net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #ifdef TIZEN_BT
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #endif
  38
  39 #include "hci_request.h"
  40 #include "smp.h"
  41 #include "mgmt_util.h"
  42 #include "mgmt_config.h"
  43 #include "msft.h"
  44 #include "eir.h"
  45 #include "aosp.h"
  46
  47 #define MGMT_VERSION    1
  48 #define MGMT_REVISION   22
  49
  50 static const u16 mgmt_commands[] = {
  51         MGMT_OP_READ_INDEX_LIST,
  52         MGMT_OP_READ_INFO,
  53         MGMT_OP_SET_POWERED,
  54         MGMT_OP_SET_DISCOVERABLE,
  55         MGMT_OP_SET_CONNECTABLE,
  56         MGMT_OP_SET_FAST_CONNECTABLE,
  57         MGMT_OP_SET_BONDABLE,
  58         MGMT_OP_SET_LINK_SECURITY,
  59         MGMT_OP_SET_SSP,
  60         MGMT_OP_SET_HS,
  61         MGMT_OP_SET_LE,
  62         MGMT_OP_SET_DEV_CLASS,
  63         MGMT_OP_SET_LOCAL_NAME,
  64         MGMT_OP_ADD_UUID,
  65         MGMT_OP_REMOVE_UUID,
  66         MGMT_OP_LOAD_LINK_KEYS,
  67         MGMT_OP_LOAD_LONG_TERM_KEYS,
  68         MGMT_OP_DISCONNECT,
  69         MGMT_OP_GET_CONNECTIONS,
  70         MGMT_OP_PIN_CODE_REPLY,
  71         MGMT_OP_PIN_CODE_NEG_REPLY,
  72         MGMT_OP_SET_IO_CAPABILITY,
  73         MGMT_OP_PAIR_DEVICE,
  74         MGMT_OP_CANCEL_PAIR_DEVICE,
  75         MGMT_OP_UNPAIR_DEVICE,
  76         MGMT_OP_USER_CONFIRM_REPLY,
  77         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  78         MGMT_OP_USER_PASSKEY_REPLY,
  79         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  80         MGMT_OP_READ_LOCAL_OOB_DATA,
  81         MGMT_OP_ADD_REMOTE_OOB_DATA,
  82         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  83         MGMT_OP_START_DISCOVERY,
  84         MGMT_OP_STOP_DISCOVERY,
  85         MGMT_OP_CONFIRM_NAME,
  86         MGMT_OP_BLOCK_DEVICE,
  87         MGMT_OP_UNBLOCK_DEVICE,
  88         MGMT_OP_SET_DEVICE_ID,
  89         MGMT_OP_SET_ADVERTISING,
  90         MGMT_OP_SET_BREDR,
  91         MGMT_OP_SET_STATIC_ADDRESS,
  92         MGMT_OP_SET_SCAN_PARAMS,
  93         MGMT_OP_SET_SECURE_CONN,
  94         MGMT_OP_SET_DEBUG_KEYS,
  95         MGMT_OP_SET_PRIVACY,
  96         MGMT_OP_LOAD_IRKS,
  97         MGMT_OP_GET_CONN_INFO,
  98         MGMT_OP_GET_CLOCK_INFO,
  99         MGMT_OP_ADD_DEVICE,
 100         MGMT_OP_REMOVE_DEVICE,
 101         MGMT_OP_LOAD_CONN_PARAM,
 102         MGMT_OP_READ_UNCONF_INDEX_LIST,
 103         MGMT_OP_READ_CONFIG_INFO,
 104         MGMT_OP_SET_EXTERNAL_CONFIG,
 105         MGMT_OP_SET_PUBLIC_ADDRESS,
 106         MGMT_OP_START_SERVICE_DISCOVERY,
 107         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 108         MGMT_OP_READ_EXT_INDEX_LIST,
 109         MGMT_OP_READ_ADV_FEATURES,
 110         MGMT_OP_ADD_ADVERTISING,
 111         MGMT_OP_REMOVE_ADVERTISING,
 112         MGMT_OP_GET_ADV_SIZE_INFO,
 113         MGMT_OP_START_LIMITED_DISCOVERY,
 114         MGMT_OP_READ_EXT_INFO,
 115         MGMT_OP_SET_APPEARANCE,
 116         MGMT_OP_GET_PHY_CONFIGURATION,
 117         MGMT_OP_SET_PHY_CONFIGURATION,
 118         MGMT_OP_SET_BLOCKED_KEYS,
 119         MGMT_OP_SET_WIDEBAND_SPEECH,
 120         MGMT_OP_READ_CONTROLLER_CAP,
 121         MGMT_OP_READ_EXP_FEATURES_INFO,
 122         MGMT_OP_SET_EXP_FEATURE,
 123         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 124         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 125         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 126         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 127         MGMT_OP_GET_DEVICE_FLAGS,
 128         MGMT_OP_SET_DEVICE_FLAGS,
 129         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 130         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 131         MGMT_OP_REMOVE_ADV_MONITOR,
 132         MGMT_OP_ADD_EXT_ADV_PARAMS,
 133         MGMT_OP_ADD_EXT_ADV_DATA,
 134         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 135         MGMT_OP_SET_MESH_RECEIVER,
 136         MGMT_OP_MESH_READ_FEATURES,
 137         MGMT_OP_MESH_SEND,
 138         MGMT_OP_MESH_SEND_CANCEL,
 139 };
 140
 141 static const u16 mgmt_events[] = {
 142         MGMT_EV_CONTROLLER_ERROR,
 143         MGMT_EV_INDEX_ADDED,
 144         MGMT_EV_INDEX_REMOVED,
 145         MGMT_EV_NEW_SETTINGS,
 146         MGMT_EV_CLASS_OF_DEV_CHANGED,
 147         MGMT_EV_LOCAL_NAME_CHANGED,
 148         MGMT_EV_NEW_LINK_KEY,
 149         MGMT_EV_NEW_LONG_TERM_KEY,
 150         MGMT_EV_DEVICE_CONNECTED,
 151         MGMT_EV_DEVICE_DISCONNECTED,
 152         MGMT_EV_CONNECT_FAILED,
 153         MGMT_EV_PIN_CODE_REQUEST,
 154         MGMT_EV_USER_CONFIRM_REQUEST,
 155         MGMT_EV_USER_PASSKEY_REQUEST,
 156         MGMT_EV_AUTH_FAILED,
 157         MGMT_EV_DEVICE_FOUND,
 158         MGMT_EV_DISCOVERING,
 159         MGMT_EV_DEVICE_BLOCKED,
 160         MGMT_EV_DEVICE_UNBLOCKED,
 161         MGMT_EV_DEVICE_UNPAIRED,
 162         MGMT_EV_PASSKEY_NOTIFY,
 163         MGMT_EV_NEW_IRK,
 164         MGMT_EV_NEW_CSRK,
 165         MGMT_EV_DEVICE_ADDED,
 166         MGMT_EV_DEVICE_REMOVED,
 167         MGMT_EV_NEW_CONN_PARAM,
 168         MGMT_EV_UNCONF_INDEX_ADDED,
 169         MGMT_EV_UNCONF_INDEX_REMOVED,
 170         MGMT_EV_NEW_CONFIG_OPTIONS,
 171         MGMT_EV_EXT_INDEX_ADDED,
 172         MGMT_EV_EXT_INDEX_REMOVED,
 173         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 174         MGMT_EV_ADVERTISING_ADDED,
 175         MGMT_EV_ADVERTISING_REMOVED,
 176         MGMT_EV_EXT_INFO_CHANGED,
 177         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 178         MGMT_EV_EXP_FEATURE_CHANGED,
 179         MGMT_EV_DEVICE_FLAGS_CHANGED,
 180         MGMT_EV_ADV_MONITOR_ADDED,
 181         MGMT_EV_ADV_MONITOR_REMOVED,
 182         MGMT_EV_CONTROLLER_SUSPEND,
 183         MGMT_EV_CONTROLLER_RESUME,
 184         MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
 185         MGMT_EV_ADV_MONITOR_DEVICE_LOST,
 186 };
 187
 188 static const u16 mgmt_untrusted_commands[] = {
 189         MGMT_OP_READ_INDEX_LIST,
 190         MGMT_OP_READ_INFO,
 191         MGMT_OP_READ_UNCONF_INDEX_LIST,
 192         MGMT_OP_READ_CONFIG_INFO,
 193         MGMT_OP_READ_EXT_INDEX_LIST,
 194         MGMT_OP_READ_EXT_INFO,
 195         MGMT_OP_READ_CONTROLLER_CAP,
 196         MGMT_OP_READ_EXP_FEATURES_INFO,
 197         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 198         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 199 };
 200
 201 static const u16 mgmt_untrusted_events[] = {
 202         MGMT_EV_INDEX_ADDED,
 203         MGMT_EV_INDEX_REMOVED,
 204         MGMT_EV_NEW_SETTINGS,
 205         MGMT_EV_CLASS_OF_DEV_CHANGED,
 206         MGMT_EV_LOCAL_NAME_CHANGED,
 207         MGMT_EV_UNCONF_INDEX_ADDED,
 208         MGMT_EV_UNCONF_INDEX_REMOVED,
 209         MGMT_EV_NEW_CONFIG_OPTIONS,
 210         MGMT_EV_EXT_INDEX_ADDED,
 211         MGMT_EV_EXT_INDEX_REMOVED,
 212         MGMT_EV_EXT_INFO_CHANGED,
 213         MGMT_EV_EXP_FEATURE_CHANGED,
 214 };
 215
 216 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 217
 218 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 219                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 220
 221 /* HCI to MGMT error code conversion table */
 222 static const u8 mgmt_status_table[] = {
 223         MGMT_STATUS_SUCCESS,
 224         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 225         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 226         MGMT_STATUS_FAILED,             /* Hardware Failure */
 227         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 228         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 229         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 230         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 231         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 232         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 233         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 234         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 235         MGMT_STATUS_BUSY,               /* Command Disallowed */
 236         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 237         MGMT_STATUS_REJECTED,           /* Rejected Security */
 238         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 239         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 240         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 241         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 242         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 243         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 244         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 245         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 246         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 247         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 248         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 249         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 250         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 251         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 252         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 253         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 254         MGMT_STATUS_FAILED,             /* Unspecified Error */
 255         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 256         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 257         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 258         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 259         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 260         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 261         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 262         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 263         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 264         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 265         MGMT_STATUS_FAILED,             /* Transaction Collision */
 266         MGMT_STATUS_FAILED,             /* Reserved for future use */
 267         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 268         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 269         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 270         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 271         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 272         MGMT_STATUS_FAILED,             /* Reserved for future use */
 273         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 274         MGMT_STATUS_FAILED,             /* Reserved for future use */
 275         MGMT_STATUS_FAILED,             /* Slot Violation */
 276         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 277         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 278         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 279         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 280         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 281         MGMT_STATUS_BUSY,               /* Controller Busy */
 282         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 283         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 284         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 285         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 286         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 287 };
 288
 289 static u8 mgmt_errno_status(int err)
 290 {
 291         switch (err) {
 292         case 0:
 293                 return MGMT_STATUS_SUCCESS;
 294         case -EPERM:
 295                 return MGMT_STATUS_REJECTED;
 296         case -EINVAL:
 297                 return MGMT_STATUS_INVALID_PARAMS;
 298         case -EOPNOTSUPP:
 299                 return MGMT_STATUS_NOT_SUPPORTED;
 300         case -EBUSY:
 301                 return MGMT_STATUS_BUSY;
 302         case -ETIMEDOUT:
 303                 return MGMT_STATUS_AUTH_FAILED;
 304         case -ENOMEM:
 305                 return MGMT_STATUS_NO_RESOURCES;
 306         case -EISCONN:
 307                 return MGMT_STATUS_ALREADY_CONNECTED;
 308         case -ENOTCONN:
 309                 return MGMT_STATUS_DISCONNECTED;
 310         }
 311
 312         return MGMT_STATUS_FAILED;
 313 }
 314
 315 static u8 mgmt_status(int err)
 316 {
 317         if (err < 0)
 318                 return mgmt_errno_status(err);
 319
 320         if (err < ARRAY_SIZE(mgmt_status_table))
 321                 return mgmt_status_table[err];
 322
 323         return MGMT_STATUS_FAILED;
 324 }
 325
 326 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 327                             u16 len, int flag)
 328 {
 329         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 330                                flag, NULL);
 331 }
 332
 333 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 334                               u16 len, int flag, struct sock *skip_sk)
 335 {
 336         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 337                                flag, skip_sk);
 338 }
 339
 340 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 341                       struct sock *skip_sk)
 342 {
 343         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 344                                HCI_SOCK_TRUSTED, skip_sk);
 345 }
 346
 347 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk)
 348 {
 349         return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED,
 350                                    skip_sk);
 351 }
 352
 353 static u8 le_addr_type(u8 mgmt_addr_type)
 354 {
 355         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 356                 return ADDR_LE_DEV_PUBLIC;
 357         else
 358                 return ADDR_LE_DEV_RANDOM;
 359 }
 360
 361 void mgmt_fill_version_info(void *ver)
 362 {
 363         struct mgmt_rp_read_version *rp = ver;
 364
 365         rp->version = MGMT_VERSION;
 366         rp->revision = cpu_to_le16(MGMT_REVISION);
 367 }
 368
 369 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 370                         u16 data_len)
 371 {
 372         struct mgmt_rp_read_version rp;
 373
 374         bt_dev_dbg(hdev, "sock %p", sk);
 375
 376         mgmt_fill_version_info(&rp);
 377
 378         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 379                                  &rp, sizeof(rp));
 380 }
 381
 382 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 383                          u16 data_len)
 384 {
 385         struct mgmt_rp_read_commands *rp;
 386         u16 num_commands, num_events;
 387         size_t rp_size;
 388         int i, err;
 389
 390         bt_dev_dbg(hdev, "sock %p", sk);
 391
 392         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 393                 num_commands = ARRAY_SIZE(mgmt_commands);
 394                 num_events = ARRAY_SIZE(mgmt_events);
 395         } else {
 396                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 397                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 398         }
 399
 400         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 401
 402         rp = kmalloc(rp_size, GFP_KERNEL);
 403         if (!rp)
 404                 return -ENOMEM;
 405
 406         rp->num_commands = cpu_to_le16(num_commands);
 407         rp->num_events = cpu_to_le16(num_events);
 408
 409         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 410                 __le16 *opcode = rp->opcodes;
 411
 412                 for (i = 0; i < num_commands; i++, opcode++)
 413                         put_unaligned_le16(mgmt_commands[i], opcode);
 414
 415                 for (i = 0; i < num_events; i++, opcode++)
 416                         put_unaligned_le16(mgmt_events[i], opcode);
 417         } else {
 418                 __le16 *opcode = rp->opcodes;
 419
 420                 for (i = 0; i < num_commands; i++, opcode++)
 421                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 422
 423                 for (i = 0; i < num_events; i++, opcode++)
 424                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 425         }
 426
 427         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 428                                 rp, rp_size);
 429         kfree(rp);
 430
 431         return err;
 432 }
 433
 434 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 435                            u16 data_len)
 436 {
 437         struct mgmt_rp_read_index_list *rp;
 438         struct hci_dev *d;
 439         size_t rp_len;
 440         u16 count;
 441         int err;
 442
 443         bt_dev_dbg(hdev, "sock %p", sk);
 444
 445         read_lock(&hci_dev_list_lock);
 446
 447         count = 0;
 448         list_for_each_entry(d, &hci_dev_list, list) {
 449                 if (d->dev_type == HCI_PRIMARY &&
 450                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 451                         count++;
 452         }
 453
 454         rp_len = sizeof(*rp) + (2 * count);
 455         rp = kmalloc(rp_len, GFP_ATOMIC);
 456         if (!rp) {
 457                 read_unlock(&hci_dev_list_lock);
 458                 return -ENOMEM;
 459         }
 460
 461         count = 0;
 462         list_for_each_entry(d, &hci_dev_list, list) {
 463                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 464                     hci_dev_test_flag(d, HCI_CONFIG) ||
 465                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 466                         continue;
 467
 468                 /* Devices marked as raw-only are neither configured
 469                  * nor unconfigured controllers.
 470                  */
 471                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 472                         continue;
 473
 474                 if (d->dev_type == HCI_PRIMARY &&
 475                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 476                         rp->index[count++] = cpu_to_le16(d->id);
 477                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 478                 }
 479         }
 480
 481         rp->num_controllers = cpu_to_le16(count);
 482         rp_len = sizeof(*rp) + (2 * count);
 483
 484         read_unlock(&hci_dev_list_lock);
 485
 486         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 487                                 0, rp, rp_len);
 488
 489         kfree(rp);
 490
 491         return err;
 492 }
 493
 494 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 495                                   void *data, u16 data_len)
 496 {
 497         struct mgmt_rp_read_unconf_index_list *rp;
 498         struct hci_dev *d;
 499         size_t rp_len;
 500         u16 count;
 501         int err;
 502
 503         bt_dev_dbg(hdev, "sock %p", sk);
 504
 505         read_lock(&hci_dev_list_lock);
 506
 507         count = 0;
 508         list_for_each_entry(d, &hci_dev_list, list) {
 509                 if (d->dev_type == HCI_PRIMARY &&
 510                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 511                         count++;
 512         }
 513
 514         rp_len = sizeof(*rp) + (2 * count);
 515         rp = kmalloc(rp_len, GFP_ATOMIC);
 516         if (!rp) {
 517                 read_unlock(&hci_dev_list_lock);
 518                 return -ENOMEM;
 519         }
 520
 521         count = 0;
 522         list_for_each_entry(d, &hci_dev_list, list) {
 523                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 524                     hci_dev_test_flag(d, HCI_CONFIG) ||
 525                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 526                         continue;
 527
 528                 /* Devices marked as raw-only are neither configured
 529                  * nor unconfigured controllers.
 530                  */
 531                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 532                         continue;
 533
 534                 if (d->dev_type == HCI_PRIMARY &&
 535                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 536                         rp->index[count++] = cpu_to_le16(d->id);
 537                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 538                 }
 539         }
 540
 541         rp->num_controllers = cpu_to_le16(count);
 542         rp_len = sizeof(*rp) + (2 * count);
 543
 544         read_unlock(&hci_dev_list_lock);
 545
 546         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 547                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 548
 549         kfree(rp);
 550
 551         return err;
 552 }
 553
 554 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 555                                void *data, u16 data_len)
 556 {
 557         struct mgmt_rp_read_ext_index_list *rp;
 558         struct hci_dev *d;
 559         u16 count;
 560         int err;
 561
 562         bt_dev_dbg(hdev, "sock %p", sk);
 563
 564         read_lock(&hci_dev_list_lock);
 565
 566         count = 0;
 567         list_for_each_entry(d, &hci_dev_list, list) {
 568                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 569                         count++;
 570         }
 571
 572         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 573         if (!rp) {
 574                 read_unlock(&hci_dev_list_lock);
 575                 return -ENOMEM;
 576         }
 577
 578         count = 0;
 579         list_for_each_entry(d, &hci_dev_list, list) {
 580                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 581                     hci_dev_test_flag(d, HCI_CONFIG) ||
 582                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 583                         continue;
 584
 585                 /* Devices marked as raw-only are neither configured
 586                  * nor unconfigured controllers.
 587                  */
 588                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 589                         continue;
 590
 591                 if (d->dev_type == HCI_PRIMARY) {
 592                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 593                                 rp->entry[count].type = 0x01;
 594                         else
 595                                 rp->entry[count].type = 0x00;
 596                 } else if (d->dev_type == HCI_AMP) {
 597                         rp->entry[count].type = 0x02;
 598                 } else {
 599                         continue;
 600                 }
 601
 602                 rp->entry[count].bus = d->bus;
 603                 rp->entry[count++].index = cpu_to_le16(d->id);
 604                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 605         }
 606
 607         rp->num_controllers = cpu_to_le16(count);
 608
 609         read_unlock(&hci_dev_list_lock);
 610
 611         /* If this command is called at least once, then all the
 612          * default index and unconfigured index events are disabled
 613          * and from now on only extended index events are used.
 614          */
 615         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 616         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 617         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 618
 619         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 620                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 621                                 struct_size(rp, entry, count));
 622
 623         kfree(rp);
 624
 625         return err;
 626 }
 627
 628 static bool is_configured(struct hci_dev *hdev)
 629 {
 630         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 631             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 632                 return false;
 633
 634         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 635              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 636             !bacmp(&hdev->public_addr, BDADDR_ANY))
 637                 return false;
 638
 639         return true;
 640 }
 641
 642 static __le32 get_missing_options(struct hci_dev *hdev)
 643 {
 644         u32 options = 0;
 645
 646         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 647             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 648                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 649
 650         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 651              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 652             !bacmp(&hdev->public_addr, BDADDR_ANY))
 653                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 654
 655         return cpu_to_le32(options);
 656 }
 657
 658 static int new_options(struct hci_dev *hdev, struct sock *skip)
 659 {
 660         __le32 options = get_missing_options(hdev);
 661
 662         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 663                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 664 }
 665
 666 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 667 {
 668         __le32 options = get_missing_options(hdev);
 669
 670         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 671                                  sizeof(options));
 672 }
 673
 674 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 675                             void *data, u16 data_len)
 676 {
 677         struct mgmt_rp_read_config_info rp;
 678         u32 options = 0;
 679
 680         bt_dev_dbg(hdev, "sock %p", sk);
 681
 682         hci_dev_lock(hdev);
 683
 684         memset(&rp, 0, sizeof(rp));
 685         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 686
 687         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 688                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 689
 690         if (hdev->set_bdaddr)
 691                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 692
 693         rp.supported_options = cpu_to_le32(options);
 694         rp.missing_options = get_missing_options(hdev);
 695
 696         hci_dev_unlock(hdev);
 697
 698         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 699                                  &rp, sizeof(rp));
 700 }
 701
 702 static u32 get_supported_phys(struct hci_dev *hdev)
 703 {
 704         u32 supported_phys = 0;
 705
 706         if (lmp_bredr_capable(hdev)) {
 707                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 708
 709                 if (hdev->features[0][0] & LMP_3SLOT)
 710                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 711
 712                 if (hdev->features[0][0] & LMP_5SLOT)
 713                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 714
 715                 if (lmp_edr_2m_capable(hdev)) {
 716                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 717
 718                         if (lmp_edr_3slot_capable(hdev))
 719                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 720
 721                         if (lmp_edr_5slot_capable(hdev))
 722                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 723
 724                         if (lmp_edr_3m_capable(hdev)) {
 725                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 726
 727                                 if (lmp_edr_3slot_capable(hdev))
 728                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 729
 730                                 if (lmp_edr_5slot_capable(hdev))
 731                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 732                         }
 733                 }
 734         }
 735
 736         if (lmp_le_capable(hdev)) {
 737                 supported_phys |= MGMT_PHY_LE_1M_TX;
 738                 supported_phys |= MGMT_PHY_LE_1M_RX;
 739
 740                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 741                         supported_phys |= MGMT_PHY_LE_2M_TX;
 742                         supported_phys |= MGMT_PHY_LE_2M_RX;
 743                 }
 744
 745                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 746                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 747                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 748                 }
 749         }
 750
 751         return supported_phys;
 752 }
 753
 754 static u32 get_selected_phys(struct hci_dev *hdev)
 755 {
 756         u32 selected_phys = 0;
 757
 758         if (lmp_bredr_capable(hdev)) {
 759                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 760
 761                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 762                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 763
 764                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 765                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 766
 767                 if (lmp_edr_2m_capable(hdev)) {
 768                         if (!(hdev->pkt_type & HCI_2DH1))
 769                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 770
 771                         if (lmp_edr_3slot_capable(hdev) &&
 772                             !(hdev->pkt_type & HCI_2DH3))
 773                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 774
 775                         if (lmp_edr_5slot_capable(hdev) &&
 776                             !(hdev->pkt_type & HCI_2DH5))
 777                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 778
 779                         if (lmp_edr_3m_capable(hdev)) {
 780                                 if (!(hdev->pkt_type & HCI_3DH1))
 781                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 782
 783                                 if (lmp_edr_3slot_capable(hdev) &&
 784                                     !(hdev->pkt_type & HCI_3DH3))
 785                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 786
 787                                 if (lmp_edr_5slot_capable(hdev) &&
 788                                     !(hdev->pkt_type & HCI_3DH5))
 789                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 790                         }
 791                 }
 792         }
 793
 794         if (lmp_le_capable(hdev)) {
 795                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 796                         selected_phys |= MGMT_PHY_LE_1M_TX;
 797
 798                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 799                         selected_phys |= MGMT_PHY_LE_1M_RX;
 800
 801                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 802                         selected_phys |= MGMT_PHY_LE_2M_TX;
 803
 804                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 805                         selected_phys |= MGMT_PHY_LE_2M_RX;
 806
 807                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 808                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 809
 810                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 811                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 812         }
 813
 814         return selected_phys;
 815 }
 816
 817 static u32 get_configurable_phys(struct hci_dev *hdev)
 818 {
 819         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 820                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 821 }
 822
 823 static u32 get_supported_settings(struct hci_dev *hdev)
 824 {
 825         u32 settings = 0;
 826
 827         settings |= MGMT_SETTING_POWERED;
 828         settings |= MGMT_SETTING_BONDABLE;
 829         settings |= MGMT_SETTING_DEBUG_KEYS;
 830         settings |= MGMT_SETTING_CONNECTABLE;
 831         settings |= MGMT_SETTING_DISCOVERABLE;
 832
 833         if (lmp_bredr_capable(hdev)) {
 834                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 835                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 836                 settings |= MGMT_SETTING_BREDR;
 837                 settings |= MGMT_SETTING_LINK_SECURITY;
 838
 839                 if (lmp_ssp_capable(hdev)) {
 840                         settings |= MGMT_SETTING_SSP;
 841                         if (IS_ENABLED(CONFIG_BT_HS))
 842                                 settings |= MGMT_SETTING_HS;
 843                 }
 844
 845                 if (lmp_sc_capable(hdev))
 846                         settings |= MGMT_SETTING_SECURE_CONN;
 847
 848                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 849                              &hdev->quirks))
 850                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 851         }
 852
 853         if (lmp_le_capable(hdev)) {
 854                 settings |= MGMT_SETTING_LE;
 855                 settings |= MGMT_SETTING_SECURE_CONN;
 856                 settings |= MGMT_SETTING_PRIVACY;
 857                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 858                 settings |= MGMT_SETTING_ADVERTISING;
 859         }
 860
 861         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 862             hdev->set_bdaddr)
 863                 settings |= MGMT_SETTING_CONFIGURATION;
 864
 865         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 866
 867         return settings;
 868 }
 869
 870 static u32 get_current_settings(struct hci_dev *hdev)
 871 {
 872         u32 settings = 0;
 873
 874         if (hdev_is_powered(hdev))
 875                 settings |= MGMT_SETTING_POWERED;
 876
 877         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 878                 settings |= MGMT_SETTING_CONNECTABLE;
 879
 880         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 881                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 882
 883         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 884                 settings |= MGMT_SETTING_DISCOVERABLE;
 885
 886         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 887                 settings |= MGMT_SETTING_BONDABLE;
 888
 889         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 890                 settings |= MGMT_SETTING_BREDR;
 891
 892         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 893                 settings |= MGMT_SETTING_LE;
 894
 895         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 896                 settings |= MGMT_SETTING_LINK_SECURITY;
 897
 898         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 899                 settings |= MGMT_SETTING_SSP;
 900
 901         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 902                 settings |= MGMT_SETTING_HS;
 903
 904         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 905                 settings |= MGMT_SETTING_ADVERTISING;
 906
 907         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 908                 settings |= MGMT_SETTING_SECURE_CONN;
 909
 910         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 911                 settings |= MGMT_SETTING_DEBUG_KEYS;
 912
 913         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 914                 settings |= MGMT_SETTING_PRIVACY;
 915
 916         /* The current setting for static address has two purposes. The
 917          * first is to indicate if the static address will be used and
 918          * the second is to indicate if it is actually set.
 919          *
 920          * This means if the static address is not configured, this flag
 921          * will never be set. If the address is configured, then if the
 922          * address is actually used decides if the flag is set or not.
 923          *
 924          * For single mode LE only controllers and dual-mode controllers
 925          * with BR/EDR disabled, the existence of the static address will
 926          * be evaluated.
 927          */
 928         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 929             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 930             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 931                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 932                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 933         }
 934
 935         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 936                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 937
 938         return settings;
 939 }
 940
 941 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 942 {
 943         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 944 }
 945
 946 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 947 {
 948         struct mgmt_pending_cmd *cmd;
 949
 950         /* If there's a pending mgmt command the flags will not yet have
 951          * their final values, so check for this first.
 952          */
 953         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 954         if (cmd) {
 955                 struct mgmt_mode *cp = cmd->param;
 956                 if (cp->val == 0x01)
 957                         return LE_AD_GENERAL;
 958                 else if (cp->val == 0x02)
 959                         return LE_AD_LIMITED;
 960         } else {
 961                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 962                         return LE_AD_LIMITED;
 963                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 964                         return LE_AD_GENERAL;
 965         }
 966
 967         return 0;
 968 }
 969
 970 bool mgmt_get_connectable(struct hci_dev *hdev)
 971 {
 972         struct mgmt_pending_cmd *cmd;
 973
 974         /* If there's a pending mgmt command the flag will not yet have
 975          * it's final value, so check for this first.
 976          */
 977         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 978         if (cmd) {
 979                 struct mgmt_mode *cp = cmd->param;
 980
 981                 return cp->val;
 982         }
 983
 984         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 985 }
 986
 987 static int service_cache_sync(struct hci_dev *hdev, void *data)
 988 {
 989         hci_update_eir_sync(hdev);
 990         hci_update_class_sync(hdev);
 991
 992         return 0;
 993 }
 994
 995 static void service_cache_off(struct work_struct *work)
 996 {
 997         struct hci_dev *hdev = container_of(work, struct hci_dev,
 998                                             service_cache.work);
 999
1000         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1001                 return;
1002
1003         hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL);
1004 }
1005
1006 static int rpa_expired_sync(struct hci_dev *hdev, void *data)
1007 {
1008         /* The generation of a new RPA and programming it into the
1009          * controller happens in the hci_req_enable_advertising()
1010          * function.
1011          */
1012         if (ext_adv_capable(hdev))
1013                 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance);
1014         else
1015                 return hci_enable_advertising_sync(hdev);
1016 }
1017
1018 static void rpa_expired(struct work_struct *work)
1019 {
1020         struct hci_dev *hdev = container_of(work, struct hci_dev,
1021                                             rpa_expired.work);
1022
1023         bt_dev_dbg(hdev, "");
1024
1025         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1026
1027         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1028                 return;
1029
1030         hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL);
1031 }
1032
1033 static void discov_off(struct work_struct *work)
1034 {
1035         struct hci_dev *hdev = container_of(work, struct hci_dev,
1036                                             discov_off.work);
1037
1038         bt_dev_dbg(hdev, "");
1039
1040         hci_dev_lock(hdev);
1041
1042         /* When discoverable timeout triggers, then just make sure
1043          * the limited discoverable flag is cleared. Even in the case
1044          * of a timeout triggered from general discoverable, it is
1045          * safe to unconditionally clear the flag.
1046          */
1047         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1048         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1049         hdev->discov_timeout = 0;
1050
1051         hci_update_discoverable(hdev);
1052
1053         mgmt_new_settings(hdev);
1054
1055         hci_dev_unlock(hdev);
1056 }
1057
1058 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev);
1059
1060 static void mesh_send_complete(struct hci_dev *hdev,
1061                                struct mgmt_mesh_tx *mesh_tx, bool silent)
1062 {
1063         u8 handle = mesh_tx->handle;
1064
1065         if (!silent)
1066                 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle,
1067                            sizeof(handle), NULL);
1068
1069         mgmt_mesh_remove(mesh_tx);
1070 }
1071
1072 static int mesh_send_done_sync(struct hci_dev *hdev, void *data)
1073 {
1074         struct mgmt_mesh_tx *mesh_tx;
1075
1076         hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
1077         hci_disable_advertising_sync(hdev);
1078         mesh_tx = mgmt_mesh_next(hdev, NULL);
1079
1080         if (mesh_tx)
1081                 mesh_send_complete(hdev, mesh_tx, false);
1082
1083         return 0;
1084 }
1085
1086 static int mesh_send_sync(struct hci_dev *hdev, void *data);
1087 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err);
1088 static void mesh_next(struct hci_dev *hdev, void *data, int err)
1089 {
1090         struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL);
1091
1092         if (!mesh_tx)
1093                 return;
1094
1095         err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
1096                                  mesh_send_start_complete);
1097
1098         if (err < 0)
1099                 mesh_send_complete(hdev, mesh_tx, false);
1100         else
1101                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
1102 }
1103
1104 static void mesh_send_done(struct work_struct *work)
1105 {
1106         struct hci_dev *hdev = container_of(work, struct hci_dev,
1107                                             mesh_send_done.work);
1108
1109         if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING))
1110                 return;
1111
1112         hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next);
1113 }
1114
1115 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1116 {
1117         if (hci_dev_test_flag(hdev, HCI_MGMT))
1118                 return;
1119
1120         BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION);
1121
1122         INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
1123         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1124         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1125         INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done);
1126
1127         /* Non-mgmt controlled devices get this bit set
1128          * implicitly so that pairing works for them, however
1129          * for mgmt we require user-space to explicitly enable
1130          * it
1131          */
1132         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1133
1134         hci_dev_set_flag(hdev, HCI_MGMT);
1135 }
1136
1137 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1138                                 void *data, u16 data_len)
1139 {
1140         struct mgmt_rp_read_info rp;
1141
1142         bt_dev_dbg(hdev, "sock %p", sk);
1143
1144         hci_dev_lock(hdev);
1145
1146         memset(&rp, 0, sizeof(rp));
1147
1148         bacpy(&rp.bdaddr, &hdev->bdaddr);
1149
1150         rp.version = hdev->hci_ver;
1151         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1152
1153         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1154         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1155
1156         memcpy(rp.dev_class, hdev->dev_class, 3);
1157
1158         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1159         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1160
1161         hci_dev_unlock(hdev);
1162
1163         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1164                                  sizeof(rp));
1165 }
1166
1167 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1168 {
1169         u16 eir_len = 0;
1170         size_t name_len;
1171
1172         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1173                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1174                                           hdev->dev_class, 3);
1175
1176         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1177                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1178                                           hdev->appearance);
1179
1180         name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name));
1181         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1182                                   hdev->dev_name, name_len);
1183
1184         name_len = strnlen(hdev->short_name, sizeof(hdev->short_name));
1185         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1186                                   hdev->short_name, name_len);
1187
1188         return eir_len;
1189 }
1190
1191 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1192                                     void *data, u16 data_len)
1193 {
1194         char buf[512];
1195         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1196         u16 eir_len;
1197
1198         bt_dev_dbg(hdev, "sock %p", sk);
1199
1200         memset(&buf, 0, sizeof(buf));
1201
1202         hci_dev_lock(hdev);
1203
1204         bacpy(&rp->bdaddr, &hdev->bdaddr);
1205
1206         rp->version = hdev->hci_ver;
1207         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1208
1209         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1210         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1211
1212
1213         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1214         rp->eir_len = cpu_to_le16(eir_len);
1215
1216         hci_dev_unlock(hdev);
1217
1218         /* If this command is called at least once, then the events
1219          * for class of device and local name changes are disabled
1220          * and only the new extended controller information event
1221          * is used.
1222          */
1223         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1224         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1225         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1226
1227         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1228                                  sizeof(*rp) + eir_len);
1229 }
1230
1231 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1232 {
1233         char buf[512];
1234         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1235         u16 eir_len;
1236
1237         memset(buf, 0, sizeof(buf));
1238
1239         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1240         ev->eir_len = cpu_to_le16(eir_len);
1241
1242         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1243                                   sizeof(*ev) + eir_len,
1244                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1245 }
1246
1247 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1248 {
1249         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1250
1251         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1252                                  sizeof(settings));
1253 }
1254
1255 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1256 {
1257         struct mgmt_ev_advertising_added ev;
1258
1259         ev.instance = instance;
1260
1261         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1262 }
1263
1264 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1265                               u8 instance)
1266 {
1267         struct mgmt_ev_advertising_removed ev;
1268
1269         ev.instance = instance;
1270
1271         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1272 }
1273
1274 static void cancel_adv_timeout(struct hci_dev *hdev)
1275 {
1276         if (hdev->adv_instance_timeout) {
1277                 hdev->adv_instance_timeout = 0;
1278                 cancel_delayed_work(&hdev->adv_instance_expire);
1279         }
1280 }
1281
1282 /* This function requires the caller holds hdev->lock */
1283 static void restart_le_actions(struct hci_dev *hdev)
1284 {
1285         struct hci_conn_params *p;
1286
1287         list_for_each_entry(p, &hdev->le_conn_params, list) {
1288                 /* Needed for AUTO_OFF case where might not "really"
1289                  * have been powered off.
1290                  */
1291                 list_del_init(&p->action);
1292
1293                 switch (p->auto_connect) {
1294                 case HCI_AUTO_CONN_DIRECT:
1295                 case HCI_AUTO_CONN_ALWAYS:
1296                         list_add(&p->action, &hdev->pend_le_conns);
1297                         break;
1298                 case HCI_AUTO_CONN_REPORT:
1299                         list_add(&p->action, &hdev->pend_le_reports);
1300                         break;
1301                 default:
1302                         break;
1303                 }
1304         }
1305 }
1306
1307 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1308 {
1309         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1310
1311         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1312                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1313 }
1314
1315 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
1316 {
1317         struct mgmt_pending_cmd *cmd = data;
1318         struct mgmt_mode *cp;
1319
1320         /* Make sure cmd still outstanding. */
1321         if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
1322                 return;
1323
1324         cp = cmd->param;
1325
1326         bt_dev_dbg(hdev, "err %d", err);
1327
1328         if (!err) {
1329                 if (cp->val) {
1330                         hci_dev_lock(hdev);
1331                         restart_le_actions(hdev);
1332                         hci_update_passive_scan(hdev);
1333                         hci_dev_unlock(hdev);
1334                 }
1335
1336                 send_settings_rsp(cmd->sk, cmd->opcode, hdev);
1337
1338                 /* Only call new_setting for power on as power off is deferred
1339                  * to hdev->power_off work which does call hci_dev_do_close.
1340                  */
1341                 if (cp->val)
1342                         new_settings(hdev, cmd->sk);
1343         } else {
1344                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED,
1345                                 mgmt_status(err));
1346         }
1347
1348         mgmt_pending_remove(cmd);
1349 }
1350
1351 static int set_powered_sync(struct hci_dev *hdev, void *data)
1352 {
1353         struct mgmt_pending_cmd *cmd = data;
1354         struct mgmt_mode *cp = cmd->param;
1355
1356         BT_DBG("%s", hdev->name);
1357
1358         return hci_set_powered_sync(hdev, cp->val);
1359 }
1360
1361 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1362                        u16 len)
1363 {
1364         struct mgmt_mode *cp = data;
1365         struct mgmt_pending_cmd *cmd;
1366         int err;
1367
1368         bt_dev_dbg(hdev, "sock %p", sk);
1369
1370         if (cp->val != 0x00 && cp->val != 0x01)
1371                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1372                                        MGMT_STATUS_INVALID_PARAMS);
1373
1374         hci_dev_lock(hdev);
1375
1376         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1377                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1378                                       MGMT_STATUS_BUSY);
1379                 goto failed;
1380         }
1381
1382         if (!!cp->val == hdev_is_powered(hdev)) {
1383                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1384                 goto failed;
1385         }
1386
1387         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1388         if (!cmd) {
1389                 err = -ENOMEM;
1390                 goto failed;
1391         }
1392
1393         err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd,
1394                                  mgmt_set_powered_complete);
1395
1396         if (err < 0)
1397                 mgmt_pending_remove(cmd);
1398
1399 failed:
1400         hci_dev_unlock(hdev);
1401         return err;
1402 }
1403
1404 int mgmt_new_settings(struct hci_dev *hdev)
1405 {
1406         return new_settings(hdev, NULL);
1407 }
1408
1409 struct cmd_lookup {
1410         struct sock *sk;
1411         struct hci_dev *hdev;
1412         u8 mgmt_status;
1413 };
1414
1415 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1416 {
1417         struct cmd_lookup *match = data;
1418
1419         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1420
1421         list_del(&cmd->list);
1422
1423         if (match->sk == NULL) {
1424                 match->sk = cmd->sk;
1425                 sock_hold(match->sk);
1426         }
1427
1428         mgmt_pending_free(cmd);
1429 }
1430
1431 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1432 {
1433         u8 *status = data;
1434
1435         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1436         mgmt_pending_remove(cmd);
1437 }
1438
1439 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1440 {
1441         if (cmd->cmd_complete) {
1442                 u8 *status = data;
1443
1444                 cmd->cmd_complete(cmd, *status);
1445                 mgmt_pending_remove(cmd);
1446
1447                 return;
1448         }
1449
1450         cmd_status_rsp(cmd, data);
1451 }
1452
1453 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1454 {
1455         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1456                                  cmd->param, cmd->param_len);
1457 }
1458
1459 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1460 {
1461         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1462                                  cmd->param, sizeof(struct mgmt_addr_info));
1463 }
1464
1465 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1466 {
1467         if (!lmp_bredr_capable(hdev))
1468                 return MGMT_STATUS_NOT_SUPPORTED;
1469         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1470                 return MGMT_STATUS_REJECTED;
1471         else
1472                 return MGMT_STATUS_SUCCESS;
1473 }
1474
1475 static u8 mgmt_le_support(struct hci_dev *hdev)
1476 {
1477         if (!lmp_le_capable(hdev))
1478                 return MGMT_STATUS_NOT_SUPPORTED;
1479         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1480                 return MGMT_STATUS_REJECTED;
1481         else
1482                 return MGMT_STATUS_SUCCESS;
1483 }
1484
1485 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
1486                                            int err)
1487 {
1488         struct mgmt_pending_cmd *cmd = data;
1489
1490         bt_dev_dbg(hdev, "err %d", err);
1491
1492         /* Make sure cmd still outstanding. */
1493         if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
1494                 return;
1495
1496         hci_dev_lock(hdev);
1497
1498         if (err) {
1499                 u8 mgmt_err = mgmt_status(err);
1500                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1501                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1502                 goto done;
1503         }
1504
1505         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1506             hdev->discov_timeout > 0) {
1507                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1508                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1509         }
1510
1511         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1512         new_settings(hdev, cmd->sk);
1513
1514 done:
1515         mgmt_pending_remove(cmd);
1516         hci_dev_unlock(hdev);
1517 }
1518
1519 static int set_discoverable_sync(struct hci_dev *hdev, void *data)
1520 {
1521         BT_DBG("%s", hdev->name);
1522
1523         return hci_update_discoverable_sync(hdev);
1524 }
1525
1526 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1527                             u16 len)
1528 {
1529         struct mgmt_cp_set_discoverable *cp = data;
1530         struct mgmt_pending_cmd *cmd;
1531         u16 timeout;
1532         int err;
1533
1534         bt_dev_dbg(hdev, "sock %p", sk);
1535
1536         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1537             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1538                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1539                                        MGMT_STATUS_REJECTED);
1540
1541         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1542                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1543                                        MGMT_STATUS_INVALID_PARAMS);
1544
1545         timeout = __le16_to_cpu(cp->timeout);
1546
1547         /* Disabling discoverable requires that no timeout is set,
1548          * and enabling limited discoverable requires a timeout.
