net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #ifdef TIZEN_BT
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #include <net/bluetooth/sco.h>
  38 #endif
  39
  40 #include "hci_request.h"
  41 #include "smp.h"
  42 #include "mgmt_util.h"
  43 #include "mgmt_config.h"
  44 #include "msft.h"
  45
  46 #define MGMT_VERSION    1
  47 #define MGMT_REVISION   21
  48
  49 static const u16 mgmt_commands[] = {
  50         MGMT_OP_READ_INDEX_LIST,
  51         MGMT_OP_READ_INFO,
  52         MGMT_OP_SET_POWERED,
  53         MGMT_OP_SET_DISCOVERABLE,
  54         MGMT_OP_SET_CONNECTABLE,
  55         MGMT_OP_SET_FAST_CONNECTABLE,
  56         MGMT_OP_SET_BONDABLE,
  57         MGMT_OP_SET_LINK_SECURITY,
  58         MGMT_OP_SET_SSP,
  59         MGMT_OP_SET_HS,
  60         MGMT_OP_SET_LE,
  61         MGMT_OP_SET_DEV_CLASS,
  62         MGMT_OP_SET_LOCAL_NAME,
  63         MGMT_OP_ADD_UUID,
  64         MGMT_OP_REMOVE_UUID,
  65         MGMT_OP_LOAD_LINK_KEYS,
  66         MGMT_OP_LOAD_LONG_TERM_KEYS,
  67         MGMT_OP_DISCONNECT,
  68         MGMT_OP_GET_CONNECTIONS,
  69         MGMT_OP_PIN_CODE_REPLY,
  70         MGMT_OP_PIN_CODE_NEG_REPLY,
  71         MGMT_OP_SET_IO_CAPABILITY,
  72         MGMT_OP_PAIR_DEVICE,
  73         MGMT_OP_CANCEL_PAIR_DEVICE,
  74         MGMT_OP_UNPAIR_DEVICE,
  75         MGMT_OP_USER_CONFIRM_REPLY,
  76         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  77         MGMT_OP_USER_PASSKEY_REPLY,
  78         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  79         MGMT_OP_READ_LOCAL_OOB_DATA,
  80         MGMT_OP_ADD_REMOTE_OOB_DATA,
  81         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  82         MGMT_OP_START_DISCOVERY,
  83         MGMT_OP_STOP_DISCOVERY,
  84         MGMT_OP_CONFIRM_NAME,
  85         MGMT_OP_BLOCK_DEVICE,
  86         MGMT_OP_UNBLOCK_DEVICE,
  87         MGMT_OP_SET_DEVICE_ID,
  88         MGMT_OP_SET_ADVERTISING,
  89         MGMT_OP_SET_BREDR,
  90         MGMT_OP_SET_STATIC_ADDRESS,
  91         MGMT_OP_SET_SCAN_PARAMS,
  92         MGMT_OP_SET_SECURE_CONN,
  93         MGMT_OP_SET_DEBUG_KEYS,
  94         MGMT_OP_SET_PRIVACY,
  95         MGMT_OP_LOAD_IRKS,
  96         MGMT_OP_GET_CONN_INFO,
  97         MGMT_OP_GET_CLOCK_INFO,
  98         MGMT_OP_ADD_DEVICE,
  99         MGMT_OP_REMOVE_DEVICE,
 100         MGMT_OP_LOAD_CONN_PARAM,
 101         MGMT_OP_READ_UNCONF_INDEX_LIST,
 102         MGMT_OP_READ_CONFIG_INFO,
 103         MGMT_OP_SET_EXTERNAL_CONFIG,
 104         MGMT_OP_SET_PUBLIC_ADDRESS,
 105         MGMT_OP_START_SERVICE_DISCOVERY,
 106         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 107         MGMT_OP_READ_EXT_INDEX_LIST,
 108         MGMT_OP_READ_ADV_FEATURES,
 109         MGMT_OP_ADD_ADVERTISING,
 110         MGMT_OP_REMOVE_ADVERTISING,
 111         MGMT_OP_GET_ADV_SIZE_INFO,
 112         MGMT_OP_START_LIMITED_DISCOVERY,
 113         MGMT_OP_READ_EXT_INFO,
 114         MGMT_OP_SET_APPEARANCE,
 115         MGMT_OP_GET_PHY_CONFIGURATION,
 116         MGMT_OP_SET_PHY_CONFIGURATION,
 117         MGMT_OP_SET_BLOCKED_KEYS,
 118         MGMT_OP_SET_WIDEBAND_SPEECH,
 119         MGMT_OP_READ_CONTROLLER_CAP,
 120         MGMT_OP_READ_EXP_FEATURES_INFO,
 121         MGMT_OP_SET_EXP_FEATURE,
 122         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 123         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 124         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 125         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 126         MGMT_OP_GET_DEVICE_FLAGS,
 127         MGMT_OP_SET_DEVICE_FLAGS,
 128         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 129         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 130         MGMT_OP_REMOVE_ADV_MONITOR,
 131         MGMT_OP_ADD_EXT_ADV_PARAMS,
 132         MGMT_OP_ADD_EXT_ADV_DATA,
 133         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 134 };
 135
 136 static const u16 mgmt_events[] = {
 137         MGMT_EV_CONTROLLER_ERROR,
 138         MGMT_EV_INDEX_ADDED,
 139         MGMT_EV_INDEX_REMOVED,
 140         MGMT_EV_NEW_SETTINGS,
 141         MGMT_EV_CLASS_OF_DEV_CHANGED,
 142         MGMT_EV_LOCAL_NAME_CHANGED,
 143         MGMT_EV_NEW_LINK_KEY,
 144         MGMT_EV_NEW_LONG_TERM_KEY,
 145         MGMT_EV_DEVICE_CONNECTED,
 146         MGMT_EV_DEVICE_DISCONNECTED,
 147         MGMT_EV_CONNECT_FAILED,
 148         MGMT_EV_PIN_CODE_REQUEST,
 149         MGMT_EV_USER_CONFIRM_REQUEST,
 150         MGMT_EV_USER_PASSKEY_REQUEST,
 151         MGMT_EV_AUTH_FAILED,
 152         MGMT_EV_DEVICE_FOUND,
 153         MGMT_EV_DISCOVERING,
 154         MGMT_EV_DEVICE_BLOCKED,
 155         MGMT_EV_DEVICE_UNBLOCKED,
 156         MGMT_EV_DEVICE_UNPAIRED,
 157         MGMT_EV_PASSKEY_NOTIFY,
 158         MGMT_EV_NEW_IRK,
 159         MGMT_EV_NEW_CSRK,
 160         MGMT_EV_DEVICE_ADDED,
 161         MGMT_EV_DEVICE_REMOVED,
 162         MGMT_EV_NEW_CONN_PARAM,
 163         MGMT_EV_UNCONF_INDEX_ADDED,
 164         MGMT_EV_UNCONF_INDEX_REMOVED,
 165         MGMT_EV_NEW_CONFIG_OPTIONS,
 166         MGMT_EV_EXT_INDEX_ADDED,
 167         MGMT_EV_EXT_INDEX_REMOVED,
 168         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 169         MGMT_EV_ADVERTISING_ADDED,
 170         MGMT_EV_ADVERTISING_REMOVED,
 171         MGMT_EV_EXT_INFO_CHANGED,
 172         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 173         MGMT_EV_EXP_FEATURE_CHANGED,
 174         MGMT_EV_DEVICE_FLAGS_CHANGED,
 175         MGMT_EV_ADV_MONITOR_ADDED,
 176         MGMT_EV_ADV_MONITOR_REMOVED,
 177         MGMT_EV_CONTROLLER_SUSPEND,
 178         MGMT_EV_CONTROLLER_RESUME,
 179 };
 180
 181 static const u16 mgmt_untrusted_commands[] = {
 182         MGMT_OP_READ_INDEX_LIST,
 183         MGMT_OP_READ_INFO,
 184         MGMT_OP_READ_UNCONF_INDEX_LIST,
 185         MGMT_OP_READ_CONFIG_INFO,
 186         MGMT_OP_READ_EXT_INDEX_LIST,
 187         MGMT_OP_READ_EXT_INFO,
 188         MGMT_OP_READ_CONTROLLER_CAP,
 189         MGMT_OP_READ_EXP_FEATURES_INFO,
 190         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 191         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 192 };
 193
 194 static const u16 mgmt_untrusted_events[] = {
 195         MGMT_EV_INDEX_ADDED,
 196         MGMT_EV_INDEX_REMOVED,
 197         MGMT_EV_NEW_SETTINGS,
 198         MGMT_EV_CLASS_OF_DEV_CHANGED,
 199         MGMT_EV_LOCAL_NAME_CHANGED,
 200         MGMT_EV_UNCONF_INDEX_ADDED,
 201         MGMT_EV_UNCONF_INDEX_REMOVED,
 202         MGMT_EV_NEW_CONFIG_OPTIONS,
 203         MGMT_EV_EXT_INDEX_ADDED,
 204         MGMT_EV_EXT_INDEX_REMOVED,
 205         MGMT_EV_EXT_INFO_CHANGED,
 206         MGMT_EV_EXP_FEATURE_CHANGED,
 207 };
 208
 209 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 210
 211 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 212                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 213
 214 /* HCI to MGMT error code conversion table */
 215 static const u8 mgmt_status_table[] = {
 216         MGMT_STATUS_SUCCESS,
 217         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 218         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 219         MGMT_STATUS_FAILED,             /* Hardware Failure */
 220         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 221         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 222         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 223         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 224         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 225         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 226         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 227         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 228         MGMT_STATUS_BUSY,               /* Command Disallowed */
 229         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 230         MGMT_STATUS_REJECTED,           /* Rejected Security */
 231         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 232         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 233         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 234         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 235         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 236         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 237         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 238         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 239         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 240         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 241         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 242         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 243         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 244         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 245         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 246         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 247         MGMT_STATUS_FAILED,             /* Unspecified Error */
 248         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 249         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 250         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 251         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 252         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 253         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 254         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 255         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 256         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 257         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 258         MGMT_STATUS_FAILED,             /* Transaction Collision */
 259         MGMT_STATUS_FAILED,             /* Reserved for future use */
 260         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 261         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 262         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 263         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 264         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 265         MGMT_STATUS_FAILED,             /* Reserved for future use */
 266         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 267         MGMT_STATUS_FAILED,             /* Reserved for future use */
 268         MGMT_STATUS_FAILED,             /* Slot Violation */
 269         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 270         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 271         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 272         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 273         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 274         MGMT_STATUS_BUSY,               /* Controller Busy */
 275         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 276         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 277         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 278         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 279         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 280 };
 281
 282 static u8 mgmt_status(u8 hci_status)
 283 {
 284         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 285                 return mgmt_status_table[hci_status];
 286
 287         return MGMT_STATUS_FAILED;
 288 }
 289
 290 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 291                             u16 len, int flag)
 292 {
 293         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 294                                flag, NULL);
 295 }
 296
 297 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 298                               u16 len, int flag, struct sock *skip_sk)
 299 {
 300         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 301                                flag, skip_sk);
 302 }
 303
 304 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 305                       struct sock *skip_sk)
 306 {
 307         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 308                                HCI_SOCK_TRUSTED, skip_sk);
 309 }
 310
 311 static u8 le_addr_type(u8 mgmt_addr_type)
 312 {
 313         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 314                 return ADDR_LE_DEV_PUBLIC;
 315         else
 316                 return ADDR_LE_DEV_RANDOM;
 317 }
 318
 319 void mgmt_fill_version_info(void *ver)
 320 {
 321         struct mgmt_rp_read_version *rp = ver;
 322
 323         rp->version = MGMT_VERSION;
 324         rp->revision = cpu_to_le16(MGMT_REVISION);
 325 }
 326
 327 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 328                         u16 data_len)
 329 {
 330         struct mgmt_rp_read_version rp;
 331
 332         bt_dev_dbg(hdev, "sock %p", sk);
 333
 334         mgmt_fill_version_info(&rp);
 335
 336         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 337                                  &rp, sizeof(rp));
 338 }
 339
 340 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 341                          u16 data_len)
 342 {
 343         struct mgmt_rp_read_commands *rp;
 344         u16 num_commands, num_events;
 345         size_t rp_size;
 346         int i, err;
 347
 348         bt_dev_dbg(hdev, "sock %p", sk);
 349
 350         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 351                 num_commands = ARRAY_SIZE(mgmt_commands);
 352                 num_events = ARRAY_SIZE(mgmt_events);
 353         } else {
 354                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 355                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 356         }
 357
 358         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 359
 360         rp = kmalloc(rp_size, GFP_KERNEL);
 361         if (!rp)
 362                 return -ENOMEM;
 363
 364         rp->num_commands = cpu_to_le16(num_commands);
 365         rp->num_events = cpu_to_le16(num_events);
 366
 367         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 368                 __le16 *opcode = rp->opcodes;
 369
 370                 for (i = 0; i < num_commands; i++, opcode++)
 371                         put_unaligned_le16(mgmt_commands[i], opcode);
 372
 373                 for (i = 0; i < num_events; i++, opcode++)
 374                         put_unaligned_le16(mgmt_events[i], opcode);
 375         } else {
 376                 __le16 *opcode = rp->opcodes;
 377
 378                 for (i = 0; i < num_commands; i++, opcode++)
 379                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 380
 381                 for (i = 0; i < num_events; i++, opcode++)
 382                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 383         }
 384
 385         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 386                                 rp, rp_size);
 387         kfree(rp);
 388
 389         return err;
 390 }
 391
 392 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 393                            u16 data_len)
 394 {
 395         struct mgmt_rp_read_index_list *rp;
 396         struct hci_dev *d;
 397         size_t rp_len;
 398         u16 count;
 399         int err;
 400
 401         bt_dev_dbg(hdev, "sock %p", sk);
 402
 403         read_lock(&hci_dev_list_lock);
 404
 405         count = 0;
 406         list_for_each_entry(d, &hci_dev_list, list) {
 407                 if (d->dev_type == HCI_PRIMARY &&
 408                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 409                         count++;
 410         }
 411
 412         rp_len = sizeof(*rp) + (2 * count);
 413         rp = kmalloc(rp_len, GFP_ATOMIC);
 414         if (!rp) {
 415                 read_unlock(&hci_dev_list_lock);
 416                 return -ENOMEM;
 417         }
 418
 419         count = 0;
 420         list_for_each_entry(d, &hci_dev_list, list) {
 421                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 422                     hci_dev_test_flag(d, HCI_CONFIG) ||
 423                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 424                         continue;
 425
 426                 /* Devices marked as raw-only are neither configured
 427                  * nor unconfigured controllers.
 428                  */
 429                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 430                         continue;
 431
 432                 if (d->dev_type == HCI_PRIMARY &&
 433                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 434                         rp->index[count++] = cpu_to_le16(d->id);
 435                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 436                 }
 437         }
 438
 439         rp->num_controllers = cpu_to_le16(count);
 440         rp_len = sizeof(*rp) + (2 * count);
 441
 442         read_unlock(&hci_dev_list_lock);
 443
 444         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 445                                 0, rp, rp_len);
 446
 447         kfree(rp);
 448
 449         return err;
 450 }
 451
 452 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 453                                   void *data, u16 data_len)
 454 {
 455         struct mgmt_rp_read_unconf_index_list *rp;
 456         struct hci_dev *d;
 457         size_t rp_len;
 458         u16 count;
 459         int err;
 460
 461         bt_dev_dbg(hdev, "sock %p", sk);
 462
 463         read_lock(&hci_dev_list_lock);
 464
 465         count = 0;
 466         list_for_each_entry(d, &hci_dev_list, list) {
 467                 if (d->dev_type == HCI_PRIMARY &&
 468                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 469                         count++;
 470         }
 471
 472         rp_len = sizeof(*rp) + (2 * count);
 473         rp = kmalloc(rp_len, GFP_ATOMIC);
 474         if (!rp) {
 475                 read_unlock(&hci_dev_list_lock);
 476                 return -ENOMEM;
 477         }
 478
 479         count = 0;
 480         list_for_each_entry(d, &hci_dev_list, list) {
 481                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 482                     hci_dev_test_flag(d, HCI_CONFIG) ||
 483                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 484                         continue;
 485
 486                 /* Devices marked as raw-only are neither configured
 487                  * nor unconfigured controllers.
 488                  */
 489                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 490                         continue;
 491
 492                 if (d->dev_type == HCI_PRIMARY &&
 493                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 494                         rp->index[count++] = cpu_to_le16(d->id);
 495                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 496                 }
 497         }
 498
 499         rp->num_controllers = cpu_to_le16(count);
 500         rp_len = sizeof(*rp) + (2 * count);
 501
 502         read_unlock(&hci_dev_list_lock);
 503
 504         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 505                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 506
 507         kfree(rp);
 508
 509         return err;
 510 }
 511
 512 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 513                                void *data, u16 data_len)
 514 {
 515         struct mgmt_rp_read_ext_index_list *rp;
 516         struct hci_dev *d;
 517         u16 count;
 518         int err;
 519
 520         bt_dev_dbg(hdev, "sock %p", sk);
 521
 522         read_lock(&hci_dev_list_lock);
 523
 524         count = 0;
 525         list_for_each_entry(d, &hci_dev_list, list) {
 526                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 527                         count++;
 528         }
 529
 530         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 531         if (!rp) {
 532                 read_unlock(&hci_dev_list_lock);
 533                 return -ENOMEM;
 534         }
 535
 536         count = 0;
 537         list_for_each_entry(d, &hci_dev_list, list) {
 538                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 539                     hci_dev_test_flag(d, HCI_CONFIG) ||
 540                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 541                         continue;
 542
 543                 /* Devices marked as raw-only are neither configured
 544                  * nor unconfigured controllers.
