long timeout = 0;
7107
7108         BT_DBG("status %d", status);
7109
7110         if (status) {
7111                 hci_dev_lock(hdev);
7112                 mgmt_start_le_discovery_failed(hdev, status);
7113                 hci_dev_unlock(hdev);
7114                 return;
7115         }
7116
7117         hci_dev_lock(hdev);
7118         hci_le_discovery_set_state(hdev, DISCOVERY_FINDING);
7119         hci_dev_unlock(hdev);
7120
7121         if (hdev->le_discovery.type != DISCOV_TYPE_LE)
7122                 BT_ERR("Invalid discovery type %d", hdev->le_discovery.type);
7123
7124         if (!timeout)
7125                 return;
7126
7127         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
7128 }
7129
7130 static int start_le_discovery(struct sock *sk, struct hci_dev *hdev,
7131                 void *data, u16 len)
7132 {
7133         struct mgmt_cp_start_le_discovery *cp = data;
7134         struct mgmt_pending_cmd *cmd;
7135         struct hci_cp_le_set_scan_param param_cp;
7136         struct hci_cp_le_set_scan_enable enable_cp;
7137         struct hci_request req;
7138         u8 status, own_addr_type;
7139         int err;
7140
7141         BT_DBG("%s", hdev->name);
7142
7143         hci_dev_lock(hdev);
7144
7145         if (!hdev_is_powered(hdev)) {
7146                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7147                                 MGMT_STATUS_NOT_POWERED);
7148                 goto unlock;
7149         }
7150
7151         if (hdev->le_discovery.state != DISCOVERY_STOPPED) {
7152                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7153                                 MGMT_STATUS_BUSY);
7154                 goto unlock;
7155         }
7156
7157         if (cp->type != DISCOV_TYPE_LE) {
7158                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7159                                 MGMT_STATUS_INVALID_PARAMS);
7160                 goto unlock;
7161         }
7162
7163         cmd = mgmt_pending_add(sk, MGMT_OP_START_LE_DISCOVERY, hdev, NULL, 0);
7164         if (!cmd) {
7165                 err = -ENOMEM;
7166                 goto unlock;
7167         }
7168
7169         hdev->le_discovery.type = cp->type;
7170
7171         hci_req_init(&req, hdev);
7172
7173         status = mgmt_le_support(hdev);
7174         if (status) {
7175                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7176                                 status);
7177                 mgmt_pending_remove(cmd);
7178                 goto unlock;
7179         }
7180
7181         /* If controller is scanning, it means the background scanning
7182          * is running. Thus, we should temporarily stop it in order to
7183          * set the discovery scanning parameters.
7184          */
7185         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
7186                 hci_req_add_le_scan_disable(&req, false);
7187
7188         memset(&param_cp, 0, sizeof(param_cp));
7189
7190         /* All active scans will be done with either a resolvable
7191          * private address (when privacy feature has been enabled)
7192          * or unresolvable private address.
7193          */
7194         err = hci_update_random_address(&req, true, hci_dev_test_flag(hdev, HCI_PRIVACY), &own_addr_type);
7195         if (err < 0) {
7196                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7197                                 MGMT_STATUS_FAILED);
7198                 mgmt_pending_remove(cmd);
7199                 goto unlock;
7200         }
7201
7202         param_cp.type = hdev->le_scan_type;
7203         param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
7204         param_cp.window = cpu_to_le16(hdev->le_scan_window);
7205         param_cp.own_address_type = own_addr_type;
7206         hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
7207                     &param_cp);
7208
7209         memset(&enable_cp, 0, sizeof(enable_cp));
7210         enable_cp.enable = LE_SCAN_ENABLE;
7211         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
7212
7213         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
7214                     &enable_cp);
7215
7216         err = hci_req_run(&req, start_le_discovery_complete);
7217         if (err < 0)
7218                 mgmt_pending_remove(cmd);
7219         else
7220                 hci_le_discovery_set_state(hdev, DISCOVERY_STARTING);
7221
7222 unlock:
7223         hci_dev_unlock(hdev);
7224         return err;
7225 }
7226
7227 static int mgmt_stop_le_discovery_failed(struct hci_dev *hdev, u8 status)
7228 {
7229         struct mgmt_pending_cmd *cmd;
7230         int err;
7231
7232         cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
7233         if (!cmd)
7234                 return -ENOENT;
7235
7236         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
7237                                 mgmt_status(status), &hdev->le_discovery.type,
7238                                 sizeof(hdev->le_discovery.type));
7239         mgmt_pending_remove(cmd);
7240
7241         return err;
7242 }
7243
7244 static void stop_le_discovery_complete(struct hci_dev *hdev, u8 status,
7245                 u16 opcode)
7246 {
7247         BT_DBG("status %d", status);
7248
7249         hci_dev_lock(hdev);
7250
7251         if (status) {
7252                 mgmt_stop_le_discovery_failed(hdev, status);
7253                 goto unlock;
7254         }
7255
7256         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
7257
7258 unlock:
7259         hci_dev_unlock(hdev);
7260 }
7261
7262 static int stop_le_discovery(struct sock *sk, struct hci_dev *hdev,
7263                 void *data, u16 len)
7264 {
7265         struct mgmt_cp_stop_le_discovery *mgmt_cp = data;
7266         struct mgmt_pending_cmd *cmd;
7267         struct hci_request req;
7268         int err;
7269
7270         BT_DBG("%s", hdev->name);
7271
7272         hci_dev_lock(hdev);
7273
7274         if (!hci_le_discovery_active(hdev)) {
7275                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7276                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
7277                                         sizeof(mgmt_cp->type));
7278                 goto unlock;
7279         }
7280
7281         if (hdev->le_discovery.type != mgmt_cp->type) {
7282                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7283                                         MGMT_STATUS_INVALID_PARAMS,
7284                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
7285                 goto unlock;
7286         }
7287
7288         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_LE_DISCOVERY, hdev, NULL, 0);
7289         if (!cmd) {
7290                 err = -ENOMEM;
7291                 goto unlock;
7292         }
7293
7294         hci_req_init(&req, hdev);
7295
7296         if (hdev->le_discovery.state  != DISCOVERY_FINDING) {
7297                 BT_DBG("unknown le discovery state %u",
7298                                         hdev->le_discovery.state);
7299
7300                 mgmt_pending_remove(cmd);
7301                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7302                                         MGMT_STATUS_FAILED, &mgmt_cp->type,
7303                                         sizeof(mgmt_cp->type));
7304                 goto unlock;
7305         }
7306
7307         cancel_delayed_work(&hdev->le_scan_disable);
7308         hci_req_add_le_scan_disable(&req, false);
7309
7310         err = hci_req_run(&req, stop_le_discovery_complete);
7311         if (err < 0)
7312                 mgmt_pending_remove(cmd);
7313         else
7314                 hci_le_discovery_set_state(hdev, DISCOVERY_STOPPING);
7315
7316 unlock:
7317         hci_dev_unlock(hdev);
7318         return err;
7319 }
7320
7321 /* Separate LE discovery */
7322 void mgmt_le_discovering(struct hci_dev *hdev, u8 discovering)
7323 {
7324         struct mgmt_ev_discovering ev;
7325         struct mgmt_pending_cmd *cmd;
7326
7327         BT_DBG("%s le discovering %u", hdev->name, discovering);
7328
7329         if (discovering)
7330                 cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
7331         else
7332                 cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
7333
7334         if (cmd) {
7335                 u8 type = hdev->le_discovery.type;
7336
7337                 mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
7338                                   sizeof(type));
7339                 mgmt_pending_remove(cmd);
7340         }
7341
7342         memset(&ev, 0, sizeof(ev));
7343         ev.type = hdev->le_discovery.type;
7344         ev.discovering = discovering;
7345
7346         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7347 }
7348
7349 static int disable_le_auto_connect(struct sock *sk, struct hci_dev *hdev,
7350                         void *data, u16 len)
7351 {
7352         int err;
7353
7354         BT_DBG("%s", hdev->name);
7355
7356         hci_dev_lock(hdev);
7357
7358         err = hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
7359         if (err < 0)
7360                 BT_ERR("HCI_OP_LE_CREATE_CONN_CANCEL is failed");
7361
7362         hci_dev_unlock(hdev);
7363
7364         return err;
7365 }
7366
7367 static inline int check_le_conn_update_param(u16 min, u16 max, u16 latency,
7368                 u16 to_multiplier)
7369 {
7370         u16 max_latency;
7371
7372         if (min > max || min < 6 || max > 3200)
7373                 return -EINVAL;
7374
7375         if (to_multiplier < 10 || to_multiplier > 3200)
7376                 return -EINVAL;
7377
7378         if (max >= to_multiplier * 8)
7379                 return -EINVAL;
7380
7381         max_latency = (to_multiplier * 8 / max) - 1;
7382
7383         if (latency > 499 || latency > max_latency)
7384                 return -EINVAL;
7385
7386         return 0;
7387 }
7388
7389 static int le_conn_update(struct sock *sk, struct hci_dev *hdev, void *data,
7390                 u16 len)
7391 {
7392         struct mgmt_cp_le_conn_update *cp = data;
7393
7394         struct hci_conn *conn;
7395         u16 min, max, latency, supervision_timeout;
7396         int err = -1;
7397
7398         if (!hdev_is_powered(hdev))
7399                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7400                                 MGMT_STATUS_NOT_POWERED);
7401
7402         min = __le16_to_cpu(cp->conn_interval_min);
7403         max = __le16_to_cpu(cp->conn_interval_max);
7404         latency = __le16_to_cpu(cp->conn_latency);
7405         supervision_timeout = __le16_to_cpu(cp->supervision_timeout);
7406
7407         BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x supervision_timeout: 0x%4.4x",
7408                         min, max, latency, supervision_timeout);
7409
7410         err = check_le_conn_update_param(min, max, latency,
7411                         supervision_timeout);
7412
7413         if (err < 0)
7414                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7415                                 MGMT_STATUS_INVALID_PARAMS);
7416
7417         hci_dev_lock(hdev);
7418
7419         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
7420         if (!conn) {
7421                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7422                                 MGMT_STATUS_NOT_CONNECTED);
7423                 hci_dev_unlock(hdev);
7424                 return err;
7425         }
7426
7427         hci_dev_unlock(hdev);
7428
7429         hci_le_conn_update(conn, min, max, latency, supervision_timeout);
7430
7431         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE, 0,
7432                                  NULL, 0);
7433 }
7434
7435 static void set_manufacturer_data_complete(struct hci_dev *hdev, u8 status,
7436                 u16 opcode)
7437 {
7438         struct mgmt_cp_set_manufacturer_data *cp;
7439         struct mgmt_pending_cmd *cmd;
7440
7441         BT_DBG("status 0x%02x", status);
7442
7443         hci_dev_lock(hdev);
7444
7445         cmd = pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev);
7446         if (!cmd)
7447                 goto unlock;
7448
7449         cp = cmd->param;
7450
7451         if (status)
7452                 mgmt_cmd_status(cmd->sk, hdev->id,
7453                                 MGMT_OP_SET_MANUFACTURER_DATA,
7454                                 mgmt_status(status));
7455         else
7456                 mgmt_cmd_complete(cmd->sk, hdev->id,
7457                                   MGMT_OP_SET_MANUFACTURER_DATA, 0,
7458                                   cp, sizeof(*cp));
7459
7460         mgmt_pending_remove(cmd);
7461
7462 unlock:
7463         hci_dev_unlock(hdev);
7464 }
7465
7466 static int set_manufacturer_data(struct sock *sk, struct hci_dev *hdev,
7467                 void *data, u16 len)
7468 {
7469         struct mgmt_pending_cmd *cmd;
7470         struct hci_request req;
7471         struct mgmt_cp_set_manufacturer_data *cp = data;
7472         u8 old_data[HCI_MAX_EIR_LENGTH] = {0, };
7473         u8 old_len;
7474         int err;
7475
7476         BT_DBG("%s", hdev->name);
7477
7478         if (!lmp_bredr_capable(hdev))
7479                 return mgmt_cmd_status(sk, hdev->id,
7480                                 MGMT_OP_SET_MANUFACTURER_DATA,
7481                                 MGMT_STATUS_NOT_SUPPORTED);
7482
7483         if (cp->data[0] == 0 ||
7484                         cp->data[0] - 1 > sizeof(hdev->manufacturer_data))
7485                 return mgmt_cmd_status(sk, hdev->id,
7486                                 MGMT_OP_SET_MANUFACTURER_DATA,
7487                                 MGMT_STATUS_INVALID_PARAMS);
7488
7489         if (cp->data[1] != 0xFF)
7490                 return mgmt_cmd_status(sk, hdev->id,
7491                                 MGMT_OP_SET_MANUFACTURER_DATA,
7492                                 MGMT_STATUS_NOT_SUPPORTED);
7493
7494         hci_dev_lock(hdev);
7495
7496         if (pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev)) {
7497                 err = mgmt_cmd_status(sk, hdev->id,
7498                                 MGMT_OP_SET_MANUFACTURER_DATA,
7499                                 MGMT_STATUS_BUSY);
7500                 goto unlocked;
7501         }
7502
7503         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MANUFACTURER_DATA, hdev, data,
7504                         len);
7505         if (!cmd) {
7506                 err = -ENOMEM;
7507                 goto unlocked;
7508         }
7509
7510         hci_req_init(&req, hdev);
7511
7512         /* if new data is same as previous data then return command
7513          * complete event
7514          */
7515         if (hdev->manufacturer_len == cp->data[0] - 1 &&
7516             !memcmp(hdev->manufacturer_data, cp->data + 2, cp->data[0] - 1)) {
7517                 mgmt_pending_remove(cmd);
7518                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
7519                                   0, cp, sizeof(*cp));
7520                 err = 0;
7521                 goto unlocked;
7522         }
7523
7524         old_len = hdev->manufacturer_len;
7525         if (old_len > 0)
7526                 memcpy(old_data, hdev->manufacturer_data, old_len);
7527
7528         hdev->manufacturer_len = cp->data[0] - 1;
7529         if (hdev->manufacturer_len > 0)
7530                 memcpy(hdev->manufacturer_data, cp->data + 2,
7531                                 hdev->manufacturer_len);
7532
7533         __hci_req_update_eir(&req);
7534
7535         err = hci_req_run(&req, set_manufacturer_data_complete);
7536         if (err < 0) {
7537                 mgmt_pending_remove(cmd);
7538                 goto failed;
7539         }
7540
7541 unlocked:
7542         hci_dev_unlock(hdev);
7543
7544         return err;
7545
7546 failed:
7547         memset(hdev->manufacturer_data, 0x00, sizeof(hdev->manufacturer_data));
7548         hdev->manufacturer_len = old_len;
7549         if (hdev->manufacturer_len > 0)
7550                 memcpy(hdev->manufacturer_data, old_data,
7551                        hdev->manufacturer_len);
7552         hci_dev_unlock(hdev);
7553         return err;
7554 }
7555
7556 static int le_set_scan_params(struct sock *sk, struct hci_dev *hdev,
7557                 void *data, u16 len)
7558 {
7559         struct mgmt_cp_le_set_scan_params *cp = data;
7560         __u16 interval, window;
7561         int err;
7562
7563         BT_DBG("%s", hdev->name);
7564
7565         if (!lmp_le_capable(hdev))
7566                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7567                                 MGMT_STATUS_NOT_SUPPORTED);
7568
7569         interval = __le16_to_cpu(cp->interval);
7570
7571         if (interval < 0x0004 || interval > 0x4000)
7572                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7573                                 MGMT_STATUS_INVALID_PARAMS);
7574
7575         window = __le16_to_cpu(cp->window);
7576
7577         if (window < 0x0004 || window > 0x4000)
7578                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7579                                 MGMT_STATUS_INVALID_PARAMS);
7580
7581         if (window > interval)
7582                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7583                                 MGMT_STATUS_INVALID_PARAMS);
7584
7585         hci_dev_lock(hdev);
7586
7587         hdev->le_scan_type = cp->type;
7588         hdev->le_scan_interval = interval;
7589         hdev->le_scan_window = window;
7590
7591         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS, 0,
7592                                 NULL, 0);
7593
7594         /* If background scan is running, restart it so new parameters are
7595          * loaded.