1549          */
1550         if ((cp->val == 0x00 && timeout > 0) ||
1551             (cp->val == 0x02 && timeout == 0))
1552                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1553                                        MGMT_STATUS_INVALID_PARAMS);
1554
1555         hci_dev_lock(hdev);
1556
1557         if (!hdev_is_powered(hdev) && timeout > 0) {
1558                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1559                                       MGMT_STATUS_NOT_POWERED);
1560                 goto failed;
1561         }
1562
1563         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1564             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1565                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1566                                       MGMT_STATUS_BUSY);
1567                 goto failed;
1568         }
1569
1570         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1571                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1572                                       MGMT_STATUS_REJECTED);
1573                 goto failed;
1574         }
1575
1576         if (hdev->advertising_paused) {
1577                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1578                                       MGMT_STATUS_BUSY);
1579                 goto failed;
1580         }
1581
1582         if (!hdev_is_powered(hdev)) {
1583                 bool changed = false;
1584
1585                 /* Setting limited discoverable when powered off is
1586                  * not a valid operation since it requires a timeout
1587                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1588                  */
1589                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1590                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1591                         changed = true;
1592                 }
1593
1594                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1595                 if (err < 0)
1596                         goto failed;
1597
1598                 if (changed)
1599                         err = new_settings(hdev, sk);
1600
1601                 goto failed;
1602         }
1603
1604         /* If the current mode is the same, then just update the timeout
1605          * value with the new value. And if only the timeout gets updated,
1606          * then no need for any HCI transactions.
1607          */
1608         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1609             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1610                                                    HCI_LIMITED_DISCOVERABLE)) {
1611                 cancel_delayed_work(&hdev->discov_off);
1612                 hdev->discov_timeout = timeout;
1613
1614                 if (cp->val && hdev->discov_timeout > 0) {
1615                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1616                         queue_delayed_work(hdev->req_workqueue,
1617                                            &hdev->discov_off, to);
1618                 }
1619
1620                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1621                 goto failed;
1622         }
1623
1624         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1625         if (!cmd) {
1626                 err = -ENOMEM;
1627                 goto failed;
1628         }
1629
1630         /* Cancel any potential discoverable timeout that might be
1631          * still active and store new timeout value. The arming of
1632          * the timeout happens in the complete handler.
1633          */
1634         cancel_delayed_work(&hdev->discov_off);
1635         hdev->discov_timeout = timeout;
1636
1637         if (cp->val)
1638                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1639         else
1640                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1641
1642         /* Limited discoverable mode */
1643         if (cp->val == 0x02)
1644                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1645         else
1646                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1647
1648         err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd,
1649                                  mgmt_set_discoverable_complete);
1650
1651         if (err < 0)
1652                 mgmt_pending_remove(cmd);
1653
1654 failed:
1655         hci_dev_unlock(hdev);
1656         return err;
1657 }
1658
1659 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
1660                                           int err)
1661 {
1662         struct mgmt_pending_cmd *cmd = data;
1663
1664         bt_dev_dbg(hdev, "err %d", err);
1665
1666         /* Make sure cmd still outstanding. */
1667         if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
1668                 return;
1669
1670         hci_dev_lock(hdev);
1671
1672         if (err) {
1673                 u8 mgmt_err = mgmt_status(err);
1674                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1675                 goto done;
1676         }
1677
1678         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1679         new_settings(hdev, cmd->sk);
1680
1681 done:
1682         if (cmd)
1683                 mgmt_pending_remove(cmd);
1684
1685         hci_dev_unlock(hdev);
1686 }
1687
1688 static int set_connectable_update_settings(struct hci_dev *hdev,
1689                                            struct sock *sk, u8 val)
1690 {
1691         bool changed = false;
1692         int err;
1693
1694         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1695                 changed = true;
1696
1697         if (val) {
1698                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1699         } else {
1700                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1701                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1702         }
1703
1704         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1705         if (err < 0)
1706                 return err;
1707
1708         if (changed) {
1709                 hci_update_scan(hdev);
1710                 hci_update_passive_scan(hdev);
1711                 return new_settings(hdev, sk);
1712         }
1713
1714         return 0;
1715 }
1716
1717 static int set_connectable_sync(struct hci_dev *hdev, void *data)
1718 {
1719         BT_DBG("%s", hdev->name);
1720
1721         return hci_update_connectable_sync(hdev);
1722 }
1723
1724 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1725                            u16 len)
1726 {
1727         struct mgmt_mode *cp = data;
1728         struct mgmt_pending_cmd *cmd;
1729         int err;
1730
1731         bt_dev_dbg(hdev, "sock %p", sk);
1732
1733         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1734             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1735                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1736                                        MGMT_STATUS_REJECTED);
1737
1738         if (cp->val != 0x00 && cp->val != 0x01)
1739                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1740                                        MGMT_STATUS_INVALID_PARAMS);
1741
1742         hci_dev_lock(hdev);
1743
1744         if (!hdev_is_powered(hdev)) {
1745                 err = set_connectable_update_settings(hdev, sk, cp->val);
1746                 goto failed;
1747         }
1748
1749         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1750             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1751                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1752                                       MGMT_STATUS_BUSY);
1753                 goto failed;
1754         }
1755
1756         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1757         if (!cmd) {
1758                 err = -ENOMEM;
1759                 goto failed;
1760         }
1761
1762         if (cp->val) {
1763                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1764         } else {
1765                 if (hdev->discov_timeout > 0)
1766                         cancel_delayed_work(&hdev->discov_off);
1767
1768                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1769                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1770                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1771         }
1772
1773         err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd,
1774                                  mgmt_set_connectable_complete);
1775
1776         if (err < 0)
1777                 mgmt_pending_remove(cmd);
1778
1779 failed:
1780         hci_dev_unlock(hdev);
1781         return err;
1782 }
1783
1784 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1785                         u16 len)
1786 {
1787         struct mgmt_mode *cp = data;
1788         bool changed;
1789         int err;
1790
1791         bt_dev_dbg(hdev, "sock %p", sk);
1792
1793         if (cp->val != 0x00 && cp->val != 0x01)
1794                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1795                                        MGMT_STATUS_INVALID_PARAMS);
1796
1797         hci_dev_lock(hdev);
1798
1799         if (cp->val)
1800                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1801         else
1802                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1803
1804         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1805         if (err < 0)
1806                 goto unlock;
1807
1808         if (changed) {
1809                 /* In limited privacy mode the change of bondable mode
1810                  * may affect the local advertising address.
1811                  */
1812                 hci_update_discoverable(hdev);
1813
1814                 err = new_settings(hdev, sk);
1815         }
1816
1817 unlock:
1818         hci_dev_unlock(hdev);
1819         return err;
1820 }
1821
1822 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1823                              u16 len)
1824 {
1825         struct mgmt_mode *cp = data;
1826         struct mgmt_pending_cmd *cmd;
1827         u8 val, status;
1828         int err;
1829
1830         bt_dev_dbg(hdev, "sock %p", sk);
1831
1832         status = mgmt_bredr_support(hdev);
1833         if (status)
1834                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1835                                        status);
1836
1837         if (cp->val != 0x00 && cp->val != 0x01)
1838                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1839                                        MGMT_STATUS_INVALID_PARAMS);
1840
1841         hci_dev_lock(hdev);
1842
1843         if (!hdev_is_powered(hdev)) {
1844                 bool changed = false;
1845
1846                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1847                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1848                         changed = true;
1849                 }
1850
1851                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1852                 if (err < 0)
1853                         goto failed;
1854
1855                 if (changed)
1856                         err = new_settings(hdev, sk);
1857
1858                 goto failed;
1859         }
1860
1861         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1862                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1863                                       MGMT_STATUS_BUSY);
1864                 goto failed;
1865         }
1866
1867         val = !!cp->val;
1868
1869         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1870                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1871                 goto failed;
1872         }
1873
1874         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1875         if (!cmd) {
1876                 err = -ENOMEM;
1877                 goto failed;
1878         }
1879
1880         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1881         if (err < 0) {
1882                 mgmt_pending_remove(cmd);
1883                 goto failed;
1884         }
1885
1886 failed:
1887         hci_dev_unlock(hdev);
1888         return err;
1889 }
1890
1891 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
1892 {
1893         struct cmd_lookup match = { NULL, hdev };
1894         struct mgmt_pending_cmd *cmd = data;
1895         struct mgmt_mode *cp = cmd->param;
1896         u8 enable = cp->val;
1897         bool changed;
1898
1899         /* Make sure cmd still outstanding. */
1900         if (cmd != pending_find(MGMT_OP_SET_SSP, hdev))
1901                 return;
1902
1903         if (err) {
1904                 u8 mgmt_err = mgmt_status(err);
1905
1906                 if (enable && hci_dev_test_and_clear_flag(hdev,
1907                                                           HCI_SSP_ENABLED)) {
1908                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1909                         new_settings(hdev, NULL);
1910                 }
1911
1912                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
1913                                      &mgmt_err);
1914                 return;
1915         }
1916
1917         if (enable) {
1918                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1919         } else {
1920                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
1921
1922                 if (!changed)
1923                         changed = hci_dev_test_and_clear_flag(hdev,
1924                                                               HCI_HS_ENABLED);
1925                 else
1926                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1927         }
1928
1929         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
1930
1931         if (changed)
1932                 new_settings(hdev, match.sk);
1933
1934         if (match.sk)
1935                 sock_put(match.sk);
1936
1937         hci_update_eir_sync(hdev);
1938 }
1939
1940 static int set_ssp_sync(struct hci_dev *hdev, void *data)
1941 {
1942         struct mgmt_pending_cmd *cmd = data;
1943         struct mgmt_mode *cp = cmd->param;
1944         bool changed = false;
1945         int err;
1946
1947         if (cp->val)
1948                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1949
1950         err = hci_write_ssp_mode_sync(hdev, cp->val);
1951
1952         if (!err && changed)
1953                 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
1954
1955         return err;
1956 }
1957
1958 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1959 {
1960         struct mgmt_mode *cp = data;
1961         struct mgmt_pending_cmd *cmd;
1962         u8 status;
1963         int err;
1964
1965         bt_dev_dbg(hdev, "sock %p", sk);
1966
1967         status = mgmt_bredr_support(hdev);
1968         if (status)
1969                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1970
1971         if (!lmp_ssp_capable(hdev))
1972                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1973                                        MGMT_STATUS_NOT_SUPPORTED);
1974
1975         if (cp->val != 0x00 && cp->val != 0x01)
1976                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1977                                        MGMT_STATUS_INVALID_PARAMS);
1978
1979         hci_dev_lock(hdev);
1980
1981         if (!hdev_is_powered(hdev)) {
1982                 bool changed;
1983
1984                 if (cp->val) {
1985                         changed = !hci_dev_test_and_set_flag(hdev,
1986                                                              HCI_SSP_ENABLED);
1987                 } else {
1988                         changed = hci_dev_test_and_clear_flag(hdev,
1989                                                               HCI_SSP_ENABLED);
1990                         if (!changed)
1991                                 changed = hci_dev_test_and_clear_flag(hdev,
1992                                                                       HCI_HS_ENABLED);
1993                         else
1994                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1995                 }
1996
1997                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1998                 if (err < 0)
1999                         goto failed;
2000
2001                 if (changed)
2002                         err = new_settings(hdev, sk);
2003
2004                 goto failed;
2005         }
2006
2007         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2008                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2009                                       MGMT_STATUS_BUSY);
2010                 goto failed;
2011         }
2012
2013         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2014                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2015                 goto failed;
2016         }
2017
2018         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2019         if (!cmd)
2020                 err = -ENOMEM;
2021         else
2022                 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd,
2023                                          set_ssp_complete);
2024
2025         if (err < 0) {
2026                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2027                                       MGMT_STATUS_FAILED);
2028
2029                 if (cmd)
2030                         mgmt_pending_remove(cmd);
2031         }
2032
2033 failed:
2034         hci_dev_unlock(hdev);
2035         return err;
2036 }
2037
2038 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2039 {
2040         struct mgmt_mode *cp = data;
2041         bool changed;
2042         u8 status;
2043         int err;
2044
2045         bt_dev_dbg(hdev, "sock %p", sk);
2046
2047         if (!IS_ENABLED(CONFIG_BT_HS))
2048                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2049                                        MGMT_STATUS_NOT_SUPPORTED);
2050
2051         status = mgmt_bredr_support(hdev);
2052         if (status)
2053                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2054
2055         if (!lmp_ssp_capable(hdev))
2056                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2057                                        MGMT_STATUS_NOT_SUPPORTED);
2058
2059         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
2060                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2061                                        MGMT_STATUS_REJECTED);
2062
2063         if (cp->val != 0x00 && cp->val != 0x01)
2064                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2065                                        MGMT_STATUS_INVALID_PARAMS);
2066
2067         hci_dev_lock(hdev);
2068
2069         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2070                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2071                                       MGMT_STATUS_BUSY);
2072                 goto unlock;
2073         }
2074
2075         if (cp->val) {
2076                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
2077         } else {
2078                 if (hdev_is_powered(hdev)) {
2079                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2080                                               MGMT_STATUS_REJECTED);
2081                         goto unlock;
2082                 }
2083
2084                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
2085         }
2086
2087         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2088         if (err < 0)
2089                 goto unlock;
2090
2091         if (changed)
2092                 err = new_settings(hdev, sk);
2093
2094 unlock:
2095         hci_dev_unlock(hdev);
2096         return err;
2097 }
2098
2099 static void set_le_complete(struct hci_dev *hdev, void *data, int err)
2100 {
2101         struct cmd_lookup match = { NULL, hdev };
2102         u8 status = mgmt_status(err);
2103
2104         bt_dev_dbg(hdev, "err %d", err);
2105
2106         if (status) {
2107                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2108                                                         &status);
2109                 return;
2110         }
2111
2112         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2113
2114         new_settings(hdev, match.sk);
2115
2116         if (match.sk)
2117                 sock_put(match.sk);
2118 }
2119
2120 static int set_le_sync(struct hci_dev *hdev, void *data)
2121 {
2122         struct mgmt_pending_cmd *cmd = data;
2123         struct mgmt_mode *cp = cmd->param;
2124         u8 val = !!cp->val;
2125         int err;
2126
2127         if (!val) {
2128                 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true);
2129
2130                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2131                         hci_disable_advertising_sync(hdev);
2132
2133                 if (ext_adv_capable(hdev))
2134                         hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk);
2135         } else {
2136                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2137         }
2138
2139         err = hci_write_le_host_supported_sync(hdev, val, 0);
2140
2141         /* Make sure the controller has a good default for
2142          * advertising data. Restrict the update to when LE
2143          * has actually been enabled. During power on, the
2144          * update in powered_update_hci will take care of it.
2145          */
2146         if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2147                 if (ext_adv_capable(hdev)) {
2148                         int status;
2149
2150                         status = hci_setup_ext_adv_instance_sync(hdev, 0x00);
2151                         if (!status)
2152                                 hci_update_scan_rsp_data_sync(hdev, 0x00);
2153                 } else {
2154                         hci_update_adv_data_sync(hdev, 0x00);
2155                         hci_update_scan_rsp_data_sync(hdev, 0x00);
2156                 }
2157
2158                 hci_update_passive_scan(hdev);
2159         }
2160
2161         return err;
2162 }
2163
2164 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err)
2165 {
2166         struct mgmt_pending_cmd *cmd = data;
2167         u8 status = mgmt_status(err);
2168         struct sock *sk = cmd->sk;
2169
2170         if (status) {
2171                 mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev,
2172                                      cmd_status_rsp, &status);
2173                 return;
2174         }
2175
2176         mgmt_pending_remove(cmd);
2177         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0);
2178 }
2179
2180 static int set_mesh_sync(struct hci_dev *hdev, void *data)
2181 {
2182         struct mgmt_pending_cmd *cmd = data;
2183         struct mgmt_cp_set_mesh *cp = cmd->param;
2184         size_t len = cmd->param_len;
2185
2186         memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types));
2187
2188         if (cp->enable)
2189                 hci_dev_set_flag(hdev, HCI_MESH);
2190         else
2191                 hci_dev_clear_flag(hdev, HCI_MESH);
2192
2193         len -= sizeof(*cp);
2194
2195         /* If filters don't fit, forward all adv pkts */
2196         if (len <= sizeof(hdev->mesh_ad_types))
2197                 memcpy(hdev->mesh_ad_types, cp->ad_types, len);
2198
2199         hci_update_passive_scan_sync(hdev);
2200         return 0;
2201 }
2202
2203 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2204 {
2205         struct mgmt_cp_set_mesh *cp = data;
2206         struct mgmt_pending_cmd *cmd;
2207         int err = 0;
2208
2209         bt_dev_dbg(hdev, "sock %p", sk);
2210
2211         if (!lmp_le_capable(hdev) ||
2212             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2213                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2214                                        MGMT_STATUS_NOT_SUPPORTED);
2215
2216         if (cp->enable != 0x00 && cp->enable != 0x01)
2217                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2218                                        MGMT_STATUS_INVALID_PARAMS);
2219
2220         hci_dev_lock(hdev);
2221
2222         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len);
2223         if (!cmd)
2224                 err = -ENOMEM;
2225         else
2226                 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd,
2227                                          set_mesh_complete);
2228
2229         if (err < 0) {
2230                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2231                                       MGMT_STATUS_FAILED);
2232
2233                 if (cmd)
2234                         mgmt_pending_remove(cmd);
2235         }
2236
2237         hci_dev_unlock(hdev);
2238         return err;
2239 }
2240
2241 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err)
2242 {
2243         struct mgmt_mesh_tx *mesh_tx = data;
2244         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2245         unsigned long mesh_send_interval;
2246         u8 mgmt_err = mgmt_status(err);
2247
2248         /* Report any errors here, but don't report completion */
2249
2250         if (mgmt_err) {
2251                 hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
2252                 /* Send Complete Error Code for handle */
2253                 mesh_send_complete(hdev, mesh_tx, false);
2254                 return;
2255         }
2256
2257         mesh_send_interval = msecs_to_jiffies((send->cnt) * 25);
2258         queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done,
2259                            mesh_send_interval);
2260 }
2261
2262 static int mesh_send_sync(struct hci_dev *hdev, void *data)
2263 {
2264         struct mgmt_mesh_tx *mesh_tx = data;
2265         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2266         struct adv_info *adv, *next_instance;
2267         u8 instance = hdev->le_num_of_adv_sets + 1;
2268         u16 timeout, duration;
2269         int err = 0;
2270
2271         if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt)
2272                 return MGMT_STATUS_BUSY;
2273
2274         timeout = 1000;
2275         duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval);
2276         adv = hci_add_adv_instance(hdev, instance, 0,
2277                                    send->adv_data_len, send->adv_data,
2278                                    0, NULL,
2279                                    timeout, duration,
2280                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
2281                                    hdev->le_adv_min_interval,
2282                                    hdev->le_adv_max_interval,
2283                                    mesh_tx->handle);
2284
2285         if (!IS_ERR(adv))
2286                 mesh_tx->instance = instance;
2287         else
2288                 err = PTR_ERR(adv);
2289
2290         if (hdev->cur_adv_instance == instance) {
2291                 /* If the currently advertised instance is being changed then
2292                  * cancel the current advertising and schedule the next
2293                  * instance. If there is only one instance then the overridden
2294                  * advertising data will be visible right away.
2295                  */
2296                 cancel_adv_timeout(hdev);
2297
2298                 next_instance = hci_get_next_instance(hdev, instance);
2299                 if (next_instance)
2300                         instance = next_instance->instance;
2301                 else
2302                         instance = 0;
2303         } else if (hdev->adv_instance_timeout) {
2304                 /* Immediately advertise the new instance if no other, or
2305                  * let it go naturally from queue if ADV is already happening
2306                  */
2307                 instance = 0;
2308         }
2309
2310         if (instance)
2311                 return hci_schedule_adv_instance_sync(hdev, instance, true);
2312
2313         return err;
2314 }
2315
2316 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data)
2317 {
2318         struct mgmt_rp_mesh_read_features *rp = data;
2319
2320         if (rp->used_handles >= rp->max_handles)
2321                 return;
2322
2323         rp->handles[rp->used_handles++] = mesh_tx->handle;
2324 }
2325
2326 static int mesh_features(struct sock *sk, struct hci_dev *hdev,
2327                          void *data, u16 len)
2328 {
2329         struct mgmt_rp_mesh_read_features rp;
2330
2331         if (!lmp_le_capable(hdev) ||
2332             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2333                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES,
2334                                        MGMT_STATUS_NOT_SUPPORTED);
2335
2336         memset(&rp, 0, sizeof(rp));
2337         rp.index = cpu_to_le16(hdev->id);
2338         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2339                 rp.max_handles = MESH_HANDLES_MAX;
2340
2341         hci_dev_lock(hdev);
2342
2343         if (rp.max_handles)
2344                 mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2345
2346         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp,
2347                           rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX);
2348
2349         hci_dev_unlock(hdev);
2350         return 0;
2351 }
2352
2353 static int send_cancel(struct hci_dev *hdev, void *data)
2354 {
2355         struct mgmt_pending_cmd *cmd = data;
2356         struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param;
2357         struct mgmt_mesh_tx *mesh_tx;
2358
2359         if (!cancel->handle) {
2360                 do {
2361                         mesh_tx = mgmt_mesh_next(hdev, cmd->sk);
2362
2363                         if (mesh_tx)
2364                                 mesh_send_complete(hdev, mesh_tx, false);
2365                 } while (mesh_tx);
2366         } else {
2367                 mesh_tx = mgmt_mesh_find(hdev, cancel->handle);
2368
2369                 if (mesh_tx && mesh_tx->sk == cmd->sk)
2370                         mesh_send_complete(hdev, mesh_tx, false);
2371         }
2372
2373         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2374                           0, NULL, 0);
2375         mgmt_pending_free(cmd);
2376
2377         return 0;
2378 }
2379
2380 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev,
2381                             void *data, u16 len)
2382 {
2383         struct mgmt_pending_cmd *cmd;
2384         int err;
2385
2386         if (!lmp_le_capable(hdev) ||
2387             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2388                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2389                                        MGMT_STATUS_NOT_SUPPORTED);
2390
2391         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2392                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2393                                        MGMT_STATUS_REJECTED);
2394
2395         hci_dev_lock(hdev);
2396         cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len);
2397         if (!cmd)
2398                 err = -ENOMEM;
2399         else
2400                 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL);
2401
2402         if (err < 0) {
2403                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2404                                       MGMT_STATUS_FAILED);
2405
2406                 if (cmd)
2407                         mgmt_pending_free(cmd);
2408         }
2409
2410         hci_dev_unlock(hdev);
2411         return err;
2412 }
2413
2414 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2415 {
2416         struct mgmt_mesh_tx *mesh_tx;
2417         struct mgmt_cp_mesh_send *send = data;
2418         struct mgmt_rp_mesh_read_features rp;
2419         bool sending;
2420         int err = 0;
2421
2422         if (!lmp_le_capable(hdev) ||
2423             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2424                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2425                                        MGMT_STATUS_NOT_SUPPORTED);
2426         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) ||
2427             len <= MGMT_MESH_SEND_SIZE ||
2428             len > (MGMT_MESH_SEND_SIZE + 31))
2429                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2430                                        MGMT_STATUS_REJECTED);
2431
2432         hci_dev_lock(hdev);
2433
2434         memset(&rp, 0, sizeof(rp));
2435         rp.max_handles = MESH_HANDLES_MAX;
2436
2437         mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2438
2439         if (rp.max_handles <= rp.used_handles) {
2440                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2441                                       MGMT_STATUS_BUSY);
2442                 goto done;
2443         }
2444
2445         sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING);
2446         mesh_tx = mgmt_mesh_add(sk, hdev, send, len);
2447
2448         if (!mesh_tx)
2449                 err = -ENOMEM;
2450         else if (!sending)
2451                 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
2452                                          mesh_send_start_complete);
2453
2454         if (err < 0) {
2455                 bt_dev_err(hdev, "Send Mesh Failed %d", err);
2456                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2457                                       MGMT_STATUS_FAILED);
2458
2459                 if (mesh_tx) {
2460                         if (sending)
2461                                 mgmt_mesh_remove(mesh_tx);
2462                 }
2463         } else {
2464                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
2465
2466                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0,
2467                                   &mesh_tx->handle, 1);
2468         }
2469
2470 done:
2471         hci_dev_unlock(hdev);
2472         return err;
2473 }
2474
2475 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2476 {
2477         struct mgmt_mode *cp = data;
2478         struct mgmt_pending_cmd *cmd;
2479         int err;
2480         u8 val, enabled;
2481
2482         bt_dev_dbg(hdev, "sock %p", sk);
2483
2484         if (!lmp_le_capable(hdev))
2485                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2486                                        MGMT_STATUS_NOT_SUPPORTED);
2487
2488         if (cp->val != 0x00 && cp->val != 0x01)
2489                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2490                                        MGMT_STATUS_INVALID_PARAMS);
2491
2492         /* Bluetooth single mode LE only controllers or dual-mode
2493          * controllers configured as LE only devices, do not allow
2494          * switching LE off. These have either LE enabled explicitly
2495          * or BR/EDR has been previously switched off.
2496          *
2497          * When trying to enable an already enabled LE, then gracefully
2498          * send a positive response. Trying to disable it however will
2499          * result into rejection.
2500          */
2501         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2502                 if (cp->val == 0x01)
2503                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2504
2505                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2506                                        MGMT_STATUS_REJECTED);
2507         }
2508
2509         hci_dev_lock(hdev);
2510
2511         val = !!cp->val;
2512         enabled = lmp_host_le_capable(hdev);
2513
2514         if (!hdev_is_powered(hdev) || val == enabled) {
2515                 bool changed = false;
2516
2517                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2518                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2519                         changed = true;
2520                 }
2521
2522                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2523                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2524                         changed = true;
2525                 }
2526
2527                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2528                 if (err < 0)
2529                         goto unlock;
2530
2531                 if (changed)
2532                         err = new_settings(hdev, sk);
2533
2534                 goto unlock;
2535         }
2536
2537         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2538             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2539                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2540                                       MGMT_STATUS_BUSY);
2541                 goto unlock;
2542         }
2543
2544         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2545         if (!cmd)
2546                 err = -ENOMEM;
2547         else
2548                 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd,
2549                                          set_le_complete);
2550
2551         if (err < 0) {
2552                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2553                                       MGMT_STATUS_FAILED);
2554
2555                 if (cmd)
2556                         mgmt_pending_remove(cmd);
2557         }
2558
2559 unlock:
2560         hci_dev_unlock(hdev);
2561         return err;
2562 }
2563
2564 /* This is a helper function to test for pending mgmt commands that can
2565  * cause CoD or EIR HCI commands. We can only allow one such pending
2566  * mgmt command at a time since otherwise we cannot easily track what
2567  * the current values are, will be, and based on that calculate if a new
2568  * HCI command needs to be sent and if yes with what value.
2569  */
2570 static bool pending_eir_or_class(struct hci_dev *hdev)
2571 {
2572         struct mgmt_pending_cmd *cmd;
2573
2574         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2575                 switch (cmd->opcode) {
2576                 case MGMT_OP_ADD_UUID:
2577                 case MGMT_OP_REMOVE_UUID:
2578                 case MGMT_OP_SET_DEV_CLASS:
2579                 case MGMT_OP_SET_POWERED:
2580                         return true;
2581                 }
2582         }
2583
2584         return false;
2585 }
2586
2587 static const u8 bluetooth_base_uuid[] = {
2588                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2589                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2590 };
2591
2592 static u8 get_uuid_size(const u8 *uuid)
2593 {
2594         u32 val;
2595
2596         if (memcmp(uuid, bluetooth_base_uuid, 12))
2597                 return 128;
2598
2599         val = get_unaligned_le32(&uuid[12]);
2600         if (val > 0xffff)
2601                 return 32;
2602
2603         return 16;
2604 }
2605
2606 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err)
2607 {
2608         struct mgmt_pending_cmd *cmd = data;
2609
2610         bt_dev_dbg(hdev, "err %d", err);
2611
2612         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2613                           mgmt_status(err), hdev->dev_class, 3);
2614
2615         mgmt_pending_free(cmd);
2616 }
2617
2618 static int add_uuid_sync(struct hci_dev *hdev, void *data)
2619 {
2620         int err;
2621
2622         err = hci_update_class_sync(hdev);
2623         if (err)
2624                 return err;
2625
2626         return hci_update_eir_sync(hdev);
2627 }
2628
2629 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2630 {
2631         struct mgmt_cp_add_uuid *cp = data;
2632         struct mgmt_pending_cmd *cmd;
2633         struct bt_uuid *uuid;
2634         int err;
2635
2636         bt_dev_dbg(hdev, "sock %p", sk);
2637
2638         hci_dev_lock(hdev);
2639
2640         if (pending_eir_or_class(hdev)) {
2641                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2642                                       MGMT_STATUS_BUSY);
2643                 goto failed;
2644         }
2645
2646         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2647         if (!uuid) {
2648                 err = -ENOMEM;
2649                 goto failed;
2650         }
2651
2652         memcpy(uuid->uuid, cp->uuid, 16);
2653         uuid->svc_hint = cp->svc_hint;
2654         uuid->size = get_uuid_size(cp->uuid);
2655
2656         list_add_tail(&uuid->list, &hdev->uuids);
2657
2658         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2659         if (!cmd) {
2660                 err = -ENOMEM;
2661                 goto failed;
2662         }
2663
2664         err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete);
2665         if (err < 0) {
2666                 mgmt_pending_free(cmd);
2667                 goto failed;
2668         }
2669
2670 failed:
2671         hci_dev_unlock(hdev);
2672         return err;
2673 }
2674
2675 static bool enable_service_cache(struct hci_dev *hdev)
2676 {
2677         if (!hdev_is_powered(hdev))
2678                 return false;
2679
2680         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2681                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2682                                    CACHE_TIMEOUT);
2683                 return true;
2684         }
2685
2686         return false;
2687 }
2688
2689 static int remove_uuid_sync(struct hci_dev *hdev, void *data)
2690 {
2691         int err;
2692
2693         err = hci_update_class_sync(hdev);
2694         if (err)
2695                 return err;
2696
2697         return hci_update_eir_sync(hdev);
2698 }
2699
2700 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2701                        u16 len)
2702 {
2703         struct mgmt_cp_remove_uuid *cp = data;
2704         struct mgmt_pending_cmd *cmd;
2705         struct bt_uuid *match, *tmp;
2706         static const u8 bt_uuid_any[] = {
2707                 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
2708         };
2709         int err, found;
2710
2711         bt_dev_dbg(hdev, "sock %p", sk);
2712
2713         hci_dev_lock(hdev);
2714
2715         if (pending_eir_or_class(hdev)) {
2716                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2717                                       MGMT_STATUS_BUSY);
2718                 goto unlock;
2719         }
2720
2721         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2722                 hci_uuids_clear(hdev);
2723
2724                 if (enable_service_cache(hdev)) {
2725                         err = mgmt_cmd_complete(sk, hdev->id,
2726                                                 MGMT_OP_REMOVE_UUID,
2727                                                 0, hdev->dev_class, 3);
2728                         goto unlock;
2729                 }
2730
2731                 goto update_class;
2732         }
2733
2734         found = 0;
2735
2736         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2737                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2738                         continue;
2739
2740                 list_del(&match->list);
2741                 kfree(match);
2742                 found++;
2743         }
2744
2745         if (found == 0) {
2746                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2747                                       MGMT_STATUS_INVALID_PARAMS);
2748                 goto unlock;
2749         }
2750
2751 update_class:
2752         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2753         if (!cmd) {
2754                 err = -ENOMEM;
2755                 goto unlock;
2756         }
2757
2758         err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd,
2759                                  mgmt_class_complete);
2760         if (err < 0)
2761                 mgmt_pending_free(cmd);
2762
2763 unlock:
2764         hci_dev_unlock(hdev);
2765         return err;
2766 }
2767
2768 static int set_class_sync(struct hci_dev *hdev, void *data)
2769 {
2770         int err = 0;
2771
2772         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2773                 cancel_delayed_work_sync(&hdev->service_cache);
2774                 err = hci_update_eir_sync(hdev);
2775         }
2776
2777         if (err)
2778                 return err;
2779
2780         return hci_update_class_sync(hdev);
2781 }
2782
2783 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2784                          u16 len)
2785 {
2786         struct mgmt_cp_set_dev_class *cp = data;
2787         struct mgmt_pending_cmd *cmd;
2788         int err;
2789
2790         bt_dev_dbg(hdev, "sock %p", sk);
2791
2792         if (!lmp_bredr_capable(hdev))
2793                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2794                                        MGMT_STATUS_NOT_SUPPORTED);
2795
2796         hci_dev_lock(hdev);
2797
2798         if (pending_eir_or_class(hdev)) {
2799                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2800                                       MGMT_STATUS_BUSY);
2801                 goto unlock;
2802         }
2803
2804         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2805                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2806                                       MGMT_STATUS_INVALID_PARAMS);
2807                 goto unlock;
2808         }
2809
2810         hdev->major_class = cp->major;
2811         hdev->minor_class = cp->minor;
2812
2813         if (!hdev_is_powered(hdev)) {
2814                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2815                                         hdev->dev_class, 3);
2816                 goto unlock;
2817         }
2818
2819         cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2820         if (!cmd) {
2821                 err = -ENOMEM;
2822                 goto unlock;
2823         }
2824
2825         err = hci_cmd_sync_queue(hdev, set_class_sync, cmd,
2826                                  mgmt_class_complete);
2827         if (err < 0)
2828                 mgmt_pending_free(cmd);
2829
2830 unlock:
2831         hci_dev_unlock(hdev);
2832         return err;
2833 }
2834
2835 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2836                           u16 len)
2837 {
2838         struct mgmt_cp_load_link_keys *cp = data;
2839         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2840                                    sizeof(struct mgmt_link_key_info));
2841         u16 key_count, expected_len;
2842         bool changed;
2843         int i;
2844
2845         bt_dev_dbg(hdev, "sock %p", sk);
2846
2847         if (!lmp_bredr_capable(hdev))
2848                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2849                                        MGMT_STATUS_NOT_SUPPORTED);
2850
2851         key_count = __le16_to_cpu(cp->key_count);
2852         if (key_count > max_key_count) {
2853                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2854                            key_count);
2855                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2856                                        MGMT_STATUS_INVALID_PARAMS);
2857         }
2858
2859         expected_len = struct_size(cp, keys, key_count);
2860         if (expected_len != len) {
2861                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2862                            expected_len, len);
2863                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2864                                        MGMT_STATUS_INVALID_PARAMS);
2865         }
2866
2867         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2868                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2869                                        MGMT_STATUS_INVALID_PARAMS);
2870
2871         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2872                    key_count);
2873
2874         for (i = 0; i < key_count; i++) {
2875                 struct mgmt_link_key_info *key = &cp->keys[i];
2876
2877                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2878                         return mgmt_cmd_status(sk, hdev->id,
2879                                                MGMT_OP_LOAD_LINK_KEYS,
2880                                                MGMT_STATUS_INVALID_PARAMS);
2881         }
2882
2883         hci_dev_lock(hdev);
2884
2885         hci_link_keys_clear(hdev);
2886
2887         if (cp->debug_keys)
2888                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2889         else
2890                 changed = hci_dev_test_and_clear_flag(hdev,
2891                                                       HCI_KEEP_DEBUG_KEYS);
2892
2893         if (changed)
2894                 new_settings(hdev, NULL);
2895
2896         for (i = 0; i < key_count; i++) {
2897                 struct mgmt_link_key_info *key = &cp->keys[i];
2898
2899                 if (hci_is_blocked_key(hdev,
2900                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2901                                        key->val)) {
2902                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2903                                     &key->addr.bdaddr);
2904                         continue;
2905                 }
2906
2907                 /* Always ignore debug keys and require a new pairing if
2908                  * the user wants to use them.
2909                  */
2910                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2911                         continue;
2912
2913                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2914                                  key->type, key->pin_len, NULL);
2915         }
2916
2917         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2918
2919         hci_dev_unlock(hdev);
2920
2921         return 0;
2922 }
2923
2924 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2925                            u8 addr_type, struct sock *skip_sk)
2926 {
2927         struct mgmt_ev_device_unpaired ev;
2928
2929         bacpy(&ev.addr.bdaddr, bdaddr);
2930         ev.addr.type = addr_type;
2931
2932         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2933                           skip_sk);
2934 }
2935
2936 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err)
2937 {
2938         struct mgmt_pending_cmd *cmd = data;
2939         struct mgmt_cp_unpair_device *cp = cmd->param;
2940
2941         if (!err)
2942                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
2943
2944         cmd->cmd_complete(cmd, err);
2945         mgmt_pending_free(cmd);
2946 }
2947
2948 static int unpair_device_sync(struct hci_dev *hdev, void *data)
2949 {
2950         struct mgmt_pending_cmd *cmd = data;
2951         struct mgmt_cp_unpair_device *cp = cmd->param;
2952         struct hci_conn *conn;
2953
2954         if (cp->addr.type == BDADDR_BREDR)
2955                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2956                                                &cp->addr.bdaddr);
2957         else
2958                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2959                                                le_addr_type(cp->addr.type));
2960
2961         if (!conn)
2962                 return 0;
2963
2964         return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
2965 }
2966
2967 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2968                          u16 len)
2969 {
2970         struct mgmt_cp_unpair_device *cp = data;
2971         struct mgmt_rp_unpair_device rp;
2972         struct hci_conn_params *params;
2973         struct mgmt_pending_cmd *cmd;
2974         struct hci_conn *conn;
2975         u8 addr_type;
2976         int err;
2977
2978         memset(&rp, 0, sizeof(rp));
2979         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2980         rp.addr.type = cp->addr.type;
2981
2982         if (!bdaddr_type_is_valid(cp->addr.type))
2983                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2984                                          MGMT_STATUS_INVALID_PARAMS,
2985                                          &rp, sizeof(rp));
2986
2987         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2988                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2989                                          MGMT_STATUS_INVALID_PARAMS,
2990                                          &rp, sizeof(rp));
2991
2992         hci_dev_lock(hdev);
2993
2994         if (!hdev_is_powered(hdev)) {
2995                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2996                                         MGMT_STATUS_NOT_POWERED, &rp,
2997                                         sizeof(rp));
2998                 goto unlock;
2999         }
3000
3001         if (cp->addr.type == BDADDR_BREDR) {
3002                 /* If disconnection is requested, then look up the
3003                  * connection. If the remote device is connected, it
3004                  * will be later used to terminate the link.
3005                  *
3006                  * Setting it to NULL explicitly will cause no
3007                  * termination of the link.
3008                  */
3009                 if (cp->disconnect)
3010                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3011                                                        &cp->addr.bdaddr);
3012                 else
3013                         conn = NULL;
3014
3015                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
3016                 if (err < 0) {
3017                         err = mgmt_cmd_complete(sk, hdev->id,
3018                                                 MGMT_OP_UNPAIR_DEVICE,
3019                                                 MGMT_STATUS_NOT_PAIRED, &rp,
3020                                                 sizeof(rp));
3021                         goto unlock;
3022                 }
3023
3024                 goto done;
3025         }
3026
3027         /* LE address type */
3028         addr_type = le_addr_type(cp->addr.type);
3029
3030         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
3031         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
3032         if (err < 0) {
3033                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3034                                         MGMT_STATUS_NOT_PAIRED, &rp,
3035                                         sizeof(rp));
3036                 goto unlock;
3037         }
3038
3039         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
3040         if (!conn) {
3041                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
3042                 goto done;
3043         }
3044
3045
3046         /* Defer clearing up the connection parameters until closing to
3047          * give a chance of keeping them if a repairing happens.
3048          */
3049         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3050
3051         /* Disable auto-connection parameters if present */
3052         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
3053         if (params) {
3054                 if (params->explicit_connect)
3055                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3056                 else
3057                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
3058         }
3059
3060         /* If disconnection is not requested, then clear the connection
3061          * variable so that the link is not terminated.
3062          */
3063         if (!cp->disconnect)
3064                 conn = NULL;
3065
3066 done:
3067         /* If the connection variable is set, then termination of the
3068          * link is requested.