 545                  */
 546                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 547                         continue;
 548
 549                 if (d->dev_type == HCI_PRIMARY) {
 550                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 551                                 rp->entry[count].type = 0x01;
 552                         else
 553                                 rp->entry[count].type = 0x00;
 554                 } else if (d->dev_type == HCI_AMP) {
 555                         rp->entry[count].type = 0x02;
 556                 } else {
 557                         continue;
 558                 }
 559
 560                 rp->entry[count].bus = d->bus;
 561                 rp->entry[count++].index = cpu_to_le16(d->id);
 562                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 563         }
 564
 565         rp->num_controllers = cpu_to_le16(count);
 566
 567         read_unlock(&hci_dev_list_lock);
 568
 569         /* If this command is called at least once, then all the
 570          * default index and unconfigured index events are disabled
 571          * and from now on only extended index events are used.
 572          */
 573         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 574         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 575         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 576
 577         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 578                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 579                                 struct_size(rp, entry, count));
 580
 581         kfree(rp);
 582
 583         return err;
 584 }
 585
 586 static bool is_configured(struct hci_dev *hdev)
 587 {
 588         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 589             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 590                 return false;
 591
 592         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 593              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 594             !bacmp(&hdev->public_addr, BDADDR_ANY))
 595                 return false;
 596
 597         return true;
 598 }
 599
 600 static __le32 get_missing_options(struct hci_dev *hdev)
 601 {
 602         u32 options = 0;
 603
 604         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 605             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 606                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 607
 608         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 609              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 610             !bacmp(&hdev->public_addr, BDADDR_ANY))
 611                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 612
 613         return cpu_to_le32(options);
 614 }
 615
 616 static int new_options(struct hci_dev *hdev, struct sock *skip)
 617 {
 618         __le32 options = get_missing_options(hdev);
 619
 620         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 621                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 622 }
 623
 624 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 625 {
 626         __le32 options = get_missing_options(hdev);
 627
 628         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 629                                  sizeof(options));
 630 }
 631
 632 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 633                             void *data, u16 data_len)
 634 {
 635         struct mgmt_rp_read_config_info rp;
 636         u32 options = 0;
 637
 638         bt_dev_dbg(hdev, "sock %p", sk);
 639
 640         hci_dev_lock(hdev);
 641
 642         memset(&rp, 0, sizeof(rp));
 643         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 644
 645         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 646                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 647
 648         if (hdev->set_bdaddr)
 649                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 650
 651         rp.supported_options = cpu_to_le32(options);
 652         rp.missing_options = get_missing_options(hdev);
 653
 654         hci_dev_unlock(hdev);
 655
 656         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 657                                  &rp, sizeof(rp));
 658 }
 659
 660 static u32 get_supported_phys(struct hci_dev *hdev)
 661 {
 662         u32 supported_phys = 0;
 663
 664         if (lmp_bredr_capable(hdev)) {
 665                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 666
 667                 if (hdev->features[0][0] & LMP_3SLOT)
 668                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 669
 670                 if (hdev->features[0][0] & LMP_5SLOT)
 671                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 672
 673                 if (lmp_edr_2m_capable(hdev)) {
 674                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 675
 676                         if (lmp_edr_3slot_capable(hdev))
 677                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 678
 679                         if (lmp_edr_5slot_capable(hdev))
 680                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 681
 682                         if (lmp_edr_3m_capable(hdev)) {
 683                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 684
 685                                 if (lmp_edr_3slot_capable(hdev))
 686                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 687
 688                                 if (lmp_edr_5slot_capable(hdev))
 689                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 690                         }
 691                 }
 692         }
 693
 694         if (lmp_le_capable(hdev)) {
 695                 supported_phys |= MGMT_PHY_LE_1M_TX;
 696                 supported_phys |= MGMT_PHY_LE_1M_RX;
 697
 698                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 699                         supported_phys |= MGMT_PHY_LE_2M_TX;
 700                         supported_phys |= MGMT_PHY_LE_2M_RX;
 701                 }
 702
 703                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 704                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 705                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 706                 }
 707         }
 708
 709         return supported_phys;
 710 }
 711
 712 static u32 get_selected_phys(struct hci_dev *hdev)
 713 {
 714         u32 selected_phys = 0;
 715
 716         if (lmp_bredr_capable(hdev)) {
 717                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 718
 719                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 720                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 721
 722                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 723                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 724
 725                 if (lmp_edr_2m_capable(hdev)) {
 726                         if (!(hdev->pkt_type & HCI_2DH1))
 727                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 728
 729                         if (lmp_edr_3slot_capable(hdev) &&
 730                             !(hdev->pkt_type & HCI_2DH3))
 731                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 732
 733                         if (lmp_edr_5slot_capable(hdev) &&
 734                             !(hdev->pkt_type & HCI_2DH5))
 735                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 736
 737                         if (lmp_edr_3m_capable(hdev)) {
 738                                 if (!(hdev->pkt_type & HCI_3DH1))
 739                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 740
 741                                 if (lmp_edr_3slot_capable(hdev) &&
 742                                     !(hdev->pkt_type & HCI_3DH3))
 743                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 744
 745                                 if (lmp_edr_5slot_capable(hdev) &&
 746                                     !(hdev->pkt_type & HCI_3DH5))
 747                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 748                         }
 749                 }
 750         }
 751
 752         if (lmp_le_capable(hdev)) {
 753                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 754                         selected_phys |= MGMT_PHY_LE_1M_TX;
 755
 756                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 757                         selected_phys |= MGMT_PHY_LE_1M_RX;
 758
 759                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 760                         selected_phys |= MGMT_PHY_LE_2M_TX;
 761
 762                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 763                         selected_phys |= MGMT_PHY_LE_2M_RX;
 764
 765                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 766                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 767
 768                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 769                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 770         }
 771
 772         return selected_phys;
 773 }
 774
 775 static u32 get_configurable_phys(struct hci_dev *hdev)
 776 {
 777         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 778                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 779 }
 780
 781 static u32 get_supported_settings(struct hci_dev *hdev)
 782 {
 783         u32 settings = 0;
 784
 785         settings |= MGMT_SETTING_POWERED;
 786         settings |= MGMT_SETTING_BONDABLE;
 787         settings |= MGMT_SETTING_DEBUG_KEYS;
 788         settings |= MGMT_SETTING_CONNECTABLE;
 789         settings |= MGMT_SETTING_DISCOVERABLE;
 790
 791         if (lmp_bredr_capable(hdev)) {
 792                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 793                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 794                 settings |= MGMT_SETTING_BREDR;
 795                 settings |= MGMT_SETTING_LINK_SECURITY;
 796
 797                 if (lmp_ssp_capable(hdev)) {
 798                         settings |= MGMT_SETTING_SSP;
 799                         if (IS_ENABLED(CONFIG_BT_HS))
 800                                 settings |= MGMT_SETTING_HS;
 801                 }
 802
 803                 if (lmp_sc_capable(hdev))
 804                         settings |= MGMT_SETTING_SECURE_CONN;
 805
 806                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 807                              &hdev->quirks))
 808                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 809         }
 810
 811         if (lmp_le_capable(hdev)) {
 812                 settings |= MGMT_SETTING_LE;
 813                 settings |= MGMT_SETTING_SECURE_CONN;
 814                 settings |= MGMT_SETTING_PRIVACY;
 815                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 816
 817                 /* When the experimental feature for LL Privacy support is
 818                  * enabled, then advertising is no longer supported.
 819                  */
 820                 if (!hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
 821                         settings |= MGMT_SETTING_ADVERTISING;
 822         }
 823
 824         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 825             hdev->set_bdaddr)
 826                 settings |= MGMT_SETTING_CONFIGURATION;
 827
 828         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 829
 830         return settings;
 831 }
 832
 833 static u32 get_current_settings(struct hci_dev *hdev)
 834 {
 835         u32 settings = 0;
 836
 837         if (hdev_is_powered(hdev))
 838                 settings |= MGMT_SETTING_POWERED;
 839
 840         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 841                 settings |= MGMT_SETTING_CONNECTABLE;
 842
 843         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 844                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 845
 846         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 847                 settings |= MGMT_SETTING_DISCOVERABLE;
 848
 849         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 850                 settings |= MGMT_SETTING_BONDABLE;
 851
 852         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 853                 settings |= MGMT_SETTING_BREDR;
 854
 855         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 856                 settings |= MGMT_SETTING_LE;
 857
 858         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 859                 settings |= MGMT_SETTING_LINK_SECURITY;
 860
 861         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 862                 settings |= MGMT_SETTING_SSP;
 863
 864         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 865                 settings |= MGMT_SETTING_HS;
 866
 867         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 868                 settings |= MGMT_SETTING_ADVERTISING;
 869
 870         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 871                 settings |= MGMT_SETTING_SECURE_CONN;
 872
 873         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 874                 settings |= MGMT_SETTING_DEBUG_KEYS;
 875
 876         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 877                 settings |= MGMT_SETTING_PRIVACY;
 878
 879         /* The current setting for static address has two purposes. The
 880          * first is to indicate if the static address will be used and
 881          * the second is to indicate if it is actually set.
 882          *
 883          * This means if the static address is not configured, this flag
 884          * will never be set. If the address is configured, then if the
 885          * address is actually used decides if the flag is set or not.
 886          *
 887          * For single mode LE only controllers and dual-mode controllers
 888          * with BR/EDR disabled, the existence of the static address will
 889          * be evaluated.
 890          */
 891         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 892             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 893             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 894                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 895                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 896         }
 897
 898         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 899                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 900
 901         return settings;
 902 }
 903
 904 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 905 {
 906         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 907 }
 908
 909 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 910                                                   struct hci_dev *hdev,
 911                                                   const void *data)
 912 {
 913         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 914 }
 915
 916 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 917 {
 918         struct mgmt_pending_cmd *cmd;
 919
 920         /* If there's a pending mgmt command the flags will not yet have
 921          * their final values, so check for this first.
 922          */
 923         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 924         if (cmd) {
 925                 struct mgmt_mode *cp = cmd->param;
 926                 if (cp->val == 0x01)
 927                         return LE_AD_GENERAL;
 928                 else if (cp->val == 0x02)
 929                         return LE_AD_LIMITED;
 930         } else {
 931                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 932                         return LE_AD_LIMITED;
 933                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 934                         return LE_AD_GENERAL;
 935         }
 936
 937         return 0;
 938 }
 939
 940 bool mgmt_get_connectable(struct hci_dev *hdev)
 941 {
 942         struct mgmt_pending_cmd *cmd;
 943
 944         /* If there's a pending mgmt command the flag will not yet have
 945          * it's final value, so check for this first.
 946          */
 947         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 948         if (cmd) {
 949                 struct mgmt_mode *cp = cmd->param;
 950
 951                 return cp->val;
 952         }
 953
 954         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 955 }
 956
 957 static void service_cache_off(struct work_struct *work)
 958 {
 959         struct hci_dev *hdev = container_of(work, struct hci_dev,
 960                                             service_cache.work);
 961         struct hci_request req;
 962
 963         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 964                 return;
 965
 966         hci_req_init(&req, hdev);
 967
 968         hci_dev_lock(hdev);
 969
 970         __hci_req_update_eir(&req);
 971         __hci_req_update_class(&req);
 972
 973         hci_dev_unlock(hdev);
 974
 975         hci_req_run(&req, NULL);
 976 }
 977
 978 static void rpa_expired(struct work_struct *work)
 979 {
 980         struct hci_dev *hdev = container_of(work, struct hci_dev,
 981                                             rpa_expired.work);
 982         struct hci_request req;
 983
 984         bt_dev_dbg(hdev, "");
 985
 986         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 987
 988         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 989                 return;
 990
 991         /* The generation of a new RPA and programming it into the
 992          * controller happens in the hci_req_enable_advertising()
 993          * function.
 994          */
 995         hci_req_init(&req, hdev);
 996         if (ext_adv_capable(hdev))
 997                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 998         else
 999                 __hci_req_enable_advertising(&req);
1000         hci_req_run(&req, NULL);
1001 }
1002
1003 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1004 {
1005         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1006                 return;
1007
1008         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1009         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1010
1011         /* Non-mgmt controlled devices get this bit set
1012          * implicitly so that pairing works for them, however
1013          * for mgmt we require user-space to explicitly enable
1014          * it
1015          */
1016         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1017 }
1018
1019 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1020                                 void *data, u16 data_len)
1021 {
1022         struct mgmt_rp_read_info rp;
1023
1024         bt_dev_dbg(hdev, "sock %p", sk);
1025
1026         hci_dev_lock(hdev);
1027
1028         memset(&rp, 0, sizeof(rp));
1029
1030         bacpy(&rp.bdaddr, &hdev->bdaddr);
1031
1032         rp.version = hdev->hci_ver;
1033         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1034
1035         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1036         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1037
1038         memcpy(rp.dev_class, hdev->dev_class, 3);
1039
1040         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1041         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1042
1043         hci_dev_unlock(hdev);
1044
1045         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1046                                  sizeof(rp));
1047 }
1048
1049 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1050 {
1051         u16 eir_len = 0;
1052         size_t name_len;
1053
1054         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1055                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1056                                           hdev->dev_class, 3);
1057
1058         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1059                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1060                                           hdev->appearance);
1061
1062         name_len = strlen(hdev->dev_name);
1063         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1064                                   hdev->dev_name, name_len);
1065
1066         name_len = strlen(hdev->short_name);
1067         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1068                                   hdev->short_name, name_len);
1069
1070         return eir_len;
1071 }
1072
1073 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1074                                     void *data, u16 data_len)
1075 {
1076         char buf[512];
1077         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1078         u16 eir_len;
1079
1080         bt_dev_dbg(hdev, "sock %p", sk);
1081
1082         memset(&buf, 0, sizeof(buf));
1083
1084         hci_dev_lock(hdev);
1085
1086         bacpy(&rp->bdaddr, &hdev->bdaddr);
1087
1088         rp->version = hdev->hci_ver;
1089         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1090
1091         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1092         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1093
1094
1095         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1096         rp->eir_len = cpu_to_le16(eir_len);
1097
1098         hci_dev_unlock(hdev);
1099
1100         /* If this command is called at least once, then the events
1101          * for class of device and local name changes are disabled
1102          * and only the new extended controller information event
1103          * is used.