7596          */
7597         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
7598             hdev->discovery.state == DISCOVERY_STOPPED) {
7599                 struct hci_request req;
7600
7601                 hci_req_init(&req, hdev);
7602
7603                 hci_req_add_le_scan_disable(&req, false);
7604                 hci_req_add_le_passive_scan(&req);
7605
7606                 hci_req_run(&req, NULL);
7607         }
7608
7609         hci_dev_unlock(hdev);
7610
7611         return err;
7612 }
7613 #endif /* TIZEN_BT */
7614
7615 static bool ltk_is_valid(struct mgmt_ltk_info *key)
7616 {
7617         if (key->master != 0x00 && key->master != 0x01)
7618                 return false;
7619
7620         switch (key->addr.type) {
7621         case BDADDR_LE_PUBLIC:
7622                 return true;
7623
7624         case BDADDR_LE_RANDOM:
7625                 /* Two most significant bits shall be set */
7626                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7627                         return false;
7628                 return true;
7629         }
7630
7631         return false;
7632 }
7633
7634 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
7635                                void *cp_data, u16 len)
7636 {
7637         struct mgmt_cp_load_long_term_keys *cp = cp_data;
7638         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
7639                                    sizeof(struct mgmt_ltk_info));
7640         u16 key_count, expected_len;
7641         int i, err;
7642
7643         bt_dev_dbg(hdev, "sock %p", sk);
7644
7645         if (!lmp_le_capable(hdev))
7646                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7647                                        MGMT_STATUS_NOT_SUPPORTED);
7648
7649         key_count = __le16_to_cpu(cp->key_count);
7650         if (key_count > max_key_count) {
7651                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
7652                            key_count);
7653                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7654                                        MGMT_STATUS_INVALID_PARAMS);
7655         }
7656
7657         expected_len = struct_size(cp, keys, key_count);
7658         if (expected_len != len) {
7659                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
7660                            expected_len, len);
7661                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7662                                        MGMT_STATUS_INVALID_PARAMS);
7663         }
7664
7665         bt_dev_dbg(hdev, "key_count %u", key_count);
7666
7667         for (i = 0; i < key_count; i++) {
7668                 struct mgmt_ltk_info *key = &cp->keys[i];
7669
7670                 if (!ltk_is_valid(key))
7671                         return mgmt_cmd_status(sk, hdev->id,
7672                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
7673                                                MGMT_STATUS_INVALID_PARAMS);
7674         }
7675
7676         hci_dev_lock(hdev);
7677
7678         hci_smp_ltks_clear(hdev);
7679
7680         for (i = 0; i < key_count; i++) {
7681                 struct mgmt_ltk_info *key = &cp->keys[i];
7682                 u8 type, authenticated;
7683
7684                 if (hci_is_blocked_key(hdev,
7685                                        HCI_BLOCKED_KEY_TYPE_LTK,
7686                                        key->val)) {
7687                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
7688                                     &key->addr.bdaddr);
7689                         continue;
7690                 }
7691
7692                 switch (key->type) {
7693                 case MGMT_LTK_UNAUTHENTICATED:
7694                         authenticated = 0x00;
7695                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
7696                         break;
7697                 case MGMT_LTK_AUTHENTICATED:
7698                         authenticated = 0x01;
7699                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
7700                         break;
7701                 case MGMT_LTK_P256_UNAUTH:
7702                         authenticated = 0x00;
7703                         type = SMP_LTK_P256;
7704                         break;
7705                 case MGMT_LTK_P256_AUTH:
7706                         authenticated = 0x01;
7707                         type = SMP_LTK_P256;
7708                         break;
7709                 case MGMT_LTK_P256_DEBUG:
7710                         authenticated = 0x00;
7711                         type = SMP_LTK_P256_DEBUG;
7712                         fallthrough;
7713                 default:
7714                         continue;
7715                 }
7716
7717                 hci_add_ltk(hdev, &key->addr.bdaddr,
7718                             le_addr_type(key->addr.type), type, authenticated,
7719                             key->val, key->enc_size, key->ediv, key->rand);
7720         }
7721
7722         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
7723                            NULL, 0);
7724
7725         hci_dev_unlock(hdev);
7726
7727         return err;
7728 }
7729
7730 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
7731 {
7732         struct hci_conn *conn = cmd->user_data;
7733         struct mgmt_rp_get_conn_info rp;
7734         int err;
7735
7736         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
7737
7738         if (status == MGMT_STATUS_SUCCESS) {
7739                 rp.rssi = conn->rssi;
7740                 rp.tx_power = conn->tx_power;
7741                 rp.max_tx_power = conn->max_tx_power;
7742         } else {
7743                 rp.rssi = HCI_RSSI_INVALID;
7744                 rp.tx_power = HCI_TX_POWER_INVALID;
7745                 rp.max_tx_power = HCI_TX_POWER_INVALID;
7746         }
7747
7748         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
7749                                 status, &rp, sizeof(rp));
7750
7751         hci_conn_drop(conn);
7752         hci_conn_put(conn);
7753
7754         return err;
7755 }
7756
7757 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
7758                                        u16 opcode)
7759 {
7760         struct hci_cp_read_rssi *cp;
7761         struct mgmt_pending_cmd *cmd;
7762         struct hci_conn *conn;
7763         u16 handle;
7764         u8 status;
7765
7766         bt_dev_dbg(hdev, "status 0x%02x", hci_status);
7767
7768         hci_dev_lock(hdev);
7769
7770         /* Commands sent in request are either Read RSSI or Read Transmit Power
7771          * Level so we check which one was last sent to retrieve connection
7772          * handle.  Both commands have handle as first parameter so it's safe to
7773          * cast data on the same command struct.
7774          *
7775          * First command sent is always Read RSSI and we fail only if it fails.
7776          * In other case we simply override error to indicate success as we
7777          * already remembered if TX power value is actually valid.
7778          */
7779         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
7780         if (!cp) {
7781                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
7782                 status = MGMT_STATUS_SUCCESS;
7783         } else {
7784                 status = mgmt_status(hci_status);
7785         }
7786
7787         if (!cp) {
7788                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
7789                 goto unlock;
7790         }
7791
7792         handle = __le16_to_cpu(cp->handle);
7793         conn = hci_conn_hash_lookup_handle(hdev, handle);
7794         if (!conn) {
7795                 bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
7796                            handle);
7797                 goto unlock;
7798         }
7799
7800         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
7801         if (!cmd)
7802                 goto unlock;
7803
7804         cmd->cmd_complete(cmd, status);
7805         mgmt_pending_remove(cmd);
7806
7807 unlock:
7808         hci_dev_unlock(hdev);
7809 }
7810
7811 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
7812                          u16 len)
7813 {
7814         struct mgmt_cp_get_conn_info *cp = data;
7815         struct mgmt_rp_get_conn_info rp;
7816         struct hci_conn *conn;
7817         unsigned long conn_info_age;
7818         int err = 0;
7819
7820         bt_dev_dbg(hdev, "sock %p", sk);
7821
7822         memset(&rp, 0, sizeof(rp));
7823         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7824         rp.addr.type = cp->addr.type;
7825
7826         if (!bdaddr_type_is_valid(cp->addr.type))
7827                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7828                                          MGMT_STATUS_INVALID_PARAMS,
7829                                          &rp, sizeof(rp));
7830
7831         hci_dev_lock(hdev);
7832
7833         if (!hdev_is_powered(hdev)) {
7834                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7835                                         MGMT_STATUS_NOT_POWERED, &rp,
7836                                         sizeof(rp));
7837                 goto unlock;
7838         }
7839
7840         if (cp->addr.type == BDADDR_BREDR)
7841                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7842                                                &cp->addr.bdaddr);
7843         else
7844                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7845
7846         if (!conn || conn->state != BT_CONNECTED) {
7847                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7848                                         MGMT_STATUS_NOT_CONNECTED, &rp,
7849                                         sizeof(rp));
7850                 goto unlock;
7851         }
7852
7853         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
7854                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7855                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
7856                 goto unlock;
7857         }
7858
7859         /* To avoid client trying to guess when to poll again for information we
7860          * calculate conn info age as random value between min/max set in hdev.
7861          */
7862         conn_info_age = hdev->conn_info_min_age +
7863                         prandom_u32_max(hdev->conn_info_max_age -
7864                                         hdev->conn_info_min_age);
7865
7866         /* Query controller to refresh cached values if they are too old or were
7867          * never read.
7868          */
7869         if (time_after(jiffies, conn->conn_info_timestamp +
7870                        msecs_to_jiffies(conn_info_age)) ||
7871             !conn->conn_info_timestamp) {
7872                 struct hci_request req;
7873                 struct hci_cp_read_tx_power req_txp_cp;
7874                 struct hci_cp_read_rssi req_rssi_cp;
7875                 struct mgmt_pending_cmd *cmd;
7876
7877                 hci_req_init(&req, hdev);
7878                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
7879                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
7880                             &req_rssi_cp);
7881
7882                 /* For LE links TX power does not change thus we don't need to
7883                  * query for it once value is known.