3069          */
3070         if (!conn) {
3071                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3072                                         &rp, sizeof(rp));
3073                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
3074                 goto unlock;
3075         }
3076
3077         cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
3078                                sizeof(*cp));
3079         if (!cmd) {
3080                 err = -ENOMEM;
3081                 goto unlock;
3082         }
3083
3084         cmd->cmd_complete = addr_cmd_complete;
3085
3086         err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd,
3087                                  unpair_device_complete);
3088         if (err < 0)
3089                 mgmt_pending_free(cmd);
3090
3091 unlock:
3092         hci_dev_unlock(hdev);
3093         return err;
3094 }
3095
3096 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
3097                       u16 len)
3098 {
3099         struct mgmt_cp_disconnect *cp = data;
3100         struct mgmt_rp_disconnect rp;
3101         struct mgmt_pending_cmd *cmd;
3102         struct hci_conn *conn;
3103         int err;
3104
3105         bt_dev_dbg(hdev, "sock %p", sk);
3106
3107         memset(&rp, 0, sizeof(rp));
3108         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3109         rp.addr.type = cp->addr.type;
3110
3111         if (!bdaddr_type_is_valid(cp->addr.type))
3112                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3113                                          MGMT_STATUS_INVALID_PARAMS,
3114                                          &rp, sizeof(rp));
3115
3116         hci_dev_lock(hdev);
3117
3118         if (!test_bit(HCI_UP, &hdev->flags)) {
3119                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3120                                         MGMT_STATUS_NOT_POWERED, &rp,
3121                                         sizeof(rp));
3122                 goto failed;
3123         }
3124
3125         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
3126                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3127                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3128                 goto failed;
3129         }
3130
3131         if (cp->addr.type == BDADDR_BREDR)
3132                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3133                                                &cp->addr.bdaddr);
3134         else
3135                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3136                                                le_addr_type(cp->addr.type));
3137
3138         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
3139                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3140                                         MGMT_STATUS_NOT_CONNECTED, &rp,
3141                                         sizeof(rp));
3142                 goto failed;
3143         }
3144
3145         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3146         if (!cmd) {
3147                 err = -ENOMEM;
3148                 goto failed;
3149         }
3150
3151         cmd->cmd_complete = generic_cmd_complete;
3152
3153         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
3154         if (err < 0)
3155                 mgmt_pending_remove(cmd);
3156
3157 failed:
3158         hci_dev_unlock(hdev);
3159         return err;
3160 }
3161
3162 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3163 {
3164         switch (link_type) {
3165         case LE_LINK:
3166                 switch (addr_type) {
3167                 case ADDR_LE_DEV_PUBLIC:
3168                         return BDADDR_LE_PUBLIC;
3169
3170                 default:
3171                         /* Fallback to LE Random address type */
3172                         return BDADDR_LE_RANDOM;
3173                 }
3174
3175         default:
3176                 /* Fallback to BR/EDR type */
3177                 return BDADDR_BREDR;
3178         }
3179 }
3180
3181 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3182                            u16 data_len)
3183 {
3184         struct mgmt_rp_get_connections *rp;
3185         struct hci_conn *c;
3186         int err;
3187         u16 i;
3188
3189         bt_dev_dbg(hdev, "sock %p", sk);
3190
3191         hci_dev_lock(hdev);
3192
3193         if (!hdev_is_powered(hdev)) {
3194                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3195                                       MGMT_STATUS_NOT_POWERED);
3196                 goto unlock;
3197         }
3198
3199         i = 0;
3200         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3201                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3202                         i++;
3203         }
3204
3205         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
3206         if (!rp) {
3207                 err = -ENOMEM;
3208                 goto unlock;
3209         }
3210
3211         i = 0;
3212         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3213                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3214                         continue;
3215                 bacpy(&rp->addr[i].bdaddr, &c->dst);
3216                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3217                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3218                         continue;
3219                 i++;
3220         }
3221
3222         rp->conn_count = cpu_to_le16(i);
3223
3224         /* Recalculate length in case of filtered SCO connections, etc */
3225         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3226                                 struct_size(rp, addr, i));
3227
3228         kfree(rp);
3229
3230 unlock:
3231         hci_dev_unlock(hdev);
3232         return err;
3233 }
3234
3235 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3236                                    struct mgmt_cp_pin_code_neg_reply *cp)
3237 {
3238         struct mgmt_pending_cmd *cmd;
3239         int err;
3240
3241         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3242                                sizeof(*cp));
3243         if (!cmd)
3244                 return -ENOMEM;
3245
3246         cmd->cmd_complete = addr_cmd_complete;
3247
3248         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3249                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3250         if (err < 0)
3251                 mgmt_pending_remove(cmd);
3252
3253         return err;
3254 }
3255
3256 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3257                           u16 len)
3258 {
3259         struct hci_conn *conn;
3260         struct mgmt_cp_pin_code_reply *cp = data;
3261         struct hci_cp_pin_code_reply reply;
3262         struct mgmt_pending_cmd *cmd;
3263         int err;
3264
3265         bt_dev_dbg(hdev, "sock %p", sk);
3266
3267         hci_dev_lock(hdev);
3268
3269         if (!hdev_is_powered(hdev)) {
3270                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3271                                       MGMT_STATUS_NOT_POWERED);
3272                 goto failed;
3273         }
3274
3275         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3276         if (!conn) {
3277                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3278                                       MGMT_STATUS_NOT_CONNECTED);
3279                 goto failed;
3280         }
3281
3282         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3283                 struct mgmt_cp_pin_code_neg_reply ncp;
3284
3285                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3286
3287                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
3288
3289                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3290                 if (err >= 0)
3291                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3292                                               MGMT_STATUS_INVALID_PARAMS);
3293
3294                 goto failed;
3295         }
3296
3297         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3298         if (!cmd) {
3299                 err = -ENOMEM;
3300                 goto failed;
3301         }
3302
3303         cmd->cmd_complete = addr_cmd_complete;
3304
3305         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3306         reply.pin_len = cp->pin_len;
3307         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3308
3309         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3310         if (err < 0)
3311                 mgmt_pending_remove(cmd);
3312
3313 failed:
3314         hci_dev_unlock(hdev);
3315         return err;
3316 }
3317
3318 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3319                              u16 len)
3320 {
3321         struct mgmt_cp_set_io_capability *cp = data;
3322
3323         bt_dev_dbg(hdev, "sock %p", sk);
3324
3325         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3326                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3327                                        MGMT_STATUS_INVALID_PARAMS);
3328
3329         hci_dev_lock(hdev);
3330
3331         hdev->io_capability = cp->io_capability;
3332
3333         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
3334
3335         hci_dev_unlock(hdev);
3336
3337         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3338                                  NULL, 0);
3339 }
3340
3341 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
3342 {
3343         struct hci_dev *hdev = conn->hdev;
3344         struct mgmt_pending_cmd *cmd;
3345
3346         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3347                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3348                         continue;
3349
3350                 if (cmd->user_data != conn)
3351                         continue;
3352
3353                 return cmd;
3354         }
3355
3356         return NULL;
3357 }
3358
3359 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3360 {
3361         struct mgmt_rp_pair_device rp;
3362         struct hci_conn *conn = cmd->user_data;
3363         int err;
3364
3365         bacpy(&rp.addr.bdaddr, &conn->dst);
3366         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3367
3368         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3369                                 status, &rp, sizeof(rp));
3370
3371         /* So we don't get further callbacks for this connection */
3372         conn->connect_cfm_cb = NULL;
3373         conn->security_cfm_cb = NULL;
3374         conn->disconn_cfm_cb = NULL;
3375
3376         hci_conn_drop(conn);
3377
3378         /* The device is paired so there is no need to remove
3379          * its connection parameters anymore.
3380          */
3381         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3382
3383         hci_conn_put(conn);
3384
3385         return err;
3386 }
3387
3388 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3389 {
3390         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3391         struct mgmt_pending_cmd *cmd;
3392
3393         cmd = find_pairing(conn);
3394         if (cmd) {
3395                 cmd->cmd_complete(cmd, status);
3396                 mgmt_pending_remove(cmd);
3397         }
3398 }
3399
3400 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3401 {
3402         struct mgmt_pending_cmd *cmd;
3403
3404         BT_DBG("status %u", status);
3405
3406         cmd = find_pairing(conn);
3407         if (!cmd) {
3408                 BT_DBG("Unable to find a pending command");
3409                 return;
3410         }
3411
3412         cmd->cmd_complete(cmd, mgmt_status(status));
3413         mgmt_pending_remove(cmd);
3414 }
3415
3416 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3417 {
3418         struct mgmt_pending_cmd *cmd;
3419
3420         BT_DBG("status %u", status);
3421
3422         if (!status)
3423                 return;
3424
3425         cmd = find_pairing(conn);
3426         if (!cmd) {
3427                 BT_DBG("Unable to find a pending command");
3428                 return;
3429         }
3430
3431         cmd->cmd_complete(cmd, mgmt_status(status));
3432         mgmt_pending_remove(cmd);
3433 }
3434
3435 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3436                        u16 len)
3437 {
3438         struct mgmt_cp_pair_device *cp = data;
3439         struct mgmt_rp_pair_device rp;
3440         struct mgmt_pending_cmd *cmd;
3441         u8 sec_level, auth_type;
3442         struct hci_conn *conn;
3443         int err;
3444
3445         bt_dev_dbg(hdev, "sock %p", sk);
3446
3447         memset(&rp, 0, sizeof(rp));
3448         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3449         rp.addr.type = cp->addr.type;
3450
3451         if (!bdaddr_type_is_valid(cp->addr.type))
3452                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3453                                          MGMT_STATUS_INVALID_PARAMS,
3454                                          &rp, sizeof(rp));
3455
3456         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3457                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3458                                          MGMT_STATUS_INVALID_PARAMS,
3459                                          &rp, sizeof(rp));
3460
3461         hci_dev_lock(hdev);
3462
3463         if (!hdev_is_powered(hdev)) {
3464                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3465                                         MGMT_STATUS_NOT_POWERED, &rp,
3466                                         sizeof(rp));
3467                 goto unlock;
3468         }
3469
3470         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3471                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3472                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3473                                         sizeof(rp));
3474                 goto unlock;
3475         }
3476
3477         sec_level = BT_SECURITY_MEDIUM;
3478         auth_type = HCI_AT_DEDICATED_BONDING;
3479
3480         if (cp->addr.type == BDADDR_BREDR) {
3481                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3482                                        auth_type, CONN_REASON_PAIR_DEVICE);
3483         } else {
3484                 u8 addr_type = le_addr_type(cp->addr.type);
3485                 struct hci_conn_params *p;
3486
3487                 /* When pairing a new device, it is expected to remember
3488                  * this device for future connections. Adding the connection
3489                  * parameter information ahead of time allows tracking
3490                  * of the peripheral preferred values and will speed up any
3491                  * further connection establishment.
3492                  *
3493                  * If connection parameters already exist, then they
3494                  * will be kept and this function does nothing.
3495                  */
3496                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3497
3498                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
3499                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
3500
3501                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
3502                                            sec_level, HCI_LE_CONN_TIMEOUT,
3503                                            CONN_REASON_PAIR_DEVICE);
3504         }
3505
3506         if (IS_ERR(conn)) {
3507                 int status;
3508
3509                 if (PTR_ERR(conn) == -EBUSY)
3510                         status = MGMT_STATUS_BUSY;
3511                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3512                         status = MGMT_STATUS_NOT_SUPPORTED;
3513                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3514                         status = MGMT_STATUS_REJECTED;
3515                 else
3516                         status = MGMT_STATUS_CONNECT_FAILED;
3517
3518                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3519                                         status, &rp, sizeof(rp));
3520                 goto unlock;
3521         }
3522
3523         if (conn->connect_cfm_cb) {
3524                 hci_conn_drop(conn);
3525                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3526                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3527                 goto unlock;
3528         }
3529
3530         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3531         if (!cmd) {
3532                 err = -ENOMEM;
3533                 hci_conn_drop(conn);
3534                 goto unlock;
3535         }
3536
3537         cmd->cmd_complete = pairing_complete;
3538
3539         /* For LE, just connecting isn't a proof that the pairing finished */
3540         if (cp->addr.type == BDADDR_BREDR) {
3541                 conn->connect_cfm_cb = pairing_complete_cb;
3542                 conn->security_cfm_cb = pairing_complete_cb;
3543                 conn->disconn_cfm_cb = pairing_complete_cb;
3544         } else {
3545                 conn->connect_cfm_cb = le_pairing_complete_cb;
3546                 conn->security_cfm_cb = le_pairing_complete_cb;
3547                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3548         }
3549
3550         conn->io_capability = cp->io_cap;
3551         cmd->user_data = hci_conn_get(conn);
3552
3553         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3554             hci_conn_security(conn, sec_level, auth_type, true)) {
3555                 cmd->cmd_complete(cmd, 0);
3556                 mgmt_pending_remove(cmd);
3557         }
3558
3559         err = 0;
3560
3561 unlock:
3562         hci_dev_unlock(hdev);
3563         return err;
3564 }
3565
3566 static int abort_conn_sync(struct hci_dev *hdev, void *data)
3567 {
3568         struct hci_conn *conn;
3569         u16 handle = PTR_ERR(data);
3570
3571         conn = hci_conn_hash_lookup_handle(hdev, handle);
3572         if (!conn)
3573                 return 0;
3574
3575         return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
3576 }
3577
3578 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3579                               u16 len)
3580 {
3581         struct mgmt_addr_info *addr = data;
3582         struct mgmt_pending_cmd *cmd;
3583         struct hci_conn *conn;
3584         int err;
3585
3586         bt_dev_dbg(hdev, "sock %p", sk);
3587
3588         hci_dev_lock(hdev);
3589
3590         if (!hdev_is_powered(hdev)) {
3591                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3592                                       MGMT_STATUS_NOT_POWERED);
3593                 goto unlock;
3594         }
3595
3596         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3597         if (!cmd) {
3598                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3599                                       MGMT_STATUS_INVALID_PARAMS);
3600                 goto unlock;
3601         }
3602
3603         conn = cmd->user_data;
3604
3605         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3606                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3607                                       MGMT_STATUS_INVALID_PARAMS);
3608                 goto unlock;
3609         }
3610
3611         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3612         mgmt_pending_remove(cmd);
3613
3614         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3615                                 addr, sizeof(*addr));
3616
3617         /* Since user doesn't want to proceed with the connection, abort any
3618          * ongoing pairing and then terminate the link if it was created
3619          * because of the pair device action.
3620          */
3621         if (addr->type == BDADDR_BREDR)
3622                 hci_remove_link_key(hdev, &addr->bdaddr);
3623         else
3624                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3625                                               le_addr_type(addr->type));
3626
3627         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3628                 hci_cmd_sync_queue(hdev, abort_conn_sync, ERR_PTR(conn->handle),
3629                                    NULL);
3630
3631 unlock:
3632         hci_dev_unlock(hdev);
3633         return err;
3634 }
3635
3636 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3637                              struct mgmt_addr_info *addr, u16 mgmt_op,
3638                              u16 hci_op, __le32 passkey)
3639 {
3640         struct mgmt_pending_cmd *cmd;
3641         struct hci_conn *conn;
3642         int err;
3643
3644         hci_dev_lock(hdev);
3645
3646         if (!hdev_is_powered(hdev)) {
3647                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3648                                         MGMT_STATUS_NOT_POWERED, addr,
3649                                         sizeof(*addr));
3650                 goto done;
3651         }
3652
3653         if (addr->type == BDADDR_BREDR)
3654                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3655         else
3656                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3657                                                le_addr_type(addr->type));
3658
3659         if (!conn) {
3660                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3661                                         MGMT_STATUS_NOT_CONNECTED, addr,
3662                                         sizeof(*addr));
3663                 goto done;
3664         }
3665
3666         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3667                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3668                 if (!err)
3669                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3670                                                 MGMT_STATUS_SUCCESS, addr,
3671                                                 sizeof(*addr));
3672                 else
3673                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3674                                                 MGMT_STATUS_FAILED, addr,
3675                                                 sizeof(*addr));
3676
3677                 goto done;
3678         }
3679
3680         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3681         if (!cmd) {
3682                 err = -ENOMEM;
3683                 goto done;
3684         }
3685
3686         cmd->cmd_complete = addr_cmd_complete;
3687
3688         /* Continue with pairing via HCI */
3689         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3690                 struct hci_cp_user_passkey_reply cp;
3691
3692                 bacpy(&cp.bdaddr, &addr->bdaddr);
3693                 cp.passkey = passkey;
3694                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3695         } else
3696                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3697                                    &addr->bdaddr);
3698
3699         if (err < 0)
3700                 mgmt_pending_remove(cmd);
3701
3702 done:
3703         hci_dev_unlock(hdev);
3704         return err;
3705 }
3706
3707 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3708                               void *data, u16 len)
3709 {
3710         struct mgmt_cp_pin_code_neg_reply *cp = data;
3711
3712         bt_dev_dbg(hdev, "sock %p", sk);
3713
3714         return user_pairing_resp(sk, hdev, &cp->addr,
3715                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3716                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3717 }
3718
3719 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3720                               u16 len)
3721 {
3722         struct mgmt_cp_user_confirm_reply *cp = data;
3723
3724         bt_dev_dbg(hdev, "sock %p", sk);
3725
3726         if (len != sizeof(*cp))
3727                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3728                                        MGMT_STATUS_INVALID_PARAMS);
3729
3730         return user_pairing_resp(sk, hdev, &cp->addr,
3731                                  MGMT_OP_USER_CONFIRM_REPLY,
3732                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3733 }
3734
3735 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3736                                   void *data, u16 len)
3737 {
3738         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3739
3740         bt_dev_dbg(hdev, "sock %p", sk);
3741
3742         return user_pairing_resp(sk, hdev, &cp->addr,
3743                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3744                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3745 }
3746
3747 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3748                               u16 len)
3749 {
3750         struct mgmt_cp_user_passkey_reply *cp = data;
3751
3752         bt_dev_dbg(hdev, "sock %p", sk);
3753
3754         return user_pairing_resp(sk, hdev, &cp->addr,
3755                                  MGMT_OP_USER_PASSKEY_REPLY,
3756                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3757 }
3758
3759 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3760                                   void *data, u16 len)
3761 {
3762         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3763
3764         bt_dev_dbg(hdev, "sock %p", sk);
3765
3766         return user_pairing_resp(sk, hdev, &cp->addr,
3767                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3768                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3769 }
3770
3771 static int adv_expire_sync(struct hci_dev *hdev, u32 flags)
3772 {
3773         struct adv_info *adv_instance;
3774
3775         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3776         if (!adv_instance)
3777                 return 0;
3778
3779         /* stop if current instance doesn't need to be changed */
3780         if (!(adv_instance->flags & flags))
3781                 return 0;
3782
3783         cancel_adv_timeout(hdev);
3784
3785         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3786         if (!adv_instance)
3787                 return 0;
3788
3789         hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true);
3790
3791         return 0;
3792 }
3793
3794 static int name_changed_sync(struct hci_dev *hdev, void *data)
3795 {
3796         return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3797 }
3798
3799 static void set_name_complete(struct hci_dev *hdev, void *data, int err)
3800 {
3801         struct mgmt_pending_cmd *cmd = data;
3802         struct mgmt_cp_set_local_name *cp = cmd->param;
3803         u8 status = mgmt_status(err);
3804
3805         bt_dev_dbg(hdev, "err %d", err);
3806
3807         if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
3808                 return;
3809
3810         if (status) {
3811                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3812                                 status);
3813         } else {
3814                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3815                                   cp, sizeof(*cp));
3816
3817                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3818                         hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL);
3819         }
3820
3821         mgmt_pending_remove(cmd);
3822 }
3823
3824 static int set_name_sync(struct hci_dev *hdev, void *data)
3825 {
3826         if (lmp_bredr_capable(hdev)) {
3827                 hci_update_name_sync(hdev);
3828                 hci_update_eir_sync(hdev);
3829         }
3830
3831         /* The name is stored in the scan response data and so
3832          * no need to update the advertising data here.
3833          */
3834         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3835                 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance);
3836
3837         return 0;
3838 }
3839
3840 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3841                           u16 len)
3842 {
3843         struct mgmt_cp_set_local_name *cp = data;
3844         struct mgmt_pending_cmd *cmd;
3845         int err;
3846
3847         bt_dev_dbg(hdev, "sock %p", sk);
3848
3849         hci_dev_lock(hdev);
3850
3851         /* If the old values are the same as the new ones just return a
3852          * direct command complete event.
3853          */
3854         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3855             !memcmp(hdev->short_name, cp->short_name,
3856                     sizeof(hdev->short_name))) {
3857                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3858                                         data, len);
3859                 goto failed;
3860         }
3861
3862         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3863
3864         if (!hdev_is_powered(hdev)) {
3865                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3866
3867                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3868                                         data, len);
3869                 if (err < 0)
3870                         goto failed;
3871
3872                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3873                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3874                 ext_info_changed(hdev, sk);
3875
3876                 goto failed;
3877         }
3878
3879         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3880         if (!cmd)
3881                 err = -ENOMEM;
3882         else
3883                 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd,
3884                                          set_name_complete);
3885
3886         if (err < 0) {
3887                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3888                                       MGMT_STATUS_FAILED);
3889
3890                 if (cmd)
3891                         mgmt_pending_remove(cmd);
3892
3893                 goto failed;
3894         }
3895
3896         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3897
3898 failed:
3899         hci_dev_unlock(hdev);
3900         return err;
3901 }
3902
3903 static int appearance_changed_sync(struct hci_dev *hdev, void *data)
3904 {
3905         return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE);
3906 }
3907
3908 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3909                           u16 len)
3910 {
3911         struct mgmt_cp_set_appearance *cp = data;
3912         u16 appearance;
3913         int err;
3914
3915         bt_dev_dbg(hdev, "sock %p", sk);
3916
3917         if (!lmp_le_capable(hdev))
3918                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3919                                        MGMT_STATUS_NOT_SUPPORTED);
3920
3921         appearance = le16_to_cpu(cp->appearance);
3922
3923         hci_dev_lock(hdev);
3924
3925         if (hdev->appearance != appearance) {
3926                 hdev->appearance = appearance;
3927
3928                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3929                         hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL,
3930                                            NULL);
3931
3932                 ext_info_changed(hdev, sk);
3933         }
3934
3935         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3936                                 0);
3937
3938         hci_dev_unlock(hdev);
3939
3940         return err;
3941 }
3942
3943 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3944                                  void *data, u16 len)
3945 {
3946         struct mgmt_rp_get_phy_configuration rp;
3947
3948         bt_dev_dbg(hdev, "sock %p", sk);
3949
3950         hci_dev_lock(hdev);
3951
3952         memset(&rp, 0, sizeof(rp));
3953
3954         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3955         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3956         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3957
3958         hci_dev_unlock(hdev);
3959
3960         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3961                                  &rp, sizeof(rp));
3962 }
3963
3964 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3965 {
3966         struct mgmt_ev_phy_configuration_changed ev;
3967
3968         memset(&ev, 0, sizeof(ev));
3969
3970         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3971
3972         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3973                           sizeof(ev), skip);
3974 }
3975
3976 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
3977 {
3978         struct mgmt_pending_cmd *cmd = data;
3979         struct sk_buff *skb = cmd->skb;
3980         u8 status = mgmt_status(err);
3981
3982         if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
3983                 return;
3984
3985         if (!status) {
3986                 if (!skb)
3987                         status = MGMT_STATUS_FAILED;
3988                 else if (IS_ERR(skb))
3989                         status = mgmt_status(PTR_ERR(skb));
3990                 else
3991                         status = mgmt_status(skb->data[0]);
3992         }
3993
3994         bt_dev_dbg(hdev, "status %d", status);
3995
3996         if (status) {
3997                 mgmt_cmd_status(cmd->sk, hdev->id,
3998                                 MGMT_OP_SET_PHY_CONFIGURATION, status);
3999         } else {
4000                 mgmt_cmd_complete(cmd->sk, hdev->id,
4001                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
4002                                   NULL, 0);
4003
4004                 mgmt_phy_configuration_changed(hdev, cmd->sk);
4005         }
4006
4007         if (skb && !IS_ERR(skb))
4008                 kfree_skb(skb);
4009
4010         mgmt_pending_remove(cmd);
4011 }
4012
4013 static int set_default_phy_sync(struct hci_dev *hdev, void *data)
4014 {
4015         struct mgmt_pending_cmd *cmd = data;
4016         struct mgmt_cp_set_phy_configuration *cp = cmd->param;
4017         struct hci_cp_le_set_default_phy cp_phy;
4018         u32 selected_phys = __le32_to_cpu(cp->selected_phys);
4019
4020         memset(&cp_phy, 0, sizeof(cp_phy));
4021
4022         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
4023                 cp_phy.all_phys |= 0x01;
4024
4025         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
4026                 cp_phy.all_phys |= 0x02;
4027
4028         if (selected_phys & MGMT_PHY_LE_1M_TX)
4029                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
4030
4031         if (selected_phys & MGMT_PHY_LE_2M_TX)
4032                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
4033
4034         if (selected_phys & MGMT_PHY_LE_CODED_TX)
4035                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
4036
4037         if (selected_phys & MGMT_PHY_LE_1M_RX)
4038                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
4039
4040         if (selected_phys & MGMT_PHY_LE_2M_RX)
4041                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
4042
4043         if (selected_phys & MGMT_PHY_LE_CODED_RX)
4044                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
4045
4046         cmd->skb =  __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY,
4047                                    sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT);
4048
4049         return 0;
4050 }
4051
4052 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
4053                                  void *data, u16 len)
4054 {
4055         struct mgmt_cp_set_phy_configuration *cp = data;
4056         struct mgmt_pending_cmd *cmd;
4057         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
4058         u16 pkt_type = (HCI_DH1 | HCI_DM1);
4059         bool changed = false;
4060         int err;
4061
4062         bt_dev_dbg(hdev, "sock %p", sk);
4063
4064         configurable_phys = get_configurable_phys(hdev);
4065         supported_phys = get_supported_phys(hdev);
4066         selected_phys = __le32_to_cpu(cp->selected_phys);
4067
4068         if (selected_phys & ~supported_phys)
4069                 return mgmt_cmd_status(sk, hdev->id,
4070                                        MGMT_OP_SET_PHY_CONFIGURATION,
4071                                        MGMT_STATUS_INVALID_PARAMS);
4072
4073         unconfigure_phys = supported_phys & ~configurable_phys;
4074
4075         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
4076                 return mgmt_cmd_status(sk, hdev->id,
4077                                        MGMT_OP_SET_PHY_CONFIGURATION,
4078                                        MGMT_STATUS_INVALID_PARAMS);
4079
4080         if (selected_phys == get_selected_phys(hdev))
4081                 return mgmt_cmd_complete(sk, hdev->id,
4082                                          MGMT_OP_SET_PHY_CONFIGURATION,
4083                                          0, NULL, 0);
4084
4085         hci_dev_lock(hdev);
4086
4087         if (!hdev_is_powered(hdev)) {
4088                 err = mgmt_cmd_status(sk, hdev->id,
4089                                       MGMT_OP_SET_PHY_CONFIGURATION,
4090                                       MGMT_STATUS_REJECTED);
4091                 goto unlock;
4092         }
4093
4094         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
4095                 err = mgmt_cmd_status(sk, hdev->id,
4096                                       MGMT_OP_SET_PHY_CONFIGURATION,
4097                                       MGMT_STATUS_BUSY);
4098                 goto unlock;
4099         }
4100
4101         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
4102                 pkt_type |= (HCI_DH3 | HCI_DM3);
4103         else
4104                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
4105
4106         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
4107                 pkt_type |= (HCI_DH5 | HCI_DM5);
4108         else
4109                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
4110
4111         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
4112                 pkt_type &= ~HCI_2DH1;
4113         else
4114                 pkt_type |= HCI_2DH1;
4115
4116         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
4117                 pkt_type &= ~HCI_2DH3;
4118         else
4119                 pkt_type |= HCI_2DH3;
4120
4121         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
4122                 pkt_type &= ~HCI_2DH5;
4123         else
4124                 pkt_type |= HCI_2DH5;
4125
4126         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
4127                 pkt_type &= ~HCI_3DH1;
4128         else
4129                 pkt_type |= HCI_3DH1;
4130
4131         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
4132                 pkt_type &= ~HCI_3DH3;
4133         else
4134                 pkt_type |= HCI_3DH3;
4135
4136         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
4137                 pkt_type &= ~HCI_3DH5;
4138         else
4139                 pkt_type |= HCI_3DH5;
4140
4141         if (pkt_type != hdev->pkt_type) {
4142                 hdev->pkt_type = pkt_type;
4143                 changed = true;
4144         }
4145
4146         if ((selected_phys & MGMT_PHY_LE_MASK) ==
4147             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
4148                 if (changed)
4149                         mgmt_phy_configuration_changed(hdev, sk);
4150
4151                 err = mgmt_cmd_complete(sk, hdev->id,
4152                                         MGMT_OP_SET_PHY_CONFIGURATION,
4153                                         0, NULL, 0);
4154
4155                 goto unlock;
4156         }
4157
4158         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
4159                                len);
4160         if (!cmd)
4161                 err = -ENOMEM;
4162         else
4163                 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd,
4164                                          set_default_phy_complete);
4165
4166         if (err < 0) {
4167                 err = mgmt_cmd_status(sk, hdev->id,
4168                                       MGMT_OP_SET_PHY_CONFIGURATION,
4169                                       MGMT_STATUS_FAILED);
4170
4171                 if (cmd)
4172                         mgmt_pending_remove(cmd);
4173         }
4174
4175 unlock:
4176         hci_dev_unlock(hdev);
4177
4178         return err;
4179 }
4180
4181 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
4182                             u16 len)
4183 {
4184         int err = MGMT_STATUS_SUCCESS;
4185         struct mgmt_cp_set_blocked_keys *keys = data;
4186         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
4187                                    sizeof(struct mgmt_blocked_key_info));
4188         u16 key_count, expected_len;
4189         int i;
4190
4191         bt_dev_dbg(hdev, "sock %p", sk);
4192
4193         key_count = __le16_to_cpu(keys->key_count);
4194         if (key_count > max_key_count) {
4195                 bt_dev_err(hdev, "too big key_count value %u", key_count);
4196                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4197                                        MGMT_STATUS_INVALID_PARAMS);
4198         }
4199
4200         expected_len = struct_size(keys, keys, key_count);
4201         if (expected_len != len) {
4202                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
4203                            expected_len, len);
4204                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4205                                        MGMT_STATUS_INVALID_PARAMS);
4206         }
4207
4208         hci_dev_lock(hdev);
4209
4210         hci_blocked_keys_clear(hdev);
4211
4212         for (i = 0; i < key_count; ++i) {
4213                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
4214
4215                 if (!b) {
4216                         err = MGMT_STATUS_NO_RESOURCES;
4217                         break;
4218                 }
4219
4220                 b->type = keys->keys[i].type;
4221                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
4222                 list_add_rcu(&b->list, &hdev->blocked_keys);
4223         }
4224         hci_dev_unlock(hdev);
4225
4226         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4227                                 err, NULL, 0);
4228 }
4229
4230 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
4231                                void *data, u16 len)
4232 {
4233         struct mgmt_mode *cp = data;
4234         int err;
4235         bool changed = false;
4236
4237         bt_dev_dbg(hdev, "sock %p", sk);
4238
4239         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
4240                 return mgmt_cmd_status(sk, hdev->id,
4241                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4242                                        MGMT_STATUS_NOT_SUPPORTED);
4243
4244         if (cp->val != 0x00 && cp->val != 0x01)
4245                 return mgmt_cmd_status(sk, hdev->id,
4246                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4247                                        MGMT_STATUS_INVALID_PARAMS);
4248
4249         hci_dev_lock(hdev);
4250
4251         if (hdev_is_powered(hdev) &&
4252             !!cp->val != hci_dev_test_flag(hdev,
4253                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
4254                 err = mgmt_cmd_status(sk, hdev->id,
4255                                       MGMT_OP_SET_WIDEBAND_SPEECH,
4256                                       MGMT_STATUS_REJECTED);
4257                 goto unlock;
4258         }
4259
4260         if (cp->val)
4261                 changed = !hci_dev_test_and_set_flag(hdev,
4262                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4263         else
4264                 changed = hci_dev_test_and_clear_flag(hdev,
4265                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4266
4267         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
4268         if (err < 0)
4269                 goto unlock;
4270
4271         if (changed)
4272                 err = new_settings(hdev, sk);
4273
4274 unlock:
4275         hci_dev_unlock(hdev);
4276         return err;
4277 }
4278
4279 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
4280                                void *data, u16 data_len)
4281 {
4282         char buf[20];
4283         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
4284         u16 cap_len = 0;
4285         u8 flags = 0;
4286         u8 tx_power_range[2];
4287
4288         bt_dev_dbg(hdev, "sock %p", sk);
4289
4290         memset(&buf, 0, sizeof(buf));
4291
4292         hci_dev_lock(hdev);
4293
4294         /* When the Read Simple Pairing Options command is supported, then
4295          * the remote public key validation is supported.
4296          *
4297          * Alternatively, when Microsoft extensions are available, they can
4298          * indicate support for public key validation as well.
4299          */
4300         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
4301                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
4302
4303         flags |= 0x02;          /* Remote public key validation (LE) */
4304
4305         /* When the Read Encryption Key Size command is supported, then the
4306          * encryption key size is enforced.
4307          */
4308         if (hdev->commands[20] & 0x10)
4309                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
4310
4311         flags |= 0x08;          /* Encryption key size enforcement (LE) */
4312
4313         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
4314                                   &flags, 1);
4315
4316         /* When the Read Simple Pairing Options command is supported, then
4317          * also max encryption key size information is provided.
4318          */
4319         if (hdev->commands[41] & 0x08)
4320                 cap_len = eir_append_le16(rp->cap, cap_len,
4321                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
4322                                           hdev->max_enc_key_size);
4323
4324         cap_len = eir_append_le16(rp->cap, cap_len,
4325                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
4326                                   SMP_MAX_ENC_KEY_SIZE);
4327
4328         /* Append the min/max LE tx power parameters if we were able to fetch
4329          * it from the controller
4330          */
4331         if (hdev->commands[38] & 0x80) {
4332                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
4333                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
4334                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
4335                                           tx_power_range, 2);
4336         }
4337
4338         rp->cap_len = cpu_to_le16(cap_len);
4339
4340         hci_dev_unlock(hdev);
4341
4342         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
4343                                  rp, sizeof(*rp) + cap_len);
4344 }
4345
4346 #ifdef CONFIG_BT_FEATURE_DEBUG
4347 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
4348 static const u8 debug_uuid[16] = {
4349         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
4350         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
4351 };
4352 #endif
4353
4354 /* 330859bc-7506-492d-9370-9a6f0614037f */
4355 static const u8 quality_report_uuid[16] = {
4356         0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93,
4357         0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33,
4358 };
4359
4360 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */
4361 static const u8 offload_codecs_uuid[16] = {
4362         0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88,
4363         0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6,
4364 };
4365
4366 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
4367 static const u8 le_simultaneous_roles_uuid[16] = {
4368         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
4369         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
4370 };
4371
4372 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
4373 static const u8 rpa_resolution_uuid[16] = {
4374         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
4375         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
4376 };
4377
4378 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */
4379 static const u8 iso_socket_uuid[16] = {
4380         0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98,
4381         0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f,
4382 };
4383
4384 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */
4385 static const u8 mgmt_mesh_uuid[16] = {
4386         0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf,
4387         0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c,
4388 };
4389
4390 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
4391                                   void *data, u16 data_len)
4392 {
4393         struct mgmt_rp_read_exp_features_info *rp;
4394         size_t len;
4395         u16 idx = 0;
4396         u32 flags;
4397         int status;
4398
4399         bt_dev_dbg(hdev, "sock %p", sk);
4400
4401         /* Enough space for 7 features */
4402         len = sizeof(*rp) + (sizeof(rp->features[0]) * 7);
4403         rp = kzalloc(len, GFP_KERNEL);
4404         if (!rp)
4405                 return -ENOMEM;
4406
4407 #ifdef CONFIG_BT_FEATURE_DEBUG
4408         if (!hdev) {
4409                 flags = bt_dbg_get() ? BIT(0) : 0;
4410
4411                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
4412                 rp->features[idx].flags = cpu_to_le32(flags);
4413                 idx++;
4414         }
4415 #endif
4416
4417         if (hdev && hci_dev_le_state_simultaneous(hdev)) {
4418                 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES))
4419                         flags = BIT(0);
4420                 else
4421                         flags = 0;
4422
4423                 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16);
4424                 rp->features[idx].flags = cpu_to_le32(flags);
4425                 idx++;
4426         }
4427
4428         if (hdev && ll_privacy_capable(hdev)) {
4429                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
4430                         flags = BIT(0) | BIT(1);
4431                 else
4432                         flags = BIT(1);
4433
4434                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
4435                 rp->features[idx].flags = cpu_to_le32(flags);
4436                 idx++;
4437         }
4438
4439         if (hdev && (aosp_has_quality_report(hdev) ||
4440                      hdev->set_quality_report)) {
4441                 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT))
4442                         flags = BIT(0);
4443                 else
4444                         flags = 0;
4445
4446                 memcpy(rp->features[idx].uuid, quality_report_uuid, 16);
4447                 rp->features[idx].flags = cpu_to_le32(flags);
4448                 idx++;
4449         }
4450
4451         if (hdev && hdev->get_data_path_id) {
4452                 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED))
4453                         flags = BIT(0);
4454                 else
4455                         flags = 0;
4456
4457                 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16);
4458                 rp->features[idx].flags = cpu_to_le32(flags);
4459                 idx++;
4460         }
4461
4462         if (IS_ENABLED(CONFIG_BT_LE)) {
4463                 flags = iso_enabled() ? BIT(0) : 0;
4464                 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16);
4465                 rp->features[idx].flags = cpu_to_le32(flags);
4466                 idx++;
4467         }
4468
4469         if (hdev && lmp_le_capable(hdev)) {
4470                 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
4471                         flags = BIT(0);
4472                 else
4473                         flags = 0;
4474
4475                 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16);
4476                 rp->features[idx].flags = cpu_to_le32(flags);
4477                 idx++;
4478         }
4479
4480         rp->feature_count = cpu_to_le16(idx);
4481
4482         /* After reading the experimental features information, enable
4483          * the events to update client on any future change.
4484          */
4485         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4486
4487         status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4488                                    MGMT_OP_READ_EXP_FEATURES_INFO,
4489                                    0, rp, sizeof(*rp) + (20 * idx));
4490
4491         kfree(rp);
4492         return status;
4493 }
4494
4495 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
4496                                           struct sock *skip)
4497 {
4498         struct mgmt_ev_exp_feature_changed ev;
4499
4500         memset(&ev, 0, sizeof(ev));
4501         memcpy(ev.uuid, rpa_resolution_uuid, 16);
4502         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
4503
4504         // Do we need to be atomic with the conn_flags?