1104          */
1105         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1106         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1107         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1108
1109         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1110                                  sizeof(*rp) + eir_len);
1111 }
1112
1113 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1114 {
1115         char buf[512];
1116         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1117         u16 eir_len;
1118
1119         memset(buf, 0, sizeof(buf));
1120
1121         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1122         ev->eir_len = cpu_to_le16(eir_len);
1123
1124         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1125                                   sizeof(*ev) + eir_len,
1126                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1127 }
1128
1129 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1130 {
1131         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1132
1133         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1134                                  sizeof(settings));
1135 }
1136
1137 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1138 {
1139         bt_dev_dbg(hdev, "status 0x%02x", status);
1140
1141         if (hci_conn_count(hdev) == 0) {
1142                 cancel_delayed_work(&hdev->power_off);
1143                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1144         }
1145 }
1146
1147 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1148 {
1149         struct mgmt_ev_advertising_added ev;
1150
1151         ev.instance = instance;
1152
1153         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1154 }
1155
1156 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1157                               u8 instance)
1158 {
1159         struct mgmt_ev_advertising_removed ev;
1160
1161         ev.instance = instance;
1162
1163         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1164 }
1165
1166 static void cancel_adv_timeout(struct hci_dev *hdev)
1167 {
1168         if (hdev->adv_instance_timeout) {
1169                 hdev->adv_instance_timeout = 0;
1170                 cancel_delayed_work(&hdev->adv_instance_expire);
1171         }
1172 }
1173
1174 static int clean_up_hci_state(struct hci_dev *hdev)
1175 {
1176         struct hci_request req;
1177         struct hci_conn *conn;
1178         bool discov_stopped;
1179         int err;
1180
1181         hci_req_init(&req, hdev);
1182
1183         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1184             test_bit(HCI_PSCAN, &hdev->flags)) {
1185                 u8 scan = 0x00;
1186                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1187         }
1188
1189         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1190
1191         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1192                 __hci_req_disable_advertising(&req);
1193
1194         discov_stopped = hci_req_stop_discovery(&req);
1195
1196         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1197                 /* 0x15 == Terminated due to Power Off */
1198                 __hci_abort_conn(&req, conn, 0x15);
1199         }
1200
1201         err = hci_req_run(&req, clean_up_hci_complete);
1202         if (!err && discov_stopped)
1203                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1204
1205         return err;
1206 }
1207
1208 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1209                        u16 len)
1210 {
1211         struct mgmt_mode *cp = data;
1212         struct mgmt_pending_cmd *cmd;
1213         int err;
1214
1215         bt_dev_dbg(hdev, "sock %p", sk);
1216
1217         if (cp->val != 0x00 && cp->val != 0x01)
1218                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1219                                        MGMT_STATUS_INVALID_PARAMS);
1220
1221         hci_dev_lock(hdev);
1222
1223         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1224                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1225                                       MGMT_STATUS_BUSY);
1226                 goto failed;
1227         }
1228
1229         if (!!cp->val == hdev_is_powered(hdev)) {
1230                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1231                 goto failed;
1232         }
1233
1234         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1235         if (!cmd) {
1236                 err = -ENOMEM;
1237                 goto failed;
1238         }
1239
1240         if (cp->val) {
1241                 queue_work(hdev->req_workqueue, &hdev->power_on);
1242                 err = 0;
1243         } else {
1244                 /* Disconnect connections, stop scans, etc */
1245                 err = clean_up_hci_state(hdev);
1246                 if (!err)
1247                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1248                                            HCI_POWER_OFF_TIMEOUT);
1249
1250                 /* ENODATA means there were no HCI commands queued */
1251                 if (err == -ENODATA) {
1252                         cancel_delayed_work(&hdev->power_off);
1253                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1254                         err = 0;
1255                 }
1256         }
1257
1258 failed:
1259         hci_dev_unlock(hdev);
1260         return err;
1261 }
1262
1263 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1264 {
1265         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1266
1267         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1268                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1269 }
1270
1271 int mgmt_new_settings(struct hci_dev *hdev)
1272 {
1273         return new_settings(hdev, NULL);
1274 }
1275
1276 struct cmd_lookup {
1277         struct sock *sk;
1278         struct hci_dev *hdev;
1279         u8 mgmt_status;
1280 };
1281
1282 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1283 {
1284         struct cmd_lookup *match = data;
1285
1286         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1287
1288         list_del(&cmd->list);
1289
1290         if (match->sk == NULL) {
1291                 match->sk = cmd->sk;
1292                 sock_hold(match->sk);
1293         }
1294
1295         mgmt_pending_free(cmd);
1296 }
1297
1298 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1299 {
1300         u8 *status = data;
1301
1302         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1303         mgmt_pending_remove(cmd);
1304 }
1305
1306 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1307 {
1308         if (cmd->cmd_complete) {
1309                 u8 *status = data;
1310
1311                 cmd->cmd_complete(cmd, *status);
1312                 mgmt_pending_remove(cmd);
1313
1314                 return;
1315         }
1316
1317         cmd_status_rsp(cmd, data);
1318 }
1319
1320 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1321 {
1322         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1323                                  cmd->param, cmd->param_len);
1324 }
1325
1326 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1327 {
1328         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1329                                  cmd->param, sizeof(struct mgmt_addr_info));
1330 }
1331
1332 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1333 {
1334         if (!lmp_bredr_capable(hdev))
1335                 return MGMT_STATUS_NOT_SUPPORTED;
1336         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1337                 return MGMT_STATUS_REJECTED;
1338         else
1339                 return MGMT_STATUS_SUCCESS;
1340 }
1341
1342 static u8 mgmt_le_support(struct hci_dev *hdev)
1343 {
1344         if (!lmp_le_capable(hdev))
1345                 return MGMT_STATUS_NOT_SUPPORTED;
1346         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1347                 return MGMT_STATUS_REJECTED;
1348         else
1349                 return MGMT_STATUS_SUCCESS;
1350 }
1351
1352 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1353 {
1354         struct mgmt_pending_cmd *cmd;
1355
1356         bt_dev_dbg(hdev, "status 0x%02x", status);
1357
1358         hci_dev_lock(hdev);
1359
1360         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1361         if (!cmd)
1362                 goto unlock;
1363
1364         if (status) {
1365                 u8 mgmt_err = mgmt_status(status);
1366                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1367                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1368                 goto remove_cmd;
1369         }
1370
1371         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1372             hdev->discov_timeout > 0) {
1373                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1374                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1375         }
1376
1377         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1378         new_settings(hdev, cmd->sk);
1379
1380 remove_cmd:
1381         mgmt_pending_remove(cmd);
1382
1383 unlock:
1384         hci_dev_unlock(hdev);
1385 }
1386
1387 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1388                             u16 len)
1389 {
1390         struct mgmt_cp_set_discoverable *cp = data;
1391         struct mgmt_pending_cmd *cmd;
1392         u16 timeout;
1393         int err;
1394
1395         bt_dev_dbg(hdev, "sock %p", sk);
1396
1397         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1398             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1399                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1400                                        MGMT_STATUS_REJECTED);
1401
1402         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1403                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1404                                        MGMT_STATUS_INVALID_PARAMS);
1405
1406         timeout = __le16_to_cpu(cp->timeout);
1407
1408         /* Disabling discoverable requires that no timeout is set,
1409          * and enabling limited discoverable requires a timeout.
1410          */
1411         if ((cp->val == 0x00 && timeout > 0) ||
1412             (cp->val == 0x02 && timeout == 0))
1413                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1414                                        MGMT_STATUS_INVALID_PARAMS);
1415
1416         hci_dev_lock(hdev);
1417
1418         if (!hdev_is_powered(hdev) && timeout > 0) {
1419                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1420                                       MGMT_STATUS_NOT_POWERED);
1421                 goto failed;
1422         }
1423
1424         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1425             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1426                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1427                                       MGMT_STATUS_BUSY);
1428                 goto failed;
1429         }
1430
1431         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1432                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1433                                       MGMT_STATUS_REJECTED);
1434                 goto failed;
1435         }
1436
1437         if (hdev->advertising_paused) {
1438                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1439                                       MGMT_STATUS_BUSY);
1440                 goto failed;
1441         }
1442
1443         if (!hdev_is_powered(hdev)) {
1444                 bool changed = false;
1445
1446                 /* Setting limited discoverable when powered off is
1447                  * not a valid operation since it requires a timeout
1448                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1449                  */
1450                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1451                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1452                         changed = true;
1453                 }
1454
1455                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1456                 if (err < 0)
1457                         goto failed;
1458
1459                 if (changed)
1460                         err = new_settings(hdev, sk);
1461
1462                 goto failed;
1463         }
1464
1465         /* If the current mode is the same, then just update the timeout
1466          * value with the new value. And if only the timeout gets updated,
1467          * then no need for any HCI transactions.
1468          */
1469         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1470             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1471                                                    HCI_LIMITED_DISCOVERABLE)) {
1472                 cancel_delayed_work(&hdev->discov_off);
1473                 hdev->discov_timeout = timeout;
1474
1475                 if (cp->val && hdev->discov_timeout > 0) {
1476                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1477                         queue_delayed_work(hdev->req_workqueue,
1478                                            &hdev->discov_off, to);
1479                 }
1480
1481                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1482                 goto failed;
1483         }
1484
1485         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1486         if (!cmd) {
1487                 err = -ENOMEM;
1488                 goto failed;
1489         }
1490
1491         /* Cancel any potential discoverable timeout that might be
1492          * still active and store new timeout value. The arming of
1493          * the timeout happens in the complete handler.
1494          */
1495         cancel_delayed_work(&hdev->discov_off);
1496         hdev->discov_timeout = timeout;
1497
1498         if (cp->val)
1499                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1500         else
1501                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1502
1503         /* Limited discoverable mode */
1504         if (cp->val == 0x02)
1505                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1506         else
1507                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1508
1509         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1510         err = 0;
1511
1512 failed:
1513         hci_dev_unlock(hdev);
1514         return err;
1515 }
1516
1517 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1518 {
1519         struct mgmt_pending_cmd *cmd;
1520
1521         bt_dev_dbg(hdev, "status 0x%02x", status);
1522
1523         hci_dev_lock(hdev);
1524
1525         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1526         if (!cmd)
1527                 goto unlock;
1528
1529         if (status) {
1530                 u8 mgmt_err = mgmt_status(status);
1531                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1532                 goto remove_cmd;
1533         }
1534
1535         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1536         new_settings(hdev, cmd->sk);
1537
1538 remove_cmd:
1539         mgmt_pending_remove(cmd);
1540
1541 unlock:
1542         hci_dev_unlock(hdev);
1543 }
1544
1545 static int set_connectable_update_settings(struct hci_dev *hdev,
1546                                            struct sock *sk, u8 val)
1547 {
1548         bool changed = false;
1549         int err;
1550
1551         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1552                 changed = true;
1553
1554         if (val) {
1555                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1556         } else {
1557                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1558                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1559         }
1560
1561         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1562         if (err < 0)
1563                 return err;
1564
1565         if (changed) {
1566                 hci_req_update_scan(hdev);
1567                 hci_update_background_scan(hdev);
1568                 return new_settings(hdev, sk);
1569         }
1570
1571         return 0;
1572 }
1573
1574 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1575                            u16 len)
1576 {
1577         struct mgmt_mode *cp = data;
1578         struct mgmt_pending_cmd *cmd;
1579         int err;
1580
1581         bt_dev_dbg(hdev, "sock %p", sk);
1582
1583         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1584             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1585                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1586                                        MGMT_STATUS_REJECTED);
1587
1588         if (cp->val != 0x00 && cp->val != 0x01)
1589                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1590                                        MGMT_STATUS_INVALID_PARAMS);
1591
1592         hci_dev_lock(hdev);
1593
1594         if (!hdev_is_powered(hdev)) {
1595                 err = set_connectable_update_settings(hdev, sk, cp->val);
1596                 goto failed;
1597         }
1598
1599         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1600             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1601                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1602                                       MGMT_STATUS_BUSY);
1603                 goto failed;
1604         }
1605
1606         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1607         if (!cmd) {
1608                 err = -ENOMEM;
1609                 goto failed;
1610         }
1611
1612         if (cp->val) {
1613                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1614         } else {
1615                 if (hdev->discov_timeout > 0)
1616                         cancel_delayed_work(&hdev->discov_off);
1617
1618                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1619                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1620                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1621         }
1622
1623         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1624         err = 0;
1625
1626 failed:
1627         hci_dev_unlock(hdev);
1628         return err;
1629 }
1630
1631 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1632                         u16 len)
1633 {
1634         struct mgmt_mode *cp = data;
1635         bool changed;
1636         int err;
1637
1638         bt_dev_dbg(hdev, "sock %p", sk);
1639
1640         if (cp->val != 0x00 && cp->val != 0x01)
1641                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1642                                        MGMT_STATUS_INVALID_PARAMS);
1643
1644         hci_dev_lock(hdev);
1645
1646         if (cp->val)
1647                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1648         else
1649                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1650
1651         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1652         if (err < 0)
1653                 goto unlock;
1654
1655         if (changed) {
1656                 /* In limited privacy mode the change of bondable mode
1657                  * may affect the local advertising address.
1658                  */
1659                 if (hdev_is_powered(hdev) &&
1660                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1661                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1662                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1663                         queue_work(hdev->req_workqueue,
1664                                    &hdev->discoverable_update);
1665
1666                 err = new_settings(hdev, sk);
1667         }
1668
1669 unlock:
1670         hci_dev_unlock(hdev);
1671         return err;
1672 }
1673
1674 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1675                              u16 len)
1676 {
1677         struct mgmt_mode *cp = data;
1678         struct mgmt_pending_cmd *cmd;
1679         u8 val, status;
1680         int err;
1681
1682         bt_dev_dbg(hdev, "sock %p", sk);
1683
1684         status = mgmt_bredr_support(hdev);
1685         if (status)
1686                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1687                                        status);
1688
1689         if (cp->val != 0x00 && cp->val != 0x01)
1690                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1691                                        MGMT_STATUS_INVALID_PARAMS);
1692
1693         hci_dev_lock(hdev);
1694
1695         if (!hdev_is_powered(hdev)) {
1696                 bool changed = false;
1697
1698                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1699                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1700                         changed = true;
1701                 }
1702
1703                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1704                 if (err < 0)
1705                         goto failed;
1706
1707                 if (changed)
1708                         err = new_settings(hdev, sk);
1709
1710                 goto failed;
1711         }
1712
1713         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1714                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1715                                       MGMT_STATUS_BUSY);
1716                 goto failed;
1717         }
1718
1719         val = !!cp->val;
1720
1721         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1722                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1723                 goto failed;
1724         }
1725
1726         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1727         if (!cmd) {
1728                 err = -ENOMEM;
1729                 goto failed;
1730         }
1731
1732         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1733         if (err < 0) {
1734                 mgmt_pending_remove(cmd);
1735                 goto failed;
1736         }
1737
1738 failed:
1739         hci_dev_unlock(hdev);
1740         return err;
1741 }
1742
1743 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1744 {
1745         struct mgmt_mode *cp = data;
1746         struct mgmt_pending_cmd *cmd;
1747         u8 status;
1748         int err;
1749
1750         bt_dev_dbg(hdev, "sock %p", sk);
1751
1752         status = mgmt_bredr_support(hdev);
1753         if (status)
1754                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1755
1756         if (!lmp_ssp_capable(hdev))
1757                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1758                                        MGMT_STATUS_NOT_SUPPORTED);
1759
1760         if (cp->val != 0x00 && cp->val != 0x01)
1761                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1762                                        MGMT_STATUS_INVALID_PARAMS);
1763
1764         hci_dev_lock(hdev);
1765
1766         if (!hdev_is_powered(hdev)) {
1767                 bool changed;
1768
1769                 if (cp->val) {
1770                         changed = !hci_dev_test_and_set_flag(hdev,
1771                                                              HCI_SSP_ENABLED);
1772                 } else {
1773                         changed = hci_dev_test_and_clear_flag(hdev,
1774                                                               HCI_SSP_ENABLED);
1775                         if (!changed)
1776                                 changed = hci_dev_test_and_clear_flag(hdev,
1777                                                                       HCI_HS_ENABLED);
1778                         else
1779                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1780                 }
1781
1782                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1783                 if (err < 0)
1784                         goto failed;
1785
1786                 if (changed)
1787                         err = new_settings(hdev, sk);
1788
1789                 goto failed;
1790         }
1791
1792         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1793                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1794                                       MGMT_STATUS_BUSY);
1795                 goto failed;
1796         }
1797
1798         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1799                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1800                 goto failed;
1801         }
1802
1803         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1804         if (!cmd) {
1805                 err = -ENOMEM;
1806                 goto failed;
1807         }
1808
1809         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1810                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1811                              sizeof(cp->val), &cp->val);
1812
1813         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1814         if (err < 0) {
1815                 mgmt_pending_remove(cmd);
1816                 goto failed;
1817         }
1818
1819 failed:
1820         hci_dev_unlock(hdev);
1821         return err;
1822 }
1823
1824 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1825 {
1826         struct mgmt_mode *cp = data;
1827         bool changed;
1828         u8 status;
1829         int err;
1830
1831         bt_dev_dbg(hdev, "sock %p", sk);
1832
1833         if (!IS_ENABLED(CONFIG_BT_HS))
1834                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1835                                        MGMT_STATUS_NOT_SUPPORTED);
1836
1837         status = mgmt_bredr_support(hdev);
1838         if (status)
1839                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1840
1841         if (!lmp_ssp_capable(hdev))
1842                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1843                                        MGMT_STATUS_NOT_SUPPORTED);
1844
1845         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1846                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1847                                        MGMT_STATUS_REJECTED);
1848
1849         if (cp->val != 0x00 && cp->val != 0x01)
1850                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1851                                        MGMT_STATUS_INVALID_PARAMS);
1852
1853         hci_dev_lock(hdev);
1854
1855         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1856                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1857                                       MGMT_STATUS_BUSY);
1858                 goto unlock;
1859         }
1860
1861         if (cp->val) {
1862                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1863         } else {
1864                 if (hdev_is_powered(hdev)) {
1865                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1866                                               MGMT_STATUS_REJECTED);
1867                         goto unlock;
1868                 }
1869
1870                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1871         }
1872
1873         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1874         if (err < 0)
1875                 goto unlock;
1876
1877         if (changed)
1878                 err = new_settings(hdev, sk);
1879
1880 unlock:
1881         hci_dev_unlock(hdev);
1882         return err;
1883 }
1884
1885 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1886 {
1887         struct cmd_lookup match = { NULL, hdev };
1888
1889         hci_dev_lock(hdev);
1890
1891         if (status) {
1892                 u8 mgmt_err = mgmt_status(status);
1893
1894                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1895                                      &mgmt_err);
1896                 goto unlock;
1897         }
1898
1899         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1900
1901         new_settings(hdev, match.sk);
1902
1903         if (match.sk)
1904                 sock_put(match.sk);
1905
1906         /* Make sure the controller has a good default for
1907          * advertising data. Restrict the update to when LE
1908          * has actually been enabled. During power on, the
1909          * update in powered_update_hci will take care of it.
1910          */
1911         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1912                 struct hci_request req;
1913                 hci_req_init(&req, hdev);
1914                 if (ext_adv_capable(hdev)) {
1915                         int err;
1916
1917                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1918                         if (!err)
1919                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1920                 } else {
1921                         __hci_req_update_adv_data(&req, 0x00);
1922                         __hci_req_update_scan_rsp_data(&req, 0x00);
1923                 }
1924                 hci_req_run(&req, NULL);
1925                 hci_update_background_scan(hdev);
1926         }
1927
1928 unlock:
1929         hci_dev_unlock(hdev);
1930 }
1931
1932 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1933 {
1934         struct mgmt_mode *cp = data;
1935         struct hci_cp_write_le_host_supported hci_cp;
1936         struct mgmt_pending_cmd *cmd;
1937         struct hci_request req;
1938         int err;
1939         u8 val, enabled;
1940
1941         bt_dev_dbg(hdev, "sock %p", sk);
1942
1943         if (!lmp_le_capable(hdev))
1944                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1945                                        MGMT_STATUS_NOT_SUPPORTED);
1946
1947         if (cp->val != 0x00 && cp->val != 0x01)
1948                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1949                                        MGMT_STATUS_INVALID_PARAMS);
1950
1951         /* Bluetooth single mode LE only controllers or dual-mode
1952          * controllers configured as LE only devices, do not allow
1953          * switching LE off. These have either LE enabled explicitly
1954          * or BR/EDR has been previously switched off.