7884                  */
7885                 if (!bdaddr_type_is_le(cp->addr.type) ||
7886                     conn->tx_power == HCI_TX_POWER_INVALID) {
7887                         req_txp_cp.handle = cpu_to_le16(conn->handle);
7888                         req_txp_cp.type = 0x00;
7889                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
7890                                     sizeof(req_txp_cp), &req_txp_cp);
7891                 }
7892
7893                 /* Max TX power needs to be read only once per connection */
7894                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
7895                         req_txp_cp.handle = cpu_to_le16(conn->handle);
7896                         req_txp_cp.type = 0x01;
7897                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
7898                                     sizeof(req_txp_cp), &req_txp_cp);
7899                 }
7900
7901                 err = hci_req_run(&req, conn_info_refresh_complete);
7902                 if (err < 0)
7903                         goto unlock;
7904
7905                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
7906                                        data, len);
7907                 if (!cmd) {
7908                         err = -ENOMEM;
7909                         goto unlock;
7910                 }
7911
7912                 hci_conn_hold(conn);
7913                 cmd->user_data = hci_conn_get(conn);
7914                 cmd->cmd_complete = conn_info_cmd_complete;
7915
7916                 conn->conn_info_timestamp = jiffies;
7917         } else {
7918                 /* Cache is valid, just reply with values cached in hci_conn */
7919                 rp.rssi = conn->rssi;
7920                 rp.tx_power = conn->tx_power;
7921                 rp.max_tx_power = conn->max_tx_power;
7922
7923                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7924                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7925         }
7926
7927 unlock:
7928         hci_dev_unlock(hdev);
7929         return err;
7930 }
7931
7932 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
7933 {
7934         struct hci_conn *conn = cmd->user_data;
7935         struct mgmt_rp_get_clock_info rp;
7936         struct hci_dev *hdev;
7937         int err;
7938
7939         memset(&rp, 0, sizeof(rp));
7940         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
7941
7942         if (status)
7943                 goto complete;
7944
7945         hdev = hci_dev_get(cmd->index);
7946         if (hdev) {
7947                 rp.local_clock = cpu_to_le32(hdev->clock);
7948                 hci_dev_put(hdev);
7949         }
7950
7951         if (conn) {
7952                 rp.piconet_clock = cpu_to_le32(conn->clock);
7953                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
7954         }
7955
7956 complete:
7957         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
7958                                 sizeof(rp));
7959
7960         if (conn) {
7961                 hci_conn_drop(conn);
7962                 hci_conn_put(conn);
7963         }
7964
7965         return err;
7966 }
7967
7968 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7969 {
7970         struct hci_cp_read_clock *hci_cp;
7971         struct mgmt_pending_cmd *cmd;
7972         struct hci_conn *conn;
7973
7974         bt_dev_dbg(hdev, "status %u", status);
7975
7976         hci_dev_lock(hdev);
7977
7978         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
7979         if (!hci_cp)
7980                 goto unlock;
7981
7982         if (hci_cp->which) {
7983                 u16 handle = __le16_to_cpu(hci_cp->handle);
7984                 conn = hci_conn_hash_lookup_handle(hdev, handle);
7985         } else {
7986                 conn = NULL;
7987         }
7988
7989         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
7990         if (!cmd)
7991                 goto unlock;
7992
7993         cmd->cmd_complete(cmd, mgmt_status(status));
7994         mgmt_pending_remove(cmd);
7995
7996 unlock:
7997         hci_dev_unlock(hdev);
7998 }
7999
8000 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
8001                          u16 len)
8002 {
8003         struct mgmt_cp_get_clock_info *cp = data;
8004         struct mgmt_rp_get_clock_info rp;
8005         struct hci_cp_read_clock hci_cp;
8006         struct mgmt_pending_cmd *cmd;
8007         struct hci_request req;
8008         struct hci_conn *conn;
8009         int err;
8010
8011         bt_dev_dbg(hdev, "sock %p", sk);
8012
8013         memset(&rp, 0, sizeof(rp));
8014         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8015         rp.addr.type = cp->addr.type;
8016
8017         if (cp->addr.type != BDADDR_BREDR)
8018                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8019                                          MGMT_STATUS_INVALID_PARAMS,
8020                                          &rp, sizeof(rp));
8021
8022         hci_dev_lock(hdev);
8023
8024         if (!hdev_is_powered(hdev)) {
8025                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8026                                         MGMT_STATUS_NOT_POWERED, &rp,
8027                                         sizeof(rp));
8028                 goto unlock;
8029         }
8030
8031         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8032                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8033                                                &cp->addr.bdaddr);
8034                 if (!conn || conn->state != BT_CONNECTED) {
8035                         err = mgmt_cmd_complete(sk, hdev->id,
8036                                                 MGMT_OP_GET_CLOCK_INFO,
8037                                                 MGMT_STATUS_NOT_CONNECTED,
8038                                                 &rp, sizeof(rp));
8039                         goto unlock;
8040                 }
8041         } else {
8042                 conn = NULL;
8043         }
8044
8045         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
8046         if (!cmd) {
8047                 err = -ENOMEM;
8048                 goto unlock;
8049         }
8050
8051         cmd->cmd_complete = clock_info_cmd_complete;
8052
8053         hci_req_init(&req, hdev);
8054
8055         memset(&hci_cp, 0, sizeof(hci_cp));
8056         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
8057
8058         if (conn) {
8059                 hci_conn_hold(conn);
8060                 cmd->user_data = hci_conn_get(conn);
8061
8062                 hci_cp.handle = cpu_to_le16(conn->handle);
8063                 hci_cp.which = 0x01; /* Piconet clock */
8064                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
8065         }
8066
8067         err = hci_req_run(&req, get_clock_info_complete);
8068         if (err < 0)
8069                 mgmt_pending_remove(cmd);
8070
8071 unlock:
8072         hci_dev_unlock(hdev);
8073         return err;
8074 }
8075
8076 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
8077 {
8078         struct hci_conn *conn;
8079
8080         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
8081         if (!conn)
8082                 return false;
8083
8084         if (conn->dst_type != type)
8085                 return false;
8086
8087         if (conn->state != BT_CONNECTED)
8088                 return false;
8089
8090         return true;
8091 }
8092
8093 /* This function requires the caller holds hdev->lock */
8094 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
8095                                u8 addr_type, u8 auto_connect)
8096 {
8097         struct hci_conn_params *params;
8098
8099         params = hci_conn_params_add(hdev, addr, addr_type);
8100         if (!params)
8101                 return -EIO;
8102
8103         if (params->auto_connect == auto_connect)
8104                 return 0;
8105
8106         list_del_init(&params->action);
8107
8108         switch (auto_connect) {
8109         case HCI_AUTO_CONN_DISABLED:
8110         case HCI_AUTO_CONN_LINK_LOSS:
8111                 /* If auto connect is being disabled when we're trying to
8112                  * connect to device, keep connecting.
8113                  */
8114                 if (params->explicit_connect)
8115                         list_add(&params->action, &hdev->pend_le_conns);
8116                 break;
8117         case HCI_AUTO_CONN_REPORT:
8118                 if (params->explicit_connect)
8119                         list_add(&params->action, &hdev->pend_le_conns);
8120                 else
8121                         list_add(&params->action, &hdev->pend_le_reports);
8122                 break;
8123         case HCI_AUTO_CONN_DIRECT:
8124         case HCI_AUTO_CONN_ALWAYS:
8125                 if (!is_connected(hdev, addr, addr_type))
8126                         list_add(&params->action, &hdev->pend_le_conns);
8127                 break;
8128         }
8129
8130         params->auto_connect = auto_connect;
8131
8132         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
8133                    addr, addr_type, auto_connect);
8134
8135         return 0;
8136 }
8137
8138 static void device_added(struct sock *sk, struct hci_dev *hdev,
8139                          bdaddr_t *bdaddr, u8 type, u8 action)
8140 {
8141         struct mgmt_ev_device_added ev;
8142
8143         bacpy(&ev.addr.bdaddr, bdaddr);
8144         ev.addr.type = type;
8145         ev.action = action;
8146
8147         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
8148 }
8149
8150 static int add_device(struct sock *sk, struct hci_dev *hdev,
8151                       void *data, u16 len)
8152 {
8153         struct mgmt_cp_add_device *cp = data;
8154         u8 auto_conn, addr_type;
8155         struct hci_conn_params *params;
8156         int err;
8157         u32 current_flags = 0;
8158
8159         bt_dev_dbg(hdev, "sock %p", sk);
8160
8161         if (!bdaddr_type_is_valid(cp->addr.type) ||
8162             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
8163                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8164                                          MGMT_STATUS_INVALID_PARAMS,
8165                                          &cp->addr, sizeof(cp->addr));
8166
8167         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
8168                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8169                                          MGMT_STATUS_INVALID_PARAMS,
8170                                          &cp->addr, sizeof(cp->addr));
8171
8172         hci_dev_lock(hdev);
8173
8174         if (cp->addr.type == BDADDR_BREDR) {
8175                 /* Only incoming connections action is supported for now */
8176                 if (cp->action != 0x01) {
8177                         err = mgmt_cmd_complete(sk, hdev->id,
8178                                                 MGMT_OP_ADD_DEVICE,
8179                                                 MGMT_STATUS_INVALID_PARAMS,
8180                                                 &cp->addr, sizeof(cp->addr));
8181                         goto unlock;
8182                 }
8183
8184                 err = hci_bdaddr_list_add_with_flags(&hdev->whitelist,
8185                                                      &cp->addr.bdaddr,
8186                                                      cp->addr.type, 0);
8187                 if (err)
8188                         goto unlock;
8189
8190                 hci_req_update_scan(hdev);
8191
8192                 goto added;
8193         }
8194
8195         addr_type = le_addr_type(cp->addr.type);
8196
8197         if (cp->action == 0x02)
8198                 auto_conn = HCI_AUTO_CONN_ALWAYS;
8199         else if (cp->action == 0x01)
8200                 auto_conn = HCI_AUTO_CONN_DIRECT;
8201         else
8202                 auto_conn = HCI_AUTO_CONN_REPORT;
8203
8204         /* Kernel internally uses conn_params with resolvable private
8205          * address, but Add Device allows only identity addresses.
8206          * Make sure it is enforced before calling
8207          * hci_conn_params_lookup.
8208          */
8209         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
8210                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8211                                         MGMT_STATUS_INVALID_PARAMS,
8212                                         &cp->addr, sizeof(cp->addr));
8213                 goto unlock;
8214         }
8215
8216         /* If the connection parameters don't exist for this device,
8217          * they will be created and configured with defaults.
8218          */
8219         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
8220                                 auto_conn) < 0) {
8221                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8222                                         MGMT_STATUS_FAILED, &cp->addr,
8223                                         sizeof(cp->addr));
8224                 goto unlock;
8225         } else {
8226                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
8227                                                 addr_type);
8228                 if (params)
8229                         current_flags = params->current_flags;
8230         }
8231
8232         hci_update_background_scan(hdev);
8233
8234 added:
8235         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
8236         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
8237                              SUPPORTED_DEVICE_FLAGS(), current_flags);
8238
8239         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8240                                 MGMT_STATUS_SUCCESS, &cp->addr,
8241                                 sizeof(cp->addr));
8242
8243 unlock:
8244         hci_dev_unlock(hdev);
8245         return err;
8246 }
8247
8248 static void device_removed(struct sock *sk, struct hci_dev *hdev,
8249                            bdaddr_t *bdaddr, u8 type)
8250 {
8251         struct mgmt_ev_device_removed ev;
8252
8253         bacpy(&ev.addr.bdaddr, bdaddr);
8254         ev.addr.type = type;
8255
8256         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
8257 }
8258
8259 static int remove_device(struct sock *sk, struct hci_dev *hdev,
8260                          void *data, u16 len)
8261 {
8262         struct mgmt_cp_remove_device *cp = data;
8263         int err;
8264
8265         bt_dev_dbg(hdev, "sock %p", sk);
8266
8267         hci_dev_lock(hdev);
8268
8269         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8270                 struct hci_conn_params *params;
8271                 u8 addr_type;
8272
8273                 if (!bdaddr_type_is_valid(cp->addr.type)) {
8274                         err = mgmt_cmd_complete(sk, hdev->id,
8275                                                 MGMT_OP_REMOVE_DEVICE,
8276                                                 MGMT_STATUS_INVALID_PARAMS,
8277                                                 &cp->addr, sizeof(cp->addr));
8278                         goto unlock;
8279                 }
8280
8281                 if (cp->addr.type == BDADDR_BREDR) {
8282                         err = hci_bdaddr_list_del(&hdev->whitelist,
8283                                                   &cp->addr.bdaddr,
8284                                                   cp->addr.type);
8285                         if (err) {
8286                                 err = mgmt_cmd_complete(sk, hdev->id,
8287                                                         MGMT_OP_REMOVE_DEVICE,
8288                                                         MGMT_STATUS_INVALID_PARAMS,
8289                                                         &cp->addr,
8290                                                         sizeof(cp->addr));
8291                                 goto unlock;
8292                         }
8293
8294                         hci_req_update_scan(hdev);
8295
8296                         device_removed(sk, hdev, &cp->addr.bdaddr,
8297                                        cp->addr.type);
8298                         goto complete;
8299                 }
8300
8301                 addr_type = le_addr_type(cp->addr.type);
8302
8303                 /* Kernel internally uses conn_params with resolvable private
8304                  * address, but Remove Device allows only identity addresses.
8305                  * Make sure it is enforced before calling
8306                  * hci_conn_params_lookup.