4505         if (enabled && privacy_mode_capable(hdev))
4506                 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY;
4507         else
4508                 hdev->conn_flags &= ~HCI_CONN_FLAG_DEVICE_PRIVACY;
4509
4510         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4511                                   &ev, sizeof(ev),
4512                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4513
4514 }
4515
4516 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid,
4517                                bool enabled, struct sock *skip)
4518 {
4519         struct mgmt_ev_exp_feature_changed ev;
4520
4521         memset(&ev, 0, sizeof(ev));
4522         memcpy(ev.uuid, uuid, 16);
4523         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
4524
4525         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4526                                   &ev, sizeof(ev),
4527                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4528 }
4529
4530 #define EXP_FEAT(_uuid, _set_func)      \
4531 {                                       \
4532         .uuid = _uuid,                  \
4533         .set_func = _set_func,          \
4534 }
4535
4536 /* The zero key uuid is special. Multiple exp features are set through it. */
4537 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
4538                              struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4539 {
4540         struct mgmt_rp_set_exp_feature rp;
4541
4542         memset(rp.uuid, 0, 16);
4543         rp.flags = cpu_to_le32(0);
4544
4545 #ifdef CONFIG_BT_FEATURE_DEBUG
4546         if (!hdev) {
4547                 bool changed = bt_dbg_get();
4548
4549                 bt_dbg_set(false);
4550
4551                 if (changed)
4552                         exp_feature_changed(NULL, ZERO_KEY, false, sk);
4553         }
4554 #endif
4555
4556         if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
4557                 bool changed;
4558
4559                 changed = hci_dev_test_and_clear_flag(hdev,
4560                                                       HCI_ENABLE_LL_PRIVACY);
4561                 if (changed)
4562                         exp_feature_changed(hdev, rpa_resolution_uuid, false,
4563                                             sk);
4564         }
4565
4566         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4567
4568         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4569                                  MGMT_OP_SET_EXP_FEATURE, 0,
4570                                  &rp, sizeof(rp));
4571 }
4572
4573 #ifdef CONFIG_BT_FEATURE_DEBUG
4574 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
4575                           struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4576 {
4577         struct mgmt_rp_set_exp_feature rp;
4578
4579         bool val, changed;
4580         int err;
4581
4582         /* Command requires to use the non-controller index */
4583         if (hdev)
4584                 return mgmt_cmd_status(sk, hdev->id,
4585                                        MGMT_OP_SET_EXP_FEATURE,
4586                                        MGMT_STATUS_INVALID_INDEX);
4587
4588         /* Parameters are limited to a single octet */
4589         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4590                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4591                                        MGMT_OP_SET_EXP_FEATURE,
4592                                        MGMT_STATUS_INVALID_PARAMS);
4593
4594         /* Only boolean on/off is supported */
4595         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4596                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4597                                        MGMT_OP_SET_EXP_FEATURE,
4598                                        MGMT_STATUS_INVALID_PARAMS);
4599
4600         val = !!cp->param[0];
4601         changed = val ? !bt_dbg_get() : bt_dbg_get();
4602         bt_dbg_set(val);
4603
4604         memcpy(rp.uuid, debug_uuid, 16);
4605         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4606
4607         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4608
4609         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4610                                 MGMT_OP_SET_EXP_FEATURE, 0,
4611                                 &rp, sizeof(rp));
4612
4613         if (changed)
4614                 exp_feature_changed(hdev, debug_uuid, val, sk);
4615
4616         return err;
4617 }
4618 #endif
4619
4620 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev,
4621                               struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4622 {
4623         struct mgmt_rp_set_exp_feature rp;
4624         bool val, changed;
4625         int err;
4626
4627         /* Command requires to use the controller index */
4628         if (!hdev)
4629                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4630                                        MGMT_OP_SET_EXP_FEATURE,
4631                                        MGMT_STATUS_INVALID_INDEX);
4632
4633         /* Changes can only be made when controller is powered down */
4634         if (hdev_is_powered(hdev))
4635                 return mgmt_cmd_status(sk, hdev->id,
4636                                        MGMT_OP_SET_EXP_FEATURE,
4637                                        MGMT_STATUS_REJECTED);
4638
4639         /* Parameters are limited to a single octet */
4640         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4641                 return mgmt_cmd_status(sk, hdev->id,
4642                                        MGMT_OP_SET_EXP_FEATURE,
4643                                        MGMT_STATUS_INVALID_PARAMS);
4644
4645         /* Only boolean on/off is supported */
4646         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4647                 return mgmt_cmd_status(sk, hdev->id,
4648                                        MGMT_OP_SET_EXP_FEATURE,
4649                                        MGMT_STATUS_INVALID_PARAMS);
4650
4651         val = !!cp->param[0];
4652
4653         if (val) {
4654                 changed = !hci_dev_test_and_set_flag(hdev,
4655                                                      HCI_MESH_EXPERIMENTAL);
4656         } else {
4657                 hci_dev_clear_flag(hdev, HCI_MESH);
4658                 changed = hci_dev_test_and_clear_flag(hdev,
4659                                                       HCI_MESH_EXPERIMENTAL);
4660         }
4661
4662         memcpy(rp.uuid, mgmt_mesh_uuid, 16);
4663         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4664
4665         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4666
4667         err = mgmt_cmd_complete(sk, hdev->id,
4668                                 MGMT_OP_SET_EXP_FEATURE, 0,
4669                                 &rp, sizeof(rp));
4670
4671         if (changed)
4672                 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk);
4673
4674         return err;
4675 }
4676
4677 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev,
4678                                    struct mgmt_cp_set_exp_feature *cp,
4679                                    u16 data_len)
4680 {
4681         struct mgmt_rp_set_exp_feature rp;
4682         bool val, changed;
4683         int err;
4684         u32 flags;
4685
4686         /* Command requires to use the controller index */
4687         if (!hdev)
4688                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4689                                        MGMT_OP_SET_EXP_FEATURE,
4690                                        MGMT_STATUS_INVALID_INDEX);
4691
4692         /* Changes can only be made when controller is powered down */
4693         if (hdev_is_powered(hdev))
4694                 return mgmt_cmd_status(sk, hdev->id,
4695                                        MGMT_OP_SET_EXP_FEATURE,
4696                                        MGMT_STATUS_REJECTED);
4697
4698         /* Parameters are limited to a single octet */
4699         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4700                 return mgmt_cmd_status(sk, hdev->id,
4701                                        MGMT_OP_SET_EXP_FEATURE,
4702                                        MGMT_STATUS_INVALID_PARAMS);
4703
4704         /* Only boolean on/off is supported */
4705         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4706                 return mgmt_cmd_status(sk, hdev->id,
4707                                        MGMT_OP_SET_EXP_FEATURE,
4708                                        MGMT_STATUS_INVALID_PARAMS);
4709
4710         val = !!cp->param[0];
4711
4712         if (val) {
4713                 changed = !hci_dev_test_and_set_flag(hdev,
4714                                                      HCI_ENABLE_LL_PRIVACY);
4715                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4716
4717                 /* Enable LL privacy + supported settings changed */
4718                 flags = BIT(0) | BIT(1);
4719         } else {
4720                 changed = hci_dev_test_and_clear_flag(hdev,
4721                                                       HCI_ENABLE_LL_PRIVACY);
4722
4723                 /* Disable LL privacy + supported settings changed */
4724                 flags = BIT(1);
4725         }
4726
4727         memcpy(rp.uuid, rpa_resolution_uuid, 16);
4728         rp.flags = cpu_to_le32(flags);
4729
4730         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4731
4732         err = mgmt_cmd_complete(sk, hdev->id,
4733                                 MGMT_OP_SET_EXP_FEATURE, 0,
4734                                 &rp, sizeof(rp));
4735
4736         if (changed)
4737                 exp_ll_privacy_feature_changed(val, hdev, sk);
4738
4739         return err;
4740 }
4741
4742 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev,
4743                                    struct mgmt_cp_set_exp_feature *cp,
4744                                    u16 data_len)
4745 {
4746         struct mgmt_rp_set_exp_feature rp;
4747         bool val, changed;
4748         int err;
4749
4750         /* Command requires to use a valid controller index */
4751         if (!hdev)
4752                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4753                                        MGMT_OP_SET_EXP_FEATURE,
4754                                        MGMT_STATUS_INVALID_INDEX);
4755
4756         /* Parameters are limited to a single octet */
4757         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4758                 return mgmt_cmd_status(sk, hdev->id,
4759                                        MGMT_OP_SET_EXP_FEATURE,
4760                                        MGMT_STATUS_INVALID_PARAMS);
4761
4762         /* Only boolean on/off is supported */
4763         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4764                 return mgmt_cmd_status(sk, hdev->id,
4765                                        MGMT_OP_SET_EXP_FEATURE,
4766                                        MGMT_STATUS_INVALID_PARAMS);
4767
4768         hci_req_sync_lock(hdev);
4769
4770         val = !!cp->param[0];
4771         changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT));
4772
4773         if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) {
4774                 err = mgmt_cmd_status(sk, hdev->id,
4775                                       MGMT_OP_SET_EXP_FEATURE,
4776                                       MGMT_STATUS_NOT_SUPPORTED);
4777                 goto unlock_quality_report;
4778         }
4779
4780         if (changed) {
4781                 if (hdev->set_quality_report)
4782                         err = hdev->set_quality_report(hdev, val);
4783                 else
4784                         err = aosp_set_quality_report(hdev, val);
4785
4786                 if (err) {
4787                         err = mgmt_cmd_status(sk, hdev->id,
4788                                               MGMT_OP_SET_EXP_FEATURE,
4789                                               MGMT_STATUS_FAILED);
4790                         goto unlock_quality_report;
4791                 }
4792
4793                 if (val)
4794                         hci_dev_set_flag(hdev, HCI_QUALITY_REPORT);
4795                 else
4796                         hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
4797         }
4798
4799         bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed);
4800
4801         memcpy(rp.uuid, quality_report_uuid, 16);
4802         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4803         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4804
4805         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0,
4806                                 &rp, sizeof(rp));
4807
4808         if (changed)
4809                 exp_feature_changed(hdev, quality_report_uuid, val, sk);
4810
4811 unlock_quality_report:
4812         hci_req_sync_unlock(hdev);
4813         return err;
4814 }
4815
4816 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev,
4817                                   struct mgmt_cp_set_exp_feature *cp,
4818                                   u16 data_len)
4819 {
4820         bool val, changed;
4821         int err;
4822         struct mgmt_rp_set_exp_feature rp;
4823
4824         /* Command requires to use a valid controller index */
4825         if (!hdev)
4826                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4827                                        MGMT_OP_SET_EXP_FEATURE,
4828                                        MGMT_STATUS_INVALID_INDEX);
4829
4830         /* Parameters are limited to a single octet */
4831         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4832                 return mgmt_cmd_status(sk, hdev->id,
4833                                        MGMT_OP_SET_EXP_FEATURE,
4834                                        MGMT_STATUS_INVALID_PARAMS);
4835
4836         /* Only boolean on/off is supported */
4837         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4838                 return mgmt_cmd_status(sk, hdev->id,
4839                                        MGMT_OP_SET_EXP_FEATURE,
4840                                        MGMT_STATUS_INVALID_PARAMS);
4841
4842         val = !!cp->param[0];
4843         changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED));
4844
4845         if (!hdev->get_data_path_id) {
4846                 return mgmt_cmd_status(sk, hdev->id,
4847                                        MGMT_OP_SET_EXP_FEATURE,
4848                                        MGMT_STATUS_NOT_SUPPORTED);
4849         }
4850
4851         if (changed) {
4852                 if (val)
4853                         hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4854                 else
4855                         hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4856         }
4857
4858         bt_dev_info(hdev, "offload codecs enable %d changed %d",
4859                     val, changed);
4860
4861         memcpy(rp.uuid, offload_codecs_uuid, 16);
4862         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4863         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4864         err = mgmt_cmd_complete(sk, hdev->id,
4865                                 MGMT_OP_SET_EXP_FEATURE, 0,
4866                                 &rp, sizeof(rp));
4867
4868         if (changed)
4869                 exp_feature_changed(hdev, offload_codecs_uuid, val, sk);
4870
4871         return err;
4872 }
4873
4874 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev,
4875                                           struct mgmt_cp_set_exp_feature *cp,
4876                                           u16 data_len)
4877 {
4878         bool val, changed;
4879         int err;
4880         struct mgmt_rp_set_exp_feature rp;
4881
4882         /* Command requires to use a valid controller index */
4883         if (!hdev)
4884                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4885                                        MGMT_OP_SET_EXP_FEATURE,
4886                                        MGMT_STATUS_INVALID_INDEX);
4887
4888         /* Parameters are limited to a single octet */
4889         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4890                 return mgmt_cmd_status(sk, hdev->id,
4891                                        MGMT_OP_SET_EXP_FEATURE,
4892                                        MGMT_STATUS_INVALID_PARAMS);
4893
4894         /* Only boolean on/off is supported */
4895         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4896                 return mgmt_cmd_status(sk, hdev->id,
4897                                        MGMT_OP_SET_EXP_FEATURE,
4898                                        MGMT_STATUS_INVALID_PARAMS);
4899
4900         val = !!cp->param[0];
4901         changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES));
4902
4903         if (!hci_dev_le_state_simultaneous(hdev)) {
4904                 return mgmt_cmd_status(sk, hdev->id,
4905                                        MGMT_OP_SET_EXP_FEATURE,
4906                                        MGMT_STATUS_NOT_SUPPORTED);
4907         }
4908
4909         if (changed) {
4910                 if (val)
4911                         hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4912                 else
4913                         hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4914         }
4915
4916         bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d",
4917                     val, changed);
4918
4919         memcpy(rp.uuid, le_simultaneous_roles_uuid, 16);
4920         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4921         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4922         err = mgmt_cmd_complete(sk, hdev->id,
4923                                 MGMT_OP_SET_EXP_FEATURE, 0,
4924                                 &rp, sizeof(rp));
4925
4926         if (changed)
4927                 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk);
4928
4929         return err;
4930 }
4931
4932 #ifdef CONFIG_BT_LE
4933 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev,
4934                                struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4935 {
4936         struct mgmt_rp_set_exp_feature rp;
4937         bool val, changed = false;
4938         int err;
4939
4940         /* Command requires to use the non-controller index */
4941         if (hdev)
4942                 return mgmt_cmd_status(sk, hdev->id,
4943                                        MGMT_OP_SET_EXP_FEATURE,
4944                                        MGMT_STATUS_INVALID_INDEX);
4945
4946         /* Parameters are limited to a single octet */
4947         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4948                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4949                                        MGMT_OP_SET_EXP_FEATURE,
4950                                        MGMT_STATUS_INVALID_PARAMS);
4951
4952         /* Only boolean on/off is supported */
4953         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4954                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4955                                        MGMT_OP_SET_EXP_FEATURE,
4956                                        MGMT_STATUS_INVALID_PARAMS);
4957
4958         val = cp->param[0] ? true : false;
4959         if (val)
4960                 err = iso_init();
4961         else
4962                 err = iso_exit();
4963
4964         if (!err)
4965                 changed = true;
4966
4967         memcpy(rp.uuid, iso_socket_uuid, 16);
4968         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4969
4970         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4971
4972         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4973                                 MGMT_OP_SET_EXP_FEATURE, 0,
4974                                 &rp, sizeof(rp));
4975
4976         if (changed)
4977                 exp_feature_changed(hdev, iso_socket_uuid, val, sk);
4978
4979         return err;
4980 }
4981 #endif
4982
4983 static const struct mgmt_exp_feature {
4984         const u8 *uuid;
4985         int (*set_func)(struct sock *sk, struct hci_dev *hdev,
4986                         struct mgmt_cp_set_exp_feature *cp, u16 data_len);
4987 } exp_features[] = {
4988         EXP_FEAT(ZERO_KEY, set_zero_key_func),
4989 #ifdef CONFIG_BT_FEATURE_DEBUG
4990         EXP_FEAT(debug_uuid, set_debug_func),
4991 #endif
4992         EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func),
4993         EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func),
4994         EXP_FEAT(quality_report_uuid, set_quality_report_func),
4995         EXP_FEAT(offload_codecs_uuid, set_offload_codec_func),
4996         EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func),
4997 #ifdef CONFIG_BT_LE
4998         EXP_FEAT(iso_socket_uuid, set_iso_socket_func),
4999 #endif
5000
5001         /* end with a null feature */
5002         EXP_FEAT(NULL, NULL)
5003 };
5004
5005 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
5006                            void *data, u16 data_len)
5007 {
5008         struct mgmt_cp_set_exp_feature *cp = data;
5009         size_t i = 0;
5010
5011         bt_dev_dbg(hdev, "sock %p", sk);
5012
5013         for (i = 0; exp_features[i].uuid; i++) {
5014                 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
5015                         return exp_features[i].set_func(sk, hdev, cp, data_len);
5016         }
5017
5018         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
5019                                MGMT_OP_SET_EXP_FEATURE,
5020                                MGMT_STATUS_NOT_SUPPORTED);
5021 }
5022
5023 static u32 get_params_flags(struct hci_dev *hdev,
5024                             struct hci_conn_params *params)
5025 {
5026         u32 flags = hdev->conn_flags;
5027
5028         /* Devices using RPAs can only be programmed in the acceptlist if
5029          * LL Privacy has been enable otherwise they cannot mark
5030          * HCI_CONN_FLAG_REMOTE_WAKEUP.
5031          */
5032         if ((flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && !use_ll_privacy(hdev) &&
5033             hci_find_irk_by_addr(hdev, &params->addr, params->addr_type))
5034                 flags &= ~HCI_CONN_FLAG_REMOTE_WAKEUP;
5035
5036         return flags;
5037 }
5038
5039 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5040                             u16 data_len)
5041 {
5042         struct mgmt_cp_get_device_flags *cp = data;
5043         struct mgmt_rp_get_device_flags rp;
5044         struct bdaddr_list_with_flags *br_params;
5045         struct hci_conn_params *params;
5046         u32 supported_flags;
5047         u32 current_flags = 0;
5048         u8 status = MGMT_STATUS_INVALID_PARAMS;
5049
5050         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
5051                    &cp->addr.bdaddr, cp->addr.type);
5052
5053         hci_dev_lock(hdev);
5054
5055         supported_flags = hdev->conn_flags;
5056
5057         memset(&rp, 0, sizeof(rp));
5058
5059         if (cp->addr.type == BDADDR_BREDR) {
5060                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5061                                                               &cp->addr.bdaddr,
5062                                                               cp->addr.type);
5063                 if (!br_params)
5064                         goto done;
5065
5066                 current_flags = br_params->flags;
5067         } else {
5068                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5069                                                 le_addr_type(cp->addr.type));
5070                 if (!params)
5071                         goto done;
5072
5073                 supported_flags = get_params_flags(hdev, params);
5074                 current_flags = params->flags;
5075         }
5076
5077         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5078         rp.addr.type = cp->addr.type;
5079         rp.supported_flags = cpu_to_le32(supported_flags);
5080         rp.current_flags = cpu_to_le32(current_flags);
5081
5082         status = MGMT_STATUS_SUCCESS;
5083
5084 done:
5085         hci_dev_unlock(hdev);
5086
5087         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
5088                                 &rp, sizeof(rp));
5089 }
5090
5091 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
5092                                  bdaddr_t *bdaddr, u8 bdaddr_type,
5093                                  u32 supported_flags, u32 current_flags)
5094 {
5095         struct mgmt_ev_device_flags_changed ev;
5096
5097         bacpy(&ev.addr.bdaddr, bdaddr);
5098         ev.addr.type = bdaddr_type;
5099         ev.supported_flags = cpu_to_le32(supported_flags);
5100         ev.current_flags = cpu_to_le32(current_flags);
5101
5102         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
5103 }
5104
5105 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5106                             u16 len)
5107 {
5108         struct mgmt_cp_set_device_flags *cp = data;
5109         struct bdaddr_list_with_flags *br_params;
5110         struct hci_conn_params *params;
5111         u8 status = MGMT_STATUS_INVALID_PARAMS;
5112         u32 supported_flags;
5113         u32 current_flags = __le32_to_cpu(cp->current_flags);
5114
5115         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
5116                    &cp->addr.bdaddr, cp->addr.type, current_flags);
5117
5118         // We should take hci_dev_lock() early, I think.. conn_flags can change
5119         supported_flags = hdev->conn_flags;
5120
5121         if ((supported_flags | current_flags) != supported_flags) {
5122                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5123                             current_flags, supported_flags);
5124                 goto done;
5125         }
5126
5127         hci_dev_lock(hdev);
5128
5129         if (cp->addr.type == BDADDR_BREDR) {
5130                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5131                                                               &cp->addr.bdaddr,
5132                                                               cp->addr.type);
5133
5134                 if (br_params) {
5135                         br_params->flags = current_flags;
5136                         status = MGMT_STATUS_SUCCESS;
5137                 } else {
5138                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
5139                                     &cp->addr.bdaddr, cp->addr.type);
5140                 }
5141
5142                 goto unlock;
5143         }
5144
5145         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5146                                         le_addr_type(cp->addr.type));
5147         if (!params) {
5148                 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
5149                             &cp->addr.bdaddr, le_addr_type(cp->addr.type));
5150                 goto unlock;
5151         }
5152
5153         supported_flags = get_params_flags(hdev, params);
5154
5155         if ((supported_flags | current_flags) != supported_flags) {
5156                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5157                             current_flags, supported_flags);
5158                 goto unlock;
5159         }
5160
5161         params->flags = current_flags;
5162         status = MGMT_STATUS_SUCCESS;
5163
5164         /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY
5165          * has been set.
5166          */
5167         if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY)
5168                 hci_update_passive_scan(hdev);
5169
5170 unlock:
5171         hci_dev_unlock(hdev);
5172
5173 done:
5174         if (status == MGMT_STATUS_SUCCESS)
5175                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
5176                                      supported_flags, current_flags);
5177
5178         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
5179                                  &cp->addr, sizeof(cp->addr));
5180 }
5181
5182 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
5183                                    u16 handle)
5184 {
5185         struct mgmt_ev_adv_monitor_added ev;
5186
5187         ev.monitor_handle = cpu_to_le16(handle);
5188
5189         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
5190 }
5191
5192 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
5193 {
5194         struct mgmt_ev_adv_monitor_removed ev;
5195         struct mgmt_pending_cmd *cmd;
5196         struct sock *sk_skip = NULL;
5197         struct mgmt_cp_remove_adv_monitor *cp;
5198
5199         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
5200         if (cmd) {
5201                 cp = cmd->param;
5202
5203                 if (cp->monitor_handle)
5204                         sk_skip = cmd->sk;
5205         }
5206
5207         ev.monitor_handle = cpu_to_le16(handle);
5208
5209         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
5210 }
5211
5212 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
5213                                  void *data, u16 len)
5214 {
5215         struct adv_monitor *monitor = NULL;
5216         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
5217         int handle, err;
5218         size_t rp_size = 0;
5219         __u32 supported = 0;
5220         __u32 enabled = 0;
5221         __u16 num_handles = 0;
5222         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
5223
5224         BT_DBG("request for %s", hdev->name);
5225
5226         hci_dev_lock(hdev);
5227
5228         if (msft_monitor_supported(hdev))
5229                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
5230
5231         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
5232                 handles[num_handles++] = monitor->handle;
5233
5234         hci_dev_unlock(hdev);
5235
5236         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
5237         rp = kmalloc(rp_size, GFP_KERNEL);
5238         if (!rp)
5239                 return -ENOMEM;
5240
5241         /* All supported features are currently enabled */
5242         enabled = supported;
5243
5244         rp->supported_features = cpu_to_le32(supported);
5245         rp->enabled_features = cpu_to_le32(enabled);
5246         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
5247         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
5248         rp->num_handles = cpu_to_le16(num_handles);
5249         if (num_handles)
5250                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
5251
5252         err = mgmt_cmd_complete(sk, hdev->id,
5253                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
5254                                 MGMT_STATUS_SUCCESS, rp, rp_size);
5255
5256         kfree(rp);
5257
5258         return err;
5259 }
5260
5261 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,
5262                                                    void *data, int status)
5263 {
5264         struct mgmt_rp_add_adv_patterns_monitor rp;
5265         struct mgmt_pending_cmd *cmd = data;
5266         struct adv_monitor *monitor = cmd->user_data;
5267
5268         hci_dev_lock(hdev);
5269
5270         rp.monitor_handle = cpu_to_le16(monitor->handle);
5271
5272         if (!status) {
5273                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
5274                 hdev->adv_monitors_cnt++;
5275                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
5276                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
5277                 hci_update_passive_scan(hdev);
5278         }
5279
5280         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5281                           mgmt_status(status), &rp, sizeof(rp));
5282         mgmt_pending_remove(cmd);
5283
5284         hci_dev_unlock(hdev);
5285         bt_dev_dbg(hdev, "add monitor %d complete, status %d",
5286                    rp.monitor_handle, status);
5287 }
5288
5289 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data)
5290 {
5291         struct mgmt_pending_cmd *cmd = data;
5292         struct adv_monitor *monitor = cmd->user_data;
5293
5294         return hci_add_adv_monitor(hdev, monitor);
5295 }
5296
5297 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5298                                       struct adv_monitor *m, u8 status,
5299                                       void *data, u16 len, u16 op)
5300 {
5301         struct mgmt_pending_cmd *cmd;
5302         int err;
5303
5304         hci_dev_lock(hdev);
5305
5306         if (status)
5307                 goto unlock;
5308
5309         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5310             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5311             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
5312             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
5313                 status = MGMT_STATUS_BUSY;
5314                 goto unlock;
5315         }
5316
5317         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5318         if (!cmd) {
5319                 status = MGMT_STATUS_NO_RESOURCES;
5320                 goto unlock;
5321         }
5322
5323         cmd->user_data = m;
5324         err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd,
5325                                  mgmt_add_adv_patterns_monitor_complete);
5326         if (err) {
5327                 if (err == -ENOMEM)
5328                         status = MGMT_STATUS_NO_RESOURCES;
5329                 else
5330                         status = MGMT_STATUS_FAILED;
5331
5332                 goto unlock;
5333         }
5334
5335         hci_dev_unlock(hdev);
5336
5337         return 0;
5338
5339 unlock:
5340         hci_free_adv_monitor(hdev, m);
5341         hci_dev_unlock(hdev);
5342         return mgmt_cmd_status(sk, hdev->id, op, status);
5343 }
5344
5345 static void parse_adv_monitor_rssi(struct adv_monitor *m,
5346                                    struct mgmt_adv_rssi_thresholds *rssi)
5347 {
5348         if (rssi) {
5349                 m->rssi.low_threshold = rssi->low_threshold;
5350                 m->rssi.low_threshold_timeout =
5351                     __le16_to_cpu(rssi->low_threshold_timeout);
5352                 m->rssi.high_threshold = rssi->high_threshold;
5353                 m->rssi.high_threshold_timeout =
5354                     __le16_to_cpu(rssi->high_threshold_timeout);
5355                 m->rssi.sampling_period = rssi->sampling_period;
5356         } else {
5357                 /* Default values. These numbers are the least constricting
5358                  * parameters for MSFT API to work, so it behaves as if there
5359                  * are no rssi parameter to consider. May need to be changed
5360                  * if other API are to be supported.
5361                  */
5362                 m->rssi.low_threshold = -127;
5363                 m->rssi.low_threshold_timeout = 60;
5364                 m->rssi.high_threshold = -127;
5365                 m->rssi.high_threshold_timeout = 0;
5366                 m->rssi.sampling_period = 0;
5367         }
5368 }
5369
5370 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
5371                                     struct mgmt_adv_pattern *patterns)
5372 {
5373         u8 offset = 0, length = 0;
5374         struct adv_pattern *p = NULL;
5375         int i;
5376
5377         for (i = 0; i < pattern_count; i++) {
5378                 offset = patterns[i].offset;
5379                 length = patterns[i].length;
5380                 if (offset >= HCI_MAX_AD_LENGTH ||
5381                     length > HCI_MAX_AD_LENGTH ||
5382                     (offset + length) > HCI_MAX_AD_LENGTH)
5383                         return MGMT_STATUS_INVALID_PARAMS;
5384
5385                 p = kmalloc(sizeof(*p), GFP_KERNEL);
5386                 if (!p)
5387                         return MGMT_STATUS_NO_RESOURCES;
5388
5389                 p->ad_type = patterns[i].ad_type;
5390                 p->offset = patterns[i].offset;
5391                 p->length = patterns[i].length;
5392                 memcpy(p->value, patterns[i].value, p->length);
5393
5394                 INIT_LIST_HEAD(&p->list);
5395                 list_add(&p->list, &m->patterns);
5396         }
5397
5398         return MGMT_STATUS_SUCCESS;
5399 }
5400
5401 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5402                                     void *data, u16 len)
5403 {
5404         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
5405         struct adv_monitor *m = NULL;
5406         u8 status = MGMT_STATUS_SUCCESS;
5407         size_t expected_size = sizeof(*cp);
5408
5409         BT_DBG("request for %s", hdev->name);
5410
5411         if (len <= sizeof(*cp)) {
5412                 status = MGMT_STATUS_INVALID_PARAMS;
5413                 goto done;
5414         }
5415
5416         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5417         if (len != expected_size) {
5418                 status = MGMT_STATUS_INVALID_PARAMS;
5419                 goto done;
5420         }
5421
5422         m = kzalloc(sizeof(*m), GFP_KERNEL);
5423         if (!m) {
5424                 status = MGMT_STATUS_NO_RESOURCES;
5425                 goto done;
5426         }
5427
5428         INIT_LIST_HEAD(&m->patterns);
5429
5430         parse_adv_monitor_rssi(m, NULL);
5431         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5432
5433 done:
5434         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5435                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
5436 }
5437
5438 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
5439                                          void *data, u16 len)
5440 {
5441         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
5442         struct adv_monitor *m = NULL;
5443         u8 status = MGMT_STATUS_SUCCESS;
5444         size_t expected_size = sizeof(*cp);
5445
5446         BT_DBG("request for %s", hdev->name);
5447
5448         if (len <= sizeof(*cp)) {
5449                 status = MGMT_STATUS_INVALID_PARAMS;
5450                 goto done;
5451         }
5452
5453         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5454         if (len != expected_size) {
5455                 status = MGMT_STATUS_INVALID_PARAMS;
5456                 goto done;
5457         }
5458
5459         m = kzalloc(sizeof(*m), GFP_KERNEL);
5460         if (!m) {
5461                 status = MGMT_STATUS_NO_RESOURCES;
5462                 goto done;
5463         }
5464
5465         INIT_LIST_HEAD(&m->patterns);
5466
5467         parse_adv_monitor_rssi(m, &cp->rssi);
5468         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5469
5470 done:
5471         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5472                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
5473 }
5474
5475 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
5476                                              void *data, int status)
5477 {
5478         struct mgmt_rp_remove_adv_monitor rp;
5479         struct mgmt_pending_cmd *cmd = data;
5480         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5481
5482         hci_dev_lock(hdev);
5483
5484         rp.monitor_handle = cp->monitor_handle;
5485
5486         if (!status)
5487                 hci_update_passive_scan(hdev);
5488
5489         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5490                           mgmt_status(status), &rp, sizeof(rp));
5491         mgmt_pending_remove(cmd);
5492
5493         hci_dev_unlock(hdev);
5494         bt_dev_dbg(hdev, "remove monitor %d complete, status %d",
5495                    rp.monitor_handle, status);
5496 }
5497
5498 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data)
5499 {
5500         struct mgmt_pending_cmd *cmd = data;
5501         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5502         u16 handle = __le16_to_cpu(cp->monitor_handle);
5503
5504         if (!handle)
5505                 return hci_remove_all_adv_monitor(hdev);
5506
5507         return hci_remove_single_adv_monitor(hdev, handle);
5508 }
5509
5510 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
5511                               void *data, u16 len)
5512 {
5513         struct mgmt_pending_cmd *cmd;
5514         int err, status;
5515
5516         hci_dev_lock(hdev);
5517
5518         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5519             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
5520             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5521             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
5522                 status = MGMT_STATUS_BUSY;
5523                 goto unlock;
5524         }
5525
5526         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
5527         if (!cmd) {
5528                 status = MGMT_STATUS_NO_RESOURCES;
5529                 goto unlock;
5530         }
5531
5532         err = hci_cmd_sync_queue(hdev, mgmt_remove_adv_monitor_sync, cmd,
5533                                  mgmt_remove_adv_monitor_complete);
5534
5535         if (err) {
5536                 mgmt_pending_remove(cmd);
5537
5538                 if (err == -ENOMEM)
5539                         status = MGMT_STATUS_NO_RESOURCES;
5540                 else
5541                         status = MGMT_STATUS_FAILED;
5542
5543                 goto unlock;
5544         }
5545
5546         hci_dev_unlock(hdev);
5547
5548         return 0;
5549
5550 unlock:
5551         hci_dev_unlock(hdev);
5552         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
5553                                status);
5554 }
5555
5556 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err)
5557 {
5558         struct mgmt_rp_read_local_oob_data mgmt_rp;
5559         size_t rp_size = sizeof(mgmt_rp);
5560         struct mgmt_pending_cmd *cmd = data;
5561         struct sk_buff *skb = cmd->skb;
5562         u8 status = mgmt_status(err);
5563
5564         if (!status) {
5565                 if (!skb)
5566                         status = MGMT_STATUS_FAILED;
5567                 else if (IS_ERR(skb))
5568                         status = mgmt_status(PTR_ERR(skb));
5569                 else
5570                         status = mgmt_status(skb->data[0]);
5571         }
5572
5573         bt_dev_dbg(hdev, "status %d", status);
5574
5575         if (status) {
5576                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status);
5577                 goto remove;
5578         }
5579
5580         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
5581
5582         if (!bredr_sc_enabled(hdev)) {
5583                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
5584
5585                 if (skb->len < sizeof(*rp)) {
5586                         mgmt_cmd_status(cmd->sk, hdev->id,
5587                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5588                                         MGMT_STATUS_FAILED);
5589                         goto remove;
5590                 }
5591
5592                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
5593                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
5594
5595                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
5596         } else {
5597                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
5598
5599                 if (skb->len < sizeof(*rp)) {
5600                         mgmt_cmd_status(cmd->sk, hdev->id,
5601                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5602                                         MGMT_STATUS_FAILED);
5603                         goto remove;
5604                 }
5605
5606                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
5607                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
5608
5609                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
5610                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
5611         }
5612
5613         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5614                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
5615
5616 remove:
5617         if (skb && !IS_ERR(skb))
5618                 kfree_skb(skb);
5619
5620         mgmt_pending_free(cmd);
5621 }
5622
5623 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data)
5624 {
5625         struct mgmt_pending_cmd *cmd = data;
5626
5627         if (bredr_sc_enabled(hdev))
5628                 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk);
5629         else
5630                 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk);
5631
5632         if (IS_ERR(cmd->skb))
5633                 return PTR_ERR(cmd->skb);
5634         else
5635                 return 0;
5636 }
5637
5638 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
5639                                void *data, u16 data_len)
5640 {
5641         struct mgmt_pending_cmd *cmd;
5642         int err;
5643
5644         bt_dev_dbg(hdev, "sock %p", sk);
5645
5646         hci_dev_lock(hdev);
5647
5648         if (!hdev_is_powered(hdev)) {
5649                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5650                                       MGMT_STATUS_NOT_POWERED);
5651                 goto unlock;
5652         }
5653
5654         if (!lmp_ssp_capable(hdev)) {
5655                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5656                                       MGMT_STATUS_NOT_SUPPORTED);
5657                 goto unlock;
5658         }
5659
5660         cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
5661         if (!cmd)
5662                 err = -ENOMEM;
5663         else
5664                 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
5665                                          read_local_oob_data_complete);
5666
5667         if (err < 0) {
5668                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5669                                       MGMT_STATUS_FAILED);
5670
5671                 if (cmd)
5672                         mgmt_pending_free(cmd);
5673         }
5674
5675 unlock:
5676         hci_dev_unlock(hdev);
5677         return err;
5678 }
5679
5680 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5681                                void *data, u16 len)
5682 {
5683         struct mgmt_addr_info *addr = data;
5684         int err;
5685
5686         bt_dev_dbg(hdev, "sock %p", sk);
5687
5688         if (!bdaddr_type_is_valid(addr->type))
5689                 return mgmt_cmd_complete(sk, hdev->id,
5690                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
5691                                          MGMT_STATUS_INVALID_PARAMS,
5692                                          addr, sizeof(*addr));
5693
5694         hci_dev_lock(hdev);
5695
5696         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
5697                 struct mgmt_cp_add_remote_oob_data *cp = data;
5698                 u8 status;
5699
5700                 if (cp->addr.type != BDADDR_BREDR) {
5701                         err = mgmt_cmd_complete(sk, hdev->id,
5702                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
5703                                                 MGMT_STATUS_INVALID_PARAMS,
5704                                                 &cp->addr, sizeof(cp->addr));
5705                         goto unlock;
5706                 }
5707
5708                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5709                                               cp->addr.type, cp->hash,
5710                                               cp->rand, NULL, NULL);
5711                 if (err < 0)
5712                         status = MGMT_STATUS_FAILED;
5713                 else
5714                         status = MGMT_STATUS_SUCCESS;
5715
5716                 err = mgmt_cmd_complete(sk, hdev->id,
5717                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
5718                                         &cp->addr, sizeof(cp->addr));
5719         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
5720                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
5721                 u8 *rand192, *hash192, *rand256, *hash256;
5722                 u8 status;
5723
5724                 if (bdaddr_type_is_le(cp->addr.type)) {
5725                         /* Enforce zero-valued 192-bit parameters as
5726                          * long as legacy SMP OOB isn't implemented.
5727                          */
5728                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
5729                             memcmp(cp->hash192, ZERO_KEY, 16)) {
5730                                 err = mgmt_cmd_complete(sk, hdev->id,
5731                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5732                                                         MGMT_STATUS_INVALID_PARAMS,
5733                                                         addr, sizeof(*addr));
5734                                 goto unlock;
5735                         }
5736
5737                         rand192 = NULL;
5738                         hash192 = NULL;
5739                 } else {
5740                         /* In case one of the P-192 values is set to zero,
5741                          * then just disable OOB data for P-192.
5742                          */
5743                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
5744                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
5745                                 rand192 = NULL;
5746                                 hash192 = NULL;
5747                         } else {
5748                                 rand192 = cp->rand192;
5749                                 hash192 = cp->hash192;
5750                         }
5751                 }
5752
5753                 /* In case one of the P-256 values is set to zero, then just
5754                  * disable OOB data for P-256.
5755                  */
5756                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
5757                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
5758                         rand256 = NULL;
5759                         hash256 = NULL;
5760                 } else {
5761                         rand256 = cp->rand256;
5762                         hash256 = cp->hash256;
5763                 }
5764
5765                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5766                                               cp->addr.type, hash192, rand192,
5767                                               hash256, rand256);
5768                 if (err < 0)
5769                         status = MGMT_STATUS_FAILED;
5770                 else
5771                         status = MGMT_STATUS_SUCCESS;
5772
5773                 err = mgmt_cmd_complete(sk, hdev->id,
5774                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5775                                         status, &cp->addr, sizeof(cp->addr));
5776         } else {
5777                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
5778                            len);
5779                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
5780                                       MGMT_STATUS_INVALID_PARAMS);
5781         }
5782
5783 unlock:
5784         hci_dev_unlock(hdev);
5785         return err;
5786 }
5787
5788 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5789                                   void *data, u16 len)
5790 {
5791         struct mgmt_cp_remove_remote_oob_data *cp = data;
5792         u8 status;
5793         int err;
5794
5795         bt_dev_dbg(hdev, "sock %p", sk);
5796
5797         if (cp->addr.type != BDADDR_BREDR)
5798                 return mgmt_cmd_complete(sk, hdev->id,
5799                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5800                                          MGMT_STATUS_INVALID_PARAMS,
5801                                          &cp->addr, sizeof(cp->addr));
5802
5803         hci_dev_lock(hdev);
5804
5805         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5806                 hci_remote_oob_data_clear(hdev);
5807                 status = MGMT_STATUS_SUCCESS;
5808                 goto done;
5809         }
5810
5811         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
5812         if (err < 0)
5813                 status = MGMT_STATUS_INVALID_PARAMS;
5814         else
5815                 status = MGMT_STATUS_SUCCESS;
5816
5817 done:
5818         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5819                                 status, &cp->addr, sizeof(cp->addr));
5820
5821         hci_dev_unlock(hdev);
5822         return err;
5823 }
5824
5825 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
5826 {
5827         struct mgmt_pending_cmd *cmd;
5828
5829         bt_dev_dbg(hdev, "status %u", status);
5830
5831         hci_dev_lock(hdev);
5832
5833         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
5834         if (!cmd)
5835                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
5836
5837         if (!cmd)
5838                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
5839
5840         if (cmd) {
5841                 cmd->cmd_complete(cmd, mgmt_status(status));
5842                 mgmt_pending_remove(cmd);
5843         }
5844
5845         hci_dev_unlock(hdev);
5846 }
5847
5848 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
5849                                     uint8_t *mgmt_status)
5850 {
5851         switch (type) {
5852         case DISCOV_TYPE_LE:
5853                 *mgmt_status = mgmt_le_support(hdev);
5854                 if (*mgmt_status)
5855                         return false;
5856                 break;
5857         case DISCOV_TYPE_INTERLEAVED:
5858                 *mgmt_status = mgmt_le_support(hdev);
5859                 if (*mgmt_status)
5860                         return false;
5861                 fallthrough;
5862         case DISCOV_TYPE_BREDR:
5863                 *mgmt_status = mgmt_bredr_support(hdev);
5864                 if (*mgmt_status)
5865                         return false;
5866                 break;
5867         default:
5868                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
5869                 return false;
5870         }
5871
5872         return true;
5873 }
5874
5875 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
5876 {
5877         struct mgmt_pending_cmd *cmd = data;
5878
5879         if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) &&
5880             cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) &&
5881             cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev))
5882                 return;
5883
5884         bt_dev_dbg(hdev, "err %d", err);
5885
5886         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
5887                           cmd->param, 1);
5888         mgmt_pending_remove(cmd);
5889
5890         hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED:
5891                                 DISCOVERY_FINDING);
5892 }
5893
5894 static int start_discovery_sync(struct hci_dev *hdev, void *data)
5895 {
5896         return hci_start_discovery_sync(hdev);
5897 }
5898
5899 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
5900                                     u16 op, void *data, u16 len)
5901 {
5902         struct mgmt_cp_start_discovery *cp = data;
5903         struct mgmt_pending_cmd *cmd;
5904         u8 status;
5905         int err;
5906
5907         bt_dev_dbg(hdev, "sock %p", sk);
5908
5909         hci_dev_lock(hdev);
5910
5911         if (!hdev_is_powered(hdev)) {
5912                 err = mgmt_cmd_complete(sk, hdev->id, op,
5913                                         MGMT_STATUS_NOT_POWERED,
5914                                         &cp->type, sizeof(cp->type));
5915                 goto failed;
5916         }
5917
5918         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5919             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5920                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5921                                         &cp->type, sizeof(cp->type));
5922                 goto failed;
5923         }
5924
5925         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5926                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
5927                                         &cp->type, sizeof(cp->type));
5928                 goto failed;
5929         }
5930
5931         /* Can't start discovery when it is paused */
5932         if (hdev->discovery_paused) {
5933                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5934                                         &cp->type, sizeof(cp->type));
5935                 goto failed;
5936         }
5937
5938         /* Clear the discovery filter first to free any previously
5939          * allocated memory for the UUID list.
5940          */
5941         hci_discovery_filter_clear(hdev);
5942
5943         hdev->discovery.type = cp->type;
5944         hdev->discovery.report_invalid_rssi = false;
5945         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
5946                 hdev->discovery.limited = true;
5947         else
5948                 hdev->discovery.limited = false;
5949
5950         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5951         if (!cmd) {
5952                 err = -ENOMEM;
5953                 goto failed;
5954         }
5955
5956         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
5957                                  start_discovery_complete);
5958         if (err < 0) {
5959                 mgmt_pending_remove(cmd);
5960                 goto failed;
5961         }
5962
5963         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5964
5965 failed:
5966         hci_dev_unlock(hdev);
5967         return err;
5968 }
5969
5970 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
5971                            void *data, u16 len)
5972 {
5973         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
5974                                         data, len);
5975 }
5976
5977 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
5978                                    void *data, u16 len)
5979 {
5980         return start_discovery_internal(sk, hdev,
5981                                         MGMT_OP_START_LIMITED_DISCOVERY,
5982                                         data, len);
5983 }
5984
5985 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
5986                                    void *data, u16 len)
5987 {
5988         struct mgmt_cp_start_service_discovery *cp = data;
5989         struct mgmt_pending_cmd *cmd;
5990         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
5991         u16 uuid_count, expected_len;
5992         u8 status;
5993         int err;
5994
5995         bt_dev_dbg(hdev, "sock %p", sk);
5996
5997         hci_dev_lock(hdev);
5998
5999         if (!hdev_is_powered(hdev)) {
6000                 err = mgmt_cmd_complete(sk, hdev->id,
6001                                         MGMT_OP_START_SERVICE_DISCOVERY,
6002                                         MGMT_STATUS_NOT_POWERED,
6003                                         &cp->type, sizeof(cp->type));
6004                 goto failed;
6005         }
6006
6007         if (hdev->discovery.state != DISCOVERY_STOPPED ||
6008             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
6009                 err = mgmt_cmd_complete(sk, hdev->id,
6010                                         MGMT_OP_START_SERVICE_DISCOVERY,
6011                                         MGMT_STATUS_BUSY, &cp->type,
6012                                         sizeof(cp->type));
6013                 goto failed;
6014         }
6015
6016         if (hdev->discovery_paused) {
6017                 err = mgmt_cmd_complete(sk, hdev->id,
6018                                         MGMT_OP_START_SERVICE_DISCOVERY,
6019                                         MGMT_STATUS_BUSY, &cp->type,
6020                                         sizeof(cp->type));
6021                 goto failed;
6022         }
6023
6024         uuid_count = __le16_to_cpu(cp->uuid_count);
6025         if (uuid_count > max_uuid_count) {
6026                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
6027                            uuid_count);
6028                 err = mgmt_cmd_complete(sk, hdev->id,
6029                                         MGMT_OP_START_SERVICE_DISCOVERY,
6030                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
6031                                         sizeof(cp->type));
6032                 goto failed;
6033         }
6034
6035         expected_len = sizeof(*cp) + uuid_count * 16;
6036         if (expected_len != len) {
6037                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
6038                            expected_len, len);
6039                 err = mgmt_cmd_complete(sk, hdev->id,
6040                                         MGMT_OP_START_SERVICE_DISCOVERY,
6041                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
6042                                         sizeof(cp->type));
6043                 goto failed;
6044         }
6045
6046         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
6047                 err = mgmt_cmd_complete(sk, hdev->id,
6048                                         MGMT_OP_START_SERVICE_DISCOVERY,
6049                                         status, &cp->type, sizeof(cp->type));
6050                 goto failed;
6051         }
6052
6053         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
6054                                hdev, data, len);
6055         if (!cmd) {
6056                 err = -ENOMEM;
6057                 goto failed;
6058         }
6059
6060         /* Clear the discovery filter first to free any previously
6061          * allocated memory for the UUID list.