1955          *
1956          * When trying to enable an already enabled LE, then gracefully
1957          * send a positive response. Trying to disable it however will
1958          * result into rejection.
1959          */
1960         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1961                 if (cp->val == 0x01)
1962                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1963
1964                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1965                                        MGMT_STATUS_REJECTED);
1966         }
1967
1968         hci_dev_lock(hdev);
1969
1970         val = !!cp->val;
1971         enabled = lmp_host_le_capable(hdev);
1972
1973         if (!val)
1974                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1975
1976         if (!hdev_is_powered(hdev) || val == enabled) {
1977                 bool changed = false;
1978
1979                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1980                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1981                         changed = true;
1982                 }
1983
1984                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1985                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1986                         changed = true;
1987                 }
1988
1989                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1990                 if (err < 0)
1991                         goto unlock;
1992
1993                 if (changed)
1994                         err = new_settings(hdev, sk);
1995
1996                 goto unlock;
1997         }
1998
1999         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2000             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2001                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2002                                       MGMT_STATUS_BUSY);
2003                 goto unlock;
2004         }
2005
2006         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2007         if (!cmd) {
2008                 err = -ENOMEM;
2009                 goto unlock;
2010         }
2011
2012         hci_req_init(&req, hdev);
2013
2014         memset(&hci_cp, 0, sizeof(hci_cp));
2015
2016         if (val) {
2017                 hci_cp.le = val;
2018                 hci_cp.simul = 0x00;
2019         } else {
2020                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2021                         __hci_req_disable_advertising(&req);
2022
2023                 if (ext_adv_capable(hdev))
2024                         __hci_req_clear_ext_adv_sets(&req);
2025         }
2026
2027         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2028                     &hci_cp);
2029
2030         err = hci_req_run(&req, le_enable_complete);
2031         if (err < 0)
2032                 mgmt_pending_remove(cmd);
2033
2034 unlock:
2035         hci_dev_unlock(hdev);
2036         return err;
2037 }
2038
2039 /* This is a helper function to test for pending mgmt commands that can
2040  * cause CoD or EIR HCI commands. We can only allow one such pending
2041  * mgmt command at a time since otherwise we cannot easily track what
2042  * the current values are, will be, and based on that calculate if a new
2043  * HCI command needs to be sent and if yes with what value.
2044  */
2045 static bool pending_eir_or_class(struct hci_dev *hdev)
2046 {
2047         struct mgmt_pending_cmd *cmd;
2048
2049         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2050                 switch (cmd->opcode) {
2051                 case MGMT_OP_ADD_UUID:
2052                 case MGMT_OP_REMOVE_UUID:
2053                 case MGMT_OP_SET_DEV_CLASS:
2054                 case MGMT_OP_SET_POWERED:
2055                         return true;
2056                 }
2057         }
2058
2059         return false;
2060 }
2061
2062 static const u8 bluetooth_base_uuid[] = {
2063                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2064                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2065 };
2066
2067 static u8 get_uuid_size(const u8 *uuid)
2068 {
2069         u32 val;
2070
2071         if (memcmp(uuid, bluetooth_base_uuid, 12))
2072                 return 128;
2073
2074         val = get_unaligned_le32(&uuid[12]);
2075         if (val > 0xffff)
2076                 return 32;
2077
2078         return 16;
2079 }
2080
2081 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2082 {
2083         struct mgmt_pending_cmd *cmd;
2084
2085         hci_dev_lock(hdev);
2086
2087         cmd = pending_find(mgmt_op, hdev);
2088         if (!cmd)
2089                 goto unlock;
2090
2091         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2092                           mgmt_status(status), hdev->dev_class, 3);
2093
2094         mgmt_pending_remove(cmd);
2095
2096 unlock:
2097         hci_dev_unlock(hdev);
2098 }
2099
2100 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2101 {
2102         bt_dev_dbg(hdev, "status 0x%02x", status);
2103
2104         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2105 }
2106
2107 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2108 {
2109         struct mgmt_cp_add_uuid *cp = data;
2110         struct mgmt_pending_cmd *cmd;
2111         struct hci_request req;
2112         struct bt_uuid *uuid;
2113         int err;
2114
2115         bt_dev_dbg(hdev, "sock %p", sk);
2116
2117         hci_dev_lock(hdev);
2118
2119         if (pending_eir_or_class(hdev)) {
2120                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2121                                       MGMT_STATUS_BUSY);
2122                 goto failed;
2123         }
2124
2125         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2126         if (!uuid) {
2127                 err = -ENOMEM;
2128                 goto failed;
2129         }
2130
2131         memcpy(uuid->uuid, cp->uuid, 16);
2132         uuid->svc_hint = cp->svc_hint;
2133         uuid->size = get_uuid_size(cp->uuid);
2134
2135         list_add_tail(&uuid->list, &hdev->uuids);
2136
2137         hci_req_init(&req, hdev);
2138
2139         __hci_req_update_class(&req);
2140         __hci_req_update_eir(&req);
2141
2142         err = hci_req_run(&req, add_uuid_complete);
2143         if (err < 0) {
2144                 if (err != -ENODATA)
2145                         goto failed;
2146
2147                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2148                                         hdev->dev_class, 3);
2149                 goto failed;
2150         }
2151
2152         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2153         if (!cmd) {
2154                 err = -ENOMEM;
2155                 goto failed;
2156         }
2157
2158         err = 0;
2159
2160 failed:
2161         hci_dev_unlock(hdev);
2162         return err;
2163 }
2164
2165 static bool enable_service_cache(struct hci_dev *hdev)
2166 {
2167         if (!hdev_is_powered(hdev))
2168                 return false;
2169
2170         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2171                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2172                                    CACHE_TIMEOUT);
2173                 return true;
2174         }
2175
2176         return false;
2177 }
2178
2179 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2180 {
2181         bt_dev_dbg(hdev, "status 0x%02x", status);
2182
2183         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2184 }
2185
2186 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2187                        u16 len)
2188 {
2189         struct mgmt_cp_remove_uuid *cp = data;
2190         struct mgmt_pending_cmd *cmd;
2191         struct bt_uuid *match, *tmp;
2192         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2193         struct hci_request req;
2194         int err, found;
2195
2196         bt_dev_dbg(hdev, "sock %p", sk);
2197
2198         hci_dev_lock(hdev);
2199
2200         if (pending_eir_or_class(hdev)) {
2201                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2202                                       MGMT_STATUS_BUSY);
2203                 goto unlock;
2204         }
2205
2206         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2207                 hci_uuids_clear(hdev);
2208
2209                 if (enable_service_cache(hdev)) {
2210                         err = mgmt_cmd_complete(sk, hdev->id,
2211                                                 MGMT_OP_REMOVE_UUID,
2212                                                 0, hdev->dev_class, 3);
2213                         goto unlock;
2214                 }
2215
2216                 goto update_class;
2217         }
2218
2219         found = 0;
2220
2221         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2222                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2223                         continue;
2224
2225                 list_del(&match->list);
2226                 kfree(match);
2227                 found++;
2228         }
2229
2230         if (found == 0) {
2231                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2232                                       MGMT_STATUS_INVALID_PARAMS);
2233                 goto unlock;
2234         }
2235
2236 update_class:
2237         hci_req_init(&req, hdev);
2238
2239         __hci_req_update_class(&req);
2240         __hci_req_update_eir(&req);
2241
2242         err = hci_req_run(&req, remove_uuid_complete);
2243         if (err < 0) {
2244                 if (err != -ENODATA)
2245                         goto unlock;
2246
2247                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2248                                         hdev->dev_class, 3);
2249                 goto unlock;
2250         }
2251
2252         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2253         if (!cmd) {
2254                 err = -ENOMEM;
2255                 goto unlock;
2256         }
2257
2258         err = 0;
2259
2260 unlock:
2261         hci_dev_unlock(hdev);
2262         return err;
2263 }
2264
2265 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2266 {
2267         bt_dev_dbg(hdev, "status 0x%02x", status);
2268
2269         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2270 }
2271
2272 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2273                          u16 len)
2274 {
2275         struct mgmt_cp_set_dev_class *cp = data;
2276         struct mgmt_pending_cmd *cmd;
2277         struct hci_request req;
2278         int err;
2279
2280         bt_dev_dbg(hdev, "sock %p", sk);
2281
2282         if (!lmp_bredr_capable(hdev))
2283                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2284                                        MGMT_STATUS_NOT_SUPPORTED);
2285
2286         hci_dev_lock(hdev);
2287
2288         if (pending_eir_or_class(hdev)) {
2289                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2290                                       MGMT_STATUS_BUSY);
2291                 goto unlock;
2292         }
2293
2294         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2295                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2296                                       MGMT_STATUS_INVALID_PARAMS);
2297                 goto unlock;
2298         }
2299
2300         hdev->major_class = cp->major;
2301         hdev->minor_class = cp->minor;
2302
2303         if (!hdev_is_powered(hdev)) {
2304                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2305                                         hdev->dev_class, 3);
2306                 goto unlock;
2307         }
2308
2309         hci_req_init(&req, hdev);
2310
2311         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2312                 hci_dev_unlock(hdev);
2313                 cancel_delayed_work_sync(&hdev->service_cache);
2314                 hci_dev_lock(hdev);
2315                 __hci_req_update_eir(&req);
2316         }
2317
2318         __hci_req_update_class(&req);
2319
2320         err = hci_req_run(&req, set_class_complete);
2321         if (err < 0) {
2322                 if (err != -ENODATA)
2323                         goto unlock;
2324
2325                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2326                                         hdev->dev_class, 3);
2327                 goto unlock;
2328         }
2329
2330         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2331         if (!cmd) {
2332                 err = -ENOMEM;
2333                 goto unlock;
2334         }
2335
2336         err = 0;
2337
2338 unlock:
2339         hci_dev_unlock(hdev);
2340         return err;
2341 }
2342
2343 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2344                           u16 len)
2345 {
2346         struct mgmt_cp_load_link_keys *cp = data;
2347         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2348                                    sizeof(struct mgmt_link_key_info));
2349         u16 key_count, expected_len;
2350         bool changed;
2351         int i;
2352
2353         bt_dev_dbg(hdev, "sock %p", sk);
2354
2355         if (!lmp_bredr_capable(hdev))
2356                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2357                                        MGMT_STATUS_NOT_SUPPORTED);
2358
2359         key_count = __le16_to_cpu(cp->key_count);
2360         if (key_count > max_key_count) {
2361                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2362                            key_count);
2363                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2364                                        MGMT_STATUS_INVALID_PARAMS);
2365         }
2366
2367         expected_len = struct_size(cp, keys, key_count);
2368         if (expected_len != len) {
2369                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2370                            expected_len, len);
2371                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2372                                        MGMT_STATUS_INVALID_PARAMS);
2373         }
2374
2375         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2376                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2377                                        MGMT_STATUS_INVALID_PARAMS);
2378
2379         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2380                    key_count);
2381
2382         for (i = 0; i < key_count; i++) {
2383                 struct mgmt_link_key_info *key = &cp->keys[i];
2384
2385                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2386                         return mgmt_cmd_status(sk, hdev->id,
2387                                                MGMT_OP_LOAD_LINK_KEYS,
2388                                                MGMT_STATUS_INVALID_PARAMS);
2389         }
2390
2391         hci_dev_lock(hdev);
2392
2393         hci_link_keys_clear(hdev);
2394
2395         if (cp->debug_keys)
2396                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2397         else
2398                 changed = hci_dev_test_and_clear_flag(hdev,
2399                                                       HCI_KEEP_DEBUG_KEYS);
2400
2401         if (changed)
2402                 new_settings(hdev, NULL);
2403
2404         for (i = 0; i < key_count; i++) {
2405                 struct mgmt_link_key_info *key = &cp->keys[i];
2406
2407                 if (hci_is_blocked_key(hdev,
2408                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2409                                        key->val)) {
2410                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2411                                     &key->addr.bdaddr);
2412                         continue;
2413                 }
2414
2415                 /* Always ignore debug keys and require a new pairing if
2416                  * the user wants to use them.
2417                  */
2418                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2419                         continue;
2420
2421                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2422                                  key->type, key->pin_len, NULL);
2423         }
2424
2425         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2426
2427         hci_dev_unlock(hdev);
2428
2429         return 0;
2430 }
2431
2432 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2433                            u8 addr_type, struct sock *skip_sk)
2434 {
2435         struct mgmt_ev_device_unpaired ev;
2436
2437         bacpy(&ev.addr.bdaddr, bdaddr);
2438         ev.addr.type = addr_type;
2439
2440         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2441                           skip_sk);
2442 }
2443
2444 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2445                          u16 len)
2446 {
2447         struct mgmt_cp_unpair_device *cp = data;
2448         struct mgmt_rp_unpair_device rp;
2449         struct hci_conn_params *params;
2450         struct mgmt_pending_cmd *cmd;
2451         struct hci_conn *conn;
2452         u8 addr_type;
2453         int err;
2454
2455         memset(&rp, 0, sizeof(rp));
2456         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2457         rp.addr.type = cp->addr.type;
2458
2459         if (!bdaddr_type_is_valid(cp->addr.type))
2460                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2461                                          MGMT_STATUS_INVALID_PARAMS,
2462                                          &rp, sizeof(rp));
2463
2464         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2465                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2466                                          MGMT_STATUS_INVALID_PARAMS,
2467                                          &rp, sizeof(rp));
2468
2469         hci_dev_lock(hdev);
2470
2471         if (!hdev_is_powered(hdev)) {
2472                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2473                                         MGMT_STATUS_NOT_POWERED, &rp,
2474                                         sizeof(rp));
2475                 goto unlock;
2476         }
2477
2478         if (cp->addr.type == BDADDR_BREDR) {
2479                 /* If disconnection is requested, then look up the
2480                  * connection. If the remote device is connected, it
2481                  * will be later used to terminate the link.
2482                  *
2483                  * Setting it to NULL explicitly will cause no
2484                  * termination of the link.
2485                  */
2486                 if (cp->disconnect)
2487                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2488                                                        &cp->addr.bdaddr);
2489                 else
2490                         conn = NULL;
2491
2492                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2493                 if (err < 0) {
2494                         err = mgmt_cmd_complete(sk, hdev->id,
2495                                                 MGMT_OP_UNPAIR_DEVICE,
2496                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2497                                                 sizeof(rp));
2498                         goto unlock;
2499                 }
2500
2501                 goto done;
2502         }
2503
2504         /* LE address type */
2505         addr_type = le_addr_type(cp->addr.type);
2506
2507         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2508         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2509         if (err < 0) {
2510                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2511                                         MGMT_STATUS_NOT_PAIRED, &rp,
2512                                         sizeof(rp));
2513                 goto unlock;
2514         }
2515
2516         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2517         if (!conn) {
2518                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2519                 goto done;
2520         }
2521
2522
2523         /* Defer clearing up the connection parameters until closing to
2524          * give a chance of keeping them if a repairing happens.
2525          */
2526         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2527
2528         /* Disable auto-connection parameters if present */
2529         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2530         if (params) {
2531                 if (params->explicit_connect)
2532                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2533                 else
2534                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2535         }
2536
2537         /* If disconnection is not requested, then clear the connection
2538          * variable so that the link is not terminated.
2539          */
2540         if (!cp->disconnect)
2541                 conn = NULL;
2542
2543 done:
2544         /* If the connection variable is set, then termination of the
2545          * link is requested.