8307                  */
8308                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
8309                         err = mgmt_cmd_complete(sk, hdev->id,
8310                                                 MGMT_OP_REMOVE_DEVICE,
8311                                                 MGMT_STATUS_INVALID_PARAMS,
8312                                                 &cp->addr, sizeof(cp->addr));
8313                         goto unlock;
8314                 }
8315
8316                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
8317                                                 addr_type);
8318                 if (!params) {
8319                         err = mgmt_cmd_complete(sk, hdev->id,
8320                                                 MGMT_OP_REMOVE_DEVICE,
8321                                                 MGMT_STATUS_INVALID_PARAMS,
8322                                                 &cp->addr, sizeof(cp->addr));
8323                         goto unlock;
8324                 }
8325
8326                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
8327                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
8328                         err = mgmt_cmd_complete(sk, hdev->id,
8329                                                 MGMT_OP_REMOVE_DEVICE,
8330                                                 MGMT_STATUS_INVALID_PARAMS,
8331                                                 &cp->addr, sizeof(cp->addr));
8332                         goto unlock;
8333                 }
8334
8335                 list_del(&params->action);
8336                 list_del(&params->list);
8337                 kfree(params);
8338                 hci_update_background_scan(hdev);
8339
8340                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
8341         } else {
8342                 struct hci_conn_params *p, *tmp;
8343                 struct bdaddr_list *b, *btmp;
8344
8345                 if (cp->addr.type) {
8346                         err = mgmt_cmd_complete(sk, hdev->id,
8347                                                 MGMT_OP_REMOVE_DEVICE,
8348                                                 MGMT_STATUS_INVALID_PARAMS,
8349                                                 &cp->addr, sizeof(cp->addr));
8350                         goto unlock;
8351                 }
8352
8353                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
8354                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
8355                         list_del(&b->list);
8356                         kfree(b);
8357                 }
8358
8359                 hci_req_update_scan(hdev);
8360
8361                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
8362                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
8363                                 continue;
8364                         device_removed(sk, hdev, &p->addr, p->addr_type);
8365                         if (p->explicit_connect) {
8366                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
8367                                 continue;
8368                         }
8369                         list_del(&p->action);
8370                         list_del(&p->list);
8371                         kfree(p);
8372                 }
8373
8374                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
8375
8376                 hci_update_background_scan(hdev);
8377         }
8378
8379 complete:
8380         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
8381                                 MGMT_STATUS_SUCCESS, &cp->addr,
8382                                 sizeof(cp->addr));
8383 unlock:
8384         hci_dev_unlock(hdev);
8385         return err;
8386 }
8387
8388 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
8389                            u16 len)
8390 {
8391         struct mgmt_cp_load_conn_param *cp = data;
8392         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
8393                                      sizeof(struct mgmt_conn_param));
8394         u16 param_count, expected_len;
8395         int i;
8396
8397         if (!lmp_le_capable(hdev))
8398                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8399                                        MGMT_STATUS_NOT_SUPPORTED);
8400
8401         param_count = __le16_to_cpu(cp->param_count);
8402         if (param_count > max_param_count) {
8403                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
8404                            param_count);
8405                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8406                                        MGMT_STATUS_INVALID_PARAMS);
8407         }
8408
8409         expected_len = struct_size(cp, params, param_count);
8410         if (expected_len != len) {
8411                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
8412                            expected_len, len);
8413                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8414                                        MGMT_STATUS_INVALID_PARAMS);
8415         }
8416
8417         bt_dev_dbg(hdev, "param_count %u", param_count);
8418
8419         hci_dev_lock(hdev);
8420
8421         hci_conn_params_clear_disabled(hdev);
8422
8423         for (i = 0; i < param_count; i++) {
8424                 struct mgmt_conn_param *param = &cp->params[i];
8425                 struct hci_conn_params *hci_param;
8426                 u16 min, max, latency, timeout;
8427                 u8 addr_type;
8428
8429                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
8430                            param->addr.type);
8431
8432                 if (param->addr.type == BDADDR_LE_PUBLIC) {
8433                         addr_type = ADDR_LE_DEV_PUBLIC;
8434                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
8435                         addr_type = ADDR_LE_DEV_RANDOM;
8436                 } else {
8437                         bt_dev_err(hdev, "ignoring invalid connection parameters");
8438                         continue;
8439                 }
8440
8441                 min = le16_to_cpu(param->min_interval);
8442                 max = le16_to_cpu(param->max_interval);
8443                 latency = le16_to_cpu(param->latency);
8444                 timeout = le16_to_cpu(param->timeout);
8445
8446                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
8447                            min, max, latency, timeout);
8448
8449                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
8450                         bt_dev_err(hdev, "ignoring invalid connection parameters");
8451                         continue;
8452                 }
8453
8454                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
8455                                                 addr_type);
8456                 if (!hci_param) {
8457                         bt_dev_err(hdev, "failed to add connection parameters");
8458                         continue;
8459                 }
8460
8461                 hci_param->conn_min_interval = min;
8462                 hci_param->conn_max_interval = max;
8463                 hci_param->conn_latency = latency;
8464                 hci_param->supervision_timeout = timeout;
8465         }
8466
8467         hci_dev_unlock(hdev);
8468
8469         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
8470                                  NULL, 0);
8471 }
8472
8473 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
8474                                void *data, u16 len)
8475 {
8476         struct mgmt_cp_set_external_config *cp = data;
8477         bool changed;
8478         int err;
8479
8480         bt_dev_dbg(hdev, "sock %p", sk);
8481
8482         if (hdev_is_powered(hdev))
8483                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8484                                        MGMT_STATUS_REJECTED);
8485
8486         if (cp->config != 0x00 && cp->config != 0x01)
8487                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8488                                          MGMT_STATUS_INVALID_PARAMS);
8489
8490         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
8491                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8492                                        MGMT_STATUS_NOT_SUPPORTED);
8493
8494         hci_dev_lock(hdev);
8495
8496         if (cp->config)
8497                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
8498         else
8499                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
8500
8501         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
8502         if (err < 0)
8503                 goto unlock;
8504
8505         if (!changed)
8506                 goto unlock;
8507
8508         err = new_options(hdev, sk);
8509
8510         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
8511                 mgmt_index_removed(hdev);
8512
8513                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
8514                         hci_dev_set_flag(hdev, HCI_CONFIG);
8515                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8516
8517                         queue_work(hdev->req_workqueue, &hdev->power_on);
8518                 } else {
8519                         set_bit(HCI_RAW, &hdev->flags);
8520                         mgmt_index_added(hdev);
8521                 }
8522         }
8523
8524 unlock:
8525         hci_dev_unlock(hdev);
8526         return err;
8527 }
8528
8529 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
8530                               void *data, u16 len)
8531 {
8532         struct mgmt_cp_set_public_address *cp = data;
8533         bool changed;
8534         int err;
8535
8536         bt_dev_dbg(hdev, "sock %p", sk);
8537
8538         if (hdev_is_powered(hdev))
8539                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8540                                        MGMT_STATUS_REJECTED);
8541
8542         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
8543                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8544                                        MGMT_STATUS_INVALID_PARAMS);
8545
8546         if (!hdev->set_bdaddr)
8547                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8548                                        MGMT_STATUS_NOT_SUPPORTED);
8549
8550         hci_dev_lock(hdev);
8551
8552         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
8553         bacpy(&hdev->public_addr, &cp->bdaddr);
8554
8555         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
8556         if (err < 0)
8557                 goto unlock;
8558
8559         if (!changed)
8560                 goto unlock;
8561
8562         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
8563                 err = new_options(hdev, sk);
8564
8565         if (is_configured(hdev)) {
8566                 mgmt_index_removed(hdev);
8567
8568                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
8569
8570                 hci_dev_set_flag(hdev, HCI_CONFIG);
8571                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8572
8573                 queue_work(hdev->req_workqueue, &hdev->power_on);
8574         }
8575
8576 unlock:
8577         hci_dev_unlock(hdev);
8578         return err;
8579 }
8580
8581 #ifdef TIZEN_BT
8582 int mgmt_device_name_update(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name,
8583                             u8 name_len)
8584 {
8585         char buf[512];
8586         struct mgmt_ev_device_name_update *ev = (void *)buf;
8587         u16 eir_len = 0;
8588
8589         if (name_len <= 0)
8590                 return -EINVAL;
8591
8592         bacpy(&ev->addr.bdaddr, bdaddr);
8593         ev->addr.type = BDADDR_BREDR;
8594
8595         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
8596                                   name_len);
8597
8598         ev->eir_len = cpu_to_le16(eir_len);
8599
8600         return mgmt_event(MGMT_EV_DEVICE_NAME_UPDATE, hdev, buf,
8601                           sizeof(*ev) + eir_len, NULL);
8602 }
8603
8604 int mgmt_le_conn_update_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
8605                                u8 link_type, u8 addr_type, u8 status)
8606 {
8607         struct mgmt_ev_conn_update_failed ev;
8608
8609         bacpy(&ev.addr.bdaddr, bdaddr);
8610         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8611         ev.status = status;
8612
8613         return mgmt_event(MGMT_EV_CONN_UPDATE_FAILED, hdev,
8614                                 &ev, sizeof(ev), NULL);
8615 }
8616
8617 int mgmt_le_conn_updated(struct hci_dev *hdev, bdaddr_t *bdaddr,
8618                          u8 link_type, u8 addr_type, u16 conn_interval,
8619                          u16 conn_latency, u16 supervision_timeout)
8620 {
8621         struct mgmt_ev_conn_updated ev;
8622
8623         bacpy(&ev.addr.bdaddr, bdaddr);
8624         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8625         ev.conn_interval = cpu_to_le16(conn_interval);
8626         ev.conn_latency = cpu_to_le16(conn_latency);
8627         ev.supervision_timeout = cpu_to_le16(supervision_timeout);
8628
8629         return mgmt_event(MGMT_EV_CONN_UPDATED, hdev,
8630                                 &ev, sizeof(ev), NULL);
8631 }
8632 #endif
8633
8634 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
8635                                              u16 opcode, struct sk_buff *skb)
8636 {
8637         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
8638         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
8639         u8 *h192, *r192, *h256, *r256;
8640         struct mgmt_pending_cmd *cmd;
8641         u16 eir_len;
8642         int err;
8643
8644         bt_dev_dbg(hdev, "status %u", status);
8645
8646         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
8647         if (!cmd)
8648                 return;
8649
8650         mgmt_cp = cmd->param;
8651
8652         if (status) {
8653                 status = mgmt_status(status);
8654                 eir_len = 0;
8655
8656                 h192 = NULL;
8657                 r192 = NULL;
8658                 h256 = NULL;
8659                 r256 = NULL;
8660         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
8661                 struct hci_rp_read_local_oob_data *rp;
8662
8663                 if (skb->len != sizeof(*rp)) {
8664                         status = MGMT_STATUS_FAILED;
8665                         eir_len = 0;
8666                 } else {
8667                         status = MGMT_STATUS_SUCCESS;
8668                         rp = (void *)skb->data;
8669
8670                         eir_len = 5 + 18 + 18;
8671                         h192 = rp->hash;
8672                         r192 = rp->rand;
8673                         h256 = NULL;
8674                         r256 = NULL;
8675                 }
8676         } else {
8677                 struct hci_rp_read_local_oob_ext_data *rp;
8678
8679                 if (skb->len != sizeof(*rp)) {
8680                         status = MGMT_STATUS_FAILED;
8681                         eir_len = 0;
8682                 } else {
8683                         status = MGMT_STATUS_SUCCESS;
8684                         rp = (void *)skb->data;
8685
8686                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
8687                                 eir_len = 5 + 18 + 18;
8688                                 h192 = NULL;
8689                                 r192 = NULL;
8690                         } else {
8691                                 eir_len = 5 + 18 + 18 + 18 + 18;
8692                                 h192 = rp->hash192;
8693                                 r192 = rp->rand192;
8694                         }
8695
8696                         h256 = rp->hash256;
8697                         r256 = rp->rand256;
8698                 }
8699         }
8700
8701         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
8702         if (!mgmt_rp)
8703                 goto done;
8704
8705         if (status)
8706                 goto send_rsp;
8707
8708         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
8709                                   hdev->dev_class, 3);
8710
8711         if (h192 && r192) {
8712                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8713                                           EIR_SSP_HASH_C192, h192, 16);
8714                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8715                                           EIR_SSP_RAND_R192, r192, 16);
8716         }
8717
8718         if (h256 && r256) {
8719                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8720                                           EIR_SSP_HASH_C256, h256, 16);
8721                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8722                                           EIR_SSP_RAND_R256, r256, 16);
8723         }
8724
8725 send_rsp:
8726         mgmt_rp->type = mgmt_cp->type;
8727         mgmt_rp->eir_len = cpu_to_le16(eir_len);
8728
8729         err = mgmt_cmd_complete(cmd->sk, hdev->id,
8730                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
8731                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
8732         if (err < 0 || status)
8733                 goto done;
8734
8735         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
8736
8737         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8738                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
8739                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
8740 done:
8741         kfree(mgmt_rp);
8742         mgmt_pending_remove(cmd);
8743 }
8744
8745 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
8746                                   struct mgmt_cp_read_local_oob_ext_data *cp)
8747 {
8748         struct mgmt_pending_cmd *cmd;
8749         struct hci_request req;
8750         int err;
8751
8752         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
8753                                cp, sizeof(*cp));
8754         if (!cmd)
8755                 return -ENOMEM;
8756
8757         hci_req_init(&req, hdev);
8758
8759         if (bredr_sc_enabled(hdev))
8760                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
8761         else
8762                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
8763
8764         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
8765         if (err < 0) {
8766                 mgmt_pending_remove(cmd);
8767                 return err;
8768         }
8769
8770         return 0;
8771 }
8772
8773 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
8774                                    void *data, u16 data_len)
8775 {
8776         struct mgmt_cp_read_local_oob_ext_data *cp = data;
8777         struct mgmt_rp_read_local_oob_ext_data *rp;
8778         size_t rp_len;
8779         u16 eir_len;
8780         u8 status, flags, role, addr[7], hash[16], rand[16];
8781         int err;
8782
8783         bt_dev_dbg(hdev, "sock %p", sk);
8784
8785         if (hdev_is_powered(hdev)) {
8786                 switch (cp->type) {
8787                 case BIT(BDADDR_BREDR):
8788                         status = mgmt_bredr_support(hdev);
8789                         if (status)
8790                                 eir_len = 0;
8791                         else
8792                                 eir_len = 5;
8793                         break;
8794                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8795                         status = mgmt_le_support(hdev);
8796                         if (status)
8797                                 eir_len = 0;
8798                         else
8799                                 eir_len = 9 + 3 + 18 + 18 + 3;
8800                         break;
8801                 default:
8802                         status = MGMT_STATUS_INVALID_PARAMS;
8803                         eir_len = 0;
8804                         break;
8805                 }
8806         } else {
8807                 status = MGMT_STATUS_NOT_POWERED;
8808                 eir_len = 0;
8809         }
8810
8811         rp_len = sizeof(*rp) + eir_len;
8812         rp = kmalloc(rp_len, GFP_ATOMIC);
8813         if (!rp)
8814                 return -ENOMEM;
8815
8816         if (status)
8817                 goto complete;
8818
8819         hci_dev_lock(hdev);
8820
8821         eir_len = 0;
8822         switch (cp->type) {
8823         case BIT(BDADDR_BREDR):
8824                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
8825                         err = read_local_ssp_oob_req(hdev, sk, cp);
8826                         hci_dev_unlock(hdev);
8827                         if (!err)
8828                                 goto done;
8829
8830                         status = MGMT_STATUS_FAILED;
8831                         goto complete;
8832                 } else {
8833                         eir_len = eir_append_data(rp->eir, eir_len,
8834                                                   EIR_CLASS_OF_DEV,
8835                                                   hdev->dev_class, 3);
8836                 }
8837                 break;
8838         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8839                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
8840                     smp_generate_oob(hdev, hash, rand) < 0) {
8841                         hci_dev_unlock(hdev);
8842                         status = MGMT_STATUS_FAILED;
8843                         goto complete;
8844                 }
8845
8846                 /* This should return the active RPA, but since the RPA
8847                  * is only programmed on demand, it is really hard to fill
8848                  * this in at the moment. For now disallow retrieving
8849                  * local out-of-band data when privacy is in use.