6062          */
6063         hci_discovery_filter_clear(hdev);
6064
6065         hdev->discovery.result_filtering = true;
6066         hdev->discovery.type = cp->type;
6067         hdev->discovery.rssi = cp->rssi;
6068         hdev->discovery.uuid_count = uuid_count;
6069
6070         if (uuid_count > 0) {
6071                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
6072                                                 GFP_KERNEL);
6073                 if (!hdev->discovery.uuids) {
6074                         err = mgmt_cmd_complete(sk, hdev->id,
6075                                                 MGMT_OP_START_SERVICE_DISCOVERY,
6076                                                 MGMT_STATUS_FAILED,
6077                                                 &cp->type, sizeof(cp->type));
6078                         mgmt_pending_remove(cmd);
6079                         goto failed;
6080                 }
6081         }
6082
6083         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
6084                                  start_discovery_complete);
6085         if (err < 0) {
6086                 mgmt_pending_remove(cmd);
6087                 goto failed;
6088         }
6089
6090         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
6091
6092 failed:
6093         hci_dev_unlock(hdev);
6094         return err;
6095 }
6096
6097 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
6098 {
6099         struct mgmt_pending_cmd *cmd;
6100
6101         bt_dev_dbg(hdev, "status %u", status);
6102
6103         hci_dev_lock(hdev);
6104
6105         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6106         if (cmd) {
6107                 cmd->cmd_complete(cmd, mgmt_status(status));
6108                 mgmt_pending_remove(cmd);
6109         }
6110
6111         hci_dev_unlock(hdev);
6112 }
6113
6114 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
6115 {
6116         struct mgmt_pending_cmd *cmd = data;
6117
6118         if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
6119                 return;
6120
6121         bt_dev_dbg(hdev, "err %d", err);
6122
6123         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
6124                           cmd->param, 1);
6125         mgmt_pending_remove(cmd);
6126
6127         if (!err)
6128                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
6129 }
6130
6131 static int stop_discovery_sync(struct hci_dev *hdev, void *data)
6132 {
6133         return hci_stop_discovery_sync(hdev);
6134 }
6135
6136 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
6137                           u16 len)
6138 {
6139         struct mgmt_cp_stop_discovery *mgmt_cp = data;
6140         struct mgmt_pending_cmd *cmd;
6141         int err;
6142
6143         bt_dev_dbg(hdev, "sock %p", sk);
6144
6145         hci_dev_lock(hdev);
6146
6147         if (!hci_discovery_active(hdev)) {
6148                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6149                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
6150                                         sizeof(mgmt_cp->type));
6151                 goto unlock;
6152         }
6153
6154         if (hdev->discovery.type != mgmt_cp->type) {
6155                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6156                                         MGMT_STATUS_INVALID_PARAMS,
6157                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
6158                 goto unlock;
6159         }
6160
6161         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
6162         if (!cmd) {
6163                 err = -ENOMEM;
6164                 goto unlock;
6165         }
6166
6167         err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd,
6168                                  stop_discovery_complete);
6169         if (err < 0) {
6170                 mgmt_pending_remove(cmd);
6171                 goto unlock;
6172         }
6173
6174         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
6175
6176 unlock:
6177         hci_dev_unlock(hdev);
6178         return err;
6179 }
6180
6181 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
6182                         u16 len)
6183 {
6184         struct mgmt_cp_confirm_name *cp = data;
6185         struct inquiry_entry *e;
6186         int err;
6187
6188         bt_dev_dbg(hdev, "sock %p", sk);
6189
6190         hci_dev_lock(hdev);
6191
6192         if (!hci_discovery_active(hdev)) {
6193                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6194                                         MGMT_STATUS_FAILED, &cp->addr,
6195                                         sizeof(cp->addr));
6196                 goto failed;
6197         }
6198
6199         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
6200         if (!e) {
6201                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6202                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
6203                                         sizeof(cp->addr));
6204                 goto failed;
6205         }
6206
6207         if (cp->name_known) {
6208                 e->name_state = NAME_KNOWN;
6209                 list_del(&e->list);
6210         } else {
6211                 e->name_state = NAME_NEEDED;
6212                 hci_inquiry_cache_update_resolve(hdev, e);
6213         }
6214
6215         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
6216                                 &cp->addr, sizeof(cp->addr));
6217
6218 failed:
6219         hci_dev_unlock(hdev);
6220         return err;
6221 }
6222
6223 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
6224                         u16 len)
6225 {
6226         struct mgmt_cp_block_device *cp = data;
6227         u8 status;
6228         int err;
6229
6230         bt_dev_dbg(hdev, "sock %p", sk);
6231
6232         if (!bdaddr_type_is_valid(cp->addr.type))
6233                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
6234                                          MGMT_STATUS_INVALID_PARAMS,
6235                                          &cp->addr, sizeof(cp->addr));
6236
6237         hci_dev_lock(hdev);
6238
6239         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
6240                                   cp->addr.type);
6241         if (err < 0) {
6242                 status = MGMT_STATUS_FAILED;
6243                 goto done;
6244         }
6245
6246         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6247                    sk);
6248         status = MGMT_STATUS_SUCCESS;
6249
6250 done:
6251         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
6252                                 &cp->addr, sizeof(cp->addr));
6253
6254         hci_dev_unlock(hdev);
6255
6256         return err;
6257 }
6258
6259 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
6260                           u16 len)
6261 {
6262         struct mgmt_cp_unblock_device *cp = data;
6263         u8 status;
6264         int err;
6265
6266         bt_dev_dbg(hdev, "sock %p", sk);
6267
6268         if (!bdaddr_type_is_valid(cp->addr.type))
6269                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
6270                                          MGMT_STATUS_INVALID_PARAMS,
6271                                          &cp->addr, sizeof(cp->addr));
6272
6273         hci_dev_lock(hdev);
6274
6275         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
6276                                   cp->addr.type);
6277         if (err < 0) {
6278                 status = MGMT_STATUS_INVALID_PARAMS;
6279                 goto done;
6280         }
6281
6282         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6283                    sk);
6284         status = MGMT_STATUS_SUCCESS;
6285
6286 done:
6287         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
6288                                 &cp->addr, sizeof(cp->addr));
6289
6290         hci_dev_unlock(hdev);
6291
6292         return err;
6293 }
6294
6295 static int set_device_id_sync(struct hci_dev *hdev, void *data)
6296 {
6297         return hci_update_eir_sync(hdev);
6298 }
6299
6300 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
6301                          u16 len)
6302 {
6303         struct mgmt_cp_set_device_id *cp = data;
6304         int err;
6305         __u16 source;
6306
6307         bt_dev_dbg(hdev, "sock %p", sk);
6308
6309         source = __le16_to_cpu(cp->source);
6310
6311         if (source > 0x0002)
6312                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
6313                                        MGMT_STATUS_INVALID_PARAMS);
6314
6315         hci_dev_lock(hdev);
6316
6317         hdev->devid_source = source;
6318         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
6319         hdev->devid_product = __le16_to_cpu(cp->product);
6320         hdev->devid_version = __le16_to_cpu(cp->version);
6321
6322         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
6323                                 NULL, 0);
6324
6325         hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL);
6326
6327         hci_dev_unlock(hdev);
6328
6329         return err;
6330 }
6331
6332 static void enable_advertising_instance(struct hci_dev *hdev, int err)
6333 {
6334         if (err)
6335                 bt_dev_err(hdev, "failed to re-configure advertising %d", err);
6336         else
6337                 bt_dev_dbg(hdev, "status %d", err);
6338 }
6339
6340 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)
6341 {
6342         struct cmd_lookup match = { NULL, hdev };
6343         u8 instance;
6344         struct adv_info *adv_instance;
6345         u8 status = mgmt_status(err);
6346
6347         if (status) {
6348                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
6349                                      cmd_status_rsp, &status);
6350                 return;
6351         }
6352
6353         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
6354                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
6355         else
6356                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
6357
6358         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
6359                              &match);
6360
6361         new_settings(hdev, match.sk);
6362
6363         if (match.sk)
6364                 sock_put(match.sk);
6365
6366         /* If "Set Advertising" was just disabled and instance advertising was
6367          * set up earlier, then re-enable multi-instance advertising.
6368          */
6369         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6370             list_empty(&hdev->adv_instances))
6371                 return;
6372
6373         instance = hdev->cur_adv_instance;
6374         if (!instance) {
6375                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
6376                                                         struct adv_info, list);
6377                 if (!adv_instance)
6378                         return;
6379
6380                 instance = adv_instance->instance;
6381         }
6382
6383         err = hci_schedule_adv_instance_sync(hdev, instance, true);
6384
6385         enable_advertising_instance(hdev, err);
6386 }
6387
6388 static int set_adv_sync(struct hci_dev *hdev, void *data)
6389 {
6390         struct mgmt_pending_cmd *cmd = data;
6391         struct mgmt_mode *cp = cmd->param;
6392         u8 val = !!cp->val;
6393
6394         if (cp->val == 0x02)
6395                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6396         else
6397                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6398
6399         cancel_adv_timeout(hdev);
6400
6401         if (val) {
6402                 /* Switch to instance "0" for the Set Advertising setting.
6403                  * We cannot use update_[adv|scan_rsp]_data() here as the
6404                  * HCI_ADVERTISING flag is not yet set.
6405                  */
6406                 hdev->cur_adv_instance = 0x00;
6407
6408                 if (ext_adv_capable(hdev)) {
6409                         hci_start_ext_adv_sync(hdev, 0x00);
6410                 } else {
6411                         hci_update_adv_data_sync(hdev, 0x00);
6412                         hci_update_scan_rsp_data_sync(hdev, 0x00);
6413                         hci_enable_advertising_sync(hdev);
6414                 }
6415         } else {
6416                 hci_disable_advertising_sync(hdev);
6417         }
6418
6419         return 0;
6420 }
6421
6422 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
6423                            u16 len)
6424 {
6425         struct mgmt_mode *cp = data;
6426         struct mgmt_pending_cmd *cmd;
6427         u8 val, status;
6428         int err;
6429
6430         bt_dev_dbg(hdev, "sock %p", sk);
6431
6432         status = mgmt_le_support(hdev);
6433         if (status)
6434                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6435                                        status);
6436
6437         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6438                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6439                                        MGMT_STATUS_INVALID_PARAMS);
6440
6441         if (hdev->advertising_paused)
6442                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6443                                        MGMT_STATUS_BUSY);
6444
6445         hci_dev_lock(hdev);
6446
6447         val = !!cp->val;
6448
6449         /* The following conditions are ones which mean that we should
6450          * not do any HCI communication but directly send a mgmt
6451          * response to user space (after toggling the flag if
6452          * necessary).
6453          */
6454         if (!hdev_is_powered(hdev) ||
6455             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
6456              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
6457             hci_dev_test_flag(hdev, HCI_MESH) ||
6458             hci_conn_num(hdev, LE_LINK) > 0 ||
6459             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6460              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
6461                 bool changed;
6462
6463                 if (cp->val) {
6464                         hdev->cur_adv_instance = 0x00;
6465                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
6466                         if (cp->val == 0x02)
6467                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6468                         else
6469                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6470                 } else {
6471                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
6472                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6473                 }
6474
6475                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
6476                 if (err < 0)
6477                         goto unlock;
6478
6479                 if (changed)
6480                         err = new_settings(hdev, sk);
6481
6482                 goto unlock;
6483         }
6484
6485         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
6486             pending_find(MGMT_OP_SET_LE, hdev)) {
6487                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6488                                       MGMT_STATUS_BUSY);
6489                 goto unlock;
6490         }
6491
6492         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
6493         if (!cmd)
6494                 err = -ENOMEM;
6495         else
6496                 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd,
6497                                          set_advertising_complete);
6498
6499         if (err < 0 && cmd)
6500                 mgmt_pending_remove(cmd);
6501
6502 unlock:
6503         hci_dev_unlock(hdev);
6504         return err;
6505 }
6506
6507 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
6508                               void *data, u16 len)
6509 {
6510         struct mgmt_cp_set_static_address *cp = data;
6511         int err;
6512
6513         bt_dev_dbg(hdev, "sock %p", sk);
6514
6515         if (!lmp_le_capable(hdev))
6516                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6517                                        MGMT_STATUS_NOT_SUPPORTED);
6518
6519         if (hdev_is_powered(hdev))
6520                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6521                                        MGMT_STATUS_REJECTED);
6522
6523         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
6524                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
6525                         return mgmt_cmd_status(sk, hdev->id,
6526                                                MGMT_OP_SET_STATIC_ADDRESS,
6527                                                MGMT_STATUS_INVALID_PARAMS);
6528
6529                 /* Two most significant bits shall be set */
6530                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
6531                         return mgmt_cmd_status(sk, hdev->id,
6532                                                MGMT_OP_SET_STATIC_ADDRESS,
6533                                                MGMT_STATUS_INVALID_PARAMS);
6534         }
6535
6536         hci_dev_lock(hdev);
6537
6538         bacpy(&hdev->static_addr, &cp->bdaddr);
6539
6540         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
6541         if (err < 0)
6542                 goto unlock;
6543
6544         err = new_settings(hdev, sk);
6545
6546 unlock:
6547         hci_dev_unlock(hdev);
6548         return err;
6549 }
6550
6551 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
6552                            void *data, u16 len)
6553 {
6554         struct mgmt_cp_set_scan_params *cp = data;
6555         __u16 interval, window;
6556         int err;
6557
6558         bt_dev_dbg(hdev, "sock %p", sk);
6559
6560         if (!lmp_le_capable(hdev))
6561                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6562                                        MGMT_STATUS_NOT_SUPPORTED);
6563
6564         interval = __le16_to_cpu(cp->interval);
6565
6566         if (interval < 0x0004 || interval > 0x4000)
6567                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6568                                        MGMT_STATUS_INVALID_PARAMS);
6569
6570         window = __le16_to_cpu(cp->window);
6571
6572         if (window < 0x0004 || window > 0x4000)
6573                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6574                                        MGMT_STATUS_INVALID_PARAMS);
6575
6576         if (window > interval)
6577                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6578                                        MGMT_STATUS_INVALID_PARAMS);
6579
6580         hci_dev_lock(hdev);
6581
6582         hdev->le_scan_interval = interval;
6583         hdev->le_scan_window = window;
6584
6585         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
6586                                 NULL, 0);
6587
6588         /* If background scan is running, restart it so new parameters are
6589          * loaded.
6590          */
6591         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6592             hdev->discovery.state == DISCOVERY_STOPPED)
6593                 hci_update_passive_scan(hdev);
6594
6595         hci_dev_unlock(hdev);
6596
6597         return err;
6598 }
6599
6600 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err)
6601 {
6602         struct mgmt_pending_cmd *cmd = data;
6603
6604         bt_dev_dbg(hdev, "err %d", err);
6605
6606         if (err) {
6607                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6608                                 mgmt_status(err));
6609         } else {
6610                 struct mgmt_mode *cp = cmd->param;
6611
6612                 if (cp->val)
6613                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
6614                 else
6615                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6616
6617                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6618                 new_settings(hdev, cmd->sk);
6619         }
6620
6621         mgmt_pending_free(cmd);
6622 }
6623
6624 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data)
6625 {
6626         struct mgmt_pending_cmd *cmd = data;
6627         struct mgmt_mode *cp = cmd->param;
6628
6629         return hci_write_fast_connectable_sync(hdev, cp->val);
6630 }
6631
6632 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
6633                                 void *data, u16 len)
6634 {
6635         struct mgmt_mode *cp = data;
6636         struct mgmt_pending_cmd *cmd;
6637         int err;
6638
6639         bt_dev_dbg(hdev, "sock %p", sk);
6640
6641         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
6642             hdev->hci_ver < BLUETOOTH_VER_1_2)
6643                 return mgmt_cmd_status(sk, hdev->id,
6644                                        MGMT_OP_SET_FAST_CONNECTABLE,
6645                                        MGMT_STATUS_NOT_SUPPORTED);
6646
6647         if (cp->val != 0x00 && cp->val != 0x01)
6648                 return mgmt_cmd_status(sk, hdev->id,
6649                                        MGMT_OP_SET_FAST_CONNECTABLE,
6650                                        MGMT_STATUS_INVALID_PARAMS);
6651
6652         hci_dev_lock(hdev);
6653
6654         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
6655                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6656                 goto unlock;
6657         }
6658
6659         if (!hdev_is_powered(hdev)) {
6660                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
6661                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6662                 new_settings(hdev, sk);
6663                 goto unlock;
6664         }
6665
6666         cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data,
6667                                len);
6668         if (!cmd)
6669                 err = -ENOMEM;
6670         else
6671                 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd,
6672                                          fast_connectable_complete);
6673
6674         if (err < 0) {
6675                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6676                                 MGMT_STATUS_FAILED);
6677
6678                 if (cmd)
6679                         mgmt_pending_free(cmd);
6680         }
6681
6682 unlock:
6683         hci_dev_unlock(hdev);
6684
6685         return err;
6686 }
6687
6688 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err)
6689 {
6690         struct mgmt_pending_cmd *cmd = data;
6691
6692         bt_dev_dbg(hdev, "err %d", err);
6693
6694         if (err) {
6695                 u8 mgmt_err = mgmt_status(err);
6696
6697                 /* We need to restore the flag if related HCI commands
6698                  * failed.
6699                  */
6700                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
6701
6702                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6703         } else {
6704                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
6705                 new_settings(hdev, cmd->sk);
6706         }
6707
6708         mgmt_pending_free(cmd);
6709 }
6710
6711 static int set_bredr_sync(struct hci_dev *hdev, void *data)
6712 {
6713         int status;
6714
6715         status = hci_write_fast_connectable_sync(hdev, false);
6716
6717         if (!status)
6718                 status = hci_update_scan_sync(hdev);
6719
6720         /* Since only the advertising data flags will change, there
6721          * is no need to update the scan response data.
6722          */
6723         if (!status)
6724                 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance);
6725
6726         return status;
6727 }
6728
6729 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6730 {
6731         struct mgmt_mode *cp = data;
6732         struct mgmt_pending_cmd *cmd;
6733         int err;
6734
6735         bt_dev_dbg(hdev, "sock %p", sk);
6736
6737         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
6738                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6739                                        MGMT_STATUS_NOT_SUPPORTED);
6740
6741         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6742                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6743                                        MGMT_STATUS_REJECTED);
6744
6745         if (cp->val != 0x00 && cp->val != 0x01)
6746                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6747                                        MGMT_STATUS_INVALID_PARAMS);
6748
6749         hci_dev_lock(hdev);
6750
6751         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6752                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6753                 goto unlock;
6754         }
6755
6756         if (!hdev_is_powered(hdev)) {
6757                 if (!cp->val) {
6758                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
6759                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
6760                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
6761                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6762                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
6763                 }
6764
6765                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
6766
6767                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6768                 if (err < 0)
6769                         goto unlock;
6770
6771                 err = new_settings(hdev, sk);
6772                 goto unlock;
6773         }
6774
6775         /* Reject disabling when powered on */
6776         if (!cp->val) {
6777                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6778                                       MGMT_STATUS_REJECTED);
6779                 goto unlock;
6780         } else {
6781                 /* When configuring a dual-mode controller to operate
6782                  * with LE only and using a static address, then switching
6783                  * BR/EDR back on is not allowed.
6784                  *
6785                  * Dual-mode controllers shall operate with the public
6786                  * address as its identity address for BR/EDR and LE. So
6787                  * reject the attempt to create an invalid configuration.
6788                  *
6789                  * The same restrictions applies when secure connections
6790                  * has been enabled. For BR/EDR this is a controller feature
6791                  * while for LE it is a host stack feature. This means that
6792                  * switching BR/EDR back on when secure connections has been
6793                  * enabled is not a supported transaction.
6794                  */
6795                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6796                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
6797                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
6798                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6799                                               MGMT_STATUS_REJECTED);
6800                         goto unlock;
6801                 }
6802         }
6803
6804         cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len);
6805         if (!cmd)
6806                 err = -ENOMEM;
6807         else
6808                 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd,
6809                                          set_bredr_complete);
6810
6811         if (err < 0) {
6812                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6813                                 MGMT_STATUS_FAILED);
6814                 if (cmd)
6815                         mgmt_pending_free(cmd);
6816
6817                 goto unlock;
6818         }
6819
6820         /* We need to flip the bit already here so that
6821          * hci_req_update_adv_data generates the correct flags.
6822          */
6823         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
6824
6825 unlock:
6826         hci_dev_unlock(hdev);
6827         return err;
6828 }
6829
6830 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err)
6831 {
6832         struct mgmt_pending_cmd *cmd = data;
6833         struct mgmt_mode *cp;
6834
6835         bt_dev_dbg(hdev, "err %d", err);
6836
6837         if (err) {
6838                 u8 mgmt_err = mgmt_status(err);
6839
6840                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6841                 goto done;
6842         }
6843
6844         cp = cmd->param;
6845
6846         switch (cp->val) {
6847         case 0x00:
6848                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
6849                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6850                 break;
6851         case 0x01:
6852                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6853                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6854                 break;
6855         case 0x02:
6856                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6857                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6858                 break;
6859         }
6860
6861         send_settings_rsp(cmd->sk, cmd->opcode, hdev);
6862         new_settings(hdev, cmd->sk);
6863
6864 done:
6865         mgmt_pending_free(cmd);
6866 }
6867
6868 static int set_secure_conn_sync(struct hci_dev *hdev, void *data)
6869 {
6870         struct mgmt_pending_cmd *cmd = data;
6871         struct mgmt_mode *cp = cmd->param;
6872         u8 val = !!cp->val;
6873
6874         /* Force write of val */
6875         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6876
6877         return hci_write_sc_support_sync(hdev, val);
6878 }
6879
6880 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
6881                            void *data, u16 len)
6882 {
6883         struct mgmt_mode *cp = data;
6884         struct mgmt_pending_cmd *cmd;
6885         u8 val;
6886         int err;
6887
6888         bt_dev_dbg(hdev, "sock %p", sk);
6889
6890         if (!lmp_sc_capable(hdev) &&
6891             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6892                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6893                                        MGMT_STATUS_NOT_SUPPORTED);
6894
6895         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6896             lmp_sc_capable(hdev) &&
6897             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
6898                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6899                                        MGMT_STATUS_REJECTED);
6900
6901         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6902                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6903                                        MGMT_STATUS_INVALID_PARAMS);
6904
6905         hci_dev_lock(hdev);
6906
6907         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
6908             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6909                 bool changed;
6910
6911                 if (cp->val) {
6912                         changed = !hci_dev_test_and_set_flag(hdev,
6913                                                              HCI_SC_ENABLED);
6914                         if (cp->val == 0x02)
6915                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6916                         else
6917                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6918                 } else {
6919                         changed = hci_dev_test_and_clear_flag(hdev,
6920                                                               HCI_SC_ENABLED);
6921                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6922                 }
6923
6924                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6925                 if (err < 0)
6926                         goto failed;
6927
6928                 if (changed)
6929                         err = new_settings(hdev, sk);
6930
6931                 goto failed;
6932         }
6933
6934         val = !!cp->val;
6935
6936         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6937             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6938                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6939                 goto failed;
6940         }
6941
6942         cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
6943         if (!cmd)
6944                 err = -ENOMEM;
6945         else
6946                 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd,
6947                                          set_secure_conn_complete);
6948
6949         if (err < 0) {
6950                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6951                                 MGMT_STATUS_FAILED);
6952                 if (cmd)
6953                         mgmt_pending_free(cmd);
6954         }
6955
6956 failed:
6957         hci_dev_unlock(hdev);
6958         return err;
6959 }
6960
6961 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
6962                           void *data, u16 len)
6963 {
6964         struct mgmt_mode *cp = data;
6965         bool changed, use_changed;
6966         int err;
6967
6968         bt_dev_dbg(hdev, "sock %p", sk);
6969
6970         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6971                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
6972                                        MGMT_STATUS_INVALID_PARAMS);
6973
6974         hci_dev_lock(hdev);
6975
6976         if (cp->val)
6977                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6978         else
6979                 changed = hci_dev_test_and_clear_flag(hdev,
6980                                                       HCI_KEEP_DEBUG_KEYS);
6981
6982         if (cp->val == 0x02)
6983                 use_changed = !hci_dev_test_and_set_flag(hdev,
6984                                                          HCI_USE_DEBUG_KEYS);
6985         else
6986                 use_changed = hci_dev_test_and_clear_flag(hdev,
6987                                                           HCI_USE_DEBUG_KEYS);
6988
6989         if (hdev_is_powered(hdev) && use_changed &&
6990             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6991                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6992                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6993                              sizeof(mode), &mode);
6994         }
6995
6996         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
6997         if (err < 0)
6998                 goto unlock;
6999
7000         if (changed)
7001                 err = new_settings(hdev, sk);
7002
7003 unlock:
7004         hci_dev_unlock(hdev);
7005         return err;
7006 }
7007
7008 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7009                        u16 len)
7010 {
7011         struct mgmt_cp_set_privacy *cp = cp_data;
7012         bool changed;
7013         int err;
7014
7015         bt_dev_dbg(hdev, "sock %p", sk);
7016
7017         if (!lmp_le_capable(hdev))
7018                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7019                                        MGMT_STATUS_NOT_SUPPORTED);
7020
7021         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
7022                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7023                                        MGMT_STATUS_INVALID_PARAMS);
7024
7025         if (hdev_is_powered(hdev))
7026                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7027                                        MGMT_STATUS_REJECTED);
7028
7029         hci_dev_lock(hdev);
7030
7031         /* If user space supports this command it is also expected to
7032          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
7033          */
7034         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7035
7036         if (cp->privacy) {
7037                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
7038                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
7039                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
7040                 hci_adv_instances_set_rpa_expired(hdev, true);
7041                 if (cp->privacy == 0x02)
7042                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
7043                 else
7044                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7045         } else {
7046                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
7047                 memset(hdev->irk, 0, sizeof(hdev->irk));
7048                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
7049                 hci_adv_instances_set_rpa_expired(hdev, false);
7050                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7051         }
7052
7053         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
7054         if (err < 0)
7055                 goto unlock;
7056
7057         if (changed)
7058                 err = new_settings(hdev, sk);
7059
7060 unlock:
7061         hci_dev_unlock(hdev);
7062         return err;
7063 }
7064
7065 static bool irk_is_valid(struct mgmt_irk_info *irk)
7066 {
7067         switch (irk->addr.type) {
7068         case BDADDR_LE_PUBLIC:
7069                 return true;
7070
7071         case BDADDR_LE_RANDOM:
7072                 /* Two most significant bits shall be set */
7073                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7074                         return false;
7075                 return true;
7076         }
7077
7078         return false;
7079 }
7080
7081 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7082                      u16 len)
7083 {
7084         struct mgmt_cp_load_irks *cp = cp_data;
7085         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
7086                                    sizeof(struct mgmt_irk_info));
7087         u16 irk_count, expected_len;
7088         int i, err;
7089
7090         bt_dev_dbg(hdev, "sock %p", sk);
7091
7092         if (!lmp_le_capable(hdev))
7093                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7094                                        MGMT_STATUS_NOT_SUPPORTED);
7095
7096         irk_count = __le16_to_cpu(cp->irk_count);
7097         if (irk_count > max_irk_count) {
7098                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
7099                            irk_count);
7100                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7101                                        MGMT_STATUS_INVALID_PARAMS);
7102         }
7103
7104         expected_len = struct_size(cp, irks, irk_count);
7105         if (expected_len != len) {
7106                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
7107                            expected_len, len);
7108                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7109                                        MGMT_STATUS_INVALID_PARAMS);
7110         }
7111
7112         bt_dev_dbg(hdev, "irk_count %u", irk_count);
7113
7114         for (i = 0; i < irk_count; i++) {
7115                 struct mgmt_irk_info *key = &cp->irks[i];
7116
7117                 if (!irk_is_valid(key))
7118                         return mgmt_cmd_status(sk, hdev->id,
7119                                                MGMT_OP_LOAD_IRKS,
7120                                                MGMT_STATUS_INVALID_PARAMS);
7121         }
7122
7123         hci_dev_lock(hdev);
7124
7125         hci_smp_irks_clear(hdev);
7126
7127         for (i = 0; i < irk_count; i++) {
7128                 struct mgmt_irk_info *irk = &cp->irks[i];
7129
7130                 if (hci_is_blocked_key(hdev,
7131                                        HCI_BLOCKED_KEY_TYPE_IRK,
7132                                        irk->val)) {
7133                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
7134                                     &irk->addr.bdaddr);
7135                         continue;
7136                 }
7137
7138                 hci_add_irk(hdev, &irk->addr.bdaddr,
7139                             le_addr_type(irk->addr.type), irk->val,
7140                             BDADDR_ANY);
7141         }
7142
7143         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7144
7145         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
7146
7147         hci_dev_unlock(hdev);
7148
7149         return err;
7150 }
7151
7152 #ifdef TIZEN_BT
7153 static int set_advertising_params(struct sock *sk, struct hci_dev *hdev,
7154                         void *data, u16 len)
7155 {
7156         struct mgmt_cp_set_advertising_params *cp = data;
7157         __u16 min_interval;
7158         __u16 max_interval;
7159         int err;
7160
7161         BT_DBG("%s", hdev->name);
7162
7163         if (!lmp_le_capable(hdev))
7164                 return mgmt_cmd_status(sk, hdev->id,
7165                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7166                                 MGMT_STATUS_NOT_SUPPORTED);
7167
7168         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7169                 return mgmt_cmd_status(sk, hdev->id,
7170                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7171                                 MGMT_STATUS_BUSY);
7172
7173         min_interval = __le16_to_cpu(cp->interval_min);
7174         max_interval = __le16_to_cpu(cp->interval_max);
7175
7176         if (min_interval > max_interval ||
7177             min_interval < 0x0020 || max_interval > 0x4000)
7178                 return mgmt_cmd_status(sk, hdev->id,
7179                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7180                                 MGMT_STATUS_INVALID_PARAMS);
7181
7182         hci_dev_lock(hdev);
7183
7184         hdev->le_adv_min_interval = min_interval;
7185         hdev->le_adv_max_interval = max_interval;
7186         hdev->adv_filter_policy = cp->filter_policy;
7187         hdev->adv_type = cp->type;
7188
7189         err = mgmt_cmd_complete(sk, hdev->id,
7190                         MGMT_OP_SET_ADVERTISING_PARAMS, 0, NULL, 0);
7191
7192         hci_dev_unlock(hdev);
7193
7194         return err;
7195 }
7196
7197 static void set_advertising_data_complete(struct hci_dev *hdev,
7198                         u8 status, u16 opcode)
7199 {
7200         struct mgmt_cp_set_advertising_data *cp;
7201         struct mgmt_pending_cmd *cmd;
7202
7203         BT_DBG("status 0x%02x", status);
7204
7205         hci_dev_lock(hdev);
7206
7207         cmd = pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev);
7208         if (!cmd)
7209                 goto unlock;
7210
7211         cp = cmd->param;
7212
7213         if (status)
7214                 mgmt_cmd_status(cmd->sk, hdev->id,
7215                                 MGMT_OP_SET_ADVERTISING_DATA,
7216                                 mgmt_status(status));
7217         else
7218                 mgmt_cmd_complete(cmd->sk, hdev->id,
7219                                 MGMT_OP_SET_ADVERTISING_DATA, 0,
7220                                 cp, sizeof(*cp));
7221
7222         mgmt_pending_remove(cmd);
7223
7224 unlock:
7225         hci_dev_unlock(hdev);
7226 }
7227
7228 static int set_advertising_data(struct sock *sk, struct hci_dev *hdev,
7229                         void *data, u16 len)
7230 {
7231         struct mgmt_pending_cmd *cmd;
7232         struct hci_request req;
7233         struct mgmt_cp_set_advertising_data *cp = data;
7234         struct hci_cp_le_set_adv_data adv;
7235         int err;
7236
7237         BT_DBG("%s", hdev->name);
7238
7239         if (!lmp_le_capable(hdev)) {
7240                 return mgmt_cmd_status(sk, hdev->id,
7241                                 MGMT_OP_SET_ADVERTISING_DATA,
7242                                 MGMT_STATUS_NOT_SUPPORTED);
7243         }
7244
7245         hci_dev_lock(hdev);
7246
7247         if (pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev)) {
7248                 err = mgmt_cmd_status(sk, hdev->id,
7249                                 MGMT_OP_SET_ADVERTISING_DATA,
7250                                 MGMT_STATUS_BUSY);
7251                 goto unlocked;
7252         }
7253
7254         if (len > HCI_MAX_AD_LENGTH) {
7255                 err = mgmt_cmd_status(sk, hdev->id,
7256                                 MGMT_OP_SET_ADVERTISING_DATA,
7257                                 MGMT_STATUS_INVALID_PARAMS);
7258                 goto unlocked;
7259         }
7260
7261         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING_DATA,
7262                                hdev, data, len);
7263         if (!cmd) {
7264                 err = -ENOMEM;
7265                 goto unlocked;
7266         }
7267
7268         hci_req_init(&req, hdev);
7269
7270         memset(&adv, 0, sizeof(adv));
7271         memcpy(adv.data, cp->data, len);
7272         adv.length = len;
7273
7274         hci_req_add(&req, HCI_OP_LE_SET_ADV_DATA, sizeof(adv), &adv);
7275
7276         err = hci_req_run(&req, set_advertising_data_complete);
7277         if (err < 0)
7278                 mgmt_pending_remove(cmd);
7279
7280 unlocked:
7281         hci_dev_unlock(hdev);
7282
7283         return err;
7284 }
7285
7286 /* Adv White List feature */
7287 static void add_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7288 {
7289         struct mgmt_cp_add_dev_white_list *cp;
7290         struct mgmt_pending_cmd *cmd;
7291
7292         BT_DBG("status 0x%02x", status);
7293
7294         hci_dev_lock(hdev);
7295
7296         cmd = pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev);
7297         if (!cmd)
7298                 goto unlock;
7299
7300         cp = cmd->param;
7301
7302         if (status)
7303                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7304                            mgmt_status(status));
7305         else
7306                 mgmt_cmd_complete(cmd->sk, hdev->id,
7307                                 MGMT_OP_ADD_DEV_WHITE_LIST, 0, cp, sizeof(*cp));
7308
7309         mgmt_pending_remove(cmd);
7310
7311 unlock:
7312         hci_dev_unlock(hdev);
7313 }
7314
7315 static int add_white_list(struct sock *sk, struct hci_dev *hdev,
7316                            void *data, u16 len)
7317 {
7318         struct mgmt_pending_cmd *cmd;
7319         struct mgmt_cp_add_dev_white_list *cp = data;
7320         struct hci_request req;
7321         int err;
7322
7323         BT_DBG("%s", hdev->name);
7324
7325         if (!lmp_le_capable(hdev))
7326                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7327                                   MGMT_STATUS_NOT_SUPPORTED);
7328
7329         if (!hdev_is_powered(hdev))
7330                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7331                                   MGMT_STATUS_REJECTED);
7332
7333         hci_dev_lock(hdev);
7334
7335         if (pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev)) {
7336                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7337                                 MGMT_STATUS_BUSY);
7338                 goto unlocked;
7339         }
7340
7341         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEV_WHITE_LIST, hdev, data, len);
7342         if (!cmd) {
7343                 err = -ENOMEM;
7344                 goto unlocked;
7345         }
7346
7347         hci_req_init(&req, hdev);
7348
7349         hci_req_add(&req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(*cp), cp);
7350
7351         err = hci_req_run(&req, add_white_list_complete);
7352         if (err < 0) {
7353                 mgmt_pending_remove(cmd);
7354                 goto unlocked;
7355         }
7356
7357 unlocked:
7358         hci_dev_unlock(hdev);
7359
7360         return err;
7361 }
7362
7363 static void remove_from_white_list_complete(struct hci_dev *hdev,
7364                         u8 status, u16 opcode)
7365 {
7366         struct mgmt_cp_remove_dev_from_white_list *cp;
7367         struct mgmt_pending_cmd *cmd;
7368
7369         BT_DBG("status 0x%02x", status);
7370
7371         hci_dev_lock(hdev);
7372
7373         cmd = pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev);
7374         if (!cmd)
7375                 goto unlock;
7376
7377         cp = cmd->param;
7378
7379         if (status)
7380                 mgmt_cmd_status(cmd->sk, hdev->id,
7381                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7382                         mgmt_status(status));
7383         else
7384                 mgmt_cmd_complete(cmd->sk, hdev->id,
7385                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, 0,
7386                         cp, sizeof(*cp));
7387
7388         mgmt_pending_remove(cmd);
7389
7390 unlock:
7391         hci_dev_unlock(hdev);
7392 }
7393
7394 static int remove_from_white_list(struct sock *sk, struct hci_dev *hdev,
7395                            void *data, u16 len)
7396 {
7397         struct mgmt_pending_cmd *cmd;
7398         struct mgmt_cp_remove_dev_from_white_list *cp = data;
7399         struct hci_request req;
7400         int err;
7401
7402         BT_DBG("%s", hdev->name);
7403
7404         if (!lmp_le_capable(hdev))
7405                 return mgmt_cmd_status(sk, hdev->id,
7406                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7407                                 MGMT_STATUS_NOT_SUPPORTED);
7408
7409         if (!hdev_is_powered(hdev))
7410                 return mgmt_cmd_status(sk, hdev->id,
7411                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7412                                 MGMT_STATUS_REJECTED);
7413
7414         hci_dev_lock(hdev);
7415
7416         if (pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev)) {
7417                 err = mgmt_cmd_status(sk, hdev->id,
7418                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7419                                 MGMT_STATUS_BUSY);
7420                 goto unlocked;
7421         }
7422
7423         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7424                                 hdev, data, len);
7425         if (!cmd) {
7426                 err = -ENOMEM;
7427                 goto unlocked;
7428         }
7429
7430         hci_req_init(&req, hdev);
7431
7432         hci_req_add(&req, HCI_OP_LE_DEL_FROM_WHITE_LIST, sizeof(*cp), cp);
7433
7434         err = hci_req_run(&req, remove_from_white_list_complete);
7435         if (err < 0) {
7436                 mgmt_pending_remove(cmd);
7437                 goto unlocked;
7438         }
7439
7440 unlocked:
7441         hci_dev_unlock(hdev);
7442
7443         return err;
7444 }
7445
7446 static void clear_white_list_complete(struct hci_dev *hdev, u8 status,
7447                         u16 opcode)
7448 {
7449         struct mgmt_pending_cmd *cmd;