2546          */
2547         if (!conn) {
2548                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2549                                         &rp, sizeof(rp));
2550                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2551                 goto unlock;
2552         }
2553
2554         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2555                                sizeof(*cp));
2556         if (!cmd) {
2557                 err = -ENOMEM;
2558                 goto unlock;
2559         }
2560
2561         cmd->cmd_complete = addr_cmd_complete;
2562
2563         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2564         if (err < 0)
2565                 mgmt_pending_remove(cmd);
2566
2567 unlock:
2568         hci_dev_unlock(hdev);
2569         return err;
2570 }
2571
2572 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2573                       u16 len)
2574 {
2575         struct mgmt_cp_disconnect *cp = data;
2576         struct mgmt_rp_disconnect rp;
2577         struct mgmt_pending_cmd *cmd;
2578         struct hci_conn *conn;
2579         int err;
2580
2581         bt_dev_dbg(hdev, "sock %p", sk);
2582
2583         memset(&rp, 0, sizeof(rp));
2584         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2585         rp.addr.type = cp->addr.type;
2586
2587         if (!bdaddr_type_is_valid(cp->addr.type))
2588                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2589                                          MGMT_STATUS_INVALID_PARAMS,
2590                                          &rp, sizeof(rp));
2591
2592         hci_dev_lock(hdev);
2593
2594         if (!test_bit(HCI_UP, &hdev->flags)) {
2595                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2596                                         MGMT_STATUS_NOT_POWERED, &rp,
2597                                         sizeof(rp));
2598                 goto failed;
2599         }
2600
2601         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2602                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2603                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2604                 goto failed;
2605         }
2606
2607         if (cp->addr.type == BDADDR_BREDR)
2608                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2609                                                &cp->addr.bdaddr);
2610         else
2611                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2612                                                le_addr_type(cp->addr.type));
2613
2614         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2615                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2616                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2617                                         sizeof(rp));
2618                 goto failed;
2619         }
2620
2621         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2622         if (!cmd) {
2623                 err = -ENOMEM;
2624                 goto failed;
2625         }
2626
2627         cmd->cmd_complete = generic_cmd_complete;
2628
2629         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2630         if (err < 0)
2631                 mgmt_pending_remove(cmd);
2632
2633 failed:
2634         hci_dev_unlock(hdev);
2635         return err;
2636 }
2637
2638 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2639 {
2640         switch (link_type) {
2641         case LE_LINK:
2642                 switch (addr_type) {
2643                 case ADDR_LE_DEV_PUBLIC:
2644                         return BDADDR_LE_PUBLIC;
2645
2646                 default:
2647                         /* Fallback to LE Random address type */
2648                         return BDADDR_LE_RANDOM;
2649                 }
2650
2651         default:
2652                 /* Fallback to BR/EDR type */
2653                 return BDADDR_BREDR;
2654         }
2655 }
2656
2657 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2658                            u16 data_len)
2659 {
2660         struct mgmt_rp_get_connections *rp;
2661         struct hci_conn *c;
2662         int err;
2663         u16 i;
2664
2665         bt_dev_dbg(hdev, "sock %p", sk);
2666
2667         hci_dev_lock(hdev);
2668
2669         if (!hdev_is_powered(hdev)) {
2670                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2671                                       MGMT_STATUS_NOT_POWERED);
2672                 goto unlock;
2673         }
2674
2675         i = 0;
2676         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2677                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2678                         i++;
2679         }
2680
2681         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2682         if (!rp) {
2683                 err = -ENOMEM;
2684                 goto unlock;
2685         }
2686
2687         i = 0;
2688         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2689                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2690                         continue;
2691                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2692                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2693                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2694                         continue;
2695                 i++;
2696         }
2697
2698         rp->conn_count = cpu_to_le16(i);
2699
2700         /* Recalculate length in case of filtered SCO connections, etc */
2701         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2702                                 struct_size(rp, addr, i));
2703
2704         kfree(rp);
2705
2706 unlock:
2707         hci_dev_unlock(hdev);
2708         return err;
2709 }
2710
2711 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2712                                    struct mgmt_cp_pin_code_neg_reply *cp)
2713 {
2714         struct mgmt_pending_cmd *cmd;
2715         int err;
2716
2717         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2718                                sizeof(*cp));
2719         if (!cmd)
2720                 return -ENOMEM;
2721
2722         cmd->cmd_complete = addr_cmd_complete;
2723
2724         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2725                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2726         if (err < 0)
2727                 mgmt_pending_remove(cmd);
2728
2729         return err;
2730 }
2731
2732 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2733                           u16 len)
2734 {
2735         struct hci_conn *conn;
2736         struct mgmt_cp_pin_code_reply *cp = data;
2737         struct hci_cp_pin_code_reply reply;
2738         struct mgmt_pending_cmd *cmd;
2739         int err;
2740
2741         bt_dev_dbg(hdev, "sock %p", sk);
2742
2743         hci_dev_lock(hdev);
2744
2745         if (!hdev_is_powered(hdev)) {
2746                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2747                                       MGMT_STATUS_NOT_POWERED);
2748                 goto failed;
2749         }
2750
2751         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2752         if (!conn) {
2753                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2754                                       MGMT_STATUS_NOT_CONNECTED);
2755                 goto failed;
2756         }
2757
2758         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2759                 struct mgmt_cp_pin_code_neg_reply ncp;
2760
2761                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2762
2763                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2764
2765                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2766                 if (err >= 0)
2767                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2768                                               MGMT_STATUS_INVALID_PARAMS);
2769
2770                 goto failed;
2771         }
2772
2773         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2774         if (!cmd) {
2775                 err = -ENOMEM;
2776                 goto failed;
2777         }
2778
2779         cmd->cmd_complete = addr_cmd_complete;
2780
2781         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2782         reply.pin_len = cp->pin_len;
2783         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2784
2785         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2786         if (err < 0)
2787                 mgmt_pending_remove(cmd);
2788
2789 failed:
2790         hci_dev_unlock(hdev);
2791         return err;
2792 }
2793
2794 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2795                              u16 len)
2796 {
2797         struct mgmt_cp_set_io_capability *cp = data;
2798
2799         bt_dev_dbg(hdev, "sock %p", sk);
2800
2801         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2802                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2803                                        MGMT_STATUS_INVALID_PARAMS);
2804
2805         hci_dev_lock(hdev);
2806
2807         hdev->io_capability = cp->io_capability;
2808
2809         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
2810
2811         hci_dev_unlock(hdev);
2812
2813         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2814                                  NULL, 0);
2815 }
2816
2817 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2818 {
2819         struct hci_dev *hdev = conn->hdev;
2820         struct mgmt_pending_cmd *cmd;
2821
2822         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2823                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2824                         continue;
2825
2826                 if (cmd->user_data != conn)
2827                         continue;
2828
2829                 return cmd;
2830         }
2831
2832         return NULL;
2833 }
2834
2835 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2836 {
2837         struct mgmt_rp_pair_device rp;
2838         struct hci_conn *conn = cmd->user_data;
2839         int err;
2840
2841         bacpy(&rp.addr.bdaddr, &conn->dst);
2842         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2843
2844         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2845                                 status, &rp, sizeof(rp));
2846
2847         /* So we don't get further callbacks for this connection */
2848         conn->connect_cfm_cb = NULL;
2849         conn->security_cfm_cb = NULL;
2850         conn->disconn_cfm_cb = NULL;
2851
2852         hci_conn_drop(conn);
2853
2854         /* The device is paired so there is no need to remove
2855          * its connection parameters anymore.
2856          */
2857         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2858
2859         hci_conn_put(conn);
2860
2861         return err;
2862 }
2863
2864 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2865 {
2866         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2867         struct mgmt_pending_cmd *cmd;
2868
2869         cmd = find_pairing(conn);
2870         if (cmd) {
2871                 cmd->cmd_complete(cmd, status);
2872                 mgmt_pending_remove(cmd);
2873         }
2874 }
2875
2876 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2877 {
2878         struct mgmt_pending_cmd *cmd;
2879
2880         BT_DBG("status %u", status);
2881
2882         cmd = find_pairing(conn);
2883         if (!cmd) {
2884                 BT_DBG("Unable to find a pending command");
2885                 return;
2886         }
2887
2888         cmd->cmd_complete(cmd, mgmt_status(status));
2889         mgmt_pending_remove(cmd);
2890 }
2891
2892 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2893 {
2894         struct mgmt_pending_cmd *cmd;
2895
2896         BT_DBG("status %u", status);
2897
2898         if (!status)
2899                 return;
2900
2901         cmd = find_pairing(conn);
2902         if (!cmd) {
2903                 BT_DBG("Unable to find a pending command");
2904                 return;
2905         }
2906
2907         cmd->cmd_complete(cmd, mgmt_status(status));
2908         mgmt_pending_remove(cmd);
2909 }
2910
2911 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2912                        u16 len)
2913 {
2914         struct mgmt_cp_pair_device *cp = data;
2915         struct mgmt_rp_pair_device rp;
2916         struct mgmt_pending_cmd *cmd;
2917         u8 sec_level, auth_type;
2918         struct hci_conn *conn;
2919         int err;
2920
2921         bt_dev_dbg(hdev, "sock %p", sk);
2922
2923         memset(&rp, 0, sizeof(rp));
2924         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2925         rp.addr.type = cp->addr.type;
2926
2927         if (!bdaddr_type_is_valid(cp->addr.type))
2928                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2929                                          MGMT_STATUS_INVALID_PARAMS,
2930                                          &rp, sizeof(rp));
2931
2932         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2933                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2934                                          MGMT_STATUS_INVALID_PARAMS,
2935                                          &rp, sizeof(rp));
2936
2937         hci_dev_lock(hdev);
2938
2939         if (!hdev_is_powered(hdev)) {
2940                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2941                                         MGMT_STATUS_NOT_POWERED, &rp,
2942                                         sizeof(rp));
2943                 goto unlock;
2944         }
2945
2946         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2947                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2948                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2949                                         sizeof(rp));
2950                 goto unlock;
2951         }
2952
2953         sec_level = BT_SECURITY_MEDIUM;
2954         auth_type = HCI_AT_DEDICATED_BONDING;
2955
2956         if (cp->addr.type == BDADDR_BREDR) {
2957                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2958                                        auth_type, CONN_REASON_PAIR_DEVICE);
2959         } else {
2960                 u8 addr_type = le_addr_type(cp->addr.type);
2961                 struct hci_conn_params *p;
2962
2963                 /* When pairing a new device, it is expected to remember
2964                  * this device for future connections. Adding the connection
2965                  * parameter information ahead of time allows tracking
2966                  * of the peripheral preferred values and will speed up any
2967                  * further connection establishment.
2968                  *
2969                  * If connection parameters already exist, then they
2970                  * will be kept and this function does nothing.
2971                  */
2972                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2973
2974                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2975                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2976
2977                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
2978                                            sec_level, HCI_LE_CONN_TIMEOUT,
2979                                            CONN_REASON_PAIR_DEVICE);
2980         }
2981
2982         if (IS_ERR(conn)) {
2983                 int status;
2984
2985                 if (PTR_ERR(conn) == -EBUSY)
2986                         status = MGMT_STATUS_BUSY;
2987                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2988                         status = MGMT_STATUS_NOT_SUPPORTED;
2989                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2990                         status = MGMT_STATUS_REJECTED;
2991                 else
2992                         status = MGMT_STATUS_CONNECT_FAILED;
2993
2994                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2995                                         status, &rp, sizeof(rp));
2996                 goto unlock;
2997         }
2998
2999         if (conn->connect_cfm_cb) {
3000                 hci_conn_drop(conn);
3001                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3002                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3003                 goto unlock;
3004         }
3005
3006         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3007         if (!cmd) {
3008                 err = -ENOMEM;
3009                 hci_conn_drop(conn);
3010                 goto unlock;
3011         }
3012
3013         cmd->cmd_complete = pairing_complete;
3014
3015         /* For LE, just connecting isn't a proof that the pairing finished */
3016         if (cp->addr.type == BDADDR_BREDR) {
3017                 conn->connect_cfm_cb = pairing_complete_cb;
3018                 conn->security_cfm_cb = pairing_complete_cb;
3019                 conn->disconn_cfm_cb = pairing_complete_cb;
3020         } else {
3021                 conn->connect_cfm_cb = le_pairing_complete_cb;
3022                 conn->security_cfm_cb = le_pairing_complete_cb;
3023                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3024         }
3025
3026         conn->io_capability = cp->io_cap;
3027         cmd->user_data = hci_conn_get(conn);
3028
3029         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3030             hci_conn_security(conn, sec_level, auth_type, true)) {
3031                 cmd->cmd_complete(cmd, 0);
3032                 mgmt_pending_remove(cmd);
3033         }
3034
3035         err = 0;
3036
3037 unlock:
3038         hci_dev_unlock(hdev);
3039         return err;
3040 }
3041
3042 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3043                               u16 len)
3044 {
3045         struct mgmt_addr_info *addr = data;
3046         struct mgmt_pending_cmd *cmd;
3047         struct hci_conn *conn;
3048         int err;
3049
3050         bt_dev_dbg(hdev, "sock %p", sk);
3051
3052         hci_dev_lock(hdev);
3053
3054         if (!hdev_is_powered(hdev)) {
3055                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3056                                       MGMT_STATUS_NOT_POWERED);
3057                 goto unlock;
3058         }
3059
3060         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3061         if (!cmd) {
3062                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3063                                       MGMT_STATUS_INVALID_PARAMS);
3064                 goto unlock;
3065         }
3066
3067         conn = cmd->user_data;
3068
3069         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3070                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3071                                       MGMT_STATUS_INVALID_PARAMS);
3072                 goto unlock;
3073         }
3074
3075         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3076         mgmt_pending_remove(cmd);
3077
3078         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3079                                 addr, sizeof(*addr));
3080
3081         /* Since user doesn't want to proceed with the connection, abort any
3082          * ongoing pairing and then terminate the link if it was created
3083          * because of the pair device action.
3084          */
3085         if (addr->type == BDADDR_BREDR)
3086                 hci_remove_link_key(hdev, &addr->bdaddr);
3087         else
3088                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3089                                               le_addr_type(addr->type));
3090
3091         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3092                 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3093
3094 unlock:
3095         hci_dev_unlock(hdev);
3096         return err;
3097 }
3098
3099 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3100                              struct mgmt_addr_info *addr, u16 mgmt_op,
3101                              u16 hci_op, __le32 passkey)
3102 {
3103         struct mgmt_pending_cmd *cmd;
3104         struct hci_conn *conn;
3105         int err;
3106
3107         hci_dev_lock(hdev);
3108
3109         if (!hdev_is_powered(hdev)) {
3110                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3111                                         MGMT_STATUS_NOT_POWERED, addr,
3112                                         sizeof(*addr));
3113                 goto done;
3114         }
3115
3116         if (addr->type == BDADDR_BREDR)
3117                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3118         else
3119                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3120                                                le_addr_type(addr->type));
3121
3122         if (!conn) {
3123                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3124                                         MGMT_STATUS_NOT_CONNECTED, addr,
3125                                         sizeof(*addr));
3126                 goto done;
3127         }
3128
3129         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3130                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3131                 if (!err)
3132                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3133                                                 MGMT_STATUS_SUCCESS, addr,
3134                                                 sizeof(*addr));
3135                 else
3136                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3137                                                 MGMT_STATUS_FAILED, addr,
3138                                                 sizeof(*addr));
3139
3140                 goto done;
3141         }
3142
3143         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3144         if (!cmd) {
3145                 err = -ENOMEM;
3146                 goto done;
3147         }
3148
3149         cmd->cmd_complete = addr_cmd_complete;
3150
3151         /* Continue with pairing via HCI */
3152         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3153                 struct hci_cp_user_passkey_reply cp;
3154
3155                 bacpy(&cp.bdaddr, &addr->bdaddr);
3156                 cp.passkey = passkey;
3157                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3158         } else
3159                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3160                                    &addr->bdaddr);
3161
3162         if (err < 0)
3163                 mgmt_pending_remove(cmd);
3164
3165 done:
3166         hci_dev_unlock(hdev);
3167         return err;
3168 }
3169
3170 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3171                               void *data, u16 len)
3172 {
3173         struct mgmt_cp_pin_code_neg_reply *cp = data;
3174
3175         bt_dev_dbg(hdev, "sock %p", sk);
3176
3177         return user_pairing_resp(sk, hdev, &cp->addr,
3178                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3179                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3180 }
3181
3182 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3183                               u16 len)
3184 {
3185         struct mgmt_cp_user_confirm_reply *cp = data;
3186
3187         bt_dev_dbg(hdev, "sock %p", sk);
3188
3189         if (len != sizeof(*cp))
3190                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3191                                        MGMT_STATUS_INVALID_PARAMS);
3192
3193         return user_pairing_resp(sk, hdev, &cp->addr,
3194                                  MGMT_OP_USER_CONFIRM_REPLY,
3195                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3196 }
3197
3198 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3199                                   void *data, u16 len)
3200 {
3201         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3202
3203         bt_dev_dbg(hdev, "sock %p", sk);
3204
3205         return user_pairing_resp(sk, hdev, &cp->addr,
3206                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3207                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3208 }
3209
3210 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3211                               u16 len)
3212 {
3213         struct mgmt_cp_user_passkey_reply *cp = data;
3214
3215         bt_dev_dbg(hdev, "sock %p", sk);
3216
3217         return user_pairing_resp(sk, hdev, &cp->addr,
3218                                  MGMT_OP_USER_PASSKEY_REPLY,
3219                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3220 }
3221
3222 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3223                                   void *data, u16 len)
3224 {
3225         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3226
3227         bt_dev_dbg(hdev, "sock %p", sk);
3228
3229         return user_pairing_resp(sk, hdev, &cp->addr,
3230                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3231                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3232 }
3233
3234 static void adv_expire(struct hci_dev *hdev, u32 flags)
3235 {
3236         struct adv_info *adv_instance;
3237         struct hci_request req;
3238         int err;
3239
3240         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3241         if (!adv_instance)
3242                 return;
3243
3244         /* stop if current instance doesn't need to be changed */
3245         if (!(adv_instance->flags & flags))
3246                 return;
3247
3248         cancel_adv_timeout(hdev);
3249
3250         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3251         if (!adv_instance)
3252                 return;
3253
3254         hci_req_init(&req, hdev);
3255         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3256                                               true);
3257         if (err)
3258                 return;
3259
3260         hci_req_run(&req, NULL);
3261 }
3262
3263 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3264 {
3265         struct mgmt_cp_set_local_name *cp;
3266         struct mgmt_pending_cmd *cmd;
3267
3268         bt_dev_dbg(hdev, "status 0x%02x", status);
3269
3270         hci_dev_lock(hdev);
3271
3272         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3273         if (!cmd)
3274                 goto unlock;
3275
3276         cp = cmd->param;
3277
3278         if (status) {
3279                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3280                                 mgmt_status(status));
3281         } else {
3282                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3283                                   cp, sizeof(*cp));
3284
3285                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3286                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3287         }
3288
3289         mgmt_pending_remove(cmd);
3290
3291 unlock:
3292         hci_dev_unlock(hdev);
3293 }
3294
3295 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3296                           u16 len)
3297 {
3298         struct mgmt_cp_set_local_name *cp = data;
3299         struct mgmt_pending_cmd *cmd;
3300         struct hci_request req;
3301         int err;
3302
3303         bt_dev_dbg(hdev, "sock %p", sk);
3304
3305         hci_dev_lock(hdev);
3306
3307         /* If the old values are the same as the new ones just return a
3308          * direct command complete event.