8850                  *
8851                  * Returning the identity address will not help here since
8852                  * pairing happens before the identity resolving key is
8853                  * known and thus the connection establishment happens
8854                  * based on the RPA and not the identity address.
8855                  */
8856                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
8857                         hci_dev_unlock(hdev);
8858                         status = MGMT_STATUS_REJECTED;
8859                         goto complete;
8860                 }
8861
8862                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
8863                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
8864                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
8865                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
8866                         memcpy(addr, &hdev->static_addr, 6);
8867                         addr[6] = 0x01;
8868                 } else {
8869                         memcpy(addr, &hdev->bdaddr, 6);
8870                         addr[6] = 0x00;
8871                 }
8872
8873                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
8874                                           addr, sizeof(addr));
8875
8876                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
8877                         role = 0x02;
8878                 else
8879                         role = 0x01;
8880
8881                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
8882                                           &role, sizeof(role));
8883
8884                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
8885                         eir_len = eir_append_data(rp->eir, eir_len,
8886                                                   EIR_LE_SC_CONFIRM,
8887                                                   hash, sizeof(hash));
8888
8889                         eir_len = eir_append_data(rp->eir, eir_len,
8890                                                   EIR_LE_SC_RANDOM,
8891                                                   rand, sizeof(rand));
8892                 }
8893
8894                 flags = mgmt_get_adv_discov_flags(hdev);
8895
8896                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
8897                         flags |= LE_AD_NO_BREDR;
8898
8899                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
8900                                           &flags, sizeof(flags));
8901                 break;
8902         }
8903
8904         hci_dev_unlock(hdev);
8905
8906         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
8907
8908         status = MGMT_STATUS_SUCCESS;
8909
8910 complete:
8911         rp->type = cp->type;
8912         rp->eir_len = cpu_to_le16(eir_len);
8913
8914         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
8915                                 status, rp, sizeof(*rp) + eir_len);
8916         if (err < 0 || status)
8917                 goto done;
8918
8919         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8920                                  rp, sizeof(*rp) + eir_len,
8921                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
8922
8923 done:
8924         kfree(rp);
8925
8926         return err;
8927 }
8928
8929 static u32 get_supported_adv_flags(struct hci_dev *hdev)
8930 {
8931         u32 flags = 0;
8932
8933         flags |= MGMT_ADV_FLAG_CONNECTABLE;
8934         flags |= MGMT_ADV_FLAG_DISCOV;
8935         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
8936         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
8937         flags |= MGMT_ADV_FLAG_APPEARANCE;
8938         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
8939
8940         /* In extended adv TX_POWER returned from Set Adv Param
8941          * will be always valid.
8942          */
8943         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
8944             ext_adv_capable(hdev))
8945                 flags |= MGMT_ADV_FLAG_TX_POWER;
8946
8947         if (ext_adv_capable(hdev)) {
8948                 flags |= MGMT_ADV_FLAG_SEC_1M;
8949                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
8950                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
8951
8952                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
8953                         flags |= MGMT_ADV_FLAG_SEC_2M;
8954
8955                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
8956                         flags |= MGMT_ADV_FLAG_SEC_CODED;
8957         }
8958
8959         return flags;
8960 }
8961
8962 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
8963                              void *data, u16 data_len)
8964 {
8965         struct mgmt_rp_read_adv_features *rp;
8966         size_t rp_len;
8967         int err;
8968         struct adv_info *adv_instance;
8969         u32 supported_flags;
8970         u8 *instance;
8971
8972         bt_dev_dbg(hdev, "sock %p", sk);
8973
8974         if (!lmp_le_capable(hdev))
8975                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8976                                        MGMT_STATUS_REJECTED);
8977
8978         /* Enabling the experimental LL Privay support disables support for
8979          * advertising.
8980          */
8981         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
8982                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
8983                                        MGMT_STATUS_NOT_SUPPORTED);
8984
8985         hci_dev_lock(hdev);
8986
8987         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
8988         rp = kmalloc(rp_len, GFP_ATOMIC);
8989         if (!rp) {
8990                 hci_dev_unlock(hdev);
8991                 return -ENOMEM;
8992         }
8993
8994         supported_flags = get_supported_adv_flags(hdev);
8995
8996         rp->supported_flags = cpu_to_le32(supported_flags);
8997         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
8998         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
8999         rp->max_instances = hdev->le_num_of_adv_sets;
9000         rp->num_instances = hdev->adv_instance_cnt;
9001
9002         instance = rp->instance;
9003         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
9004                 *instance = adv_instance->instance;
9005                 instance++;
9006         }
9007
9008         hci_dev_unlock(hdev);
9009
9010         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9011                                 MGMT_STATUS_SUCCESS, rp, rp_len);
9012
9013         kfree(rp);
9014
9015         return err;
9016 }
9017
9018 static u8 calculate_name_len(struct hci_dev *hdev)
9019 {
9020         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
9021
9022         return append_local_name(hdev, buf, 0);
9023 }
9024
9025 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
9026                            bool is_adv_data)
9027 {
9028         u8 max_len = HCI_MAX_AD_LENGTH;
9029
9030         if (is_adv_data) {
9031                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
9032                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
9033                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
9034                         max_len -= 3;
9035
9036                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
9037                         max_len -= 3;
9038         } else {
9039                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
9040                         max_len -= calculate_name_len(hdev);
9041
9042                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
9043                         max_len -= 4;
9044         }
9045
9046         return max_len;
9047 }
9048
9049 static bool flags_managed(u32 adv_flags)
9050 {
9051         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
9052                             MGMT_ADV_FLAG_LIMITED_DISCOV |
9053                             MGMT_ADV_FLAG_MANAGED_FLAGS);
9054 }
9055
9056 static bool tx_power_managed(u32 adv_flags)
9057 {
9058         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
9059 }
9060
9061 static bool name_managed(u32 adv_flags)
9062 {
9063         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
9064 }
9065
9066 static bool appearance_managed(u32 adv_flags)
9067 {
9068         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
9069 }
9070
9071 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
9072                               u8 len, bool is_adv_data)
9073 {
9074         int i, cur_len;
9075         u8 max_len;
9076
9077         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
9078
9079         if (len > max_len)
9080                 return false;
9081
9082         /* Make sure that the data is correctly formatted. */
9083         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
9084                 cur_len = data[i];
9085
9086                 if (!cur_len)
9087                         continue;
9088
9089                 if (data[i + 1] == EIR_FLAGS &&
9090                     (!is_adv_data || flags_managed(adv_flags)))
9091                         return false;
9092
9093                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
9094                         return false;
9095
9096                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
9097                         return false;
9098
9099                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
9100                         return false;
9101
9102                 if (data[i + 1] == EIR_APPEARANCE &&
9103                     appearance_managed(adv_flags))
9104                         return false;
9105
9106                 /* If the current field length would exceed the total data
9107                  * length, then it's invalid.
9108                  */
9109                 if (i + cur_len >= len)
9110                         return false;
9111         }
9112
9113         return true;
9114 }
9115
9116 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
9117                                      u16 opcode)
9118 {
9119         struct mgmt_pending_cmd *cmd;
9120         struct mgmt_cp_add_advertising *cp;
9121         struct mgmt_rp_add_advertising rp;
9122         struct adv_info *adv_instance, *n;
9123         u8 instance;
9124
9125         bt_dev_dbg(hdev, "status %d", status);
9126
9127         hci_dev_lock(hdev);
9128
9129         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
9130
9131         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
9132                 if (!adv_instance->pending)
9133                         continue;
9134
9135                 if (!status) {
9136                         adv_instance->pending = false;
9137                         continue;
9138                 }
9139
9140                 instance = adv_instance->instance;
9141
9142                 if (hdev->cur_adv_instance == instance)
9143                         cancel_adv_timeout(hdev);
9144
9145                 hci_remove_adv_instance(hdev, instance);
9146                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
9147         }
9148
9149         if (!cmd)
9150                 goto unlock;
9151
9152         cp = cmd->param;
9153         rp.instance = cp->instance;
9154
9155         if (status)
9156                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9157                                 mgmt_status(status));
9158         else
9159                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9160                                   mgmt_status(status), &rp, sizeof(rp));
9161
9162         mgmt_pending_remove(cmd);
9163
9164 unlock:
9165         hci_dev_unlock(hdev);
9166 }
9167
9168 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
9169                            void *data, u16 data_len)
9170 {
9171         struct mgmt_cp_add_advertising *cp = data;
9172         struct mgmt_rp_add_advertising rp;
9173         u32 flags;
9174         u32 supported_flags, phy_flags;
9175         u8 status;
9176         u16 timeout, duration;
9177         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
9178         u8 schedule_instance = 0;
9179         struct adv_info *next_instance;
9180         int err;
9181         struct mgmt_pending_cmd *cmd;
9182         struct hci_request req;
9183
9184         bt_dev_dbg(hdev, "sock %p", sk);
9185
9186         status = mgmt_le_support(hdev);
9187         if (status)
9188                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9189                                        status);
9190
9191         /* Enabling the experimental LL Privay support disables support for
9192          * advertising.
9193          */
9194         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
9195                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9196                                        MGMT_STATUS_NOT_SUPPORTED);
9197
9198         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9199                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9200                                        MGMT_STATUS_INVALID_PARAMS);
9201
9202         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
9203                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9204                                        MGMT_STATUS_INVALID_PARAMS);
9205
9206         flags = __le32_to_cpu(cp->flags);
9207         timeout = __le16_to_cpu(cp->timeout);
9208         duration = __le16_to_cpu(cp->duration);
9209
9210         /* The current implementation only supports a subset of the specified
9211          * flags. Also need to check mutual exclusiveness of sec flags.
9212          */
9213         supported_flags = get_supported_adv_flags(hdev);
9214         phy_flags = flags & MGMT_ADV_FLAG_SEC_MASK;
9215         if (flags & ~supported_flags ||
9216             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
9217                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9218                                        MGMT_STATUS_INVALID_PARAMS);
9219
9220         hci_dev_lock(hdev);
9221
9222         if (timeout && !hdev_is_powered(hdev)) {
9223                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9224                                       MGMT_STATUS_REJECTED);
9225                 goto unlock;
9226         }
9227
9228         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
9229             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
9230             pending_find(MGMT_OP_SET_LE, hdev)) {
9231                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9232                                       MGMT_STATUS_BUSY);
9233                 goto unlock;
9234         }
9235
9236         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
9237             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
9238                                cp->scan_rsp_len, false)) {
9239                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9240                                       MGMT_STATUS_INVALID_PARAMS);
9241                 goto unlock;
9242         }
9243
9244         err = hci_add_adv_instance(hdev, cp->instance, flags,
9245                                    cp->adv_data_len, cp->data,
9246                                    cp->scan_rsp_len,
9247                                    cp->data + cp->adv_data_len,
9248                                    timeout, duration);
9249         if (err < 0) {
9250                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9251                                       MGMT_STATUS_FAILED);
9252                 goto unlock;
9253         }
9254
9255         /* Only trigger an advertising added event if a new instance was
9256          * actually added.
9257          */
9258         if (hdev->adv_instance_cnt > prev_instance_cnt)
9259                 mgmt_advertising_added(sk, hdev, cp->instance);
9260
9261         if (hdev->cur_adv_instance == cp->instance) {
9262                 /* If the currently advertised instance is being changed then
9263                  * cancel the current advertising and schedule the next
9264                  * instance. If there is only one instance then the overridden
9265                  * advertising data will be visible right away.
9266                  */
9267                 cancel_adv_timeout(hdev);
9268
9269                 next_instance = hci_get_next_instance(hdev, cp->instance);
9270                 if (next_instance)
9271                         schedule_instance = next_instance->instance;
9272         } else if (!hdev->adv_instance_timeout) {
9273                 /* Immediately advertise the new instance if no other
9274                  * instance is currently being advertised.
9275                  */
9276                 schedule_instance = cp->instance;
9277         }
9278
9279         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
9280          * there is no instance to be advertised then we have no HCI
9281          * communication to make. Simply return.
9282          */
9283         if (!hdev_is_powered(hdev) ||
9284             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
9285             !schedule_instance) {
9286                 rp.instance = cp->instance;
9287                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9288                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9289                 goto unlock;
9290         }
9291
9292         /* We're good to go, update advertising data, parameters, and start
9293          * advertising.