7450
7451         BT_DBG("status 0x%02x", status);
7452
7453         hci_dev_lock(hdev);
7454
7455         cmd = pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev);
7456         if (!cmd)
7457                 goto unlock;
7458
7459         if (status)
7460                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
7461                            mgmt_status(status));
7462         else
7463                 mgmt_cmd_complete(cmd->sk, hdev->id,
7464                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7465                                 0, NULL, 0);
7466
7467         mgmt_pending_remove(cmd);
7468
7469 unlock:
7470         hci_dev_unlock(hdev);
7471 }
7472
7473 static int clear_white_list(struct sock *sk, struct hci_dev *hdev,
7474                            void *data, u16 len)
7475 {
7476         struct mgmt_pending_cmd *cmd;
7477         struct hci_request req;
7478         int err;
7479
7480         BT_DBG("%s", hdev->name);
7481
7482         if (!lmp_le_capable(hdev))
7483                 return mgmt_cmd_status(sk, hdev->id,
7484                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7485                                 MGMT_STATUS_NOT_SUPPORTED);
7486
7487         if (!hdev_is_powered(hdev))
7488                 return mgmt_cmd_status(sk, hdev->id,
7489                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7490                                 MGMT_STATUS_REJECTED);
7491
7492         hci_dev_lock(hdev);
7493
7494         if (pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev)) {
7495                 err = mgmt_cmd_status(sk, hdev->id,
7496                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7497                                 MGMT_STATUS_BUSY);
7498                 goto unlocked;
7499         }
7500
7501         cmd = mgmt_pending_add(sk, MGMT_OP_CLEAR_DEV_WHITE_LIST,
7502                                 hdev, NULL, 0);
7503         if (!cmd) {
7504                 err = -ENOMEM;
7505                 goto unlocked;
7506         }
7507
7508         hci_req_init(&req, hdev);
7509
7510         hci_req_add(&req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
7511
7512         err = hci_req_run(&req, clear_white_list_complete);
7513         if (err < 0) {
7514                 mgmt_pending_remove(cmd);
7515                 goto unlocked;
7516         }
7517
7518 unlocked:
7519         hci_dev_unlock(hdev);
7520
7521         return err;
7522 }
7523
7524 static void set_scan_rsp_data_complete(struct hci_dev *hdev, u8 status,
7525                         u16 opcode)
7526 {
7527         struct mgmt_cp_set_scan_rsp_data *cp;
7528         struct mgmt_pending_cmd *cmd;
7529
7530         BT_DBG("status 0x%02x", status);
7531
7532         hci_dev_lock(hdev);
7533
7534         cmd = pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev);
7535         if (!cmd)
7536                 goto unlock;
7537
7538         cp = cmd->param;
7539
7540         if (status)
7541                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7542                                 mgmt_status(status));
7543         else
7544                 mgmt_cmd_complete(cmd->sk, hdev->id,
7545                                 MGMT_OP_SET_SCAN_RSP_DATA, 0,
7546                                 cp, sizeof(*cp));
7547
7548         mgmt_pending_remove(cmd);
7549
7550 unlock:
7551         hci_dev_unlock(hdev);
7552 }
7553
7554 static int set_scan_rsp_data(struct sock *sk, struct hci_dev *hdev, void *data,
7555                         u16 len)
7556 {
7557         struct mgmt_pending_cmd *cmd;
7558         struct hci_request req;
7559         struct mgmt_cp_set_scan_rsp_data *cp = data;
7560         struct hci_cp_le_set_scan_rsp_data rsp;
7561         int err;
7562
7563         BT_DBG("%s", hdev->name);
7564
7565         if (!lmp_le_capable(hdev))
7566                 return mgmt_cmd_status(sk, hdev->id,
7567                                 MGMT_OP_SET_SCAN_RSP_DATA,
7568                                 MGMT_STATUS_NOT_SUPPORTED);
7569
7570         hci_dev_lock(hdev);
7571
7572         if (pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev)) {
7573                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7574                                 MGMT_STATUS_BUSY);
7575                 goto unlocked;
7576         }
7577
7578         if (len > HCI_MAX_AD_LENGTH) {
7579                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7580                                 MGMT_STATUS_INVALID_PARAMS);
7581                 goto unlocked;
7582         }
7583
7584         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SCAN_RSP_DATA, hdev, data, len);
7585         if (!cmd) {
7586                 err = -ENOMEM;
7587                 goto unlocked;
7588         }
7589
7590         hci_req_init(&req, hdev);
7591
7592         memset(&rsp, 0, sizeof(rsp));
7593         memcpy(rsp.data, cp->data, len);
7594         rsp.length = len;
7595
7596         hci_req_add(&req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(rsp), &rsp);
7597
7598         err = hci_req_run(&req, set_scan_rsp_data_complete);
7599         if (err < 0)
7600                 mgmt_pending_remove(cmd);
7601
7602 unlocked:
7603         hci_dev_unlock(hdev);
7604
7605         return err;
7606 }
7607
7608 static void set_rssi_threshold_complete(struct hci_dev *hdev,
7609                         u8 status, u16 opcode)
7610 {
7611         struct mgmt_pending_cmd *cmd;
7612
7613         BT_DBG("status 0x%02x", status);
7614
7615         hci_dev_lock(hdev);
7616
7617         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7618         if (!cmd)
7619                 goto unlock;
7620
7621         if (status)
7622                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7623                                 mgmt_status(status));
7624         else
7625                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
7626                                 NULL, 0);
7627
7628         mgmt_pending_remove(cmd);
7629
7630 unlock:
7631         hci_dev_unlock(hdev);
7632 }
7633
7634 static void set_rssi_disable_complete(struct hci_dev *hdev,
7635                         u8 status, u16 opcode)
7636 {
7637         struct mgmt_pending_cmd *cmd;
7638
7639         BT_DBG("status 0x%02x", status);
7640
7641         hci_dev_lock(hdev);
7642
7643         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7644         if (!cmd)
7645                 goto unlock;
7646
7647         if (status)
7648                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7649                                 mgmt_status(status));
7650         else
7651                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7652                                 0, NULL, 0);
7653
7654         mgmt_pending_remove(cmd);
7655
7656 unlock:
7657         hci_dev_unlock(hdev);
7658 }
7659
7660 int mgmt_set_rssi_threshold(struct sock *sk, struct hci_dev *hdev,
7661                 void *data, u16 len)
7662 {
7663         int err = 0;
7664         struct hci_cp_set_rssi_threshold th = { 0, };
7665         struct mgmt_cp_set_enable_rssi *cp = data;
7666         struct hci_conn *conn;
7667         struct mgmt_pending_cmd *cmd;
7668         struct hci_request req;
7669         __u8 dest_type;
7670
7671         hci_dev_lock(hdev);
7672
7673         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7674         if (!cmd) {
7675                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7676                                 MGMT_STATUS_FAILED);
7677                 goto unlocked;
7678         }
7679
7680         if (!lmp_le_capable(hdev)) {
7681                 mgmt_pending_remove(cmd);
7682                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7683                                 MGMT_STATUS_NOT_SUPPORTED);
7684                 goto unlocked;
7685         }
7686
7687         if (!hdev_is_powered(hdev)) {
7688                 BT_DBG("%s", hdev->name);
7689                 mgmt_pending_remove(cmd);
7690                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7691                                 MGMT_STATUS_NOT_POWERED);
7692                 goto unlocked;
7693         }
7694
7695         if (cp->link_type == 0x01)
7696                 dest_type = LE_LINK;
7697         else
7698                 dest_type = ACL_LINK;
7699
7700         /* Get LE/ACL link handle info */
7701         conn = hci_conn_hash_lookup_ba(hdev,
7702                         dest_type, &cp->bdaddr);
7703
7704         if (!conn) {
7705                 err = mgmt_cmd_complete(sk, hdev->id,
7706                                 MGMT_OP_SET_RSSI_ENABLE, 1, NULL, 0);
7707                 mgmt_pending_remove(cmd);
7708                 goto unlocked;
7709         }
7710
7711         hci_req_init(&req, hdev);
7712
7713         th.hci_le_ext_opcode = 0x0B;
7714         th.mode = 0x01;
7715         th.conn_handle = conn->handle;
7716         th.alert_mask = 0x07;
7717         th.low_th = cp->low_th;
7718         th.in_range_th = cp->in_range_th;
7719         th.high_th = cp->high_th;
7720
7721         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
7722         err = hci_req_run(&req, set_rssi_threshold_complete);
7723
7724         if (err < 0) {
7725                 mgmt_pending_remove(cmd);
7726                 BT_ERR("Error in requesting hci_req_run");
7727                 goto unlocked;
7728         }
7729
7730 unlocked:
7731         hci_dev_unlock(hdev);
7732         return err;
7733 }
7734
7735 void mgmt_rssi_enable_success(struct sock *sk, struct hci_dev *hdev,
7736                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
7737 {
7738         struct mgmt_cc_rsp_enable_rssi mgmt_rp = { 0, };
7739         struct mgmt_cp_set_enable_rssi *cp = data;
7740         struct mgmt_pending_cmd *cmd;
7741
7742         if (!cp || !rp)
7743                 goto remove_cmd;
7744
7745         mgmt_rp.status = rp->status;
7746         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
7747         mgmt_rp.bt_address = cp->bdaddr;
7748         mgmt_rp.link_type = cp->link_type;
7749
7750         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7751                         MGMT_STATUS_SUCCESS, &mgmt_rp,
7752                         sizeof(struct mgmt_cc_rsp_enable_rssi));
7753
7754         mgmt_event(MGMT_EV_RSSI_ENABLED, hdev, &mgmt_rp,
7755                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
7756
7757         hci_conn_rssi_unset_all(hdev, mgmt_rp.link_type);
7758         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
7759                         &mgmt_rp.bt_address, true);
7760
7761 remove_cmd:
7762         hci_dev_lock(hdev);
7763         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7764         if (cmd)
7765                 mgmt_pending_remove(cmd);
7766
7767         hci_dev_unlock(hdev);
7768 }
7769
7770 void mgmt_rssi_disable_success(struct sock *sk, struct hci_dev *hdev,
7771                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
7772 {
7773         struct mgmt_cc_rp_disable_rssi mgmt_rp = { 0, };
7774         struct mgmt_cp_disable_rssi *cp = data;
7775         struct mgmt_pending_cmd *cmd;
7776
7777         if (!cp || !rp)
7778                 goto remove_cmd;
7779
7780         mgmt_rp.status = rp->status;
7781         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
7782         mgmt_rp.bt_address = cp->bdaddr;
7783         mgmt_rp.link_type = cp->link_type;
7784
7785         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7786                         MGMT_STATUS_SUCCESS, &mgmt_rp,
7787                         sizeof(struct mgmt_cc_rsp_enable_rssi));
7788
7789         mgmt_event(MGMT_EV_RSSI_DISABLED, hdev, &mgmt_rp,
7790                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
7791
7792         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
7793                         &mgmt_rp.bt_address, false);
7794
7795 remove_cmd:
7796         hci_dev_lock(hdev);
7797         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7798         if (cmd)
7799                 mgmt_pending_remove(cmd);
7800
7801         hci_dev_unlock(hdev);
7802 }
7803
7804 static int mgmt_set_disable_rssi(struct sock *sk, struct hci_dev *hdev,
7805                 void *data, u16 len)
7806 {
7807         struct mgmt_pending_cmd *cmd;
7808         struct hci_request req;
7809         struct hci_cp_set_enable_rssi cp_en = { 0, };
7810         int err;
7811
7812         BT_DBG("Set Disable RSSI.");
7813
7814         cp_en.hci_le_ext_opcode = 0x01;
7815         cp_en.le_enable_cs_Features = 0x00;
7816         cp_en.data[0] = 0x00;
7817         cp_en.data[1] = 0x00;
7818         cp_en.data[2] = 0x00;
7819
7820         hci_dev_lock(hdev);
7821
7822         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7823         if (!cmd) {
7824                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7825                                 MGMT_STATUS_FAILED);
7826                 goto unlocked;
7827         }
7828
7829         if (!lmp_le_capable(hdev)) {
7830                 mgmt_pending_remove(cmd);
7831                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7832                                 MGMT_STATUS_NOT_SUPPORTED);
7833                 goto unlocked;
7834         }
7835
7836         if (!hdev_is_powered(hdev)) {
7837                 BT_DBG("%s", hdev->name);
7838                 mgmt_pending_remove(cmd);
7839                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7840                                 MGMT_STATUS_NOT_POWERED);
7841                 goto unlocked;
7842         }
7843
7844         hci_req_init(&req, hdev);
7845
7846         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
7847                         sizeof(struct hci_cp_set_enable_rssi),
7848                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
7849                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
7850
7851         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
7852         err = hci_req_run(&req, set_rssi_disable_complete);
7853
7854         if (err < 0) {
7855                 mgmt_pending_remove(cmd);
7856                 BT_ERR("Error in requesting hci_req_run");
7857                 goto unlocked;
7858         }
7859
7860 unlocked:
7861         hci_dev_unlock(hdev);
7862         return err;
7863 }
7864
7865 void mgmt_enable_rssi_cc(struct hci_dev *hdev, void *response, u8 status)
7866 {
7867         struct hci_cc_rsp_enable_rssi *rp = response;
7868         struct mgmt_pending_cmd *cmd_enable = NULL;
7869         struct mgmt_pending_cmd *cmd_disable = NULL;
7870         struct mgmt_cp_set_enable_rssi *cp_en;
7871         struct mgmt_cp_disable_rssi *cp_dis;
7872
7873         hci_dev_lock(hdev);
7874         cmd_enable = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7875         cmd_disable = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7876         hci_dev_unlock(hdev);
7877
7878         if (cmd_enable)
7879                 BT_DBG("Enable Request");
7880
7881         if (cmd_disable)
7882                 BT_DBG("Disable Request");
7883
7884         if (cmd_enable) {
7885                 cp_en = cmd_enable->param;
7886
7887                 if (status != 0x00)
7888                         return;
7889
7890                 switch (rp->le_ext_opcode) {
7891                 case 0x01:
7892                         BT_DBG("RSSI enabled.. Setting Threshold...");
7893                         mgmt_set_rssi_threshold(cmd_enable->sk, hdev,
7894                                         cp_en, sizeof(*cp_en));
7895                         break;
7896
7897                 case 0x0B:
7898                         BT_DBG("Sending RSSI enable success");
7899                         mgmt_rssi_enable_success(cmd_enable->sk, hdev,
7900                                         cp_en, rp, rp->status);
7901                         break;
7902                 }
7903
7904         } else if (cmd_disable) {
7905                 cp_dis = cmd_disable->param;
7906
7907                 if (status != 0x00)
7908                         return;
7909
7910                 switch (rp->le_ext_opcode) {
7911                 case 0x01:
7912                         BT_DBG("Sending RSSI disable success");
7913                         mgmt_rssi_disable_success(cmd_disable->sk, hdev,
7914                                         cp_dis, rp, rp->status);
7915                         break;
7916
7917                 case 0x0B:
7918                         /*
7919                          * Only unset RSSI Threshold values for the Link if
7920                          * RSSI is monitored for other BREDR or LE Links
7921                          */
7922                         if (hci_conn_hash_lookup_rssi_count(hdev) > 1) {
7923                                 BT_DBG("Unset Threshold. Other links being monitored");
7924                                 mgmt_rssi_disable_success(cmd_disable->sk, hdev,
7925                                                 cp_dis, rp, rp->status);
7926                         } else {
7927                                 BT_DBG("Unset Threshold. Disabling...");
7928                                 mgmt_set_disable_rssi(cmd_disable->sk, hdev,
7929                                                 cp_dis, sizeof(*cp_dis));
7930                         }
7931                         break;
7932                 }
7933         }
7934 }
7935
7936 static void set_rssi_enable_complete(struct hci_dev *hdev, u8 status,
7937                 u16 opcode)
7938 {
7939         struct mgmt_pending_cmd *cmd;
7940
7941         BT_DBG("status 0x%02x", status);
7942
7943         hci_dev_lock(hdev);
7944
7945         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7946         if (!cmd)
7947                 goto unlock;
7948
7949         if (status)
7950                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7951                                 mgmt_status(status));
7952         else
7953                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
7954                                 NULL, 0);
7955
7956         mgmt_pending_remove(cmd);
7957
7958 unlock:
7959         hci_dev_unlock(hdev);
7960 }
7961
7962 static int set_enable_rssi(struct sock *sk, struct hci_dev *hdev,
7963                 void *data, u16 len)
7964 {
7965         struct mgmt_pending_cmd *cmd;
7966         struct hci_request req;
7967         struct mgmt_cp_set_enable_rssi *cp = data;
7968         struct hci_cp_set_enable_rssi cp_en = { 0, };
7969         int err;
7970
7971         BT_DBG("Set Enable RSSI.");
7972
7973         cp_en.hci_le_ext_opcode = 0x01;
7974         cp_en.le_enable_cs_Features = 0x04;
7975         cp_en.data[0] = 0x00;
7976         cp_en.data[1] = 0x00;
7977         cp_en.data[2] = 0x00;
7978
7979         hci_dev_lock(hdev);
7980
7981         if (!lmp_le_capable(hdev)) {
7982                 err =  mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7983                                 MGMT_STATUS_NOT_SUPPORTED);
7984                 goto unlocked;
7985         }
7986
7987         if (!hdev_is_powered(hdev)) {
7988                 BT_DBG("%s", hdev->name);
7989                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7990                                 MGMT_STATUS_NOT_POWERED);
7991                 goto unlocked;
7992         }
7993
7994         if (pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev)) {
7995                 BT_DBG("%s", hdev->name);
7996                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7997                                 MGMT_STATUS_BUSY);
7998                 goto unlocked;
7999         }
8000
8001         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_ENABLE, hdev, cp,
8002                         sizeof(*cp));
8003         if (!cmd) {
8004                 BT_DBG("%s", hdev->name);
8005                 err = -ENOMEM;
8006                 goto unlocked;
8007         }
8008
8009         /* If RSSI is already enabled directly set Threshold values */
8010         if (hci_conn_hash_lookup_rssi_count(hdev) > 0) {
8011                 hci_dev_unlock(hdev);
8012                 BT_DBG("RSSI Enabled. Directly set Threshold");
8013                 err = mgmt_set_rssi_threshold(sk, hdev, cp, sizeof(*cp));
8014                 return err;
8015         }
8016
8017         hci_req_init(&req, hdev);
8018
8019         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
8020                         sizeof(struct hci_cp_set_enable_rssi),
8021                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
8022                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
8023
8024         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
8025         err = hci_req_run(&req, set_rssi_enable_complete);
8026
8027         if (err < 0) {
8028                 mgmt_pending_remove(cmd);
8029                 BT_ERR("Error in requesting hci_req_run");
8030                 goto unlocked;
8031         }
8032
8033 unlocked:
8034         hci_dev_unlock(hdev);
8035
8036         return err;
8037 }
8038
8039 static void get_raw_rssi_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8040 {
8041         struct mgmt_pending_cmd *cmd;
8042
8043         BT_DBG("status 0x%02x", status);
8044
8045         hci_dev_lock(hdev);
8046
8047         cmd = pending_find(MGMT_OP_GET_RAW_RSSI, hdev);
8048         if (!cmd)
8049                 goto unlock;
8050
8051         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8052                         MGMT_STATUS_SUCCESS, &status, 1);
8053
8054         mgmt_pending_remove(cmd);
8055
8056 unlock:
8057         hci_dev_unlock(hdev);
8058 }
8059
8060 static int get_raw_rssi(struct sock *sk, struct hci_dev *hdev, void *data,
8061                         u16 len)
8062 {
8063         struct mgmt_pending_cmd *cmd;
8064         struct hci_request req;
8065         struct mgmt_cp_get_raw_rssi *cp = data;
8066         struct hci_cp_get_raw_rssi hci_cp;
8067
8068         struct hci_conn *conn;
8069         int err;
8070         __u8 dest_type;
8071
8072         BT_DBG("Get Raw RSSI.");
8073
8074         hci_dev_lock(hdev);
8075
8076         if (!lmp_le_capable(hdev)) {
8077                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8078                                 MGMT_STATUS_NOT_SUPPORTED);
8079                 goto unlocked;
8080         }
8081
8082         if (cp->link_type == 0x01)
8083                 dest_type = LE_LINK;
8084         else
8085                 dest_type = ACL_LINK;
8086
8087         /* Get LE/BREDR link handle info */
8088         conn = hci_conn_hash_lookup_ba(hdev,
8089                         dest_type, &cp->bt_address);
8090         if (!conn) {
8091                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8092                                                    MGMT_STATUS_NOT_CONNECTED);
8093                 goto unlocked;
8094         }
8095         hci_cp.conn_handle = conn->handle;
8096
8097         if (!hdev_is_powered(hdev)) {
8098                 BT_DBG("%s", hdev->name);
8099                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8100                                 MGMT_STATUS_NOT_POWERED);
8101                 goto unlocked;
8102         }
8103
8104         if (pending_find(MGMT_OP_GET_RAW_RSSI, hdev)) {
8105                 BT_DBG("%s", hdev->name);
8106                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8107                                 MGMT_STATUS_BUSY);
8108                 goto unlocked;
8109         }
8110
8111         cmd = mgmt_pending_add(sk, MGMT_OP_GET_RAW_RSSI, hdev, data, len);
8112         if (!cmd) {
8113                 BT_DBG("%s", hdev->name);
8114                 err = -ENOMEM;
8115                 goto unlocked;
8116         }
8117
8118         hci_req_init(&req, hdev);
8119
8120         BT_DBG("Connection Handle [%d]", hci_cp.conn_handle);
8121         hci_req_add(&req, HCI_OP_GET_RAW_RSSI, sizeof(hci_cp), &hci_cp);
8122         err = hci_req_run(&req, get_raw_rssi_complete);
8123
8124         if (err < 0) {
8125                 mgmt_pending_remove(cmd);
8126                 BT_ERR("Error in requesting hci_req_run");
8127         }
8128
8129 unlocked:
8130         hci_dev_unlock(hdev);
8131
8132         return err;
8133 }
8134
8135 void mgmt_raw_rssi_response(struct hci_dev *hdev,
8136                 struct hci_cc_rp_get_raw_rssi *rp, int success)
8137 {
8138         struct mgmt_cc_rp_get_raw_rssi mgmt_rp = { 0, };
8139         struct hci_conn *conn;
8140
8141         mgmt_rp.status = rp->status;
8142         mgmt_rp.rssi_dbm = rp->rssi_dbm;
8143
8144         conn = hci_conn_hash_lookup_handle(hdev, rp->conn_handle);
8145         if (!conn)
8146                 return;
8147
8148         bacpy(&mgmt_rp.bt_address, &conn->dst);
8149         if (conn->type == LE_LINK)
8150                 mgmt_rp.link_type = 0x01;
8151         else
8152                 mgmt_rp.link_type = 0x00;
8153
8154         mgmt_event(MGMT_EV_RAW_RSSI, hdev, &mgmt_rp,
8155                         sizeof(struct mgmt_cc_rp_get_raw_rssi), NULL);
8156 }
8157
8158 static void set_disable_threshold_complete(struct hci_dev *hdev,
8159                         u8 status, u16 opcode)
8160 {
8161         struct mgmt_pending_cmd *cmd;
8162
8163         BT_DBG("status 0x%02x", status);
8164
8165         hci_dev_lock(hdev);
8166
8167         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
8168         if (!cmd)
8169                 goto unlock;
8170
8171         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8172                         MGMT_STATUS_SUCCESS, &status, 1);
8173
8174         mgmt_pending_remove(cmd);
8175
8176 unlock:
8177         hci_dev_unlock(hdev);
8178 }
8179
8180 /** Removes monitoring for a link*/
8181 static int set_disable_threshold(struct sock *sk, struct hci_dev *hdev,
8182                 void *data, u16 len)
8183 {
8184         int err = 0;
8185         struct hci_cp_set_rssi_threshold th = { 0, };
8186         struct mgmt_cp_disable_rssi *cp = data;
8187         struct hci_conn *conn;
8188         struct mgmt_pending_cmd *cmd;
8189         struct hci_request req;
8190         __u8 dest_type;
8191
8192         BT_DBG("Set Disable RSSI.");
8193
8194         hci_dev_lock(hdev);
8195
8196         if (!lmp_le_capable(hdev)) {
8197                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8198                                 MGMT_STATUS_NOT_SUPPORTED);
8199                 goto unlocked;
8200         }
8201
8202         /* Get LE/ACL link handle info*/
8203         if (cp->link_type == 0x01)
8204                 dest_type = LE_LINK;
8205         else
8206                 dest_type = ACL_LINK;
8207
8208         conn = hci_conn_hash_lookup_ba(hdev, dest_type, &cp->bdaddr);
8209         if (!conn) {
8210                 err = mgmt_cmd_complete(sk, hdev->id,
8211                                 MGMT_OP_SET_RSSI_DISABLE, 1, NULL, 0);
8212                 goto unlocked;
8213         }
8214
8215         th.hci_le_ext_opcode = 0x0B;
8216         th.mode = 0x01;
8217         th.conn_handle = conn->handle;
8218         th.alert_mask = 0x00;
8219         th.low_th = 0x00;
8220         th.in_range_th = 0x00;
8221         th.high_th = 0x00;
8222
8223         if (!hdev_is_powered(hdev)) {
8224                 BT_DBG("%s", hdev->name);
8225                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8226                                 0, data, len);
8227                 goto unlocked;
8228         }
8229
8230         if (pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev)) {
8231                 BT_DBG("%s", hdev->name);
8232                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8233                                 MGMT_STATUS_BUSY);
8234                 goto unlocked;
8235         }
8236
8237         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_DISABLE, hdev, cp,
8238                         sizeof(*cp));
8239         if (!cmd) {
8240                 BT_DBG("%s", hdev->name);
8241                 err = -ENOMEM;
8242                 goto unlocked;
8243         }
8244
8245         hci_req_init(&req, hdev);
8246
8247         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
8248         err = hci_req_run(&req, set_disable_threshold_complete);
8249         if (err < 0) {
8250                 mgmt_pending_remove(cmd);
8251                 BT_ERR("Error in requesting hci_req_run");
8252                 goto unlocked;
8253         }
8254
8255 unlocked:
8256         hci_dev_unlock(hdev);
8257
8258         return err;
8259 }
8260
8261 void mgmt_rssi_alert_evt(struct hci_dev *hdev, struct sk_buff *skb)
8262 {
8263         struct hci_ev_vendor_specific_rssi_alert *ev = (void *)skb->data;
8264         struct mgmt_ev_vendor_specific_rssi_alert mgmt_ev;
8265         struct hci_conn *conn;
8266
8267         BT_DBG("RSSI alert [%2.2X %2.2X %2.2X]",
8268                         ev->conn_handle, ev->alert_type, ev->rssi_dbm);
8269
8270         conn = hci_conn_hash_lookup_handle(hdev, ev->conn_handle);
8271
8272         if (!conn) {
8273                 BT_ERR("RSSI alert Error: Device not found for handle");
8274                 return;
8275         }
8276         bacpy(&mgmt_ev.bdaddr, &conn->dst);
8277
8278         if (conn->type == LE_LINK)
8279                 mgmt_ev.link_type = 0x01;
8280         else
8281                 mgmt_ev.link_type = 0x00;
8282
8283         mgmt_ev.alert_type = ev->alert_type;
8284         mgmt_ev.rssi_dbm = ev->rssi_dbm;
8285
8286         mgmt_event(MGMT_EV_RSSI_ALERT, hdev, &mgmt_ev,
8287                         sizeof(struct mgmt_ev_vendor_specific_rssi_alert),
8288                         NULL);
8289 }
8290 #endif /* TIZEN_BT */
8291
8292 static bool ltk_is_valid(struct mgmt_ltk_info *key)
8293 {
8294         if (key->initiator != 0x00 && key->initiator != 0x01)
8295                 return false;
8296
8297         switch (key->addr.type) {
8298         case BDADDR_LE_PUBLIC:
8299                 return true;
8300
8301         case BDADDR_LE_RANDOM:
8302                 /* Two most significant bits shall be set */
8303                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
8304                         return false;
8305                 return true;
8306         }
8307
8308         return false;
8309 }
8310
8311 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
8312                                void *cp_data, u16 len)
8313 {
8314         struct mgmt_cp_load_long_term_keys *cp = cp_data;
8315         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
8316                                    sizeof(struct mgmt_ltk_info));
8317         u16 key_count, expected_len;
8318         int i, err;
8319
8320         bt_dev_dbg(hdev, "sock %p", sk);
8321
8322         if (!lmp_le_capable(hdev))
8323                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8324                                        MGMT_STATUS_NOT_SUPPORTED);
8325
8326         key_count = __le16_to_cpu(cp->key_count);
8327         if (key_count > max_key_count) {
8328                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
8329                            key_count);
8330                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8331                                        MGMT_STATUS_INVALID_PARAMS);
8332         }
8333
8334         expected_len = struct_size(cp, keys, key_count);
8335         if (expected_len != len) {
8336                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
8337                            expected_len, len);
8338                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8339                                        MGMT_STATUS_INVALID_PARAMS);
8340         }
8341
8342         bt_dev_dbg(hdev, "key_count %u", key_count);
8343
8344         for (i = 0; i < key_count; i++) {
8345                 struct mgmt_ltk_info *key = &cp->keys[i];
8346
8347                 if (!ltk_is_valid(key))
8348                         return mgmt_cmd_status(sk, hdev->id,
8349                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
8350                                                MGMT_STATUS_INVALID_PARAMS);
8351         }
8352
8353         hci_dev_lock(hdev);
8354
8355         hci_smp_ltks_clear(hdev);
8356
8357         for (i = 0; i < key_count; i++) {
8358                 struct mgmt_ltk_info *key = &cp->keys[i];
8359                 u8 type, authenticated;
8360
8361                 if (hci_is_blocked_key(hdev,
8362                                        HCI_BLOCKED_KEY_TYPE_LTK,
8363                                        key->val)) {
8364                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
8365                                     &key->addr.bdaddr);
8366                         continue;
8367                 }
8368
8369                 switch (key->type) {
8370                 case MGMT_LTK_UNAUTHENTICATED:
8371                         authenticated = 0x00;
8372                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
8373                         break;
8374                 case MGMT_LTK_AUTHENTICATED:
8375                         authenticated = 0x01;
8376                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
8377                         break;
8378                 case MGMT_LTK_P256_UNAUTH:
8379                         authenticated = 0x00;
8380                         type = SMP_LTK_P256;
8381                         break;
8382                 case MGMT_LTK_P256_AUTH:
8383                         authenticated = 0x01;
8384                         type = SMP_LTK_P256;
8385                         break;
8386                 case MGMT_LTK_P256_DEBUG:
8387                         authenticated = 0x00;
8388                         type = SMP_LTK_P256_DEBUG;
8389                         fallthrough;
8390                 default:
8391                         continue;
8392                 }
8393
8394                 hci_add_ltk(hdev, &key->addr.bdaddr,
8395                             le_addr_type(key->addr.type), type, authenticated,
8396                             key->val, key->enc_size, key->ediv, key->rand);
8397         }
8398
8399         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
8400                            NULL, 0);
8401
8402         hci_dev_unlock(hdev);
8403
8404         return err;
8405 }
8406
8407 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err)
8408 {
8409         struct mgmt_pending_cmd *cmd = data;
8410         struct hci_conn *conn = cmd->user_data;
8411         struct mgmt_cp_get_conn_info *cp = cmd->param;
8412         struct mgmt_rp_get_conn_info rp;
8413         u8 status;
8414
8415         bt_dev_dbg(hdev, "err %d", err);
8416
8417         memcpy(&rp.addr, &cp->addr.bdaddr, sizeof(rp.addr));
8418
8419         status = mgmt_status(err);
8420         if (status == MGMT_STATUS_SUCCESS) {
8421                 rp.rssi = conn->rssi;
8422                 rp.tx_power = conn->tx_power;
8423                 rp.max_tx_power = conn->max_tx_power;
8424         } else {
8425                 rp.rssi = HCI_RSSI_INVALID;
8426                 rp.tx_power = HCI_TX_POWER_INVALID;
8427                 rp.max_tx_power = HCI_TX_POWER_INVALID;
8428         }
8429
8430         mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
8431                           &rp, sizeof(rp));
8432
8433         mgmt_pending_free(cmd);
8434 }
8435
8436 static int get_conn_info_sync(struct hci_dev *hdev, void *data)
8437 {
8438         struct mgmt_pending_cmd *cmd = data;
8439         struct mgmt_cp_get_conn_info *cp = cmd->param;
8440         struct hci_conn *conn;
8441         int err;
8442         __le16   handle;
8443
8444         /* Make sure we are still connected */
8445         if (cp->addr.type == BDADDR_BREDR)
8446                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8447                                                &cp->addr.bdaddr);
8448         else
8449                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
8450
8451         if (!conn || conn->state != BT_CONNECTED)
8452                 return MGMT_STATUS_NOT_CONNECTED;
8453
8454         cmd->user_data = conn;
8455         handle = cpu_to_le16(conn->handle);
8456
8457         /* Refresh RSSI each time */
8458         err = hci_read_rssi_sync(hdev, handle);
8459
8460         /* For LE links TX power does not change thus we don't need to
8461          * query for it once value is known.
8462          */
8463         if (!err && (!bdaddr_type_is_le(cp->addr.type) ||
8464                      conn->tx_power == HCI_TX_POWER_INVALID))
8465                 err = hci_read_tx_power_sync(hdev, handle, 0x00);
8466
8467         /* Max TX power needs to be read only once per connection */
8468         if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID)
8469                 err = hci_read_tx_power_sync(hdev, handle, 0x01);
8470
8471         return err;
8472 }
8473
8474 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
8475                          u16 len)
8476 {
8477         struct mgmt_cp_get_conn_info *cp = data;
8478         struct mgmt_rp_get_conn_info rp;
8479         struct hci_conn *conn;
8480         unsigned long conn_info_age;
8481         int err = 0;
8482
8483         bt_dev_dbg(hdev, "sock %p", sk);
8484
8485         memset(&rp, 0, sizeof(rp));
8486         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8487         rp.addr.type = cp->addr.type;
8488
8489         if (!bdaddr_type_is_valid(cp->addr.type))
8490                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8491                                          MGMT_STATUS_INVALID_PARAMS,
8492                                          &rp, sizeof(rp));
8493
8494         hci_dev_lock(hdev);
8495
8496         if (!hdev_is_powered(hdev)) {
8497                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8498                                         MGMT_STATUS_NOT_POWERED, &rp,
8499                                         sizeof(rp));
8500                 goto unlock;
8501         }
8502
8503         if (cp->addr.type == BDADDR_BREDR)
8504                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8505                                                &cp->addr.bdaddr);
8506         else
8507                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
8508
8509         if (!conn || conn->state != BT_CONNECTED) {
8510                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8511                                         MGMT_STATUS_NOT_CONNECTED, &rp,
8512                                         sizeof(rp));
8513                 goto unlock;
8514         }
8515
8516         /* To avoid client trying to guess when to poll again for information we
8517          * calculate conn info age as random value between min/max set in hdev.
8518          */
8519         conn_info_age = hdev->conn_info_min_age +
8520                         prandom_u32_max(hdev->conn_info_max_age -
8521                                         hdev->conn_info_min_age);
8522
8523         /* Query controller to refresh cached values if they are too old or were
8524          * never read.
8525          */
8526         if (time_after(jiffies, conn->conn_info_timestamp +
8527                        msecs_to_jiffies(conn_info_age)) ||
8528             !conn->conn_info_timestamp) {
8529                 struct mgmt_pending_cmd *cmd;
8530
8531                 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data,
8532                                        len);
8533                 if (!cmd) {
8534                         err = -ENOMEM;
8535                 } else {
8536                         err = hci_cmd_sync_queue(hdev, get_conn_info_sync,
8537                                                  cmd, get_conn_info_complete);
8538                 }
8539
8540                 if (err < 0) {
8541                         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8542                                           MGMT_STATUS_FAILED, &rp, sizeof(rp));
8543
8544                         if (cmd)
8545                                 mgmt_pending_free(cmd);
8546
8547                         goto unlock;
8548                 }
8549
8550                 conn->conn_info_timestamp = jiffies;
8551         } else {
8552                 /* Cache is valid, just reply with values cached in hci_conn */
8553                 rp.rssi = conn->rssi;
8554                 rp.tx_power = conn->tx_power;
8555                 rp.max_tx_power = conn->max_tx_power;
8556
8557                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8558                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8559         }
8560
8561 unlock:
8562         hci_dev_unlock(hdev);
8563         return err;
8564 }
8565
8566 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err)
8567 {
8568         struct mgmt_pending_cmd *cmd = data;
8569         struct mgmt_cp_get_clock_info *cp = cmd->param;
8570         struct mgmt_rp_get_clock_info rp;
8571         struct hci_conn *conn = cmd->user_data;
8572         u8 status = mgmt_status(err);
8573
8574         bt_dev_dbg(hdev, "err %d", err);
8575
8576         memset(&rp, 0, sizeof(rp));
8577         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8578         rp.addr.type = cp->addr.type;
8579
8580         if (err)
8581                 goto complete;
8582
8583         rp.local_clock = cpu_to_le32(hdev->clock);
8584
8585         if (conn) {
8586                 rp.piconet_clock = cpu_to_le32(conn->clock);
8587                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
8588         }
8589
8590 complete:
8591         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
8592                           sizeof(rp));
8593
8594         mgmt_pending_free(cmd);
8595 }
8596
8597 static int get_clock_info_sync(struct hci_dev *hdev, void *data)
8598 {
8599         struct mgmt_pending_cmd *cmd = data;
8600         struct mgmt_cp_get_clock_info *cp = cmd->param;
8601         struct hci_cp_read_clock hci_cp;
8602         struct hci_conn *conn;
8603
8604         memset(&hci_cp, 0, sizeof(hci_cp));
8605         hci_read_clock_sync(hdev, &hci_cp);
8606
8607         /* Make sure connection still exists */
8608         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
8609         if (!conn || conn->state != BT_CONNECTED)
8610                 return MGMT_STATUS_NOT_CONNECTED;
8611
8612         cmd->user_data = conn;
8613         hci_cp.handle = cpu_to_le16(conn->handle);
8614         hci_cp.which = 0x01; /* Piconet clock */
8615
8616         return hci_read_clock_sync(hdev, &hci_cp);
8617 }
8618
8619 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
8620                                                                 u16 len)
8621 {
8622         struct mgmt_cp_get_clock_info *cp = data;
8623         struct mgmt_rp_get_clock_info rp;
8624         struct mgmt_pending_cmd *cmd;
8625         struct hci_conn *conn;
8626         int err;
8627
8628         bt_dev_dbg(hdev, "sock %p", sk);
8629
8630         memset(&rp, 0, sizeof(rp));
8631         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8632         rp.addr.type = cp->addr.type;
8633
8634         if (cp->addr.type != BDADDR_BREDR)
8635                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8636                                          MGMT_STATUS_INVALID_PARAMS,
8637                                          &rp, sizeof(rp));
8638
8639         hci_dev_lock(hdev);
8640
8641         if (!hdev_is_powered(hdev)) {
8642                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8643                                         MGMT_STATUS_NOT_POWERED, &rp,
8644                                         sizeof(rp));
8645                 goto unlock;
8646         }
8647
8648         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8649                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8650                                                &cp->addr.bdaddr);
8651                 if (!conn || conn->state != BT_CONNECTED) {
8652                         err = mgmt_cmd_complete(sk, hdev->id,
8653                                                 MGMT_OP_GET_CLOCK_INFO,
8654                                                 MGMT_STATUS_NOT_CONNECTED,
8655                                                 &rp, sizeof(rp));
8656                         goto unlock;
8657                 }
8658         } else {
8659                 conn = NULL;
8660         }
8661
8662         cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
8663         if (!cmd)
8664                 err = -ENOMEM;
8665         else
8666                 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd,
8667                                          get_clock_info_complete);
8668
8669         if (err < 0) {
8670                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8671                                         MGMT_STATUS_FAILED, &rp, sizeof(rp));
8672
8673                 if (cmd)
8674                         mgmt_pending_free(cmd);
8675         }
8676
8677
8678 unlock:
8679         hci_dev_unlock(hdev);
8680         return err;
8681 }
8682
8683 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
8684 {
8685         struct hci_conn *conn;
8686
8687         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
8688         if (!conn)
8689                 return false;
8690
8691         if (conn->dst_type != type)
8692                 return false;
8693
8694         if (conn->state != BT_CONNECTED)
8695                 return false;
8696
8697         return true;
8698 }
8699
8700 /* This function requires the caller holds hdev->lock */
8701 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
8702                                u8 addr_type, u8 auto_connect)
8703 {
8704         struct hci_conn_params *params;
8705
8706         params = hci_conn_params_add(hdev, addr, addr_type);
8707         if (!params)
8708                 return -EIO;
8709
8710         if (params->auto_connect == auto_connect)
8711                 return 0;
8712
8713         list_del_init(&params->action);
8714
8715         switch (auto_connect) {
8716         case HCI_AUTO_CONN_DISABLED:
8717         case HCI_AUTO_CONN_LINK_LOSS:
8718                 /* If auto connect is being disabled when we're trying to
8719                  * connect to device, keep connecting.
8720                  */
8721                 if (params->explicit_connect)
8722                         list_add(&params->action, &hdev->pend_le_conns);
8723                 break;
8724         case HCI_AUTO_CONN_REPORT:
8725                 if (params->explicit_connect)
8726                         list_add(&params->action, &hdev->pend_le_conns);
8727                 else
8728                         list_add(&params->action, &hdev->pend_le_reports);
8729                 break;
8730         case HCI_AUTO_CONN_DIRECT:
8731         case HCI_AUTO_CONN_ALWAYS:
8732                 if (!is_connected(hdev, addr, addr_type))
8733                         list_add(&params->action, &hdev->pend_le_conns);
8734                 break;
8735         }
8736
8737         params->auto_connect = auto_connect;
8738
8739         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
8740                    addr, addr_type, auto_connect);
8741
8742         return 0;
8743 }
8744
8745 static void device_added(struct sock *sk, struct hci_dev *hdev,
8746                          bdaddr_t *bdaddr, u8 type, u8 action)
8747 {
8748         struct mgmt_ev_device_added ev;
8749
8750         bacpy(&ev.addr.bdaddr, bdaddr);
8751         ev.addr.type = type;
8752         ev.action = action;
8753
8754         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
8755 }
8756
8757 static int add_device_sync(struct hci_dev *hdev, void *data)
8758 {
8759         return hci_update_passive_scan_sync(hdev);
8760 }
8761
8762 static int add_device(struct sock *sk, struct hci_dev *hdev,
8763                       void *data, u16 len)
8764 {
8765         struct mgmt_cp_add_device *cp = data;
8766         u8 auto_conn, addr_type;
8767         struct hci_conn_params *params;
8768         int err;
8769         u32 current_flags = 0;
8770         u32 supported_flags;
8771
8772         bt_dev_dbg(hdev, "sock %p", sk);
8773
8774         if (!bdaddr_type_is_valid(cp->addr.type) ||
8775             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
8776                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8777                                          MGMT_STATUS_INVALID_PARAMS,
8778                                          &cp->addr, sizeof(cp->addr));
8779
8780         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
8781                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8782                                          MGMT_STATUS_INVALID_PARAMS,
8783                                          &cp->addr, sizeof(cp->addr));
8784
8785         hci_dev_lock(hdev);
8786
8787         if (cp->addr.type == BDADDR_BREDR) {
8788                 /* Only incoming connections action is supported for now */
8789                 if (cp->action != 0x01) {
8790                         err = mgmt_cmd_complete(sk, hdev->id,
8791                                                 MGMT_OP_ADD_DEVICE,
8792                                                 MGMT_STATUS_INVALID_PARAMS,
8793                                                 &cp->addr, sizeof(cp->addr));
8794                         goto unlock;
8795                 }
8796
8797                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
8798                                                      &cp->addr.bdaddr,
8799                                                      cp->addr.type, 0);
8800                 if (err)
8801                         goto unlock;
8802
8803                 hci_update_scan(hdev);
8804
8805                 goto added;
8806         }
8807
8808         addr_type = le_addr_type(cp->addr.type);
8809
8810         if (cp->action == 0x02)
8811                 auto_conn = HCI_AUTO_CONN_ALWAYS;
8812         else if (cp->action == 0x01)
8813                 auto_conn = HCI_AUTO_CONN_DIRECT;
8814         else
8815                 auto_conn = HCI_AUTO_CONN_REPORT;
8816
8817         /* Kernel internally uses conn_params with resolvable private
8818          * address, but Add Device allows only identity addresses.
8819          * Make sure it is enforced before calling
8820          * hci_conn_params_lookup.
8821          */
8822         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
8823                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8824                                         MGMT_STATUS_INVALID_PARAMS,
8825                                         &cp->addr, sizeof(cp->addr));
8826                 goto unlock;
8827         }
8828
8829         /* If the connection parameters don't exist for this device,
8830          * they will be created and configured with defaults.