3309          */
3310         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3311             !memcmp(hdev->short_name, cp->short_name,
3312                     sizeof(hdev->short_name))) {
3313                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3314                                         data, len);
3315                 goto failed;
3316         }
3317
3318         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3319
3320         if (!hdev_is_powered(hdev)) {
3321                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3322
3323                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3324                                         data, len);
3325                 if (err < 0)
3326                         goto failed;
3327
3328                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3329                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3330                 ext_info_changed(hdev, sk);
3331
3332                 goto failed;
3333         }
3334
3335         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3336         if (!cmd) {
3337                 err = -ENOMEM;
3338                 goto failed;
3339         }
3340
3341         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3342
3343         hci_req_init(&req, hdev);
3344
3345         if (lmp_bredr_capable(hdev)) {
3346                 __hci_req_update_name(&req);
3347                 __hci_req_update_eir(&req);
3348         }
3349
3350         /* The name is stored in the scan response data and so
3351          * no need to update the advertising data here.
3352          */
3353         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3354                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3355
3356         err = hci_req_run(&req, set_name_complete);
3357         if (err < 0)
3358                 mgmt_pending_remove(cmd);
3359
3360 failed:
3361         hci_dev_unlock(hdev);
3362         return err;
3363 }
3364
3365 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3366                           u16 len)
3367 {
3368         struct mgmt_cp_set_appearance *cp = data;
3369         u16 appearance;
3370         int err;
3371
3372         bt_dev_dbg(hdev, "sock %p", sk);
3373
3374         if (!lmp_le_capable(hdev))
3375                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3376                                        MGMT_STATUS_NOT_SUPPORTED);
3377
3378         appearance = le16_to_cpu(cp->appearance);
3379
3380         hci_dev_lock(hdev);
3381
3382         if (hdev->appearance != appearance) {
3383                 hdev->appearance = appearance;
3384
3385                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3386                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3387
3388                 ext_info_changed(hdev, sk);
3389         }
3390
3391         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3392                                 0);
3393
3394         hci_dev_unlock(hdev);
3395
3396         return err;
3397 }
3398
3399 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3400                                  void *data, u16 len)
3401 {
3402         struct mgmt_rp_get_phy_configuration rp;
3403
3404         bt_dev_dbg(hdev, "sock %p", sk);
3405
3406         hci_dev_lock(hdev);
3407
3408         memset(&rp, 0, sizeof(rp));
3409
3410         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3411         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3412         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3413
3414         hci_dev_unlock(hdev);
3415
3416         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3417                                  &rp, sizeof(rp));
3418 }
3419
3420 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3421 {
3422         struct mgmt_ev_phy_configuration_changed ev;
3423
3424         memset(&ev, 0, sizeof(ev));
3425
3426         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3427
3428         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3429                           sizeof(ev), skip);
3430 }
3431
3432 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3433                                      u16 opcode, struct sk_buff *skb)
3434 {
3435         struct mgmt_pending_cmd *cmd;
3436
3437         bt_dev_dbg(hdev, "status 0x%02x", status);
3438
3439         hci_dev_lock(hdev);
3440
3441         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3442         if (!cmd)
3443                 goto unlock;
3444
3445         if (status) {
3446                 mgmt_cmd_status(cmd->sk, hdev->id,
3447                                 MGMT_OP_SET_PHY_CONFIGURATION,
3448                                 mgmt_status(status));
3449         } else {
3450                 mgmt_cmd_complete(cmd->sk, hdev->id,
3451                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3452                                   NULL, 0);
3453
3454                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3455         }
3456
3457         mgmt_pending_remove(cmd);
3458
3459 unlock:
3460         hci_dev_unlock(hdev);
3461 }
3462
3463 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3464                                  void *data, u16 len)
3465 {
3466         struct mgmt_cp_set_phy_configuration *cp = data;
3467         struct hci_cp_le_set_default_phy cp_phy;
3468         struct mgmt_pending_cmd *cmd;
3469         struct hci_request req;
3470         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3471         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3472         bool changed = false;
3473         int err;
3474
3475         bt_dev_dbg(hdev, "sock %p", sk);
3476
3477         configurable_phys = get_configurable_phys(hdev);
3478         supported_phys = get_supported_phys(hdev);
3479         selected_phys = __le32_to_cpu(cp->selected_phys);
3480
3481         if (selected_phys & ~supported_phys)
3482                 return mgmt_cmd_status(sk, hdev->id,
3483                                        MGMT_OP_SET_PHY_CONFIGURATION,
3484                                        MGMT_STATUS_INVALID_PARAMS);
3485
3486         unconfigure_phys = supported_phys & ~configurable_phys;
3487
3488         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3489                 return mgmt_cmd_status(sk, hdev->id,
3490                                        MGMT_OP_SET_PHY_CONFIGURATION,
3491                                        MGMT_STATUS_INVALID_PARAMS);
3492
3493         if (selected_phys == get_selected_phys(hdev))
3494                 return mgmt_cmd_complete(sk, hdev->id,
3495                                          MGMT_OP_SET_PHY_CONFIGURATION,
3496                                          0, NULL, 0);
3497
3498         hci_dev_lock(hdev);
3499
3500         if (!hdev_is_powered(hdev)) {
3501                 err = mgmt_cmd_status(sk, hdev->id,
3502                                       MGMT_OP_SET_PHY_CONFIGURATION,
3503                                       MGMT_STATUS_REJECTED);
3504                 goto unlock;
3505         }
3506
3507         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3508                 err = mgmt_cmd_status(sk, hdev->id,
3509                                       MGMT_OP_SET_PHY_CONFIGURATION,
3510                                       MGMT_STATUS_BUSY);
3511                 goto unlock;
3512         }
3513
3514         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3515                 pkt_type |= (HCI_DH3 | HCI_DM3);
3516         else
3517                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3518
3519         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3520                 pkt_type |= (HCI_DH5 | HCI_DM5);
3521         else
3522                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3523
3524         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3525                 pkt_type &= ~HCI_2DH1;
3526         else
3527                 pkt_type |= HCI_2DH1;
3528
3529         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3530                 pkt_type &= ~HCI_2DH3;
3531         else
3532                 pkt_type |= HCI_2DH3;
3533
3534         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3535                 pkt_type &= ~HCI_2DH5;
3536         else
3537                 pkt_type |= HCI_2DH5;
3538
3539         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3540                 pkt_type &= ~HCI_3DH1;
3541         else
3542                 pkt_type |= HCI_3DH1;
3543
3544         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3545                 pkt_type &= ~HCI_3DH3;
3546         else
3547                 pkt_type |= HCI_3DH3;
3548
3549         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3550                 pkt_type &= ~HCI_3DH5;
3551         else
3552                 pkt_type |= HCI_3DH5;
3553
3554         if (pkt_type != hdev->pkt_type) {
3555                 hdev->pkt_type = pkt_type;
3556                 changed = true;
3557         }
3558
3559         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3560             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3561                 if (changed)
3562                         mgmt_phy_configuration_changed(hdev, sk);
3563
3564                 err = mgmt_cmd_complete(sk, hdev->id,
3565                                         MGMT_OP_SET_PHY_CONFIGURATION,
3566                                         0, NULL, 0);
3567
3568                 goto unlock;
3569         }
3570
3571         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3572                                len);
3573         if (!cmd) {
3574                 err = -ENOMEM;
3575                 goto unlock;
3576         }
3577
3578         hci_req_init(&req, hdev);
3579
3580         memset(&cp_phy, 0, sizeof(cp_phy));
3581
3582         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3583                 cp_phy.all_phys |= 0x01;
3584
3585         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3586                 cp_phy.all_phys |= 0x02;
3587
3588         if (selected_phys & MGMT_PHY_LE_1M_TX)
3589                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3590
3591         if (selected_phys & MGMT_PHY_LE_2M_TX)
3592                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3593
3594         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3595                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3596
3597         if (selected_phys & MGMT_PHY_LE_1M_RX)
3598                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3599
3600         if (selected_phys & MGMT_PHY_LE_2M_RX)
3601                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3602
3603         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3604                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3605
3606         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3607
3608         err = hci_req_run_skb(&req, set_default_phy_complete);
3609         if (err < 0)
3610                 mgmt_pending_remove(cmd);
3611
3612 unlock:
3613         hci_dev_unlock(hdev);
3614
3615         return err;
3616 }
3617
3618 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3619                             u16 len)
3620 {
3621         int err = MGMT_STATUS_SUCCESS;
3622         struct mgmt_cp_set_blocked_keys *keys = data;
3623         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
3624                                    sizeof(struct mgmt_blocked_key_info));
3625         u16 key_count, expected_len;
3626         int i;
3627
3628         bt_dev_dbg(hdev, "sock %p", sk);
3629
3630         key_count = __le16_to_cpu(keys->key_count);
3631         if (key_count > max_key_count) {
3632                 bt_dev_err(hdev, "too big key_count value %u", key_count);
3633                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3634                                        MGMT_STATUS_INVALID_PARAMS);
3635         }
3636
3637         expected_len = struct_size(keys, keys, key_count);
3638         if (expected_len != len) {
3639                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
3640                            expected_len, len);
3641                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3642                                        MGMT_STATUS_INVALID_PARAMS);
3643         }
3644
3645         hci_dev_lock(hdev);
3646
3647         hci_blocked_keys_clear(hdev);
3648
3649         for (i = 0; i < keys->key_count; ++i) {
3650                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
3651
3652                 if (!b) {
3653                         err = MGMT_STATUS_NO_RESOURCES;
3654                         break;
3655                 }
3656
3657                 b->type = keys->keys[i].type;
3658                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
3659                 list_add_rcu(&b->list, &hdev->blocked_keys);
3660         }
3661         hci_dev_unlock(hdev);
3662
3663         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3664                                 err, NULL, 0);
3665 }
3666
3667 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
3668                                void *data, u16 len)
3669 {
3670         struct mgmt_mode *cp = data;
3671         int err;
3672         bool changed = false;
3673
3674         bt_dev_dbg(hdev, "sock %p", sk);
3675
3676         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
3677                 return mgmt_cmd_status(sk, hdev->id,
3678                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3679                                        MGMT_STATUS_NOT_SUPPORTED);
3680
3681         if (cp->val != 0x00 && cp->val != 0x01)
3682                 return mgmt_cmd_status(sk, hdev->id,
3683                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3684                                        MGMT_STATUS_INVALID_PARAMS);
3685
3686         hci_dev_lock(hdev);
3687
3688         if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) {
3689                 err = mgmt_cmd_status(sk, hdev->id,
3690                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3691                                       MGMT_STATUS_BUSY);
3692                 goto unlock;
3693         }
3694
3695         if (hdev_is_powered(hdev) &&
3696             !!cp->val != hci_dev_test_flag(hdev,
3697                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
3698                 err = mgmt_cmd_status(sk, hdev->id,
3699                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3700                                       MGMT_STATUS_REJECTED);
3701                 goto unlock;
3702         }
3703
3704         if (cp->val)
3705                 changed = !hci_dev_test_and_set_flag(hdev,
3706                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3707         else
3708                 changed = hci_dev_test_and_clear_flag(hdev,
3709                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3710
3711         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
3712         if (err < 0)
3713                 goto unlock;
3714
3715         if (changed)
3716                 err = new_settings(hdev, sk);
3717
3718 unlock:
3719         hci_dev_unlock(hdev);
3720         return err;
3721 }
3722
3723 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
3724                                void *data, u16 data_len)
3725 {
3726         char buf[20];
3727         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
3728         u16 cap_len = 0;
3729         u8 flags = 0;
3730         u8 tx_power_range[2];
3731
3732         bt_dev_dbg(hdev, "sock %p", sk);
3733
3734         memset(&buf, 0, sizeof(buf));
3735
3736         hci_dev_lock(hdev);
3737
3738         /* When the Read Simple Pairing Options command is supported, then
3739          * the remote public key validation is supported.
3740          *
3741          * Alternatively, when Microsoft extensions are available, they can
3742          * indicate support for public key validation as well.
3743          */
3744         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
3745                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
3746
3747         flags |= 0x02;          /* Remote public key validation (LE) */
3748
3749         /* When the Read Encryption Key Size command is supported, then the
3750          * encryption key size is enforced.
3751          */
3752         if (hdev->commands[20] & 0x10)
3753                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
3754
3755         flags |= 0x08;          /* Encryption key size enforcement (LE) */
3756
3757         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
3758                                   &flags, 1);
3759
3760         /* When the Read Simple Pairing Options command is supported, then
3761          * also max encryption key size information is provided.
3762          */
3763         if (hdev->commands[41] & 0x08)
3764                 cap_len = eir_append_le16(rp->cap, cap_len,
3765                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
3766                                           hdev->max_enc_key_size);
3767
3768         cap_len = eir_append_le16(rp->cap, cap_len,
3769                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
3770                                   SMP_MAX_ENC_KEY_SIZE);
3771
3772         /* Append the min/max LE tx power parameters if we were able to fetch
3773          * it from the controller
3774          */
3775         if (hdev->commands[38] & 0x80) {
3776                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
3777                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
3778                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
3779                                           tx_power_range, 2);
3780         }
3781
3782         rp->cap_len = cpu_to_le16(cap_len);
3783
3784         hci_dev_unlock(hdev);
3785
3786         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
3787                                  rp, sizeof(*rp) + cap_len);
3788 }
3789
3790 #ifdef CONFIG_BT_FEATURE_DEBUG
3791 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
3792 static const u8 debug_uuid[16] = {
3793         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
3794         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
3795 };
3796 #endif
3797
3798 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
3799 static const u8 simult_central_periph_uuid[16] = {
3800         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
3801         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
3802 };
3803
3804 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
3805 static const u8 rpa_resolution_uuid[16] = {
3806         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
3807         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
3808 };
3809
3810 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
3811                                   void *data, u16 data_len)
3812 {
3813         char buf[62];   /* Enough space for 3 features */
3814         struct mgmt_rp_read_exp_features_info *rp = (void *)buf;
3815         u16 idx = 0;
3816         u32 flags;
3817
3818         bt_dev_dbg(hdev, "sock %p", sk);
3819
3820         memset(&buf, 0, sizeof(buf));
3821
3822 #ifdef CONFIG_BT_FEATURE_DEBUG
3823         if (!hdev) {
3824                 flags = bt_dbg_get() ? BIT(0) : 0;
3825
3826                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
3827                 rp->features[idx].flags = cpu_to_le32(flags);
3828                 idx++;
3829         }
3830 #endif
3831
3832         if (hdev) {
3833                 if (test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) &&
3834                     (hdev->le_states[4] & 0x08) &&      /* Central */
3835                     (hdev->le_states[4] & 0x40) &&      /* Peripheral */
3836                     (hdev->le_states[3] & 0x10))        /* Simultaneous */
3837                         flags = BIT(0);
3838                 else
3839                         flags = 0;
3840
3841                 memcpy(rp->features[idx].uuid, simult_central_periph_uuid, 16);
3842                 rp->features[idx].flags = cpu_to_le32(flags);
3843                 idx++;
3844         }
3845
3846         if (hdev && use_ll_privacy(hdev)) {
3847                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
3848                         flags = BIT(0) | BIT(1);
3849                 else
3850                         flags = BIT(1);
3851
3852                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
3853                 rp->features[idx].flags = cpu_to_le32(flags);
3854                 idx++;
3855         }
3856
3857         rp->feature_count = cpu_to_le16(idx);
3858
3859         /* After reading the experimental features information, enable
3860          * the events to update client on any future change.