9294          */
9295         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
9296                                data_len);
9297         if (!cmd) {
9298                 err = -ENOMEM;
9299                 goto unlock;
9300         }
9301
9302         hci_req_init(&req, hdev);
9303
9304         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
9305
9306         if (!err)
9307                 err = hci_req_run(&req, add_advertising_complete);
9308
9309         if (err < 0) {
9310                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9311                                       MGMT_STATUS_FAILED);
9312                 mgmt_pending_remove(cmd);
9313         }
9314
9315 unlock:
9316         hci_dev_unlock(hdev);
9317
9318         return err;
9319 }
9320
9321 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
9322                                         u16 opcode)
9323 {
9324         struct mgmt_pending_cmd *cmd;
9325         struct mgmt_cp_remove_advertising *cp;
9326         struct mgmt_rp_remove_advertising rp;
9327
9328         bt_dev_dbg(hdev, "status %d", status);
9329
9330         hci_dev_lock(hdev);
9331
9332         /* A failure status here only means that we failed to disable
9333          * advertising. Otherwise, the advertising instance has been removed,
9334          * so report success.
9335          */
9336         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
9337         if (!cmd)
9338                 goto unlock;
9339
9340         cp = cmd->param;
9341         rp.instance = cp->instance;
9342
9343         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
9344                           &rp, sizeof(rp));
9345         mgmt_pending_remove(cmd);
9346
9347 unlock:
9348         hci_dev_unlock(hdev);
9349 }
9350
9351 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
9352                               void *data, u16 data_len)
9353 {
9354         struct mgmt_cp_remove_advertising *cp = data;
9355         struct mgmt_rp_remove_advertising rp;
9356         struct mgmt_pending_cmd *cmd;
9357         struct hci_request req;
9358         int err;
9359
9360         bt_dev_dbg(hdev, "sock %p", sk);
9361
9362         /* Enabling the experimental LL Privay support disables support for
9363          * advertising.
9364          */
9365         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
9366                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
9367                                        MGMT_STATUS_NOT_SUPPORTED);
9368
9369         hci_dev_lock(hdev);
9370
9371         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
9372                 err = mgmt_cmd_status(sk, hdev->id,
9373                                       MGMT_OP_REMOVE_ADVERTISING,
9374                                       MGMT_STATUS_INVALID_PARAMS);
9375                 goto unlock;
9376         }
9377
9378         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
9379             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
9380             pending_find(MGMT_OP_SET_LE, hdev)) {
9381                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9382                                       MGMT_STATUS_BUSY);
9383                 goto unlock;
9384         }
9385
9386         if (list_empty(&hdev->adv_instances)) {
9387                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9388                                       MGMT_STATUS_INVALID_PARAMS);
9389                 goto unlock;
9390         }
9391
9392         hci_req_init(&req, hdev);
9393
9394         /* If we use extended advertising, instance is disabled and removed */
9395         if (ext_adv_capable(hdev)) {
9396                 __hci_req_disable_ext_adv_instance(&req, cp->instance);
9397                 __hci_req_remove_ext_adv_instance(&req, cp->instance);
9398         }
9399
9400         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
9401
9402         if (list_empty(&hdev->adv_instances))
9403                 __hci_req_disable_advertising(&req);
9404
9405         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
9406          * flag is set or the device isn't powered then we have no HCI
9407          * communication to make. Simply return.
9408          */
9409         if (skb_queue_empty(&req.cmd_q) ||
9410             !hdev_is_powered(hdev) ||
9411             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
9412                 hci_req_purge(&req);
9413                 rp.instance = cp->instance;
9414                 err = mgmt_cmd_complete(sk, hdev->id,
9415                                         MGMT_OP_REMOVE_ADVERTISING,
9416                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9417                 goto unlock;
9418         }
9419
9420         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
9421                                data_len);
9422         if (!cmd) {
9423                 err = -ENOMEM;
9424                 goto unlock;
9425         }
9426
9427         err = hci_req_run(&req, remove_advertising_complete);
9428         if (err < 0)
9429                 mgmt_pending_remove(cmd);
9430
9431 unlock:
9432         hci_dev_unlock(hdev);
9433
9434         return err;
9435 }
9436
9437 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
9438                              void *data, u16 data_len)
9439 {
9440         struct mgmt_cp_get_adv_size_info *cp = data;
9441         struct mgmt_rp_get_adv_size_info rp;
9442         u32 flags, supported_flags;
9443         int err;
9444
9445         bt_dev_dbg(hdev, "sock %p", sk);
9446
9447         if (!lmp_le_capable(hdev))
9448                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9449                                        MGMT_STATUS_REJECTED);
9450
9451         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9452                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9453                                        MGMT_STATUS_INVALID_PARAMS);
9454
9455         flags = __le32_to_cpu(cp->flags);
9456
9457         /* The current implementation only supports a subset of the specified
9458          * flags.
9459          */
9460         supported_flags = get_supported_adv_flags(hdev);
9461         if (flags & ~supported_flags)
9462                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9463                                        MGMT_STATUS_INVALID_PARAMS);
9464
9465         rp.instance = cp->instance;
9466         rp.flags = cp->flags;
9467         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9468         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9469
9470         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9471                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9472
9473         return err;
9474 }
9475
9476 static const struct hci_mgmt_handler mgmt_handlers[] = {
9477         { NULL }, /* 0x0000 (no command) */
9478         { read_version,            MGMT_READ_VERSION_SIZE,
9479                                                 HCI_MGMT_NO_HDEV |
9480                                                 HCI_MGMT_UNTRUSTED },
9481         { read_commands,           MGMT_READ_COMMANDS_SIZE,
9482                                                 HCI_MGMT_NO_HDEV |
9483                                                 HCI_MGMT_UNTRUSTED },
9484         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
9485                                                 HCI_MGMT_NO_HDEV |
9486                                                 HCI_MGMT_UNTRUSTED },
9487         { read_controller_info,    MGMT_READ_INFO_SIZE,
9488                                                 HCI_MGMT_UNTRUSTED },
9489         { set_powered,             MGMT_SETTING_SIZE },
9490         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
9491         { set_connectable,         MGMT_SETTING_SIZE },
9492         { set_fast_connectable,    MGMT_SETTING_SIZE },
9493         { set_bondable,            MGMT_SETTING_SIZE },
9494         { set_link_security,       MGMT_SETTING_SIZE },
9495         { set_ssp,                 MGMT_SETTING_SIZE },
9496         { set_hs,                  MGMT_SETTING_SIZE },
9497         { set_le,                  MGMT_SETTING_SIZE },
9498         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
9499         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
9500         { add_uuid,                MGMT_ADD_UUID_SIZE },
9501         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
9502         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
9503                                                 HCI_MGMT_VAR_LEN },
9504         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
9505                                                 HCI_MGMT_VAR_LEN },
9506         { disconnect,              MGMT_DISCONNECT_SIZE },
9507         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
9508         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
9509         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
9510         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
9511         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
9512         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
9513         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
9514         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
9515         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
9516         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
9517         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
9518         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
9519         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
9520                                                 HCI_MGMT_VAR_LEN },
9521         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
9522         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
9523         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
9524         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
9525         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
9526         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
9527         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
9528         { set_advertising,         MGMT_SETTING_SIZE },
9529         { set_bredr,               MGMT_SETTING_SIZE },
9530         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
9531         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
9532         { set_secure_conn,         MGMT_SETTING_SIZE },
9533         { set_debug_keys,          MGMT_SETTING_SIZE },
9534         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
9535         { load_irks,               MGMT_LOAD_IRKS_SIZE,
9536                                                 HCI_MGMT_VAR_LEN },
9537         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
9538         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
9539         { add_device,              MGMT_ADD_DEVICE_SIZE },
9540         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
9541         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
9542                                                 HCI_MGMT_VAR_LEN },
9543         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
9544                                                 HCI_MGMT_NO_HDEV |
9545                                                 HCI_MGMT_UNTRUSTED },
9546         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
9547                                                 HCI_MGMT_UNCONFIGURED |
9548                                                 HCI_MGMT_UNTRUSTED },
9549         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
9550                                                 HCI_MGMT_UNCONFIGURED },
9551         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
9552                                                 HCI_MGMT_UNCONFIGURED },
9553         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
9554                                                 HCI_MGMT_VAR_LEN },
9555         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
9556         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
9557                                                 HCI_MGMT_NO_HDEV |
9558                                                 HCI_MGMT_UNTRUSTED },
9559         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
9560         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
9561                                                 HCI_MGMT_VAR_LEN },
9562         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
9563         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
9564         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
9565         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
9566                                                 HCI_MGMT_UNTRUSTED },
9567         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
9568         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
9569         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
9570         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
9571                                                 HCI_MGMT_VAR_LEN },
9572         { set_wideband_speech,     MGMT_SETTING_SIZE },
9573         { read_security_info,      MGMT_READ_SECURITY_INFO_SIZE,
9574                                                 HCI_MGMT_UNTRUSTED },
9575         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
9576                                                 HCI_MGMT_UNTRUSTED |
9577                                                 HCI_MGMT_HDEV_OPTIONAL },
9578         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
9579                                                 HCI_MGMT_VAR_LEN |
9580                                                 HCI_MGMT_HDEV_OPTIONAL },
9581         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
9582                                                 HCI_MGMT_UNTRUSTED },
9583         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
9584                                                 HCI_MGMT_VAR_LEN },
9585         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
9586                                                 HCI_MGMT_UNTRUSTED },
9587         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
9588                                                 HCI_MGMT_VAR_LEN },
9589         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
9590         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
9591         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
9592         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
9593                                                 HCI_MGMT_VAR_LEN },
9594         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
9595 };
9596
9597 #ifdef TIZEN_BT
9598 static const struct hci_mgmt_handler tizen_mgmt_handlers[] = {
9599         { NULL }, /* 0x0000 (no command) */
9600         { set_advertising_params,  MGMT_SET_ADVERTISING_PARAMS_SIZE },
9601         { set_advertising_data,    MGMT_SET_ADV_MIN_APP_DATA_SIZE,
9602                                                 HCI_MGMT_VAR_LEN },
9603         { set_scan_rsp_data,       MGMT_SET_SCAN_RSP_MIN_APP_DATA_SIZE,
9604                                                 HCI_MGMT_VAR_LEN },
9605         { add_white_list,          MGMT_ADD_DEV_WHITE_LIST_SIZE },
9606         { remove_from_white_list,  MGMT_REMOVE_DEV_FROM_WHITE_LIST_SIZE },
9607         { clear_white_list,        MGMT_OP_CLEAR_DEV_WHITE_LIST_SIZE },
9608         { set_enable_rssi,         MGMT_SET_RSSI_ENABLE_SIZE },
9609         { get_raw_rssi,            MGMT_GET_RAW_RSSI_SIZE },
9610         { set_disable_threshold,   MGMT_SET_RSSI_DISABLE_SIZE },
9611         { start_le_discovery,      MGMT_START_LE_DISCOVERY_SIZE },
9612         { stop_le_discovery,       MGMT_STOP_LE_DISCOVERY_SIZE },
9613         { disable_le_auto_connect, MGMT_DISABLE_LE_AUTO_CONNECT_SIZE },
9614         { le_conn_update,          MGMT_LE_CONN_UPDATE_SIZE },
9615         { set_manufacturer_data,   MGMT_SET_MANUFACTURER_DATA_SIZE },
9616         { le_set_scan_params,      MGMT_LE_SET_SCAN_PARAMS_SIZE },
9617 };
9618 #endif
9619
9620 void mgmt_index_added(struct hci_dev *hdev)
9621 {
9622         struct mgmt_ev_ext_index ev;
9623
9624         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
9625                 return;
9626
9627         switch (hdev->dev_type) {
9628         case HCI_PRIMARY:
9629                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9630                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
9631                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
9632                         ev.type = 0x01;
9633                 } else {
9634                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
9635                                          HCI_MGMT_INDEX_EVENTS);
9636                         ev.type = 0x00;
9637                 }
9638                 break;
9639         case HCI_AMP:
9640                 ev.type = 0x02;
9641                 break;
9642         default:
9643                 return;
9644         }
9645
9646         ev.bus = hdev->bus;
9647
9648         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
9649                          HCI_MGMT_EXT_INDEX_EVENTS);
9650 }
9651
9652 void mgmt_index_removed(struct hci_dev *hdev)
9653 {
9654         struct mgmt_ev_ext_index ev;
9655         u8 status = MGMT_STATUS_INVALID_INDEX;
9656
9657         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
9658                 return;
9659
9660         switch (hdev->dev_type) {
9661         case HCI_PRIMARY:
9662                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
9663
9664                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9665                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
9666                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
9667                         ev.type = 0x01;
9668                 } else {
9669                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
9670                                          HCI_MGMT_INDEX_EVENTS);
9671                         ev.type = 0x00;
9672                 }
9673                 break;
9674         case HCI_AMP:
9675                 ev.type = 0x02;
9676                 break;
9677         default:
9678                 return;
9679         }
9680
9681         ev.bus = hdev->bus;
9682
9683         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
9684                          HCI_MGMT_EXT_INDEX_EVENTS);
9685 }
9686
9687 /* This function requires the caller holds hdev->lock */
9688 static void restart_le_actions(struct hci_dev *hdev)
9689 {
9690         struct hci_conn_params *p;
9691
9692         list_for_each_entry(p, &hdev->le_conn_params, list) {
9693                 /* Needed for AUTO_OFF case where might not "really"
9694                  * have been powered off.