8831          */
8832         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
8833                                 auto_conn) < 0) {
8834                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8835                                         MGMT_STATUS_FAILED, &cp->addr,
8836                                         sizeof(cp->addr));
8837                 goto unlock;
8838         } else {
8839                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
8840                                                 addr_type);
8841                 if (params)
8842                         current_flags = params->flags;
8843         }
8844
8845         err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL);
8846         if (err < 0)
8847                 goto unlock;
8848
8849 added:
8850         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
8851         supported_flags = hdev->conn_flags;
8852         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
8853                              supported_flags, current_flags);
8854
8855         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8856                                 MGMT_STATUS_SUCCESS, &cp->addr,
8857                                 sizeof(cp->addr));
8858
8859 unlock:
8860         hci_dev_unlock(hdev);
8861         return err;
8862 }
8863
8864 static void device_removed(struct sock *sk, struct hci_dev *hdev,
8865                            bdaddr_t *bdaddr, u8 type)
8866 {
8867         struct mgmt_ev_device_removed ev;
8868
8869         bacpy(&ev.addr.bdaddr, bdaddr);
8870         ev.addr.type = type;
8871
8872         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
8873 }
8874
8875 static int remove_device_sync(struct hci_dev *hdev, void *data)
8876 {
8877         return hci_update_passive_scan_sync(hdev);
8878 }
8879
8880 static int remove_device(struct sock *sk, struct hci_dev *hdev,
8881                          void *data, u16 len)
8882 {
8883         struct mgmt_cp_remove_device *cp = data;
8884         int err;
8885
8886         bt_dev_dbg(hdev, "sock %p", sk);
8887
8888         hci_dev_lock(hdev);
8889
8890         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8891                 struct hci_conn_params *params;
8892                 u8 addr_type;
8893
8894                 if (!bdaddr_type_is_valid(cp->addr.type)) {
8895                         err = mgmt_cmd_complete(sk, hdev->id,
8896                                                 MGMT_OP_REMOVE_DEVICE,
8897                                                 MGMT_STATUS_INVALID_PARAMS,
8898                                                 &cp->addr, sizeof(cp->addr));
8899                         goto unlock;
8900                 }
8901
8902                 if (cp->addr.type == BDADDR_BREDR) {
8903                         err = hci_bdaddr_list_del(&hdev->accept_list,
8904                                                   &cp->addr.bdaddr,
8905                                                   cp->addr.type);
8906                         if (err) {
8907                                 err = mgmt_cmd_complete(sk, hdev->id,
8908                                                         MGMT_OP_REMOVE_DEVICE,
8909                                                         MGMT_STATUS_INVALID_PARAMS,
8910                                                         &cp->addr,
8911                                                         sizeof(cp->addr));
8912                                 goto unlock;
8913                         }
8914
8915                         hci_update_scan(hdev);
8916
8917                         device_removed(sk, hdev, &cp->addr.bdaddr,
8918                                        cp->addr.type);
8919                         goto complete;
8920                 }
8921
8922                 addr_type = le_addr_type(cp->addr.type);
8923
8924                 /* Kernel internally uses conn_params with resolvable private
8925                  * address, but Remove Device allows only identity addresses.
8926                  * Make sure it is enforced before calling
8927                  * hci_conn_params_lookup.
8928                  */
8929                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
8930                         err = mgmt_cmd_complete(sk, hdev->id,
8931                                                 MGMT_OP_REMOVE_DEVICE,
8932                                                 MGMT_STATUS_INVALID_PARAMS,
8933                                                 &cp->addr, sizeof(cp->addr));
8934                         goto unlock;
8935                 }
8936
8937                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
8938                                                 addr_type);
8939                 if (!params) {
8940                         err = mgmt_cmd_complete(sk, hdev->id,
8941                                                 MGMT_OP_REMOVE_DEVICE,
8942                                                 MGMT_STATUS_INVALID_PARAMS,
8943                                                 &cp->addr, sizeof(cp->addr));
8944                         goto unlock;
8945                 }
8946
8947                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
8948                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
8949                         err = mgmt_cmd_complete(sk, hdev->id,
8950                                                 MGMT_OP_REMOVE_DEVICE,
8951                                                 MGMT_STATUS_INVALID_PARAMS,
8952                                                 &cp->addr, sizeof(cp->addr));
8953                         goto unlock;
8954                 }
8955
8956                 list_del(&params->action);
8957                 list_del(&params->list);
8958                 kfree(params);
8959
8960                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
8961         } else {
8962                 struct hci_conn_params *p, *tmp;
8963                 struct bdaddr_list *b, *btmp;
8964
8965                 if (cp->addr.type) {
8966                         err = mgmt_cmd_complete(sk, hdev->id,
8967                                                 MGMT_OP_REMOVE_DEVICE,
8968                                                 MGMT_STATUS_INVALID_PARAMS,
8969                                                 &cp->addr, sizeof(cp->addr));
8970                         goto unlock;
8971                 }
8972
8973                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
8974                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
8975                         list_del(&b->list);
8976                         kfree(b);
8977                 }
8978
8979                 hci_update_scan(hdev);
8980
8981                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
8982                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
8983                                 continue;
8984                         device_removed(sk, hdev, &p->addr, p->addr_type);
8985                         if (p->explicit_connect) {
8986                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
8987                                 continue;
8988                         }
8989                         list_del(&p->action);
8990                         list_del(&p->list);
8991                         kfree(p);
8992                 }
8993
8994                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
8995         }
8996
8997         hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL);
8998
8999 complete:
9000         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
9001                                 MGMT_STATUS_SUCCESS, &cp->addr,
9002                                 sizeof(cp->addr));
9003 unlock:
9004         hci_dev_unlock(hdev);
9005         return err;
9006 }
9007
9008 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
9009                            u16 len)
9010 {
9011         struct mgmt_cp_load_conn_param *cp = data;
9012         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
9013                                      sizeof(struct mgmt_conn_param));
9014         u16 param_count, expected_len;
9015         int i;
9016
9017         if (!lmp_le_capable(hdev))
9018                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9019                                        MGMT_STATUS_NOT_SUPPORTED);
9020
9021         param_count = __le16_to_cpu(cp->param_count);
9022         if (param_count > max_param_count) {
9023                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
9024                            param_count);
9025                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9026                                        MGMT_STATUS_INVALID_PARAMS);
9027         }
9028
9029         expected_len = struct_size(cp, params, param_count);
9030         if (expected_len != len) {
9031                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
9032                            expected_len, len);
9033                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9034                                        MGMT_STATUS_INVALID_PARAMS);
9035         }
9036
9037         bt_dev_dbg(hdev, "param_count %u", param_count);
9038
9039         hci_dev_lock(hdev);
9040
9041         hci_conn_params_clear_disabled(hdev);
9042
9043         for (i = 0; i < param_count; i++) {
9044                 struct mgmt_conn_param *param = &cp->params[i];
9045                 struct hci_conn_params *hci_param;
9046                 u16 min, max, latency, timeout;
9047                 u8 addr_type;
9048
9049                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
9050                            param->addr.type);
9051
9052                 if (param->addr.type == BDADDR_LE_PUBLIC) {
9053                         addr_type = ADDR_LE_DEV_PUBLIC;
9054                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
9055                         addr_type = ADDR_LE_DEV_RANDOM;
9056                 } else {
9057                         bt_dev_err(hdev, "ignoring invalid connection parameters");
9058                         continue;
9059                 }
9060
9061                 min = le16_to_cpu(param->min_interval);
9062                 max = le16_to_cpu(param->max_interval);
9063                 latency = le16_to_cpu(param->latency);
9064                 timeout = le16_to_cpu(param->timeout);
9065
9066                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
9067                            min, max, latency, timeout);
9068
9069                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
9070                         bt_dev_err(hdev, "ignoring invalid connection parameters");
9071                         continue;
9072                 }
9073
9074                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
9075                                                 addr_type);
9076                 if (!hci_param) {
9077                         bt_dev_err(hdev, "failed to add connection parameters");
9078                         continue;
9079                 }
9080
9081                 hci_param->conn_min_interval = min;
9082                 hci_param->conn_max_interval = max;
9083                 hci_param->conn_latency = latency;
9084                 hci_param->supervision_timeout = timeout;
9085         }
9086
9087         hci_dev_unlock(hdev);
9088
9089         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
9090                                  NULL, 0);
9091 }
9092
9093 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
9094                                void *data, u16 len)
9095 {
9096         struct mgmt_cp_set_external_config *cp = data;
9097         bool changed;
9098         int err;
9099
9100         bt_dev_dbg(hdev, "sock %p", sk);
9101
9102         if (hdev_is_powered(hdev))
9103                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9104                                        MGMT_STATUS_REJECTED);
9105
9106         if (cp->config != 0x00 && cp->config != 0x01)
9107                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9108                                          MGMT_STATUS_INVALID_PARAMS);
9109
9110         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
9111                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9112                                        MGMT_STATUS_NOT_SUPPORTED);
9113
9114         hci_dev_lock(hdev);
9115
9116         if (cp->config)
9117                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
9118         else
9119                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
9120
9121         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
9122         if (err < 0)
9123                 goto unlock;
9124
9125         if (!changed)
9126                 goto unlock;
9127
9128         err = new_options(hdev, sk);
9129
9130         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
9131                 mgmt_index_removed(hdev);
9132
9133                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
9134                         hci_dev_set_flag(hdev, HCI_CONFIG);
9135                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9136
9137                         queue_work(hdev->req_workqueue, &hdev->power_on);
9138                 } else {
9139                         set_bit(HCI_RAW, &hdev->flags);
9140                         mgmt_index_added(hdev);
9141                 }
9142         }
9143
9144 unlock:
9145         hci_dev_unlock(hdev);
9146         return err;
9147 }
9148
9149 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
9150                               void *data, u16 len)
9151 {
9152         struct mgmt_cp_set_public_address *cp = data;
9153         bool changed;
9154         int err;
9155
9156         bt_dev_dbg(hdev, "sock %p", sk);
9157
9158         if (hdev_is_powered(hdev))
9159                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9160                                        MGMT_STATUS_REJECTED);
9161
9162         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
9163                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9164                                        MGMT_STATUS_INVALID_PARAMS);
9165
9166         if (!hdev->set_bdaddr)
9167                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9168                                        MGMT_STATUS_NOT_SUPPORTED);
9169
9170         hci_dev_lock(hdev);
9171
9172         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
9173         bacpy(&hdev->public_addr, &cp->bdaddr);
9174
9175         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
9176         if (err < 0)
9177                 goto unlock;
9178
9179         if (!changed)
9180                 goto unlock;
9181
9182         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
9183                 err = new_options(hdev, sk);
9184
9185         if (is_configured(hdev)) {
9186                 mgmt_index_removed(hdev);
9187
9188                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
9189
9190                 hci_dev_set_flag(hdev, HCI_CONFIG);
9191                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9192
9193                 queue_work(hdev->req_workqueue, &hdev->power_on);
9194         }
9195
9196 unlock:
9197         hci_dev_unlock(hdev);
9198         return err;
9199 }
9200
9201 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
9202                                              int err)
9203 {
9204         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
9205         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
9206         u8 *h192, *r192, *h256, *r256;
9207         struct mgmt_pending_cmd *cmd = data;
9208         struct sk_buff *skb = cmd->skb;
9209         u8 status = mgmt_status(err);
9210         u16 eir_len;
9211
9212         if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
9213                 return;
9214
9215         if (!status) {
9216                 if (!skb)
9217                         status = MGMT_STATUS_FAILED;
9218                 else if (IS_ERR(skb))
9219                         status = mgmt_status(PTR_ERR(skb));
9220                 else
9221                         status = mgmt_status(skb->data[0]);
9222         }
9223
9224         bt_dev_dbg(hdev, "status %u", status);
9225
9226         mgmt_cp = cmd->param;
9227
9228         if (status) {
9229                 status = mgmt_status(status);
9230                 eir_len = 0;
9231
9232                 h192 = NULL;
9233                 r192 = NULL;
9234                 h256 = NULL;
9235                 r256 = NULL;
9236         } else if (!bredr_sc_enabled(hdev)) {
9237                 struct hci_rp_read_local_oob_data *rp;
9238
9239                 if (skb->len != sizeof(*rp)) {
9240                         status = MGMT_STATUS_FAILED;
9241                         eir_len = 0;
9242                 } else {
9243                         status = MGMT_STATUS_SUCCESS;
9244                         rp = (void *)skb->data;
9245
9246                         eir_len = 5 + 18 + 18;
9247                         h192 = rp->hash;
9248                         r192 = rp->rand;
9249                         h256 = NULL;
9250                         r256 = NULL;
9251                 }
9252         } else {
9253                 struct hci_rp_read_local_oob_ext_data *rp;
9254
9255                 if (skb->len != sizeof(*rp)) {
9256                         status = MGMT_STATUS_FAILED;
9257                         eir_len = 0;
9258                 } else {
9259                         status = MGMT_STATUS_SUCCESS;
9260                         rp = (void *)skb->data;
9261
9262                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
9263                                 eir_len = 5 + 18 + 18;
9264                                 h192 = NULL;
9265                                 r192 = NULL;
9266                         } else {
9267                                 eir_len = 5 + 18 + 18 + 18 + 18;
9268                                 h192 = rp->hash192;
9269                                 r192 = rp->rand192;
9270                         }
9271
9272                         h256 = rp->hash256;
9273                         r256 = rp->rand256;
9274                 }
9275         }
9276
9277         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
9278         if (!mgmt_rp)
9279                 goto done;
9280
9281         if (eir_len == 0)
9282                 goto send_rsp;
9283
9284         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
9285                                   hdev->dev_class, 3);
9286
9287         if (h192 && r192) {
9288                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9289                                           EIR_SSP_HASH_C192, h192, 16);
9290                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9291                                           EIR_SSP_RAND_R192, r192, 16);
9292         }
9293
9294         if (h256 && r256) {
9295                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9296                                           EIR_SSP_HASH_C256, h256, 16);
9297                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9298                                           EIR_SSP_RAND_R256, r256, 16);
9299         }
9300
9301 send_rsp:
9302         mgmt_rp->type = mgmt_cp->type;
9303         mgmt_rp->eir_len = cpu_to_le16(eir_len);
9304
9305         err = mgmt_cmd_complete(cmd->sk, hdev->id,
9306                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
9307                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
9308         if (err < 0 || status)
9309                 goto done;
9310
9311         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
9312
9313         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9314                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
9315                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
9316 done:
9317         if (skb && !IS_ERR(skb))
9318                 kfree_skb(skb);
9319
9320         kfree(mgmt_rp);
9321         mgmt_pending_remove(cmd);
9322 }
9323
9324 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
9325                                   struct mgmt_cp_read_local_oob_ext_data *cp)
9326 {
9327         struct mgmt_pending_cmd *cmd;
9328         int err;
9329
9330         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
9331                                cp, sizeof(*cp));
9332         if (!cmd)
9333                 return -ENOMEM;
9334
9335         err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
9336                                  read_local_oob_ext_data_complete);
9337
9338         if (err < 0) {
9339                 mgmt_pending_remove(cmd);
9340                 return err;
9341         }
9342
9343         return 0;
9344 }
9345
9346 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
9347                                    void *data, u16 data_len)
9348 {
9349         struct mgmt_cp_read_local_oob_ext_data *cp = data;
9350         struct mgmt_rp_read_local_oob_ext_data *rp;
9351         size_t rp_len;
9352         u16 eir_len;
9353         u8 status, flags, role, addr[7], hash[16], rand[16];
9354         int err;
9355
9356         bt_dev_dbg(hdev, "sock %p", sk);
9357
9358         if (hdev_is_powered(hdev)) {
9359                 switch (cp->type) {
9360                 case BIT(BDADDR_BREDR):
9361                         status = mgmt_bredr_support(hdev);
9362                         if (status)
9363                                 eir_len = 0;
9364                         else
9365                                 eir_len = 5;
9366                         break;
9367                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9368                         status = mgmt_le_support(hdev);
9369                         if (status)
9370                                 eir_len = 0;
9371                         else
9372                                 eir_len = 9 + 3 + 18 + 18 + 3;
9373                         break;
9374                 default:
9375                         status = MGMT_STATUS_INVALID_PARAMS;
9376                         eir_len = 0;
9377                         break;
9378                 }
9379         } else {
9380                 status = MGMT_STATUS_NOT_POWERED;
9381                 eir_len = 0;
9382         }
9383
9384         rp_len = sizeof(*rp) + eir_len;
9385         rp = kmalloc(rp_len, GFP_ATOMIC);
9386         if (!rp)
9387                 return -ENOMEM;
9388
9389         if (!status && !lmp_ssp_capable(hdev)) {
9390                 status = MGMT_STATUS_NOT_SUPPORTED;
9391                 eir_len = 0;
9392         }
9393
9394         if (status)
9395                 goto complete;
9396
9397         hci_dev_lock(hdev);
9398
9399         eir_len = 0;
9400         switch (cp->type) {
9401         case BIT(BDADDR_BREDR):
9402                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
9403                         err = read_local_ssp_oob_req(hdev, sk, cp);
9404                         hci_dev_unlock(hdev);
9405                         if (!err)
9406                                 goto done;
9407
9408                         status = MGMT_STATUS_FAILED;
9409                         goto complete;
9410                 } else {
9411                         eir_len = eir_append_data(rp->eir, eir_len,
9412                                                   EIR_CLASS_OF_DEV,
9413                                                   hdev->dev_class, 3);
9414                 }
9415                 break;
9416         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9417                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
9418                     smp_generate_oob(hdev, hash, rand) < 0) {
9419                         hci_dev_unlock(hdev);
9420                         status = MGMT_STATUS_FAILED;
9421                         goto complete;
9422                 }
9423
9424                 /* This should return the active RPA, but since the RPA
9425                  * is only programmed on demand, it is really hard to fill
9426                  * this in at the moment. For now disallow retrieving
9427                  * local out-of-band data when privacy is in use.
9428                  *
9429                  * Returning the identity address will not help here since
9430                  * pairing happens before the identity resolving key is
9431                  * known and thus the connection establishment happens
9432                  * based on the RPA and not the identity address.
9433                  */
9434                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
9435                         hci_dev_unlock(hdev);
9436                         status = MGMT_STATUS_REJECTED;
9437                         goto complete;
9438                 }
9439
9440                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
9441                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
9442                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
9443                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
9444                         memcpy(addr, &hdev->static_addr, 6);
9445                         addr[6] = 0x01;
9446                 } else {
9447                         memcpy(addr, &hdev->bdaddr, 6);
9448                         addr[6] = 0x00;
9449                 }
9450
9451                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
9452                                           addr, sizeof(addr));
9453
9454                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
9455                         role = 0x02;
9456                 else
9457                         role = 0x01;
9458
9459                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
9460                                           &role, sizeof(role));
9461
9462                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
9463                         eir_len = eir_append_data(rp->eir, eir_len,
9464                                                   EIR_LE_SC_CONFIRM,
9465                                                   hash, sizeof(hash));
9466
9467                         eir_len = eir_append_data(rp->eir, eir_len,
9468                                                   EIR_LE_SC_RANDOM,
9469                                                   rand, sizeof(rand));
9470                 }
9471
9472                 flags = mgmt_get_adv_discov_flags(hdev);
9473
9474                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
9475                         flags |= LE_AD_NO_BREDR;
9476
9477                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
9478                                           &flags, sizeof(flags));
9479                 break;
9480         }
9481
9482         hci_dev_unlock(hdev);
9483
9484         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
9485
9486         status = MGMT_STATUS_SUCCESS;
9487
9488 complete:
9489         rp->type = cp->type;
9490         rp->eir_len = cpu_to_le16(eir_len);
9491
9492         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
9493                                 status, rp, sizeof(*rp) + eir_len);
9494         if (err < 0 || status)
9495                 goto done;
9496
9497         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9498                                  rp, sizeof(*rp) + eir_len,
9499                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
9500
9501 done:
9502         kfree(rp);
9503
9504         return err;
9505 }
9506
9507 static u32 get_supported_adv_flags(struct hci_dev *hdev)
9508 {
9509         u32 flags = 0;
9510
9511         flags |= MGMT_ADV_FLAG_CONNECTABLE;
9512         flags |= MGMT_ADV_FLAG_DISCOV;
9513         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
9514         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
9515         flags |= MGMT_ADV_FLAG_APPEARANCE;
9516         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
9517         flags |= MGMT_ADV_PARAM_DURATION;
9518         flags |= MGMT_ADV_PARAM_TIMEOUT;
9519         flags |= MGMT_ADV_PARAM_INTERVALS;
9520         flags |= MGMT_ADV_PARAM_TX_POWER;
9521         flags |= MGMT_ADV_PARAM_SCAN_RSP;
9522
9523         /* In extended adv TX_POWER returned from Set Adv Param
9524          * will be always valid.
9525          */
9526         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev))
9527                 flags |= MGMT_ADV_FLAG_TX_POWER;
9528
9529         if (ext_adv_capable(hdev)) {
9530                 flags |= MGMT_ADV_FLAG_SEC_1M;
9531                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
9532                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
9533
9534                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
9535                         flags |= MGMT_ADV_FLAG_SEC_2M;
9536
9537                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
9538                         flags |= MGMT_ADV_FLAG_SEC_CODED;
9539         }
9540
9541         return flags;
9542 }
9543
9544 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
9545                              void *data, u16 data_len)
9546 {
9547         struct mgmt_rp_read_adv_features *rp;
9548         size_t rp_len;
9549         int err;
9550         struct adv_info *adv_instance;
9551         u32 supported_flags;
9552         u8 *instance;
9553
9554         bt_dev_dbg(hdev, "sock %p", sk);
9555
9556         if (!lmp_le_capable(hdev))
9557                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9558                                        MGMT_STATUS_REJECTED);
9559
9560         hci_dev_lock(hdev);
9561
9562         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
9563         rp = kmalloc(rp_len, GFP_ATOMIC);
9564         if (!rp) {
9565                 hci_dev_unlock(hdev);
9566                 return -ENOMEM;
9567         }
9568
9569         supported_flags = get_supported_adv_flags(hdev);
9570
9571         rp->supported_flags = cpu_to_le32(supported_flags);
9572         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
9573         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
9574         rp->max_instances = hdev->le_num_of_adv_sets;
9575         rp->num_instances = hdev->adv_instance_cnt;
9576
9577         instance = rp->instance;
9578         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
9579                 /* Only instances 1-le_num_of_adv_sets are externally visible */
9580                 if (adv_instance->instance <= hdev->adv_instance_cnt) {
9581                         *instance = adv_instance->instance;
9582                         instance++;
9583                 } else {
9584                         rp->num_instances--;
9585                         rp_len--;
9586                 }
9587         }
9588
9589         hci_dev_unlock(hdev);
9590
9591         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9592                                 MGMT_STATUS_SUCCESS, rp, rp_len);
9593
9594         kfree(rp);
9595
9596         return err;
9597 }
9598
9599 static u8 calculate_name_len(struct hci_dev *hdev)
9600 {
9601         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
9602
9603         return eir_append_local_name(hdev, buf, 0);
9604 }
9605
9606 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
9607                            bool is_adv_data)
9608 {
9609         u8 max_len = HCI_MAX_AD_LENGTH;
9610
9611         if (is_adv_data) {
9612                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
9613                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
9614                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
9615                         max_len -= 3;
9616
9617                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
9618                         max_len -= 3;
9619         } else {
9620                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
9621                         max_len -= calculate_name_len(hdev);
9622
9623                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
9624                         max_len -= 4;
9625         }
9626
9627         return max_len;
9628 }
9629
9630 static bool flags_managed(u32 adv_flags)
9631 {
9632         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
9633                             MGMT_ADV_FLAG_LIMITED_DISCOV |
9634                             MGMT_ADV_FLAG_MANAGED_FLAGS);
9635 }
9636
9637 static bool tx_power_managed(u32 adv_flags)
9638 {
9639         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
9640 }
9641
9642 static bool name_managed(u32 adv_flags)
9643 {
9644         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
9645 }
9646
9647 static bool appearance_managed(u32 adv_flags)
9648 {
9649         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
9650 }
9651
9652 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
9653                               u8 len, bool is_adv_data)
9654 {
9655         int i, cur_len;
9656         u8 max_len;
9657
9658         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
9659
9660         if (len > max_len)
9661                 return false;
9662
9663         /* Make sure that the data is correctly formatted. */
9664         for (i = 0; i < len; i += (cur_len + 1)) {
9665                 cur_len = data[i];
9666
9667                 if (!cur_len)
9668                         continue;
9669
9670                 if (data[i + 1] == EIR_FLAGS &&
9671                     (!is_adv_data || flags_managed(adv_flags)))
9672                         return false;
9673
9674                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
9675                         return false;
9676
9677                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
9678                         return false;
9679
9680                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
9681                         return false;
9682
9683                 if (data[i + 1] == EIR_APPEARANCE &&
9684                     appearance_managed(adv_flags))
9685                         return false;
9686
9687                 /* If the current field length would exceed the total data
9688                  * length, then it's invalid.
9689                  */
9690                 if (i + cur_len >= len)
9691                         return false;
9692         }
9693
9694         return true;
9695 }
9696
9697 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
9698 {
9699         u32 supported_flags, phy_flags;
9700
9701         /* The current implementation only supports a subset of the specified
9702          * flags. Also need to check mutual exclusiveness of sec flags.
9703          */
9704         supported_flags = get_supported_adv_flags(hdev);
9705         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
9706         if (adv_flags & ~supported_flags ||
9707             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
9708                 return false;
9709
9710         return true;
9711 }
9712
9713 static bool adv_busy(struct hci_dev *hdev)
9714 {
9715         return pending_find(MGMT_OP_SET_LE, hdev);
9716 }
9717
9718 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance,
9719                              int err)
9720 {
9721         struct adv_info *adv, *n;
9722
9723         bt_dev_dbg(hdev, "err %d", err);
9724
9725         hci_dev_lock(hdev);
9726
9727         list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
9728                 u8 instance;
9729
9730                 if (!adv->pending)
9731                         continue;
9732
9733                 if (!err) {
9734                         adv->pending = false;
9735                         continue;
9736                 }
9737
9738                 instance = adv->instance;
9739
9740                 if (hdev->cur_adv_instance == instance)
9741                         cancel_adv_timeout(hdev);
9742
9743                 hci_remove_adv_instance(hdev, instance);
9744                 mgmt_advertising_removed(sk, hdev, instance);
9745         }
9746
9747         hci_dev_unlock(hdev);
9748 }
9749
9750 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err)
9751 {
9752         struct mgmt_pending_cmd *cmd = data;
9753         struct mgmt_cp_add_advertising *cp = cmd->param;
9754         struct mgmt_rp_add_advertising rp;
9755
9756         memset(&rp, 0, sizeof(rp));
9757
9758         rp.instance = cp->instance;
9759
9760         if (err)
9761                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9762                                 mgmt_status(err));
9763         else
9764                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9765                                   mgmt_status(err), &rp, sizeof(rp));
9766
9767         add_adv_complete(hdev, cmd->sk, cp->instance, err);
9768
9769         mgmt_pending_free(cmd);
9770 }
9771
9772 static int add_advertising_sync(struct hci_dev *hdev, void *data)
9773 {
9774         struct mgmt_pending_cmd *cmd = data;
9775         struct mgmt_cp_add_advertising *cp = cmd->param;
9776
9777         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
9778 }
9779
9780 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
9781                            void *data, u16 data_len)
9782 {
9783         struct mgmt_cp_add_advertising *cp = data;
9784         struct mgmt_rp_add_advertising rp;
9785         u32 flags;
9786         u8 status;
9787         u16 timeout, duration;
9788         unsigned int prev_instance_cnt;
9789         u8 schedule_instance = 0;
9790         struct adv_info *adv, *next_instance;
9791         int err;
9792         struct mgmt_pending_cmd *cmd;
9793
9794         bt_dev_dbg(hdev, "sock %p", sk);
9795
9796         status = mgmt_le_support(hdev);
9797         if (status)
9798                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9799                                        status);
9800
9801         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9802                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9803                                        MGMT_STATUS_INVALID_PARAMS);
9804
9805         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
9806                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9807                                        MGMT_STATUS_INVALID_PARAMS);
9808
9809         flags = __le32_to_cpu(cp->flags);
9810         timeout = __le16_to_cpu(cp->timeout);
9811         duration = __le16_to_cpu(cp->duration);
9812
9813         if (!requested_adv_flags_are_valid(hdev, flags))
9814                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9815                                        MGMT_STATUS_INVALID_PARAMS);
9816
9817         hci_dev_lock(hdev);
9818
9819         if (timeout && !hdev_is_powered(hdev)) {
9820                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9821                                       MGMT_STATUS_REJECTED);
9822                 goto unlock;
9823         }
9824
9825         if (adv_busy(hdev)) {
9826                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9827                                       MGMT_STATUS_BUSY);
9828                 goto unlock;
9829         }
9830
9831         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
9832             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
9833                                cp->scan_rsp_len, false)) {
9834                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9835                                       MGMT_STATUS_INVALID_PARAMS);
9836                 goto unlock;
9837         }
9838
9839         prev_instance_cnt = hdev->adv_instance_cnt;
9840
9841         adv = hci_add_adv_instance(hdev, cp->instance, flags,
9842                                    cp->adv_data_len, cp->data,
9843                                    cp->scan_rsp_len,
9844                                    cp->data + cp->adv_data_len,
9845                                    timeout, duration,
9846                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
9847                                    hdev->le_adv_min_interval,
9848                                    hdev->le_adv_max_interval, 0);
9849         if (IS_ERR(adv)) {
9850                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9851                                       MGMT_STATUS_FAILED);
9852                 goto unlock;
9853         }
9854
9855         /* Only trigger an advertising added event if a new instance was
9856          * actually added.
9857          */
9858         if (hdev->adv_instance_cnt > prev_instance_cnt)
9859                 mgmt_advertising_added(sk, hdev, cp->instance);
9860
9861         if (hdev->cur_adv_instance == cp->instance) {
9862                 /* If the currently advertised instance is being changed then
9863                  * cancel the current advertising and schedule the next
9864                  * instance. If there is only one instance then the overridden
9865                  * advertising data will be visible right away.
9866                  */
9867                 cancel_adv_timeout(hdev);
9868
9869                 next_instance = hci_get_next_instance(hdev, cp->instance);
9870                 if (next_instance)
9871                         schedule_instance = next_instance->instance;
9872         } else if (!hdev->adv_instance_timeout) {
9873                 /* Immediately advertise the new instance if no other
9874                  * instance is currently being advertised.
9875                  */
9876                 schedule_instance = cp->instance;
9877         }
9878
9879         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
9880          * there is no instance to be advertised then we have no HCI
9881          * communication to make. Simply return.
9882          */
9883         if (!hdev_is_powered(hdev) ||
9884             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
9885             !schedule_instance) {
9886                 rp.instance = cp->instance;
9887                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9888                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9889                 goto unlock;
9890         }
9891
9892         /* We're good to go, update advertising data, parameters, and start
9893          * advertising.
9894          */
9895         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
9896                                data_len);
9897         if (!cmd) {
9898                 err = -ENOMEM;
9899                 goto unlock;
9900         }
9901
9902         cp->instance = schedule_instance;
9903
9904         err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd,
9905                                  add_advertising_complete);
9906         if (err < 0)
9907                 mgmt_pending_free(cmd);
9908
9909 unlock:
9910         hci_dev_unlock(hdev);
9911
9912         return err;
9913 }
9914
9915 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data,
9916                                         int err)
9917 {
9918         struct mgmt_pending_cmd *cmd = data;
9919         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
9920         struct mgmt_rp_add_ext_adv_params rp;
9921         struct adv_info *adv;
9922         u32 flags;
9923
9924         BT_DBG("%s", hdev->name);
9925
9926         hci_dev_lock(hdev);
9927
9928         adv = hci_find_adv_instance(hdev, cp->instance);
9929         if (!adv)
9930                 goto unlock;
9931
9932         rp.instance = cp->instance;
9933         rp.tx_power = adv->tx_power;
9934
9935         /* While we're at it, inform userspace of the available space for this
9936          * advertisement, given the flags that will be used.
9937          */
9938         flags = __le32_to_cpu(cp->flags);
9939         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9940         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9941
9942         if (err) {
9943                 /* If this advertisement was previously advertising and we
9944                  * failed to update it, we signal that it has been removed and
9945                  * delete its structure
9946                  */
9947                 if (!adv->pending)
9948                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
9949
9950                 hci_remove_adv_instance(hdev, cp->instance);
9951
9952                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9953                                 mgmt_status(err));
9954         } else {
9955                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9956                                   mgmt_status(err), &rp, sizeof(rp));
9957         }
9958
9959 unlock:
9960         if (cmd)
9961                 mgmt_pending_free(cmd);
9962
9963         hci_dev_unlock(hdev);
9964 }
9965
9966 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data)
9967 {
9968         struct mgmt_pending_cmd *cmd = data;
9969         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
9970
9971         return hci_setup_ext_adv_instance_sync(hdev, cp->instance);
9972 }
9973
9974 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
9975                               void *data, u16 data_len)
9976 {
9977         struct mgmt_cp_add_ext_adv_params *cp = data;
9978         struct mgmt_rp_add_ext_adv_params rp;
9979         struct mgmt_pending_cmd *cmd = NULL;
9980         struct adv_info *adv;
9981         u32 flags, min_interval, max_interval;
9982         u16 timeout, duration;
9983         u8 status;
9984         s8 tx_power;
9985         int err;
9986
9987         BT_DBG("%s", hdev->name);
9988
9989         status = mgmt_le_support(hdev);
9990         if (status)
9991                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9992                                        status);
9993
9994         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9995                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9996                                        MGMT_STATUS_INVALID_PARAMS);
9997
9998         /* The purpose of breaking add_advertising into two separate MGMT calls
9999          * for params and data is to allow more parameters to be added to this
10000          * structure in the future. For this reason, we verify that we have the
10001          * bare minimum structure we know of when the interface was defined. Any
10002          * extra parameters we don't know about will be ignored in this request.
10003          */
10004         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
10005                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10006                                        MGMT_STATUS_INVALID_PARAMS);
10007
10008         flags = __le32_to_cpu(cp->flags);
10009
10010         if (!requested_adv_flags_are_valid(hdev, flags))
10011                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10012                                        MGMT_STATUS_INVALID_PARAMS);
10013
10014         hci_dev_lock(hdev);
10015
10016         /* In new interface, we require that we are powered to register */
10017         if (!hdev_is_powered(hdev)) {
10018                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10019                                       MGMT_STATUS_REJECTED);
10020                 goto unlock;
10021         }
10022
10023         if (adv_busy(hdev)) {
10024                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10025                                       MGMT_STATUS_BUSY);
10026                 goto unlock;
10027         }
10028
10029         /* Parse defined parameters from request, use defaults otherwise */
10030         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
10031                   __le16_to_cpu(cp->timeout) : 0;
10032
10033         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
10034                    __le16_to_cpu(cp->duration) :
10035                    hdev->def_multi_adv_rotation_duration;
10036
10037         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
10038                        __le32_to_cpu(cp->min_interval) :
10039                        hdev->le_adv_min_interval;
10040
10041         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
10042                        __le32_to_cpu(cp->max_interval) :
10043                        hdev->le_adv_max_interval;
10044
10045         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
10046                    cp->tx_power :
10047                    HCI_ADV_TX_POWER_NO_PREFERENCE;
10048
10049         /* Create advertising instance with no advertising or response data */
10050         adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL,
10051                                    timeout, duration, tx_power, min_interval,
10052                                    max_interval, 0);
10053
10054         if (IS_ERR(adv)) {
10055                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10056                                       MGMT_STATUS_FAILED);
10057                 goto unlock;
10058         }
10059
10060         /* Submit request for advertising params if ext adv available */
10061         if (ext_adv_capable(hdev)) {
10062                 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev,
10063                                        data, data_len);
10064                 if (!cmd) {
10065                         err = -ENOMEM;
10066                         hci_remove_adv_instance(hdev, cp->instance);
10067                         goto unlock;
10068                 }
10069
10070                 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd,
10071                                          add_ext_adv_params_complete);
10072                 if (err < 0)
10073                         mgmt_pending_free(cmd);
10074         } else {
10075                 rp.instance = cp->instance;
10076                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
10077                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10078                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10079                 err = mgmt_cmd_complete(sk, hdev->id,
10080                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
10081                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10082         }
10083
10084 unlock:
10085         hci_dev_unlock(hdev);
10086
10087         return err;
10088 }
10089
10090 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err)
10091 {
10092         struct mgmt_pending_cmd *cmd = data;
10093         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
10094         struct mgmt_rp_add_advertising rp;
10095
10096         add_adv_complete(hdev, cmd->sk, cp->instance, err);
10097
10098         memset(&rp, 0, sizeof(rp));
10099
10100         rp.instance = cp->instance;
10101
10102         if (err)
10103                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
10104                                 mgmt_status(err));
10105         else
10106                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
10107                                   mgmt_status(err), &rp, sizeof(rp));
10108
10109         mgmt_pending_free(cmd);
10110 }
10111
10112 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data)
10113 {
10114         struct mgmt_pending_cmd *cmd = data;
10115         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
10116         int err;
10117
10118         if (ext_adv_capable(hdev)) {
10119                 err = hci_update_adv_data_sync(hdev, cp->instance);
10120                 if (err)
10121                         return err;
10122
10123                 err = hci_update_scan_rsp_data_sync(hdev, cp->instance);
10124                 if (err)
10125                         return err;
10126
10127                 return hci_enable_ext_advertising_sync(hdev, cp->instance);
10128         }
10129
10130         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
10131 }
10132
10133 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
10134                             u16 data_len)
10135 {
10136         struct mgmt_cp_add_ext_adv_data *cp = data;
10137         struct mgmt_rp_add_ext_adv_data rp;
10138         u8 schedule_instance = 0;
10139         struct adv_info *next_instance;
10140         struct adv_info *adv_instance;
10141         int err = 0;
10142         struct mgmt_pending_cmd *cmd;
10143
10144         BT_DBG("%s", hdev->name);
10145
10146         hci_dev_lock(hdev);
10147
10148         adv_instance = hci_find_adv_instance(hdev, cp->instance);
10149
10150         if (!adv_instance) {
10151                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10152                                       MGMT_STATUS_INVALID_PARAMS);
10153                 goto unlock;
10154         }
10155
10156         /* In new interface, we require that we are powered to register */
10157         if (!hdev_is_powered(hdev)) {
10158                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10159                                       MGMT_STATUS_REJECTED);
10160                 goto clear_new_instance;
10161         }
10162
10163         if (adv_busy(hdev)) {
10164                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10165                                       MGMT_STATUS_BUSY);
10166                 goto clear_new_instance;
10167         }
10168
10169         /* Validate new data */
10170         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
10171                                cp->adv_data_len, true) ||
10172             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
10173                                cp->adv_data_len, cp->scan_rsp_len, false)) {
10174                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10175                                       MGMT_STATUS_INVALID_PARAMS);
10176                 goto clear_new_instance;
10177         }
10178
10179         /* Set the data in the advertising instance */
10180         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
10181                                   cp->data, cp->scan_rsp_len,
10182                                   cp->data + cp->adv_data_len);
10183
10184         /* If using software rotation, determine next instance to use */
10185         if (hdev->cur_adv_instance == cp->instance) {
10186                 /* If the currently advertised instance is being changed
10187                  * then cancel the current advertising and schedule the
10188                  * next instance. If there is only one instance then the
10189                  * overridden advertising data will be visible right
10190                  * away
10191                  */
10192                 cancel_adv_timeout(hdev);
10193
10194                 next_instance = hci_get_next_instance(hdev, cp->instance);
10195                 if (next_instance)
10196                         schedule_instance = next_instance->instance;
10197         } else if (!hdev->adv_instance_timeout) {
10198                 /* Immediately advertise the new instance if no other
10199                  * instance is currently being advertised.
10200                  */
10201                 schedule_instance = cp->instance;
10202         }
10203
10204         /* If the HCI_ADVERTISING flag is set or there is no instance to
10205          * be advertised then we have no HCI communication to make.
10206          * Simply return.