3861          */
3862         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3863
3864         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3865                                  MGMT_OP_READ_EXP_FEATURES_INFO,
3866                                  0, rp, sizeof(*rp) + (20 * idx));
3867 }
3868
3869 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
3870                                           struct sock *skip)
3871 {
3872         struct mgmt_ev_exp_feature_changed ev;
3873
3874         memset(&ev, 0, sizeof(ev));
3875         memcpy(ev.uuid, rpa_resolution_uuid, 16);
3876         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
3877
3878         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
3879                                   &ev, sizeof(ev),
3880                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3881
3882 }
3883
3884 #ifdef CONFIG_BT_FEATURE_DEBUG
3885 static int exp_debug_feature_changed(bool enabled, struct sock *skip)
3886 {
3887         struct mgmt_ev_exp_feature_changed ev;
3888
3889         memset(&ev, 0, sizeof(ev));
3890         memcpy(ev.uuid, debug_uuid, 16);
3891         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
3892
3893         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL,
3894                                   &ev, sizeof(ev),
3895                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3896 }
3897 #endif
3898
3899 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
3900                            void *data, u16 data_len)
3901 {
3902         struct mgmt_cp_set_exp_feature *cp = data;
3903         struct mgmt_rp_set_exp_feature rp;
3904
3905         bt_dev_dbg(hdev, "sock %p", sk);
3906
3907         if (!memcmp(cp->uuid, ZERO_KEY, 16)) {
3908                 memset(rp.uuid, 0, 16);
3909                 rp.flags = cpu_to_le32(0);
3910
3911 #ifdef CONFIG_BT_FEATURE_DEBUG
3912                 if (!hdev) {
3913                         bool changed = bt_dbg_get();
3914
3915                         bt_dbg_set(false);
3916
3917                         if (changed)
3918                                 exp_debug_feature_changed(false, sk);
3919                 }
3920 #endif
3921
3922                 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
3923                         bool changed = hci_dev_test_flag(hdev,
3924                                                          HCI_ENABLE_LL_PRIVACY);
3925
3926                         hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY);
3927
3928                         if (changed)
3929                                 exp_ll_privacy_feature_changed(false, hdev, sk);
3930                 }
3931
3932                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3933
3934                 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3935                                          MGMT_OP_SET_EXP_FEATURE, 0,
3936                                          &rp, sizeof(rp));
3937         }
3938
3939 #ifdef CONFIG_BT_FEATURE_DEBUG
3940         if (!memcmp(cp->uuid, debug_uuid, 16)) {
3941                 bool val, changed;
3942                 int err;
3943
3944                 /* Command requires to use the non-controller index */
3945                 if (hdev)
3946                         return mgmt_cmd_status(sk, hdev->id,
3947                                                MGMT_OP_SET_EXP_FEATURE,
3948                                                MGMT_STATUS_INVALID_INDEX);
3949
3950                 /* Parameters are limited to a single octet */
3951                 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3952                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3953                                                MGMT_OP_SET_EXP_FEATURE,
3954                                                MGMT_STATUS_INVALID_PARAMS);
3955
3956                 /* Only boolean on/off is supported */
3957                 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3958                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3959                                                MGMT_OP_SET_EXP_FEATURE,
3960                                                MGMT_STATUS_INVALID_PARAMS);
3961
3962                 val = !!cp->param[0];
3963                 changed = val ? !bt_dbg_get() : bt_dbg_get();
3964                 bt_dbg_set(val);
3965
3966                 memcpy(rp.uuid, debug_uuid, 16);
3967                 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
3968
3969                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3970
3971                 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
3972                                         MGMT_OP_SET_EXP_FEATURE, 0,
3973                                         &rp, sizeof(rp));
3974
3975                 if (changed)
3976                         exp_debug_feature_changed(val, sk);
3977
3978                 return err;
3979         }
3980 #endif
3981
3982         if (!memcmp(cp->uuid, rpa_resolution_uuid, 16)) {
3983                 bool val, changed;
3984                 int err;
3985                 u32 flags;
3986
3987                 /* Command requires to use the controller index */
3988                 if (!hdev)
3989                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3990                                                MGMT_OP_SET_EXP_FEATURE,
3991                                                MGMT_STATUS_INVALID_INDEX);
3992
3993                 /* Changes can only be made when controller is powered down */
3994                 if (hdev_is_powered(hdev))
3995                         return mgmt_cmd_status(sk, hdev->id,
3996                                                MGMT_OP_SET_EXP_FEATURE,
3997                                                MGMT_STATUS_REJECTED);
3998
3999                 /* Parameters are limited to a single octet */
4000                 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4001                         return mgmt_cmd_status(sk, hdev->id,
4002                                                MGMT_OP_SET_EXP_FEATURE,
4003                                                MGMT_STATUS_INVALID_PARAMS);
4004
4005                 /* Only boolean on/off is supported */
4006                 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4007                         return mgmt_cmd_status(sk, hdev->id,
4008                                                MGMT_OP_SET_EXP_FEATURE,
4009                                                MGMT_STATUS_INVALID_PARAMS);
4010
4011                 val = !!cp->param[0];
4012
4013                 if (val) {
4014                         changed = !hci_dev_test_flag(hdev,
4015                                                      HCI_ENABLE_LL_PRIVACY);
4016                         hci_dev_set_flag(hdev, HCI_ENABLE_LL_PRIVACY);
4017                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4018
4019                         /* Enable LL privacy + supported settings changed */
4020                         flags = BIT(0) | BIT(1);
4021                 } else {
4022                         changed = hci_dev_test_flag(hdev,
4023                                                     HCI_ENABLE_LL_PRIVACY);
4024                         hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY);
4025
4026                         /* Disable LL privacy + supported settings changed */
4027                         flags = BIT(1);
4028                 }
4029
4030                 memcpy(rp.uuid, rpa_resolution_uuid, 16);
4031                 rp.flags = cpu_to_le32(flags);
4032
4033                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4034
4035                 err = mgmt_cmd_complete(sk, hdev->id,
4036                                         MGMT_OP_SET_EXP_FEATURE, 0,
4037                                         &rp, sizeof(rp));
4038
4039                 if (changed)
4040                         exp_ll_privacy_feature_changed(val, hdev, sk);
4041
4042                 return err;
4043         }
4044
4045         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4046                                MGMT_OP_SET_EXP_FEATURE,
4047                                MGMT_STATUS_NOT_SUPPORTED);
4048 }
4049
4050 #define SUPPORTED_DEVICE_FLAGS() ((1U << HCI_CONN_FLAG_MAX) - 1)
4051
4052 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4053                             u16 data_len)
4054 {
4055         struct mgmt_cp_get_device_flags *cp = data;
4056         struct mgmt_rp_get_device_flags rp;
4057         struct bdaddr_list_with_flags *br_params;
4058         struct hci_conn_params *params;
4059         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4060         u32 current_flags = 0;
4061         u8 status = MGMT_STATUS_INVALID_PARAMS;
4062
4063         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
4064                    &cp->addr.bdaddr, cp->addr.type);
4065
4066         hci_dev_lock(hdev);
4067
4068         memset(&rp, 0, sizeof(rp));
4069
4070         if (cp->addr.type == BDADDR_BREDR) {
4071                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4072                                                               &cp->addr.bdaddr,
4073                                                               cp->addr.type);
4074                 if (!br_params)
4075                         goto done;
4076
4077                 current_flags = br_params->current_flags;
4078         } else {
4079                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4080                                                 le_addr_type(cp->addr.type));
4081
4082                 if (!params)
4083                         goto done;
4084
4085                 current_flags = params->current_flags;
4086         }
4087
4088         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4089         rp.addr.type = cp->addr.type;
4090         rp.supported_flags = cpu_to_le32(supported_flags);
4091         rp.current_flags = cpu_to_le32(current_flags);
4092
4093         status = MGMT_STATUS_SUCCESS;
4094
4095 done:
4096         hci_dev_unlock(hdev);
4097
4098         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
4099                                 &rp, sizeof(rp));
4100 }
4101
4102 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
4103                                  bdaddr_t *bdaddr, u8 bdaddr_type,
4104                                  u32 supported_flags, u32 current_flags)
4105 {
4106         struct mgmt_ev_device_flags_changed ev;
4107
4108         bacpy(&ev.addr.bdaddr, bdaddr);
4109         ev.addr.type = bdaddr_type;
4110         ev.supported_flags = cpu_to_le32(supported_flags);
4111         ev.current_flags = cpu_to_le32(current_flags);
4112
4113         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
4114 }
4115
4116 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4117                             u16 len)
4118 {
4119         struct mgmt_cp_set_device_flags *cp = data;
4120         struct bdaddr_list_with_flags *br_params;
4121         struct hci_conn_params *params;
4122         u8 status = MGMT_STATUS_INVALID_PARAMS;
4123         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4124         u32 current_flags = __le32_to_cpu(cp->current_flags);
4125
4126         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
4127                    &cp->addr.bdaddr, cp->addr.type,
4128                    __le32_to_cpu(current_flags));
4129
4130         if ((supported_flags | current_flags) != supported_flags) {
4131                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
4132                             current_flags, supported_flags);
4133                 goto done;
4134         }
4135
4136         hci_dev_lock(hdev);
4137
4138         if (cp->addr.type == BDADDR_BREDR) {
4139                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4140                                                               &cp->addr.bdaddr,
4141                                                               cp->addr.type);
4142
4143                 if (br_params) {
4144                         br_params->current_flags = current_flags;
4145                         status = MGMT_STATUS_SUCCESS;
4146                 } else {
4147                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
4148                                     &cp->addr.bdaddr, cp->addr.type);
4149                 }
4150         } else {
4151                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4152                                                 le_addr_type(cp->addr.type));
4153                 if (params) {
4154                         params->current_flags = current_flags;
4155                         status = MGMT_STATUS_SUCCESS;
4156                 } else {
4157                         bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
4158                                     &cp->addr.bdaddr,
4159                                     le_addr_type(cp->addr.type));
4160                 }
4161         }
4162
4163 done:
4164         hci_dev_unlock(hdev);
4165
4166         if (status == MGMT_STATUS_SUCCESS)
4167                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
4168                                      supported_flags, current_flags);
4169
4170         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
4171                                  &cp->addr, sizeof(cp->addr));
4172 }
4173
4174 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
4175                                    u16 handle)
4176 {
4177         struct mgmt_ev_adv_monitor_added ev;
4178
4179         ev.monitor_handle = cpu_to_le16(handle);
4180
4181         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
4182 }
4183
4184 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
4185 {
4186         struct mgmt_ev_adv_monitor_removed ev;
4187         struct mgmt_pending_cmd *cmd;
4188         struct sock *sk_skip = NULL;
4189         struct mgmt_cp_remove_adv_monitor *cp;
4190
4191         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4192         if (cmd) {
4193                 cp = cmd->param;
4194
4195                 if (cp->monitor_handle)
4196                         sk_skip = cmd->sk;
4197         }
4198
4199         ev.monitor_handle = cpu_to_le16(handle);
4200
4201         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
4202 }
4203
4204 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
4205                                  void *data, u16 len)
4206 {
4207         struct adv_monitor *monitor = NULL;
4208         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
4209         int handle, err;
4210         size_t rp_size = 0;
4211         __u32 supported = 0;
4212         __u32 enabled = 0;
4213         __u16 num_handles = 0;
4214         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
4215
4216         BT_DBG("request for %s", hdev->name);
4217
4218         hci_dev_lock(hdev);
4219
4220         if (msft_monitor_supported(hdev))
4221                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
4222
4223         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
4224                 handles[num_handles++] = monitor->handle;
4225
4226         hci_dev_unlock(hdev);
4227
4228         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
4229         rp = kmalloc(rp_size, GFP_KERNEL);
4230         if (!rp)
4231                 return -ENOMEM;
4232
4233         /* All supported features are currently enabled */
4234         enabled = supported;
4235
4236         rp->supported_features = cpu_to_le32(supported);
4237         rp->enabled_features = cpu_to_le32(enabled);
4238         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
4239         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
4240         rp->num_handles = cpu_to_le16(num_handles);
4241         if (num_handles)
4242                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
4243
4244         err = mgmt_cmd_complete(sk, hdev->id,
4245                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
4246                                 MGMT_STATUS_SUCCESS, rp, rp_size);
4247
4248         kfree(rp);
4249
4250         return err;
4251 }
4252
4253 int mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status)
4254 {
4255         struct mgmt_rp_add_adv_patterns_monitor rp;
4256         struct mgmt_pending_cmd *cmd;
4257         struct adv_monitor *monitor;
4258         int err = 0;
4259
4260         hci_dev_lock(hdev);
4261
4262         cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev);
4263         if (!cmd) {
4264                 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev);
4265                 if (!cmd)
4266                         goto done;
4267         }
4268
4269         monitor = cmd->user_data;
4270         rp.monitor_handle = cpu_to_le16(monitor->handle);
4271
4272         if (!status) {
4273                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
4274                 hdev->adv_monitors_cnt++;
4275                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
4276                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
4277                 hci_update_background_scan(hdev);
4278         }
4279
4280         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4281                                 mgmt_status(status), &rp, sizeof(rp));
4282         mgmt_pending_remove(cmd);
4283
4284 done:
4285         hci_dev_unlock(hdev);
4286         bt_dev_dbg(hdev, "add monitor %d complete, status %u",
4287                    rp.monitor_handle, status);
4288
4289         return err;
4290 }
4291
4292 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4293                                       struct adv_monitor *m, u8 status,
4294                                       void *data, u16 len, u16 op)
4295 {
4296         struct mgmt_rp_add_adv_patterns_monitor rp;
4297         struct mgmt_pending_cmd *cmd;
4298         int err;
4299         bool pending;
4300
4301         hci_dev_lock(hdev);
4302
4303         if (status)
4304                 goto unlock;
4305
4306         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4307             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4308             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
4309             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
4310                 status = MGMT_STATUS_BUSY;
4311                 goto unlock;
4312         }
4313
4314         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4315         if (!cmd) {
4316                 status = MGMT_STATUS_NO_RESOURCES;
4317                 goto unlock;
4318         }
4319
4320         cmd->user_data = m;
4321         pending = hci_add_adv_monitor(hdev, m, &err);
4322         if (err) {
4323                 if (err == -ENOSPC || err == -ENOMEM)
4324                         status = MGMT_STATUS_NO_RESOURCES;
4325                 else if (err == -EINVAL)
4326                         status = MGMT_STATUS_INVALID_PARAMS;
4327                 else
4328                         status = MGMT_STATUS_FAILED;
4329
4330                 mgmt_pending_remove(cmd);
4331                 goto unlock;
4332         }
4333
4334         if (!pending) {
4335                 mgmt_pending_remove(cmd);
4336                 rp.monitor_handle = cpu_to_le16(m->handle);
4337                 mgmt_adv_monitor_added(sk, hdev, m->handle);
4338                 m->state = ADV_MONITOR_STATE_REGISTERED;
4339                 hdev->adv_monitors_cnt++;
4340
4341                 hci_dev_unlock(hdev);
4342                 return mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_SUCCESS,
4343                                          &rp, sizeof(rp));
4344         }
4345
4346         hci_dev_unlock(hdev);
4347
4348         return 0;
4349
4350 unlock:
4351         hci_free_adv_monitor(hdev, m);
4352         hci_dev_unlock(hdev);
4353         return mgmt_cmd_status(sk, hdev->id, op, status);
4354 }
4355
4356 static void parse_adv_monitor_rssi(struct adv_monitor *m,
4357                                    struct mgmt_adv_rssi_thresholds *rssi)
4358 {
4359         if (rssi) {
4360                 m->rssi.low_threshold = rssi->low_threshold;
4361                 m->rssi.low_threshold_timeout =
4362                     __le16_to_cpu(rssi->low_threshold_timeout);
4363                 m->rssi.high_threshold = rssi->high_threshold;
4364                 m->rssi.high_threshold_timeout =
4365                     __le16_to_cpu(rssi->high_threshold_timeout);
4366                 m->rssi.sampling_period = rssi->sampling_period;
4367         } else {
4368                 /* Default values. These numbers are the least constricting
4369                  * parameters for MSFT API to work, so it behaves as if there
4370                  * are no rssi parameter to consider. May need to be changed
4371                  * if other API are to be supported.