9695                  */
9696                 list_del_init(&p->action);
9697
9698                 switch (p->auto_connect) {
9699                 case HCI_AUTO_CONN_DIRECT:
9700                 case HCI_AUTO_CONN_ALWAYS:
9701                         list_add(&p->action, &hdev->pend_le_conns);
9702                         break;
9703                 case HCI_AUTO_CONN_REPORT:
9704                         list_add(&p->action, &hdev->pend_le_reports);
9705                         break;
9706                 default:
9707                         break;
9708                 }
9709         }
9710 }
9711
9712 void mgmt_power_on(struct hci_dev *hdev, int err)
9713 {
9714         struct cmd_lookup match = { NULL, hdev };
9715
9716         bt_dev_dbg(hdev, "err %d", err);
9717
9718         hci_dev_lock(hdev);
9719
9720         if (!err) {
9721                 restart_le_actions(hdev);
9722                 hci_update_background_scan(hdev);
9723         }
9724
9725         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9726
9727         new_settings(hdev, match.sk);
9728
9729         if (match.sk)
9730                 sock_put(match.sk);
9731
9732         hci_dev_unlock(hdev);
9733 }
9734
9735 void __mgmt_power_off(struct hci_dev *hdev)
9736 {
9737         struct cmd_lookup match = { NULL, hdev };
9738         u8 status, zero_cod[] = { 0, 0, 0 };
9739
9740         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9741
9742         /* If the power off is because of hdev unregistration let
9743          * use the appropriate INVALID_INDEX status. Otherwise use
9744          * NOT_POWERED. We cover both scenarios here since later in
9745          * mgmt_index_removed() any hci_conn callbacks will have already
9746          * been triggered, potentially causing misleading DISCONNECTED
9747          * status responses.
9748          */
9749         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
9750                 status = MGMT_STATUS_INVALID_INDEX;
9751         else
9752                 status = MGMT_STATUS_NOT_POWERED;
9753
9754         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
9755
9756         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
9757                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
9758                                    zero_cod, sizeof(zero_cod),
9759                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
9760                 ext_info_changed(hdev, NULL);
9761         }
9762
9763         new_settings(hdev, match.sk);
9764
9765         if (match.sk)
9766                 sock_put(match.sk);
9767 }
9768
9769 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
9770 {
9771         struct mgmt_pending_cmd *cmd;
9772         u8 status;
9773
9774         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
9775         if (!cmd)
9776                 return;
9777
9778         if (err == -ERFKILL)
9779                 status = MGMT_STATUS_RFKILLED;
9780         else
9781                 status = MGMT_STATUS_FAILED;
9782
9783         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
9784
9785         mgmt_pending_remove(cmd);
9786 }
9787
9788 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
9789                        bool persistent)
9790 {
9791         struct mgmt_ev_new_link_key ev;
9792
9793         memset(&ev, 0, sizeof(ev));
9794
9795         ev.store_hint = persistent;
9796         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9797         ev.key.addr.type = BDADDR_BREDR;
9798         ev.key.type = key->type;
9799         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
9800         ev.key.pin_len = key->pin_len;
9801
9802         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
9803 }
9804
9805 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
9806 {
9807         switch (ltk->type) {
9808         case SMP_LTK:
9809         case SMP_LTK_SLAVE:
9810                 if (ltk->authenticated)
9811                         return MGMT_LTK_AUTHENTICATED;
9812                 return MGMT_LTK_UNAUTHENTICATED;
9813         case SMP_LTK_P256:
9814                 if (ltk->authenticated)
9815                         return MGMT_LTK_P256_AUTH;
9816                 return MGMT_LTK_P256_UNAUTH;
9817         case SMP_LTK_P256_DEBUG:
9818                 return MGMT_LTK_P256_DEBUG;
9819         }
9820
9821         return MGMT_LTK_UNAUTHENTICATED;
9822 }
9823
9824 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
9825 {
9826         struct mgmt_ev_new_long_term_key ev;
9827
9828         memset(&ev, 0, sizeof(ev));
9829
9830         /* Devices using resolvable or non-resolvable random addresses
9831          * without providing an identity resolving key don't require
9832          * to store long term keys. Their addresses will change the
9833          * next time around.
9834          *
9835          * Only when a remote device provides an identity address
9836          * make sure the long term key is stored. If the remote
9837          * identity is known, the long term keys are internally
9838          * mapped to the identity address. So allow static random
9839          * and public addresses here.
9840          */
9841         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9842             (key->bdaddr.b[5] & 0xc0) != 0xc0)
9843                 ev.store_hint = 0x00;
9844         else
9845                 ev.store_hint = persistent;
9846
9847         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9848         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
9849         ev.key.type = mgmt_ltk_type(key);
9850         ev.key.enc_size = key->enc_size;
9851         ev.key.ediv = key->ediv;
9852         ev.key.rand = key->rand;
9853
9854         if (key->type == SMP_LTK)
9855                 ev.key.master = 1;
9856
9857         /* Make sure we copy only the significant bytes based on the
9858          * encryption key size, and set the rest of the value to zeroes.
9859          */
9860         memcpy(ev.key.val, key->val, key->enc_size);
9861         memset(ev.key.val + key->enc_size, 0,
9862                sizeof(ev.key.val) - key->enc_size);
9863
9864         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
9865 }
9866
9867 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
9868 {
9869         struct mgmt_ev_new_irk ev;
9870
9871         memset(&ev, 0, sizeof(ev));
9872
9873         ev.store_hint = persistent;
9874
9875         bacpy(&ev.rpa, &irk->rpa);
9876         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
9877         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
9878         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
9879
9880         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
9881 }
9882
9883 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
9884                    bool persistent)
9885 {
9886         struct mgmt_ev_new_csrk ev;
9887
9888         memset(&ev, 0, sizeof(ev));
9889
9890         /* Devices using resolvable or non-resolvable random addresses
9891          * without providing an identity resolving key don't require
9892          * to store signature resolving keys. Their addresses will change
9893          * the next time around.
9894          *
9895          * Only when a remote device provides an identity address
9896          * make sure the signature resolving key is stored. So allow
9897          * static random and public addresses here.
9898          */
9899         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9900             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
9901                 ev.store_hint = 0x00;
9902         else
9903                 ev.store_hint = persistent;
9904
9905         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
9906         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
9907         ev.key.type = csrk->type;
9908         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
9909
9910         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
9911 }
9912
9913 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
9914                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
9915                          u16 max_interval, u16 latency, u16 timeout)
9916 {
9917         struct mgmt_ev_new_conn_param ev;
9918
9919         if (!hci_is_identity_address(bdaddr, bdaddr_type))
9920                 return;
9921
9922         memset(&ev, 0, sizeof(ev));
9923         bacpy(&ev.addr.bdaddr, bdaddr);
9924         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
9925         ev.store_hint = store_hint;
9926         ev.min_interval = cpu_to_le16(min_interval);
9927         ev.max_interval = cpu_to_le16(max_interval);
9928         ev.latency = cpu_to_le16(latency);
9929         ev.timeout = cpu_to_le16(timeout);
9930
9931         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
9932 }
9933
9934 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
9935                            u32 flags, u8 *name, u8 name_len)
9936 {
9937         char buf[512];
9938         struct mgmt_ev_device_connected *ev = (void *) buf;
9939         u16 eir_len = 0;
9940
9941         bacpy(&ev->addr.bdaddr, &conn->dst);
9942         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9943
9944         ev->flags = __cpu_to_le32(flags);
9945
9946         /* We must ensure that the EIR Data fields are ordered and
9947          * unique. Keep it simple for now and avoid the problem by not
9948          * adding any BR/EDR data to the LE adv.
9949          */
9950         if (conn->le_adv_data_len > 0) {
9951                 memcpy(&ev->eir[eir_len],
9952                        conn->le_adv_data, conn->le_adv_data_len);
9953                 eir_len = conn->le_adv_data_len;
9954         } else {
9955                 if (name_len > 0)
9956                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
9957                                                   name, name_len);
9958
9959                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
9960                         eir_len = eir_append_data(ev->eir, eir_len,
9961                                                   EIR_CLASS_OF_DEV,
9962                                                   conn->dev_class, 3);
9963         }
9964
9965         ev->eir_len = cpu_to_le16(eir_len);
9966
9967         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
9968                     sizeof(*ev) + eir_len, NULL);
9969 }
9970
9971 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
9972 {
9973         struct sock **sk = data;
9974
9975         cmd->cmd_complete(cmd, 0);
9976
9977         *sk = cmd->sk;
9978         sock_hold(*sk);
9979
9980         mgmt_pending_remove(cmd);
9981 }
9982
9983 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
9984 {
9985         struct hci_dev *hdev = data;
9986         struct mgmt_cp_unpair_device *cp = cmd->param;
9987
9988         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
9989
9990         cmd->cmd_complete(cmd, 0);
9991         mgmt_pending_remove(cmd);
9992 }
9993
9994 bool mgmt_powering_down(struct hci_dev *hdev)
9995 {
9996         struct mgmt_pending_cmd *cmd;
9997         struct mgmt_mode *cp;
9998
9999         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
10000         if (!cmd)
10001                 return false;
10002
10003         cp = cmd->param;
10004         if (!cp->val)
10005                 return true;
10006
10007         return false;
10008 }
10009
10010 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
10011                               u8 link_type, u8 addr_type, u8 reason,
10012                               bool mgmt_connected)
10013 {
10014         struct mgmt_ev_device_disconnected ev;
10015         struct sock *sk = NULL;
10016
10017         /* The connection is still in hci_conn_hash so test for 1
10018          * instead of 0 to know if this is the last one.
10019          */
10020         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
10021                 cancel_delayed_work(&hdev->power_off);
10022                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
10023         }
10024
10025         if (!mgmt_connected)
10026                 return;
10027
10028         if (link_type != ACL_LINK && link_type != LE_LINK)
10029                 return;
10030
10031         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
10032
10033         bacpy(&ev.addr.bdaddr, bdaddr);
10034         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10035         ev.reason = reason;
10036
10037         /* Report disconnects due to suspend */
10038         if (hdev->suspended)
10039                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
10040
10041         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
10042
10043         if (sk)
10044                 sock_put(sk);
10045
10046         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
10047                              hdev);
10048 }
10049
10050 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
10051                             u8 link_type, u8 addr_type, u8 status)
10052 {
10053         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
10054         struct mgmt_cp_disconnect *cp;
10055         struct mgmt_pending_cmd *cmd;
10056
10057         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
10058                              hdev);
10059
10060         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
10061         if (!cmd)
10062                 return;
10063
10064         cp = cmd->param;
10065
10066         if (bacmp(bdaddr, &cp->addr.bdaddr))
10067                 return;
10068
10069         if (cp->addr.type != bdaddr_type)
10070                 return;
10071
10072         cmd->cmd_complete(cmd, mgmt_status(status));
10073         mgmt_pending_remove(cmd);
10074 }
10075
10076 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10077                          u8 addr_type, u8 status)
10078 {
10079         struct mgmt_ev_connect_failed ev;
10080
10081         /* The connection is still in hci_conn_hash so test for 1
10082          * instead of 0 to know if this is the last one.