10207          */
10208         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) {
10209                 if (adv_instance->pending) {
10210                         mgmt_advertising_added(sk, hdev, cp->instance);
10211                         adv_instance->pending = false;
10212                 }
10213                 rp.instance = cp->instance;
10214                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10215                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10216                 goto unlock;
10217         }
10218
10219         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
10220                                data_len);
10221         if (!cmd) {
10222                 err = -ENOMEM;
10223                 goto clear_new_instance;
10224         }
10225
10226         err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd,
10227                                  add_ext_adv_data_complete);
10228         if (err < 0) {
10229                 mgmt_pending_free(cmd);
10230                 goto clear_new_instance;
10231         }
10232
10233         /* We were successful in updating data, so trigger advertising_added
10234          * event if this is an instance that wasn't previously advertising. If
10235          * a failure occurs in the requests we initiated, we will remove the
10236          * instance again in add_advertising_complete
10237          */
10238         if (adv_instance->pending)
10239                 mgmt_advertising_added(sk, hdev, cp->instance);
10240
10241         goto unlock;
10242
10243 clear_new_instance:
10244         hci_remove_adv_instance(hdev, cp->instance);
10245
10246 unlock:
10247         hci_dev_unlock(hdev);
10248
10249         return err;
10250 }
10251
10252 static void remove_advertising_complete(struct hci_dev *hdev, void *data,
10253                                         int err)
10254 {
10255         struct mgmt_pending_cmd *cmd = data;
10256         struct mgmt_cp_remove_advertising *cp = cmd->param;
10257         struct mgmt_rp_remove_advertising rp;
10258
10259         bt_dev_dbg(hdev, "err %d", err);
10260
10261         memset(&rp, 0, sizeof(rp));
10262         rp.instance = cp->instance;
10263
10264         if (err)
10265                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
10266                                 mgmt_status(err));
10267         else
10268                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
10269                                   MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10270
10271         mgmt_pending_free(cmd);
10272 }
10273
10274 static int remove_advertising_sync(struct hci_dev *hdev, void *data)
10275 {
10276         struct mgmt_pending_cmd *cmd = data;
10277         struct mgmt_cp_remove_advertising *cp = cmd->param;
10278         int err;
10279
10280         err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true);
10281         if (err)
10282                 return err;
10283
10284         if (list_empty(&hdev->adv_instances))
10285                 err = hci_disable_advertising_sync(hdev);
10286
10287         return err;
10288 }
10289
10290 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
10291                               void *data, u16 data_len)
10292 {
10293         struct mgmt_cp_remove_advertising *cp = data;
10294         struct mgmt_pending_cmd *cmd;
10295         int err;
10296
10297         bt_dev_dbg(hdev, "sock %p", sk);
10298
10299         hci_dev_lock(hdev);
10300
10301         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
10302                 err = mgmt_cmd_status(sk, hdev->id,
10303                                       MGMT_OP_REMOVE_ADVERTISING,
10304                                       MGMT_STATUS_INVALID_PARAMS);
10305                 goto unlock;
10306         }
10307
10308         if (pending_find(MGMT_OP_SET_LE, hdev)) {
10309                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10310                                       MGMT_STATUS_BUSY);
10311                 goto unlock;
10312         }
10313
10314         if (list_empty(&hdev->adv_instances)) {
10315                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10316                                       MGMT_STATUS_INVALID_PARAMS);
10317                 goto unlock;
10318         }
10319
10320         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
10321                                data_len);
10322         if (!cmd) {
10323                 err = -ENOMEM;
10324                 goto unlock;
10325         }
10326
10327         err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd,
10328                                  remove_advertising_complete);
10329         if (err < 0)
10330                 mgmt_pending_free(cmd);
10331
10332 unlock:
10333         hci_dev_unlock(hdev);
10334
10335         return err;
10336 }
10337
10338 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
10339                              void *data, u16 data_len)
10340 {
10341         struct mgmt_cp_get_adv_size_info *cp = data;
10342         struct mgmt_rp_get_adv_size_info rp;
10343         u32 flags, supported_flags;
10344
10345         bt_dev_dbg(hdev, "sock %p", sk);
10346
10347         if (!lmp_le_capable(hdev))
10348                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10349                                        MGMT_STATUS_REJECTED);
10350
10351         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10352                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10353                                        MGMT_STATUS_INVALID_PARAMS);
10354
10355         flags = __le32_to_cpu(cp->flags);
10356
10357         /* The current implementation only supports a subset of the specified
10358          * flags.
10359          */
10360         supported_flags = get_supported_adv_flags(hdev);
10361         if (flags & ~supported_flags)
10362                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10363                                        MGMT_STATUS_INVALID_PARAMS);
10364
10365         rp.instance = cp->instance;
10366         rp.flags = cp->flags;
10367         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10368         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10369
10370         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10371                                  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10372 }
10373
10374 static const struct hci_mgmt_handler mgmt_handlers[] = {
10375         { NULL }, /* 0x0000 (no command) */
10376         { read_version,            MGMT_READ_VERSION_SIZE,
10377                                                 HCI_MGMT_NO_HDEV |
10378                                                 HCI_MGMT_UNTRUSTED },
10379         { read_commands,           MGMT_READ_COMMANDS_SIZE,
10380                                                 HCI_MGMT_NO_HDEV |
10381                                                 HCI_MGMT_UNTRUSTED },
10382         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
10383                                                 HCI_MGMT_NO_HDEV |
10384                                                 HCI_MGMT_UNTRUSTED },
10385         { read_controller_info,    MGMT_READ_INFO_SIZE,
10386                                                 HCI_MGMT_UNTRUSTED },
10387         { set_powered,             MGMT_SETTING_SIZE },
10388         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
10389         { set_connectable,         MGMT_SETTING_SIZE },
10390         { set_fast_connectable,    MGMT_SETTING_SIZE },
10391         { set_bondable,            MGMT_SETTING_SIZE },
10392         { set_link_security,       MGMT_SETTING_SIZE },
10393         { set_ssp,                 MGMT_SETTING_SIZE },
10394         { set_hs,                  MGMT_SETTING_SIZE },
10395         { set_le,                  MGMT_SETTING_SIZE },
10396         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
10397         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
10398         { add_uuid,                MGMT_ADD_UUID_SIZE },
10399         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
10400         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
10401                                                 HCI_MGMT_VAR_LEN },
10402         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
10403                                                 HCI_MGMT_VAR_LEN },
10404         { disconnect,              MGMT_DISCONNECT_SIZE },
10405         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
10406         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
10407         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
10408         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
10409         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
10410         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
10411         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
10412         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
10413         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
10414         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
10415         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
10416         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
10417         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
10418                                                 HCI_MGMT_VAR_LEN },
10419         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
10420         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
10421         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
10422         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
10423         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
10424         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
10425         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
10426         { set_advertising,         MGMT_SETTING_SIZE },
10427         { set_bredr,               MGMT_SETTING_SIZE },
10428         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
10429         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
10430         { set_secure_conn,         MGMT_SETTING_SIZE },
10431         { set_debug_keys,          MGMT_SETTING_SIZE },
10432         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
10433         { load_irks,               MGMT_LOAD_IRKS_SIZE,
10434                                                 HCI_MGMT_VAR_LEN },
10435         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
10436         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
10437         { add_device,              MGMT_ADD_DEVICE_SIZE },
10438         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
10439         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
10440                                                 HCI_MGMT_VAR_LEN },
10441         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
10442                                                 HCI_MGMT_NO_HDEV |
10443                                                 HCI_MGMT_UNTRUSTED },
10444         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
10445                                                 HCI_MGMT_UNCONFIGURED |
10446                                                 HCI_MGMT_UNTRUSTED },
10447         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
10448                                                 HCI_MGMT_UNCONFIGURED },
10449         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
10450                                                 HCI_MGMT_UNCONFIGURED },
10451         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
10452                                                 HCI_MGMT_VAR_LEN },
10453         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
10454         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
10455                                                 HCI_MGMT_NO_HDEV |
10456                                                 HCI_MGMT_UNTRUSTED },
10457         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
10458         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
10459                                                 HCI_MGMT_VAR_LEN },
10460         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
10461         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
10462         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
10463         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
10464                                                 HCI_MGMT_UNTRUSTED },
10465         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
10466         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
10467         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
10468         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
10469                                                 HCI_MGMT_VAR_LEN },
10470         { set_wideband_speech,     MGMT_SETTING_SIZE },
10471         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
10472                                                 HCI_MGMT_UNTRUSTED },
10473         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
10474                                                 HCI_MGMT_UNTRUSTED |
10475                                                 HCI_MGMT_HDEV_OPTIONAL },
10476         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
10477                                                 HCI_MGMT_VAR_LEN |
10478                                                 HCI_MGMT_HDEV_OPTIONAL },
10479         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
10480                                                 HCI_MGMT_UNTRUSTED },
10481         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
10482                                                 HCI_MGMT_VAR_LEN },
10483         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
10484                                                 HCI_MGMT_UNTRUSTED },
10485         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
10486                                                 HCI_MGMT_VAR_LEN },
10487         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
10488         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
10489         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
10490         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
10491                                                 HCI_MGMT_VAR_LEN },
10492         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
10493         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
10494                                                 HCI_MGMT_VAR_LEN },
10495         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
10496                                                 HCI_MGMT_VAR_LEN },
10497         { add_adv_patterns_monitor_rssi,
10498                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE },
10499         { set_mesh,                MGMT_SET_MESH_RECEIVER_SIZE,
10500                                                 HCI_MGMT_VAR_LEN },
10501         { mesh_features,           MGMT_MESH_READ_FEATURES_SIZE },
10502         { mesh_send,               MGMT_MESH_SEND_SIZE,
10503                                                 HCI_MGMT_VAR_LEN },
10504         { mesh_send_cancel,        MGMT_MESH_SEND_CANCEL_SIZE },
10505 };
10506
10507 #ifdef TIZEN_BT
10508 static const struct hci_mgmt_handler tizen_mgmt_handlers[] = {
10509         { NULL }, /* 0x0000 (no command) */
10510         { set_advertising_params,  MGMT_SET_ADVERTISING_PARAMS_SIZE },
10511         { set_advertising_data,    MGMT_SET_ADV_MIN_APP_DATA_SIZE,
10512                                                 HCI_MGMT_VAR_LEN },
10513         { set_scan_rsp_data,       MGMT_SET_SCAN_RSP_MIN_APP_DATA_SIZE,
10514                                                 HCI_MGMT_VAR_LEN },
10515         { add_white_list,          MGMT_ADD_DEV_WHITE_LIST_SIZE },
10516         { remove_from_white_list,  MGMT_REMOVE_DEV_FROM_WHITE_LIST_SIZE },
10517         { clear_white_list,        MGMT_OP_CLEAR_DEV_WHITE_LIST_SIZE },
10518         { set_enable_rssi,         MGMT_SET_RSSI_ENABLE_SIZE },
10519         { get_raw_rssi,            MGMT_GET_RAW_RSSI_SIZE },
10520         { set_disable_threshold,   MGMT_SET_RSSI_DISABLE_SIZE },
10521 };
10522 #endif
10523
10524 void mgmt_index_added(struct hci_dev *hdev)
10525 {
10526         struct mgmt_ev_ext_index ev;
10527
10528         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10529                 return;
10530
10531         switch (hdev->dev_type) {
10532         case HCI_PRIMARY:
10533                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10534                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
10535                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10536                         ev.type = 0x01;
10537                 } else {
10538                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
10539                                          HCI_MGMT_INDEX_EVENTS);
10540                         ev.type = 0x00;
10541                 }
10542                 break;
10543         case HCI_AMP:
10544                 ev.type = 0x02;
10545                 break;
10546         default:
10547                 return;
10548         }
10549
10550         ev.bus = hdev->bus;
10551
10552         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
10553                          HCI_MGMT_EXT_INDEX_EVENTS);
10554 }
10555
10556 void mgmt_index_removed(struct hci_dev *hdev)
10557 {
10558         struct mgmt_ev_ext_index ev;
10559         u8 status = MGMT_STATUS_INVALID_INDEX;
10560
10561         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10562                 return;
10563
10564         switch (hdev->dev_type) {
10565         case HCI_PRIMARY:
10566                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
10567
10568                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10569                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
10570                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10571                         ev.type = 0x01;
10572                 } else {
10573                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
10574                                          HCI_MGMT_INDEX_EVENTS);
10575                         ev.type = 0x00;
10576                 }
10577                 break;
10578         case HCI_AMP:
10579                 ev.type = 0x02;
10580                 break;
10581         default:
10582                 return;
10583         }
10584
10585         ev.bus = hdev->bus;
10586
10587         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
10588                          HCI_MGMT_EXT_INDEX_EVENTS);
10589
10590         /* Cancel any remaining timed work */
10591         if (!hci_dev_test_flag(hdev, HCI_MGMT))
10592                 return;
10593         cancel_delayed_work_sync(&hdev->discov_off);
10594         cancel_delayed_work_sync(&hdev->service_cache);
10595         cancel_delayed_work_sync(&hdev->rpa_expired);
10596 }
10597
10598 void mgmt_power_on(struct hci_dev *hdev, int err)
10599 {
10600         struct cmd_lookup match = { NULL, hdev };
10601
10602         bt_dev_dbg(hdev, "err %d", err);
10603
10604         hci_dev_lock(hdev);
10605
10606         if (!err) {
10607                 restart_le_actions(hdev);
10608                 hci_update_passive_scan(hdev);
10609         }
10610
10611         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
10612
10613         new_settings(hdev, match.sk);
10614
10615         if (match.sk)
10616                 sock_put(match.sk);
10617
10618         hci_dev_unlock(hdev);
10619 }
10620
10621 void __mgmt_power_off(struct hci_dev *hdev)
10622 {
10623         struct cmd_lookup match = { NULL, hdev };
10624         u8 status, zero_cod[] = { 0, 0, 0 };
10625
10626         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
10627
10628         /* If the power off is because of hdev unregistration let
10629          * use the appropriate INVALID_INDEX status. Otherwise use
10630          * NOT_POWERED. We cover both scenarios here since later in
10631          * mgmt_index_removed() any hci_conn callbacks will have already
10632          * been triggered, potentially causing misleading DISCONNECTED
10633          * status responses.
10634          */
10635         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
10636                 status = MGMT_STATUS_INVALID_INDEX;
10637         else
10638                 status = MGMT_STATUS_NOT_POWERED;
10639
10640         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
10641
10642         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
10643                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
10644                                    zero_cod, sizeof(zero_cod),
10645                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
10646                 ext_info_changed(hdev, NULL);
10647         }
10648
10649         new_settings(hdev, match.sk);
10650
10651         if (match.sk)
10652                 sock_put(match.sk);
10653 }
10654
10655 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
10656 {
10657         struct mgmt_pending_cmd *cmd;
10658         u8 status;
10659
10660         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
10661         if (!cmd)
10662                 return;
10663
10664         if (err == -ERFKILL)
10665                 status = MGMT_STATUS_RFKILLED;
10666         else
10667                 status = MGMT_STATUS_FAILED;
10668
10669         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
10670
10671         mgmt_pending_remove(cmd);
10672 }
10673
10674 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
10675                        bool persistent)
10676 {
10677         struct mgmt_ev_new_link_key ev;
10678
10679         memset(&ev, 0, sizeof(ev));
10680
10681         ev.store_hint = persistent;
10682         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
10683         ev.key.addr.type = BDADDR_BREDR;
10684         ev.key.type = key->type;
10685         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
10686         ev.key.pin_len = key->pin_len;
10687
10688         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
10689 }
10690
10691 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
10692 {
10693         switch (ltk->type) {
10694         case SMP_LTK:
10695         case SMP_LTK_RESPONDER:
10696                 if (ltk->authenticated)
10697                         return MGMT_LTK_AUTHENTICATED;
10698                 return MGMT_LTK_UNAUTHENTICATED;
10699         case SMP_LTK_P256:
10700                 if (ltk->authenticated)
10701                         return MGMT_LTK_P256_AUTH;
10702                 return MGMT_LTK_P256_UNAUTH;
10703         case SMP_LTK_P256_DEBUG:
10704                 return MGMT_LTK_P256_DEBUG;
10705         }
10706
10707         return MGMT_LTK_UNAUTHENTICATED;
10708 }
10709
10710 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
10711 {
10712         struct mgmt_ev_new_long_term_key ev;
10713
10714         memset(&ev, 0, sizeof(ev));
10715
10716         /* Devices using resolvable or non-resolvable random addresses
10717          * without providing an identity resolving key don't require
10718          * to store long term keys. Their addresses will change the
10719          * next time around.
10720          *
10721          * Only when a remote device provides an identity address
10722          * make sure the long term key is stored. If the remote
10723          * identity is known, the long term keys are internally
10724          * mapped to the identity address. So allow static random
10725          * and public addresses here.
10726          */
10727         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
10728             (key->bdaddr.b[5] & 0xc0) != 0xc0)
10729                 ev.store_hint = 0x00;
10730         else
10731                 ev.store_hint = persistent;
10732
10733         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
10734         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
10735         ev.key.type = mgmt_ltk_type(key);
10736         ev.key.enc_size = key->enc_size;
10737         ev.key.ediv = key->ediv;
10738         ev.key.rand = key->rand;
10739
10740         if (key->type == SMP_LTK)
10741                 ev.key.initiator = 1;
10742
10743         /* Make sure we copy only the significant bytes based on the
10744          * encryption key size, and set the rest of the value to zeroes.
10745          */
10746         memcpy(ev.key.val, key->val, key->enc_size);
10747         memset(ev.key.val + key->enc_size, 0,
10748                sizeof(ev.key.val) - key->enc_size);
10749
10750         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
10751 }
10752
10753 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
10754 {
10755         struct mgmt_ev_new_irk ev;
10756
10757         memset(&ev, 0, sizeof(ev));
10758
10759         ev.store_hint = persistent;
10760
10761         bacpy(&ev.rpa, &irk->rpa);
10762         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
10763         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
10764         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
10765
10766         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
10767 }
10768
10769 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
10770                    bool persistent)
10771 {
10772         struct mgmt_ev_new_csrk ev;
10773
10774         memset(&ev, 0, sizeof(ev));
10775
10776         /* Devices using resolvable or non-resolvable random addresses
10777          * without providing an identity resolving key don't require
10778          * to store signature resolving keys. Their addresses will change
10779          * the next time around.
10780          *
10781          * Only when a remote device provides an identity address
10782          * make sure the signature resolving key is stored. So allow
10783          * static random and public addresses here.
10784          */
10785         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
10786             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
10787                 ev.store_hint = 0x00;
10788         else
10789                 ev.store_hint = persistent;
10790
10791         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
10792         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
10793         ev.key.type = csrk->type;
10794         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
10795
10796         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
10797 }
10798
10799 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
10800                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
10801                          u16 max_interval, u16 latency, u16 timeout)
10802 {
10803         struct mgmt_ev_new_conn_param ev;
10804
10805         if (!hci_is_identity_address(bdaddr, bdaddr_type))
10806                 return;
10807
10808         memset(&ev, 0, sizeof(ev));
10809         bacpy(&ev.addr.bdaddr, bdaddr);
10810         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
10811         ev.store_hint = store_hint;
10812         ev.min_interval = cpu_to_le16(min_interval);
10813         ev.max_interval = cpu_to_le16(max_interval);
10814         ev.latency = cpu_to_le16(latency);
10815         ev.timeout = cpu_to_le16(timeout);
10816
10817         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
10818 }
10819
10820 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
10821                            u8 *name, u8 name_len)
10822 {
10823         struct sk_buff *skb;
10824         struct mgmt_ev_device_connected *ev;
10825         u16 eir_len = 0;
10826         u32 flags = 0;
10827
10828         /* allocate buff for LE or BR/EDR adv */
10829         if (conn->le_adv_data_len > 0)
10830                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
10831                                      sizeof(*ev) + conn->le_adv_data_len);
10832         else
10833                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
10834                                      sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) +
10835                                      eir_precalc_len(sizeof(conn->dev_class)));
10836
10837         ev = skb_put(skb, sizeof(*ev));
10838         bacpy(&ev->addr.bdaddr, &conn->dst);
10839         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10840
10841         if (conn->out)
10842                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
10843
10844         ev->flags = __cpu_to_le32(flags);
10845
10846         /* We must ensure that the EIR Data fields are ordered and
10847          * unique. Keep it simple for now and avoid the problem by not
10848          * adding any BR/EDR data to the LE adv.
10849          */
10850         if (conn->le_adv_data_len > 0) {
10851                 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len);
10852                 eir_len = conn->le_adv_data_len;
10853         } else {
10854                 if (name)
10855                         eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
10856
10857                 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class)))
10858                         eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV,
10859                                                     conn->dev_class, sizeof(conn->dev_class));
10860         }
10861
10862         ev->eir_len = cpu_to_le16(eir_len);
10863
10864         mgmt_event_skb(skb, NULL);
10865 }
10866
10867 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
10868 {
10869         struct sock **sk = data;
10870
10871         cmd->cmd_complete(cmd, 0);
10872
10873         *sk = cmd->sk;
10874         sock_hold(*sk);
10875
10876         mgmt_pending_remove(cmd);
10877 }
10878
10879 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
10880 {
10881         struct hci_dev *hdev = data;
10882         struct mgmt_cp_unpair_device *cp = cmd->param;
10883
10884         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
10885
10886         cmd->cmd_complete(cmd, 0);
10887         mgmt_pending_remove(cmd);
10888 }
10889
10890 bool mgmt_powering_down(struct hci_dev *hdev)
10891 {
10892         struct mgmt_pending_cmd *cmd;
10893         struct mgmt_mode *cp;
10894
10895         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
10896         if (!cmd)
10897                 return false;
10898
10899         cp = cmd->param;
10900         if (!cp->val)
10901                 return true;
10902
10903         return false;
10904 }
10905
10906 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
10907                               u8 link_type, u8 addr_type, u8 reason,
10908                               bool mgmt_connected)
10909 {
10910         struct mgmt_ev_device_disconnected ev;
10911         struct sock *sk = NULL;
10912
10913         /* The connection is still in hci_conn_hash so test for 1
10914          * instead of 0 to know if this is the last one.
10915          */
10916         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
10917                 cancel_delayed_work(&hdev->power_off);
10918                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
10919         }
10920
10921         if (!mgmt_connected)
10922                 return;
10923
10924         if (link_type != ACL_LINK && link_type != LE_LINK)
10925                 return;
10926
10927         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
10928
10929         bacpy(&ev.addr.bdaddr, bdaddr);
10930         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10931         ev.reason = reason;
10932
10933         /* Report disconnects due to suspend */
10934         if (hdev->suspended)
10935                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
10936
10937         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
10938
10939         if (sk)
10940                 sock_put(sk);
10941
10942         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
10943                              hdev);
10944 }
10945
10946 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
10947                             u8 link_type, u8 addr_type, u8 status)
10948 {
10949         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
10950         struct mgmt_cp_disconnect *cp;
10951         struct mgmt_pending_cmd *cmd;
10952
10953         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
10954                              hdev);
10955
10956         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
10957         if (!cmd)
10958                 return;
10959
10960         cp = cmd->param;
10961
10962         if (bacmp(bdaddr, &cp->addr.bdaddr))
10963                 return;
10964
10965         if (cp->addr.type != bdaddr_type)
10966                 return;
10967
10968         cmd->cmd_complete(cmd, mgmt_status(status));
10969         mgmt_pending_remove(cmd);
10970 }
10971
10972 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10973                          u8 addr_type, u8 status)
10974 {
10975         struct mgmt_ev_connect_failed ev;
10976
10977         /* The connection is still in hci_conn_hash so test for 1
10978          * instead of 0 to know if this is the last one.
10979          */
10980         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
10981                 cancel_delayed_work(&hdev->power_off);
10982                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
10983         }
10984
10985         bacpy(&ev.addr.bdaddr, bdaddr);
10986         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10987         ev.status = mgmt_status(status);
10988
10989         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
10990 }
10991
10992 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
10993 {
10994         struct mgmt_ev_pin_code_request ev;
10995
10996         bacpy(&ev.addr.bdaddr, bdaddr);
10997         ev.addr.type = BDADDR_BREDR;
10998         ev.secure = secure;
10999
11000         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
11001 }
11002
11003 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11004                                   u8 status)
11005 {
11006         struct mgmt_pending_cmd *cmd;
11007
11008         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
11009         if (!cmd)
11010                 return;
11011
11012         cmd->cmd_complete(cmd, mgmt_status(status));
11013         mgmt_pending_remove(cmd);
11014 }
11015
11016 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11017                                       u8 status)
11018 {
11019         struct mgmt_pending_cmd *cmd;
11020
11021         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
11022         if (!cmd)
11023                 return;
11024
11025         cmd->cmd_complete(cmd, mgmt_status(status));
11026         mgmt_pending_remove(cmd);
11027 }
11028
11029 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
11030                               u8 link_type, u8 addr_type, u32 value,
11031                               u8 confirm_hint)
11032 {
11033         struct mgmt_ev_user_confirm_request ev;
11034
11035         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11036
11037         bacpy(&ev.addr.bdaddr, bdaddr);
11038         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11039         ev.confirm_hint = confirm_hint;
11040         ev.value = cpu_to_le32(value);
11041
11042         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
11043                           NULL);
11044 }
11045
11046 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
11047                               u8 link_type, u8 addr_type)
11048 {
11049         struct mgmt_ev_user_passkey_request ev;
11050
11051         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11052
11053         bacpy(&ev.addr.bdaddr, bdaddr);
11054         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11055
11056         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
11057                           NULL);
11058 }
11059
11060 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11061                                       u8 link_type, u8 addr_type, u8 status,
11062                                       u8 opcode)
11063 {
11064         struct mgmt_pending_cmd *cmd;
11065
11066         cmd = pending_find(opcode, hdev);
11067         if (!cmd)
11068                 return -ENOENT;
11069
11070         cmd->cmd_complete(cmd, mgmt_status(status));
11071         mgmt_pending_remove(cmd);
11072
11073         return 0;
11074 }
11075
11076 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11077                                      u8 link_type, u8 addr_type, u8 status)
11078 {
11079         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11080                                           status, MGMT_OP_USER_CONFIRM_REPLY);
11081 }
11082
11083 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11084                                          u8 link_type, u8 addr_type, u8 status)
11085 {
11086         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11087                                           status,
11088                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
11089 }
11090
11091 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11092                                      u8 link_type, u8 addr_type, u8 status)
11093 {
11094         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11095                                           status, MGMT_OP_USER_PASSKEY_REPLY);
11096 }
11097
11098 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11099                                          u8 link_type, u8 addr_type, u8 status)
11100 {
11101         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11102                                           status,
11103                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
11104 }
11105
11106 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
11107                              u8 link_type, u8 addr_type, u32 passkey,
11108                              u8 entered)
11109 {
11110         struct mgmt_ev_passkey_notify ev;
11111
11112         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11113
11114         bacpy(&ev.addr.bdaddr, bdaddr);
11115         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11116         ev.passkey = __cpu_to_le32(passkey);
11117         ev.entered = entered;
11118
11119         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
11120 }
11121
11122 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
11123 {
11124         struct mgmt_ev_auth_failed ev;
11125         struct mgmt_pending_cmd *cmd;
11126         u8 status = mgmt_status(hci_status);
11127
11128         bacpy(&ev.addr.bdaddr, &conn->dst);
11129         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
11130         ev.status = status;
11131
11132         cmd = find_pairing(conn);
11133
11134         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
11135                     cmd ? cmd->sk : NULL);
11136
11137         if (cmd) {
11138                 cmd->cmd_complete(cmd, status);
11139                 mgmt_pending_remove(cmd);
11140         }
11141 }
11142
11143 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
11144 {
11145         struct cmd_lookup match = { NULL, hdev };
11146         bool changed;
11147
11148         if (status) {
11149                 u8 mgmt_err = mgmt_status(status);
11150                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
11151                                      cmd_status_rsp, &mgmt_err);
11152                 return;
11153         }
11154
11155         if (test_bit(HCI_AUTH, &hdev->flags))
11156                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
11157         else
11158                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
11159
11160         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
11161                              &match);
11162
11163         if (changed)
11164                 new_settings(hdev, match.sk);
11165
11166         if (match.sk)
11167                 sock_put(match.sk);
11168 }
11169
11170 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
11171 {
11172         struct cmd_lookup *match = data;
11173
11174         if (match->sk == NULL) {
11175                 match->sk = cmd->sk;
11176                 sock_hold(match->sk);
11177         }
11178 }
11179
11180 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
11181                                     u8 status)
11182 {
11183         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
11184
11185         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
11186         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
11187         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
11188
11189         if (!status) {
11190                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
11191                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
11192                 ext_info_changed(hdev, NULL);
11193         }
11194
11195         if (match.sk)
11196                 sock_put(match.sk);
11197 }
11198
11199 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
11200 {
11201         struct mgmt_cp_set_local_name ev;
11202         struct mgmt_pending_cmd *cmd;
11203
11204         if (status)
11205                 return;
11206
11207         memset(&ev, 0, sizeof(ev));
11208         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
11209         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
11210
11211         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
11212         if (!cmd) {
11213                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
11214
11215                 /* If this is a HCI command related to powering on the
11216                  * HCI dev don't send any mgmt signals.
11217                  */
11218                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
11219                         return;
11220         }
11221
11222         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
11223                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
11224         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
11225 }
11226
11227 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
11228 {
11229         int i;
11230
11231         for (i = 0; i < uuid_count; i++) {
11232                 if (!memcmp(uuid, uuids[i], 16))
11233                         return true;
11234         }
11235
11236         return false;
11237 }
11238
11239 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
11240 {
11241         u16 parsed = 0;
11242
11243         while (parsed < eir_len) {
11244                 u8 field_len = eir[0];
11245                 u8 uuid[16];
11246                 int i;
11247
11248                 if (field_len == 0)
11249                         break;
11250
11251                 if (eir_len - parsed < field_len + 1)
11252                         break;
11253
11254                 switch (eir[1]) {
11255                 case EIR_UUID16_ALL:
11256                 case EIR_UUID16_SOME:
11257                         for (i = 0; i + 3 <= field_len; i += 2) {
11258                                 memcpy(uuid, bluetooth_base_uuid, 16);
11259                                 uuid[13] = eir[i + 3];
11260                                 uuid[12] = eir[i + 2];
11261                                 if (has_uuid(uuid, uuid_count, uuids))
11262                                         return true;
11263                         }
11264                         break;
11265                 case EIR_UUID32_ALL:
11266                 case EIR_UUID32_SOME:
11267                         for (i = 0; i + 5 <= field_len; i += 4) {
11268                                 memcpy(uuid, bluetooth_base_uuid, 16);
11269                                 uuid[15] = eir[i + 5];
11270                                 uuid[14] = eir[i + 4];
11271                                 uuid[13] = eir[i + 3];
11272                                 uuid[12] = eir[i + 2];
11273                                 if (has_uuid(uuid, uuid_count, uuids))
11274                                         return true;
11275                         }
11276                         break;
11277                 case EIR_UUID128_ALL:
11278                 case EIR_UUID128_SOME:
11279                         for (i = 0; i + 17 <= field_len; i += 16) {
11280                                 memcpy(uuid, eir + i + 2, 16);
11281                                 if (has_uuid(uuid, uuid_count, uuids))
11282                                         return true;
11283                         }
11284                         break;
11285                 }
11286
11287                 parsed += field_len + 1;
11288                 eir += field_len + 1;
11289         }
11290
11291         return false;
11292 }
11293
11294 static void restart_le_scan(struct hci_dev *hdev)
11295 {
11296         /* If controller is not scanning we are done. */
11297         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
11298                 return;
11299
11300         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
11301                        hdev->discovery.scan_start +
11302                        hdev->discovery.scan_duration))
11303                 return;
11304
11305         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
11306                            DISCOV_LE_RESTART_DELAY);
11307 }
11308
11309 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
11310                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
11311 {
11312         /* If a RSSI threshold has been specified, and
11313          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
11314          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
11315          * is set, let it through for further processing, as we might need to
11316          * restart the scan.
11317          *
11318          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
11319          * the results are also dropped.
11320          */
11321         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11322             (rssi == HCI_RSSI_INVALID ||
11323             (rssi < hdev->discovery.rssi &&
11324              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
11325                 return  false;
11326
11327         if (hdev->discovery.uuid_count != 0) {
11328                 /* If a list of UUIDs is provided in filter, results with no
11329                  * matching UUID should be dropped.
11330                  */
11331                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
11332                                    hdev->discovery.uuids) &&
11333                     !eir_has_uuids(scan_rsp, scan_rsp_len,
11334                                    hdev->discovery.uuid_count,
11335                                    hdev->discovery.uuids))
11336                         return false;
11337         }
11338
11339         /* If duplicate filtering does not report RSSI changes, then restart
11340          * scanning to ensure updated result with updated RSSI values.
11341          */
11342         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
11343                 restart_le_scan(hdev);
11344
11345                 /* Validate RSSI value against the RSSI threshold once more. */
11346                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11347                     rssi < hdev->discovery.rssi)
11348                         return false;
11349         }
11350
11351         return true;
11352 }
11353
11354 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle,
11355                                   bdaddr_t *bdaddr, u8 addr_type)
11356 {
11357         struct mgmt_ev_adv_monitor_device_lost ev;
11358
11359         ev.monitor_handle = cpu_to_le16(handle);
11360         bacpy(&ev.addr.bdaddr, bdaddr);
11361         ev.addr.type = addr_type;
11362
11363         mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev),
11364                    NULL);
11365 }
11366
11367 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev,
11368                                                struct sk_buff *skb,
11369                                                struct sock *skip_sk,
11370                                                u16 handle)
11371 {
11372         struct sk_buff *advmon_skb;
11373         size_t advmon_skb_len;
11374         __le16 *monitor_handle;
11375
11376         if (!skb)
11377                 return;
11378
11379         advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) -
11380                           sizeof(struct mgmt_ev_device_found)) + skb->len;
11381         advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
11382                                     advmon_skb_len);
11383         if (!advmon_skb)
11384                 return;
11385
11386         /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except
11387          * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and
11388          * store monitor_handle of the matched monitor.
11389          */
11390         monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle));
11391         *monitor_handle = cpu_to_le16(handle);
11392         skb_put_data(advmon_skb, skb->data, skb->len);
11393
11394         mgmt_event_skb(advmon_skb, skip_sk);
11395 }
11396
11397 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev,
11398                                           bdaddr_t *bdaddr, bool report_device,
11399                                           struct sk_buff *skb,
11400                                           struct sock *skip_sk)
11401 {
11402         struct monitored_device *dev, *tmp;
11403         bool matched = false;
11404         bool notified = false;
11405
11406         /* We have received the Advertisement Report because:
11407          * 1. the kernel has initiated active discovery
11408          * 2. if not, we have pend_le_reports > 0 in which case we are doing
11409          *    passive scanning
11410          * 3. if none of the above is true, we have one or more active
11411          *    Advertisement Monitor
11412          *
11413          * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND
11414          * and report ONLY one advertisement per device for the matched Monitor
11415          * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
11416          *
11417          * For case 3, since we are not active scanning and all advertisements
11418          * received are due to a matched Advertisement Monitor, report all
11419          * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
11420          */
11421         if (report_device && !hdev->advmon_pend_notify) {
11422                 mgmt_event_skb(skb, skip_sk);
11423                 return;
11424         }
11425
11426         hdev->advmon_pend_notify = false;
11427
11428         list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) {
11429                 if (!bacmp(&dev->bdaddr, bdaddr)) {
11430                         matched = true;
11431
11432                         if (!dev->notified) {
11433                                 mgmt_send_adv_monitor_device_found(hdev, skb,
11434                                                                    skip_sk,
11435                                                                    dev->handle);
11436                                 notified = true;
11437                                 dev->notified = true;
11438                         }
11439                 }
11440
11441                 if (!dev->notified)
11442                         hdev->advmon_pend_notify = true;
11443         }
11444
11445         if (!report_device &&
11446             ((matched && !notified) || !msft_monitor_supported(hdev))) {
11447                 /* Handle 0 indicates that we are not active scanning and this
11448                  * is a subsequent advertisement report for an already matched
11449                  * Advertisement Monitor or the controller offloading support
11450                  * is not available.
11451                  */
11452                 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0);
11453         }
11454
11455         if (report_device)
11456                 mgmt_event_skb(skb, skip_sk);
11457         else
11458                 kfree_skb(skb);
11459 }
11460
11461 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr,
11462                               u8 addr_type, s8 rssi, u32 flags, u8 *eir,
11463                               u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
11464                               u64 instant)
11465 {
11466         struct sk_buff *skb;
11467         struct mgmt_ev_mesh_device_found *ev;
11468         int i, j;
11469
11470         if (!hdev->mesh_ad_types[0])
11471                 goto accepted;
11472
11473         /* Scan for requested AD types */
11474         if (eir_len > 0) {
11475                 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) {
11476                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
11477                                 if (!hdev->mesh_ad_types[j])
11478                                         break;
11479
11480                                 if (hdev->mesh_ad_types[j] == eir[i + 1])
11481                                         goto accepted;
11482                         }
11483                 }
11484         }
11485
11486         if (scan_rsp_len > 0) {
11487                 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) {
11488                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
11489                                 if (!hdev->mesh_ad_types[j])
11490                                         break;
11491
11492                                 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1])
11493                                         goto accepted;
11494                         }
11495                 }
11496         }
11497
11498         return;
11499
11500 accepted:
11501         skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND,
11502                              sizeof(*ev) + eir_len + scan_rsp_len);
11503         if (!skb)
11504                 return;
11505
11506         ev = skb_put(skb, sizeof(*ev));
11507
11508         bacpy(&ev->addr.bdaddr, bdaddr);
11509         ev->addr.type = link_to_bdaddr(LE_LINK, addr_type);
11510         ev->rssi = rssi;
11511         ev->flags = cpu_to_le32(flags);
11512         ev->instant = cpu_to_le64(instant);
11513
11514         if (eir_len > 0)
11515                 /* Copy EIR or advertising data into event */
11516                 skb_put_data(skb, eir, eir_len);
11517
11518         if (scan_rsp_len > 0)
11519                 /* Append scan response data to event */
11520                 skb_put_data(skb, scan_rsp, scan_rsp_len);
11521
11522         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
11523
11524         mgmt_event_skb(skb, NULL);
11525 }
11526
11527 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11528                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
11529                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
11530                        u64 instant)
11531 {
11532         struct sk_buff *skb;
11533         struct mgmt_ev_device_found *ev;
11534         bool report_device = hci_discovery_active(hdev);
11535
11536         if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK)
11537                 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags,
11538                                   eir, eir_len, scan_rsp, scan_rsp_len,
11539                                   instant);
11540
11541         /* Don't send events for a non-kernel initiated discovery. With
11542          * LE one exception is if we have pend_le_reports > 0 in which
11543          * case we're doing passive scanning and want these events.
11544          */
11545         if (!hci_discovery_active(hdev)) {
11546                 if (link_type == ACL_LINK)
11547                         return;
11548                 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports))
11549                         report_device = true;
11550                 else if (!hci_is_adv_monitoring(hdev))
11551                         return;
11552         }
11553
11554         if (hdev->discovery.result_filtering) {
11555                 /* We are using service discovery */
11556                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
11557                                      scan_rsp_len))
11558                         return;
11559         }
11560
11561         if (hdev->discovery.limited) {
11562                 /* Check for limited discoverable bit */
11563                 if (dev_class) {
11564                         if (!(dev_class[1] & 0x20))
11565                                 return;
11566                 } else {
11567                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
11568                         if (!flags || !(flags[0] & LE_AD_LIMITED))
11569                                 return;
11570                 }
11571         }
11572
11573         /* Allocate skb. The 5 extra bytes are for the potential CoD field */
11574         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
11575                              sizeof(*ev) + eir_len + scan_rsp_len + 5);
11576         if (!skb)
11577                 return;
11578
11579         ev = skb_put(skb, sizeof(*ev));
11580
11581         /* In case of device discovery with BR/EDR devices (pre 1.2), the
11582          * RSSI value was reported as 0 when not available. This behavior
11583          * is kept when using device discovery. This is required for full
11584          * backwards compatibility with the API.
11585          *
11586          * However when using service discovery, the value 127 will be
11587          * returned when the RSSI is not available.
11588          */
11589         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
11590             link_type == ACL_LINK)
11591                 rssi = 0;
11592
11593         bacpy(&ev->addr.bdaddr, bdaddr);
11594         ev->addr.type = link_to_bdaddr(link_type, addr_type);
11595         ev->rssi = rssi;
11596         ev->flags = cpu_to_le32(flags);
11597
11598         if (eir_len > 0)
11599                 /* Copy EIR or advertising data into event */
11600                 skb_put_data(skb, eir, eir_len);
11601
11602         if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) {
11603                 u8 eir_cod[5];
11604
11605                 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV,
11606                                            dev_class, 3);
11607                 skb_put_data(skb, eir_cod, sizeof(eir_cod));
11608         }
11609
11610         if (scan_rsp_len > 0)
11611                 /* Append scan response data to event */
11612                 skb_put_data(skb, scan_rsp, scan_rsp_len);
11613
11614         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
11615
11616         mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL);
11617 }
11618
11619 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11620                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
11621 {
11622         struct sk_buff *skb;
11623         struct mgmt_ev_device_found *ev;
11624         u16 eir_len = 0;
11625         u32 flags = 0;
11626
11627         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
11628                              sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));
11629
11630         ev = skb_put(skb, sizeof(*ev));
11631         bacpy(&ev->addr.bdaddr, bdaddr);
11632         ev->addr.type = link_to_bdaddr(link_type, addr_type);
11633         ev->rssi = rssi;
11634
11635         if (name)
11636                 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
11637         else
11638                 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
11639
11640         ev->eir_len = cpu_to_le16(eir_len);
11641         ev->flags = cpu_to_le32(flags);
11642
11643         mgmt_event_skb(skb, NULL);
11644 }
11645
11646 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
11647 {
11648         struct mgmt_ev_discovering ev;
11649
11650         bt_dev_dbg(hdev, "discovering %u", discovering);
11651
11652         memset(&ev, 0, sizeof(ev));
11653         ev.type = hdev->discovery.type;
11654         ev.discovering = discovering;
11655
11656         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
11657 }
11658
11659 void mgmt_suspending(struct hci_dev *hdev, u8 state)
11660 {
11661         struct mgmt_ev_controller_suspend ev;
11662
11663         ev.suspend_state = state;
11664         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
11665 }
11666
11667 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
11668                    u8 addr_type)
11669 {
11670         struct mgmt_ev_controller_resume ev;
11671
11672         ev.wake_reason = reason;
11673         if (bdaddr) {
11674                 bacpy(&ev.addr.bdaddr, bdaddr);
11675                 ev.addr.type = addr_type;
11676         } else {
11677                 memset(&ev.addr, 0, sizeof(ev.addr));
11678         }
11679
11680         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
11681 }
11682
11683 static struct hci_mgmt_chan chan = {
11684         .channel        = HCI_CHANNEL_CONTROL,
11685         .handler_count  = ARRAY_SIZE(mgmt_handlers),
11686         .handlers       = mgmt_handlers,
11687 #ifdef TIZEN_BT
11688         .tizen_handler_count    = ARRAY_SIZE(tizen_mgmt_handlers),
11689         .tizen_handlers = tizen_mgmt_handlers,
11690 #endif
11691         .hdev_init      = mgmt_init_hdev,
11692 };
11693
11694 int mgmt_init(void)
11695 {
11696         return hci_mgmt_chan_register(&chan);
11697 }
11698
11699 void mgmt_exit(void)
11700 {
11701         hci_mgmt_chan_unregister(&chan);
11702 }
11703
11704 void mgmt_cleanup(struct sock *sk)
11705 {
11706         struct mgmt_mesh_tx *mesh_tx;
11707         struct hci_dev *hdev;
11708
11709         read_lock(&hci_dev_list_lock);
11710
11711         list_for_each_entry(hdev, &hci_dev_list, list) {
11712                 do {
11713                         mesh_tx = mgmt_mesh_next(hdev, sk);
11714
11715                         if (mesh_tx)
11716                                 mesh_send_complete(hdev, mesh_tx, true);
11717                 } while (mesh_tx);
11718         }
11719
11720         read_unlock(&hci_dev_list_lock);
11721 }