10083          */
10084         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
10085                 cancel_delayed_work(&hdev->power_off);
10086                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
10087         }
10088
10089         bacpy(&ev.addr.bdaddr, bdaddr);
10090         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10091         ev.status = mgmt_status(status);
10092
10093         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
10094 }
10095
10096 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
10097 {
10098         struct mgmt_ev_pin_code_request ev;
10099
10100         bacpy(&ev.addr.bdaddr, bdaddr);
10101         ev.addr.type = BDADDR_BREDR;
10102         ev.secure = secure;
10103
10104         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
10105 }
10106
10107 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10108                                   u8 status)
10109 {
10110         struct mgmt_pending_cmd *cmd;
10111
10112         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
10113         if (!cmd)
10114                 return;
10115
10116         cmd->cmd_complete(cmd, mgmt_status(status));
10117         mgmt_pending_remove(cmd);
10118 }
10119
10120 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10121                                       u8 status)
10122 {
10123         struct mgmt_pending_cmd *cmd;
10124
10125         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
10126         if (!cmd)
10127                 return;
10128
10129         cmd->cmd_complete(cmd, mgmt_status(status));
10130         mgmt_pending_remove(cmd);
10131 }
10132
10133 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
10134                               u8 link_type, u8 addr_type, u32 value,
10135                               u8 confirm_hint)
10136 {
10137         struct mgmt_ev_user_confirm_request ev;
10138
10139         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10140
10141         bacpy(&ev.addr.bdaddr, bdaddr);
10142         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10143         ev.confirm_hint = confirm_hint;
10144         ev.value = cpu_to_le32(value);
10145
10146         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
10147                           NULL);
10148 }
10149
10150 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
10151                               u8 link_type, u8 addr_type)
10152 {
10153         struct mgmt_ev_user_passkey_request ev;
10154
10155         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10156
10157         bacpy(&ev.addr.bdaddr, bdaddr);
10158         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10159
10160         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
10161                           NULL);
10162 }
10163
10164 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10165                                       u8 link_type, u8 addr_type, u8 status,
10166                                       u8 opcode)
10167 {
10168         struct mgmt_pending_cmd *cmd;
10169
10170         cmd = pending_find(opcode, hdev);
10171         if (!cmd)
10172                 return -ENOENT;
10173
10174         cmd->cmd_complete(cmd, mgmt_status(status));
10175         mgmt_pending_remove(cmd);
10176
10177         return 0;
10178 }
10179
10180 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10181                                      u8 link_type, u8 addr_type, u8 status)
10182 {
10183         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10184                                           status, MGMT_OP_USER_CONFIRM_REPLY);
10185 }
10186
10187 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10188                                          u8 link_type, u8 addr_type, u8 status)
10189 {
10190         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10191                                           status,
10192                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
10193 }
10194
10195 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10196                                      u8 link_type, u8 addr_type, u8 status)
10197 {
10198         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10199                                           status, MGMT_OP_USER_PASSKEY_REPLY);
10200 }
10201
10202 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10203                                          u8 link_type, u8 addr_type, u8 status)
10204 {
10205         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10206                                           status,
10207                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
10208 }
10209
10210 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
10211                              u8 link_type, u8 addr_type, u32 passkey,
10212                              u8 entered)
10213 {
10214         struct mgmt_ev_passkey_notify ev;
10215
10216         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10217
10218         bacpy(&ev.addr.bdaddr, bdaddr);
10219         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10220         ev.passkey = __cpu_to_le32(passkey);
10221         ev.entered = entered;
10222
10223         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
10224 }
10225
10226 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
10227 {
10228         struct mgmt_ev_auth_failed ev;
10229         struct mgmt_pending_cmd *cmd;
10230         u8 status = mgmt_status(hci_status);
10231
10232         bacpy(&ev.addr.bdaddr, &conn->dst);
10233         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10234         ev.status = status;
10235
10236         cmd = find_pairing(conn);
10237
10238         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
10239                     cmd ? cmd->sk : NULL);
10240
10241         if (cmd) {
10242                 cmd->cmd_complete(cmd, status);
10243                 mgmt_pending_remove(cmd);
10244         }
10245 }
10246
10247 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
10248 {
10249         struct cmd_lookup match = { NULL, hdev };
10250         bool changed;
10251
10252         if (status) {
10253                 u8 mgmt_err = mgmt_status(status);
10254                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
10255                                      cmd_status_rsp, &mgmt_err);
10256                 return;
10257         }
10258
10259         if (test_bit(HCI_AUTH, &hdev->flags))
10260                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
10261         else
10262                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
10263
10264         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
10265                              &match);
10266
10267         if (changed)
10268                 new_settings(hdev, match.sk);
10269
10270         if (match.sk)
10271                 sock_put(match.sk);
10272 }
10273
10274 static void clear_eir(struct hci_request *req)
10275 {
10276         struct hci_dev *hdev = req->hdev;
10277         struct hci_cp_write_eir cp;
10278
10279         if (!lmp_ext_inq_capable(hdev))
10280                 return;
10281
10282         memset(hdev->eir, 0, sizeof(hdev->eir));
10283
10284         memset(&cp, 0, sizeof(cp));
10285
10286         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
10287 }
10288
10289 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
10290 {
10291         struct cmd_lookup match = { NULL, hdev };
10292         struct hci_request req;
10293         bool changed = false;
10294
10295         if (status) {
10296                 u8 mgmt_err = mgmt_status(status);
10297
10298                 if (enable && hci_dev_test_and_clear_flag(hdev,
10299                                                           HCI_SSP_ENABLED)) {
10300                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
10301                         new_settings(hdev, NULL);
10302                 }
10303
10304                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
10305                                      &mgmt_err);
10306                 return;
10307         }
10308
10309         if (enable) {
10310                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
10311         } else {
10312                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
10313                 if (!changed)
10314                         changed = hci_dev_test_and_clear_flag(hdev,
10315                                                               HCI_HS_ENABLED);
10316                 else
10317                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
10318         }
10319
10320         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
10321
10322         if (changed)
10323                 new_settings(hdev, match.sk);
10324
10325         if (match.sk)
10326                 sock_put(match.sk);
10327
10328         hci_req_init(&req, hdev);
10329
10330         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
10331                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
10332                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
10333                                     sizeof(enable), &enable);
10334                 __hci_req_update_eir(&req);
10335         } else {
10336                 clear_eir(&req);
10337         }
10338
10339         hci_req_run(&req, NULL);
10340 }
10341
10342 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
10343 {
10344         struct cmd_lookup *match = data;
10345
10346         if (match->sk == NULL) {
10347                 match->sk = cmd->sk;
10348                 sock_hold(match->sk);
10349         }
10350 }
10351
10352 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
10353                                     u8 status)
10354 {
10355         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
10356
10357         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
10358         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
10359         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
10360
10361         if (!status) {
10362                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
10363                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
10364                 ext_info_changed(hdev, NULL);
10365         }
10366
10367         if (match.sk)
10368                 sock_put(match.sk);
10369 }
10370
10371 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
10372 {
10373         struct mgmt_cp_set_local_name ev;
10374         struct mgmt_pending_cmd *cmd;
10375
10376         if (status)
10377                 return;
10378
10379         memset(&ev, 0, sizeof(ev));
10380         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
10381         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
10382
10383         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
10384         if (!cmd) {
10385                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
10386
10387                 /* If this is a HCI command related to powering on the
10388                  * HCI dev don't send any mgmt signals.
10389                  */
10390                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
10391                         return;
10392         }
10393
10394         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
10395                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
10396         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
10397 }
10398
10399 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
10400 {
10401         int i;
10402
10403         for (i = 0; i < uuid_count; i++) {
10404                 if (!memcmp(uuid, uuids[i], 16))
10405                         return true;
10406         }
10407
10408         return false;
10409 }
10410
10411 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
10412 {
10413         u16 parsed = 0;
10414
10415         while (parsed < eir_len) {
10416                 u8 field_len = eir[0];
10417                 u8 uuid[16];
10418                 int i;
10419
10420                 if (field_len == 0)
10421                         break;
10422
10423                 if (eir_len - parsed < field_len + 1)
10424                         break;
10425
10426                 switch (eir[1]) {
10427                 case EIR_UUID16_ALL:
10428                 case EIR_UUID16_SOME:
10429                         for (i = 0; i + 3 <= field_len; i += 2) {
10430                                 memcpy(uuid, bluetooth_base_uuid, 16);
10431                                 uuid[13] = eir[i + 3];
10432                                 uuid[12] = eir[i + 2];
10433                                 if (has_uuid(uuid, uuid_count, uuids))
10434                                         return true;
10435                         }
10436                         break;
10437                 case EIR_UUID32_ALL:
10438                 case EIR_UUID32_SOME:
10439                         for (i = 0; i + 5 <= field_len; i += 4) {
10440                                 memcpy(uuid, bluetooth_base_uuid, 16);
10441                                 uuid[15] = eir[i + 5];
10442                                 uuid[14] = eir[i + 4];
10443                                 uuid[13] = eir[i + 3];
10444                                 uuid[12] = eir[i + 2];
10445                                 if (has_uuid(uuid, uuid_count, uuids))
10446                                         return true;
10447                         }
10448                         break;
10449                 case EIR_UUID128_ALL:
10450                 case EIR_UUID128_SOME:
10451                         for (i = 0; i + 17 <= field_len; i += 16) {
10452                                 memcpy(uuid, eir + i + 2, 16);
10453                                 if (has_uuid(uuid, uuid_count, uuids))
10454                                         return true;
10455                         }
10456                         break;
10457                 }
10458
10459                 parsed += field_len + 1;
10460                 eir += field_len + 1;
10461         }
10462
10463         return false;
10464 }
10465
10466 static void restart_le_scan(struct hci_dev *hdev)
10467 {
10468         /* If controller is not scanning we are done. */
10469         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
10470                 return;
10471
10472         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
10473                        hdev->discovery.scan_start +
10474                        hdev->discovery.scan_duration))
10475                 return;
10476
10477         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
10478                            DISCOV_LE_RESTART_DELAY);
10479 }
10480
10481 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
10482                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
10483 {
10484         /* If a RSSI threshold has been specified, and
10485          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
10486          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
10487          * is set, let it through for further processing, as we might need to
10488          * restart the scan.
10489          *
10490          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
10491          * the results are also dropped.
10492          */
10493         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10494             (rssi == HCI_RSSI_INVALID ||
10495             (rssi < hdev->discovery.rssi &&
10496              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
10497                 return  false;
10498
10499         if (hdev->discovery.uuid_count != 0) {
10500                 /* If a list of UUIDs is provided in filter, results with no
10501                  * matching UUID should be dropped.
10502                  */
10503                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
10504                                    hdev->discovery.uuids) &&
10505                     !eir_has_uuids(scan_rsp, scan_rsp_len,
10506                                    hdev->discovery.uuid_count,
10507                                    hdev->discovery.uuids))
10508                         return false;
10509         }
10510
10511         /* If duplicate filtering does not report RSSI changes, then restart
10512          * scanning to ensure updated result with updated RSSI values.
10513          */
10514         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
10515                 restart_le_scan(hdev);
10516
10517                 /* Validate RSSI value against the RSSI threshold once more. */
10518                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10519                     rssi < hdev->discovery.rssi)
10520                         return false;
10521         }
10522
10523         return true;
10524 }
10525
10526 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10527                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
10528                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
10529 {
10530         char buf[512];
10531         struct mgmt_ev_device_found *ev = (void *)buf;
10532         size_t ev_size;
10533
10534         /* Don't send events for a non-kernel initiated discovery. With
10535          * LE one exception is if we have pend_le_reports > 0 in which
10536          * case we're doing passive scanning and want these events.
10537          */
10538         if (!hci_discovery_active(hdev)) {
10539                 if (link_type == ACL_LINK)
10540                         return;
10541                 if (link_type == LE_LINK &&
10542                     list_empty(&hdev->pend_le_reports) &&
10543                     !hci_is_adv_monitoring(hdev)) {
10544                         return;
10545                 }
10546         }
10547
10548         if (hdev->discovery.result_filtering) {
10549                 /* We are using service discovery */
10550                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
10551                                      scan_rsp_len))
10552                         return;
10553         }
10554
10555         if (hdev->discovery.limited) {
10556                 /* Check for limited discoverable bit */
10557                 if (dev_class) {
10558                         if (!(dev_class[1] & 0x20))
10559                                 return;
10560                 } else {
10561                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
10562                         if (!flags || !(flags[0] & LE_AD_LIMITED))
10563                                 return;
10564                 }
10565         }
10566
10567         /* Make sure that the buffer is big enough. The 5 extra bytes
10568          * are for the potential CoD field.
10569          */
10570         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
10571                 return;
10572
10573         memset(buf, 0, sizeof(buf));
10574
10575         /* In case of device discovery with BR/EDR devices (pre 1.2), the
10576          * RSSI value was reported as 0 when not available. This behavior
10577          * is kept when using device discovery. This is required for full
10578          * backwards compatibility with the API.
10579          *
10580          * However when using service discovery, the value 127 will be
10581          * returned when the RSSI is not available.
10582          */
10583         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
10584             link_type == ACL_LINK)
10585                 rssi = 0;
10586
10587         bacpy(&ev->addr.bdaddr, bdaddr);
10588         ev->addr.type = link_to_bdaddr(link_type, addr_type);
10589         ev->rssi = rssi;
10590         ev->flags = cpu_to_le32(flags);
10591
10592         if (eir_len > 0)
10593                 /* Copy EIR or advertising data into event */
10594                 memcpy(ev->eir, eir, eir_len);
10595
10596         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
10597                                        NULL))
10598                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
10599                                           dev_class, 3);
10600
10601         if (scan_rsp_len > 0)
10602                 /* Append scan response data to event */
10603                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
10604
10605         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10606         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
10607
10608         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
10609 }
10610
10611 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10612                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
10613 {
10614         struct mgmt_ev_device_found *ev;
10615         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
10616         u16 eir_len;
10617
10618         ev = (struct mgmt_ev_device_found *) buf;
10619
10620         memset(buf, 0, sizeof(buf));
10621
10622         bacpy(&ev->addr.bdaddr, bdaddr);
10623         ev->addr.type = link_to_bdaddr(link_type, addr_type);
10624         ev->rssi = rssi;
10625
10626         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
10627                                   name_len);
10628
10629         ev->eir_len = cpu_to_le16(eir_len);
10630
10631         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
10632 }
10633
10634 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
10635 {
10636         struct mgmt_ev_discovering ev;
10637
10638         bt_dev_dbg(hdev, "discovering %u", discovering);
10639
10640         memset(&ev, 0, sizeof(ev));
10641         ev.type = hdev->discovery.type;
10642         ev.discovering = discovering;
10643
10644         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
10645 }
10646
10647 void mgmt_suspending(struct hci_dev *hdev, u8 state)
10648 {
10649         struct mgmt_ev_controller_suspend ev;
10650
10651         ev.suspend_state = state;
10652         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
10653 }
10654
10655 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
10656                    u8 addr_type)
10657 {
10658         struct mgmt_ev_controller_resume ev;
10659
10660         ev.wake_reason = reason;
10661         if (bdaddr) {
10662                 bacpy(&ev.addr.bdaddr, bdaddr);
10663                 ev.addr.type = addr_type;
10664         } else {
10665                 memset(&ev.addr, 0, sizeof(ev.addr));
10666         }
10667
10668         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
10669 }
10670
10671 static struct hci_mgmt_chan chan = {
10672         .channel        = HCI_CHANNEL_CONTROL,
10673         .handler_count  = ARRAY_SIZE(mgmt_handlers),
10674         .handlers       = mgmt_handlers,
10675 #ifdef TIZEN_BT
10676         .tizen_handler_count    = ARRAY_SIZE(tizen_mgmt_handlers),
10677         .tizen_handlers = tizen_mgmt_handlers,
10678 #endif
10679         .hdev_init      = mgmt_init_hdev,
10680 };
10681
10682 int mgmt_init(void)
10683 {
10684         return hci_mgmt_chan_register(&chan);
10685 }
10686
10687 void mgmt_exit(void)
10688 {
10689         hci_mgmt_chan_unregister(&chan);
10690 }