4372                  */
4373                 m->rssi.low_threshold = -127;
4374                 m->rssi.low_threshold_timeout = 60;
4375                 m->rssi.high_threshold = -127;
4376                 m->rssi.high_threshold_timeout = 0;
4377                 m->rssi.sampling_period = 0;
4378         }
4379 }
4380
4381 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
4382                                     struct mgmt_adv_pattern *patterns)
4383 {
4384         u8 offset = 0, length = 0;
4385         struct adv_pattern *p = NULL;
4386         int i;
4387
4388         for (i = 0; i < pattern_count; i++) {
4389                 offset = patterns[i].offset;
4390                 length = patterns[i].length;
4391                 if (offset >= HCI_MAX_AD_LENGTH ||
4392                     length > HCI_MAX_AD_LENGTH ||
4393                     (offset + length) > HCI_MAX_AD_LENGTH)
4394                         return MGMT_STATUS_INVALID_PARAMS;
4395
4396                 p = kmalloc(sizeof(*p), GFP_KERNEL);
4397                 if (!p)
4398                         return MGMT_STATUS_NO_RESOURCES;
4399
4400                 p->ad_type = patterns[i].ad_type;
4401                 p->offset = patterns[i].offset;
4402                 p->length = patterns[i].length;
4403                 memcpy(p->value, patterns[i].value, p->length);
4404
4405                 INIT_LIST_HEAD(&p->list);
4406                 list_add(&p->list, &m->patterns);
4407         }
4408
4409         return MGMT_STATUS_SUCCESS;
4410 }
4411
4412 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4413                                     void *data, u16 len)
4414 {
4415         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
4416         struct adv_monitor *m = NULL;
4417         u8 status = MGMT_STATUS_SUCCESS;
4418         size_t expected_size = sizeof(*cp);
4419
4420         BT_DBG("request for %s", hdev->name);
4421
4422         if (len <= sizeof(*cp)) {
4423                 status = MGMT_STATUS_INVALID_PARAMS;
4424                 goto done;
4425         }
4426
4427         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4428         if (len != expected_size) {
4429                 status = MGMT_STATUS_INVALID_PARAMS;
4430                 goto done;
4431         }
4432
4433         m = kzalloc(sizeof(*m), GFP_KERNEL);
4434         if (!m) {
4435                 status = MGMT_STATUS_NO_RESOURCES;
4436                 goto done;
4437         }
4438
4439         INIT_LIST_HEAD(&m->patterns);
4440
4441         parse_adv_monitor_rssi(m, NULL);
4442         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4443
4444 done:
4445         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4446                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
4447 }
4448
4449 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
4450                                          void *data, u16 len)
4451 {
4452         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
4453         struct adv_monitor *m = NULL;
4454         u8 status = MGMT_STATUS_SUCCESS;
4455         size_t expected_size = sizeof(*cp);
4456
4457         BT_DBG("request for %s", hdev->name);
4458
4459         if (len <= sizeof(*cp)) {
4460                 status = MGMT_STATUS_INVALID_PARAMS;
4461                 goto done;
4462         }
4463
4464         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4465         if (len != expected_size) {
4466                 status = MGMT_STATUS_INVALID_PARAMS;
4467                 goto done;
4468         }
4469
4470         m = kzalloc(sizeof(*m), GFP_KERNEL);
4471         if (!m) {
4472                 status = MGMT_STATUS_NO_RESOURCES;
4473                 goto done;
4474         }
4475
4476         INIT_LIST_HEAD(&m->patterns);
4477
4478         parse_adv_monitor_rssi(m, &cp->rssi);
4479         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4480
4481 done:
4482         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4483                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
4484 }
4485
4486 int mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status)
4487 {
4488         struct mgmt_rp_remove_adv_monitor rp;
4489         struct mgmt_cp_remove_adv_monitor *cp;
4490         struct mgmt_pending_cmd *cmd;
4491         int err = 0;
4492
4493         hci_dev_lock(hdev);
4494
4495         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4496         if (!cmd)
4497                 goto done;
4498
4499         cp = cmd->param;
4500         rp.monitor_handle = cp->monitor_handle;
4501
4502         if (!status)
4503                 hci_update_background_scan(hdev);
4504
4505         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4506                                 mgmt_status(status), &rp, sizeof(rp));
4507         mgmt_pending_remove(cmd);
4508
4509 done:
4510         hci_dev_unlock(hdev);
4511         bt_dev_dbg(hdev, "remove monitor %d complete, status %u",
4512                    rp.monitor_handle, status);
4513
4514         return err;
4515 }
4516
4517 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
4518                               void *data, u16 len)
4519 {
4520         struct mgmt_cp_remove_adv_monitor *cp = data;
4521         struct mgmt_rp_remove_adv_monitor rp;
4522         struct mgmt_pending_cmd *cmd;
4523         u16 handle = __le16_to_cpu(cp->monitor_handle);
4524         int err, status;
4525         bool pending;
4526
4527         BT_DBG("request for %s", hdev->name);
4528         rp.monitor_handle = cp->monitor_handle;
4529
4530         hci_dev_lock(hdev);
4531
4532         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4533             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
4534             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4535             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
4536                 status = MGMT_STATUS_BUSY;
4537                 goto unlock;
4538         }
4539
4540         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
4541         if (!cmd) {
4542                 status = MGMT_STATUS_NO_RESOURCES;
4543                 goto unlock;
4544         }
4545
4546         if (handle)
4547                 pending = hci_remove_single_adv_monitor(hdev, handle, &err);
4548         else
4549                 pending = hci_remove_all_adv_monitor(hdev, &err);
4550
4551         if (err) {
4552                 mgmt_pending_remove(cmd);
4553
4554                 if (err == -ENOENT)
4555                         status = MGMT_STATUS_INVALID_INDEX;
4556                 else
4557                         status = MGMT_STATUS_FAILED;
4558
4559                 goto unlock;
4560         }
4561
4562         /* monitor can be removed without forwarding request to controller */
4563         if (!pending) {
4564                 mgmt_pending_remove(cmd);
4565                 hci_dev_unlock(hdev);
4566
4567                 return mgmt_cmd_complete(sk, hdev->id,
4568                                          MGMT_OP_REMOVE_ADV_MONITOR,
4569                                          MGMT_STATUS_SUCCESS,
4570                                          &rp, sizeof(rp));
4571         }
4572
4573         hci_dev_unlock(hdev);
4574         return 0;
4575
4576 unlock:
4577         hci_dev_unlock(hdev);
4578         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4579                                status);
4580 }
4581
4582 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
4583                                          u16 opcode, struct sk_buff *skb)
4584 {
4585         struct mgmt_rp_read_local_oob_data mgmt_rp;
4586         size_t rp_size = sizeof(mgmt_rp);
4587         struct mgmt_pending_cmd *cmd;
4588
4589         bt_dev_dbg(hdev, "status %u", status);
4590
4591         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4592         if (!cmd)
4593                 return;
4594
4595         if (status || !skb) {
4596                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4597                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
4598                 goto remove;
4599         }
4600
4601         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
4602
4603         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
4604                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
4605
4606                 if (skb->len < sizeof(*rp)) {
4607                         mgmt_cmd_status(cmd->sk, hdev->id,
4608                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4609                                         MGMT_STATUS_FAILED);
4610                         goto remove;
4611                 }
4612
4613                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
4614                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
4615
4616                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
4617         } else {
4618                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
4619
4620                 if (skb->len < sizeof(*rp)) {
4621                         mgmt_cmd_status(cmd->sk, hdev->id,
4622                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4623                                         MGMT_STATUS_FAILED);
4624                         goto remove;
4625                 }
4626
4627                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
4628                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
4629
4630                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
4631                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
4632         }
4633
4634         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4635                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
4636
4637 remove:
4638         mgmt_pending_remove(cmd);
4639 }
4640
4641 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
4642                                void *data, u16 data_len)
4643 {
4644         struct mgmt_pending_cmd *cmd;
4645         struct hci_request req;
4646         int err;
4647
4648         bt_dev_dbg(hdev, "sock %p", sk);
4649
4650         hci_dev_lock(hdev);
4651
4652         if (!hdev_is_powered(hdev)) {
4653                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4654                                       MGMT_STATUS_NOT_POWERED);
4655                 goto unlock;
4656         }
4657
4658         if (!lmp_ssp_capable(hdev)) {
4659                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4660                                       MGMT_STATUS_NOT_SUPPORTED);
4661                 goto unlock;
4662         }
4663
4664         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
4665                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4666                                       MGMT_STATUS_BUSY);
4667                 goto unlock;
4668         }
4669
4670         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
4671         if (!cmd) {
4672                 err = -ENOMEM;
4673                 goto unlock;
4674         }
4675
4676         hci_req_init(&req, hdev);
4677
4678         if (bredr_sc_enabled(hdev))
4679                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4680         else
4681                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4682
4683         err = hci_req_run_skb(&req, read_local_oob_data_complete);
4684         if (err < 0)
4685                 mgmt_pending_remove(cmd);
4686
4687 unlock:
4688         hci_dev_unlock(hdev);
4689         return err;
4690 }
4691
4692 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4693                                void *data, u16 len)
4694 {
4695         struct mgmt_addr_info *addr = data;
4696         int err;
4697
4698         bt_dev_dbg(hdev, "sock %p", sk);
4699
4700         if (!bdaddr_type_is_valid(addr->type))
4701                 return mgmt_cmd_complete(sk, hdev->id,
4702                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
4703                                          MGMT_STATUS_INVALID_PARAMS,
4704                                          addr, sizeof(*addr));
4705
4706         hci_dev_lock(hdev);
4707
4708         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4709                 struct mgmt_cp_add_remote_oob_data *cp = data;
4710                 u8 status;
4711
4712                 if (cp->addr.type != BDADDR_BREDR) {
4713                         err = mgmt_cmd_complete(sk, hdev->id,
4714                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
4715                                                 MGMT_STATUS_INVALID_PARAMS,
4716                                                 &cp->addr, sizeof(cp->addr));
4717                         goto unlock;
4718                 }
4719
4720                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4721                                               cp->addr.type, cp->hash,
4722                                               cp->rand, NULL, NULL);
4723                 if (err < 0)
4724                         status = MGMT_STATUS_FAILED;
4725                 else
4726                         status = MGMT_STATUS_SUCCESS;
4727
4728                 err = mgmt_cmd_complete(sk, hdev->id,
4729                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4730                                         &cp->addr, sizeof(cp->addr));
4731         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4732                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
4733                 u8 *rand192, *hash192, *rand256, *hash256;
4734                 u8 status;
4735
4736                 if (bdaddr_type_is_le(cp->addr.type)) {
4737                         /* Enforce zero-valued 192-bit parameters as
4738                          * long as legacy SMP OOB isn't implemented.
4739                          */
4740                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4741                             memcmp(cp->hash192, ZERO_KEY, 16)) {
4742                                 err = mgmt_cmd_complete(sk, hdev->id,
4743                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4744                                                         MGMT_STATUS_INVALID_PARAMS,
4745                                                         addr, sizeof(*addr));
4746                                 goto unlock;
4747                         }
4748
4749                         rand192 = NULL;
4750                         hash192 = NULL;
4751                 } else {
4752                         /* In case one of the P-192 values is set to zero,
4753                          * then just disable OOB data for P-192.
4754                          */
4755                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4756                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
4757                                 rand192 = NULL;
4758                                 hash192 = NULL;
4759                         } else {
4760                                 rand192 = cp->rand192;
4761                                 hash192 = cp->hash192;
4762                         }
4763                 }
4764
4765                 /* In case one of the P-256 values is set to zero, then just
4766                  * disable OOB data for P-256.
4767                  */
4768                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4769                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
4770                         rand256 = NULL;
4771                         hash256 = NULL;
4772                 } else {
4773                         rand256 = cp->rand256;
4774                         hash256 = cp->hash256;
4775                 }
4776
4777                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4778                                               cp->addr.type, hash192, rand192,
4779                                               hash256, rand256);
4780                 if (err < 0)
4781                         status = MGMT_STATUS_FAILED;
4782                 else
4783                         status = MGMT_STATUS_SUCCESS;
4784
4785                 err = mgmt_cmd_complete(sk, hdev->id,
4786                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4787                                         status, &cp->addr, sizeof(cp->addr));
4788         } else {
4789                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
4790                            len);
4791                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4792                                       MGMT_STATUS_INVALID_PARAMS);
4793         }
4794
4795 unlock:
4796         hci_dev_unlock(hdev);
4797         return err;
4798 }
4799
4800 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4801                                   void *data, u16 len)
4802 {
4803         struct mgmt_cp_remove_remote_oob_data *cp = data;
4804         u8 status;
4805         int err;
4806
4807         bt_dev_dbg(hdev, "sock %p", sk);
4808
4809         if (cp->addr.type != BDADDR_BREDR)
4810                 return mgmt_cmd_complete(sk, hdev->id,
4811                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4812                                          MGMT_STATUS_INVALID_PARAMS,
4813                                          &cp->addr, sizeof(cp->addr));
4814
4815         hci_dev_lock(hdev);
4816
4817         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4818                 hci_remote_oob_data_clear(hdev);
4819                 status = MGMT_STATUS_SUCCESS;
4820                 goto done;
4821         }
4822
4823         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
4824         if (err < 0)
4825                 status = MGMT_STATUS_INVALID_PARAMS;
4826         else
4827                 status = MGMT_STATUS_SUCCESS;
4828
4829 done:
4830         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4831                                 status, &cp->addr, sizeof(cp->addr));
4832
4833         hci_dev_unlock(hdev);
4834         return err;
4835 }
4836
4837 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
4838 {
4839         struct mgmt_pending_cmd *cmd;
4840
4841         bt_dev_dbg(hdev, "status %u", status);
4842
4843         hci_dev_lock(hdev);
4844
4845         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4846         if (!cmd)
4847                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4848
4849         if (!cmd)
4850                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
4851
4852         if (cmd) {
4853                 cmd->cmd_complete(cmd, mgmt_status(status));
4854                 mgmt_pending_remove(cmd);
4855         }
4856
4857         hci_dev_unlock(hdev);
4858
4859         /* Handle suspend notifier */
4860         if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY,
4861                                hdev->suspend_tasks)) {
4862                 bt_dev_dbg(hdev, "Unpaused discovery");
4863                 wake_up(&hdev->suspend_wait_q);
4864         }
4865 }
4866
4867 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
4868                                     uint8_t *mgmt_status)
4869 {
4870         switch (type) {
4871         case DISCOV_TYPE_LE:
4872                 *mgmt_status = mgmt_le_support(hdev);
4873                 if (*mgmt_status)
4874                         return false;
4875                 break;
4876         case DISCOV_TYPE_INTERLEAVED:
4877                 *mgmt_status = mgmt_le_support(hdev);
4878                 if (*mgmt_status)
4879                         return false;
4880                 fallthrough;
4881         case DISCOV_TYPE_BREDR:
4882                 *mgmt_status = mgmt_bredr_support(hdev);
4883                 if (*mgmt_status)
4884                         return false;
4885                 break;
4886         default:
4887                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
4888                 return false;
4889         }
4890
4891         return true;
4892 }
4893
4894 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
4895                                     u16 op, void *data, u16 len)
4896 {
4897         struct mgmt_cp_start_discovery *cp = data;
4898         struct mgmt_pending_cmd *cmd;
4899         u8 status;
4900         int err;
4901
4902         bt_dev_dbg(hdev, "sock %p", sk);
4903
4904         hci_dev_lock(hdev);
4905
4906         if (!hdev_is_powered(hdev)) {
4907                 err = mgmt_cmd_complete(sk, hdev->id, op,
4908                                         MGMT_STATUS_NOT_POWERED,
4909                                         &cp->type, sizeof(cp->type));
4910                 goto failed;
4911         }
4912
4913         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4914             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4915                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4916                                         &cp->type, sizeof(cp->type));
4917                 goto failed;
4918         }
4919
4920         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4921                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
4922                                         &cp->type, sizeof(cp->type));
4923                 goto failed;
4924         }
4925
4926         /* Can't start discovery when it is paused */
4927         if (hdev->discovery_paused) {
4928                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4929                                         &cp->type, sizeof(cp->type));
4930                 goto failed;
4931         }
4932
4933         /* Clear the discovery filter first to free any previously
4934          * allocated memory for the UUID list.
4935          */
4936         hci_discovery_filter_clear(hdev);
4937
4938         hdev->discovery.type = cp->type;
4939         hdev->discovery.report_invalid_rssi = false;
4940         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
4941                 hdev->discovery.limited = true;
4942         else
4943                 hdev->discovery.limited = false;
4944
4945         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4946         if (!cmd) {
4947                 err = -ENOMEM;
4948                 goto failed;
4949         }
4950
4951         cmd->cmd_complete = generic_cmd_complete;
4952
4953         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4954         queue_work(hdev->req_workqueue, &hdev->discov_update);
4955         err = 0;
4956
4957 failed:
4958         hci_dev_unlock(hdev);
4959         return err;
4960 }
4961
4962 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4963                            void *data, u16 len)
4964 {
4965         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
4966                                         data, len);
4967 }
4968
4969 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
4970                                    void *data, u16 len)
4971 {
4972         return start_discovery_internal(sk, hdev,
4973                                         MGMT_OP_START_LIMITED_DISCOVERY,
4974                                         data, len);
4975 }
4976
4977 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4978                                           u8 status)
4979 {
4980         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4981                                  cmd->param, 1);
4982 }
4983
4984 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4985                                    void *data, u16 len)
4986 {
4987         struct mgmt_cp_start_service_discovery *cp = data;
4988         struct mgmt_pending_cmd *cmd;
4989         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4990         u16 uuid_count, expected_len;
4991         u8 status;
4992         int err;
4993
4994         bt_dev_dbg(hdev, "sock %p", sk);
4995
4996         hci_dev_lock(hdev);
4997
4998         if (!hdev_is_powered(hdev)) {
4999                 err = mgmt_cmd_complete(sk, hdev->id,
5000                                         MGMT_OP_START_SERVICE_DISCOVERY,
5001                                         MGMT_STATUS_NOT_POWERED,
5002                                         &cp->type, sizeof(cp->type));
5003                 goto failed;
5004         }
5005
5006         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5007             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5008                 err = mgmt_cmd_complete(sk, hdev->id,
5009                                         MGMT_OP_START_SERVICE_DISCOVERY,
5010                                         MGMT_STATUS_BUSY, &cp->type,
5011                                         sizeof(cp->type));
5012                 goto failed;
5013         }
5014
5015         if (hdev->discovery_paused) {
5016                 err = mgmt_cmd_complete(sk, hdev->id,
5017                                         MGMT_OP_START_SERVICE_DISCOVERY,
5018                                         MGMT_STATUS_BUSY, &cp->type,
5019                                         sizeof(cp->type));
5020                 goto failed;
5021         }
5022
5023         uuid_count = __le16_to_cpu(cp->uuid_count);
5024         if (uuid_count > max_uuid_count) {
5025                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
5026                            uuid_count);
5027                 err = mgmt_cmd_complete(sk, hdev->id,
5028                                         MGMT_OP_START_SERVICE_DISCOVERY,
5029                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5030                                         sizeof(cp->type));
5031                 goto failed;
5032         }
5033
5034         expected_len = sizeof(*cp) + uuid_count * 16;
5035         if (expected_len != len) {
5036                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
5037                            expected_len, len);
5038                 err = mgmt_cmd_complete(sk, hdev->id,
5039                                         MGMT_OP_START_SERVICE_DISCOVERY,
5040                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5041                                         sizeof(cp->type));
5042                 goto failed;
5043         }
5044
5045         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5046                 err = mgmt_cmd_complete(sk, hdev->id,
5047                                         MGMT_OP_START_SERVICE_DISCOVERY,
5048                                         status, &cp->type, sizeof(cp->type));
5049                 goto failed;
5050         }
5051
5052         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
5053                                hdev, data, len);
5054         if (!cmd) {
5055                 err = -ENOMEM;
5056                 goto failed;
5057         }
5058
5059         cmd->cmd_complete = service_discovery_cmd_complete;
5060
5061         /* Clear the discovery filter first to free any previously
5062          * allocated memory for the UUID list.
5063          */
5064         hci_discovery_filter_clear(hdev);
5065
5066         hdev->discovery.result_filtering = true;
5067         hdev->discovery.type = cp->type;
5068         hdev->discovery.rssi = cp->rssi;
5069         hdev->discovery.uuid_count = uuid_count;
5070
5071         if (uuid_count > 0) {
5072                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
5073                                                 GFP_KERNEL);
5074                 if (!hdev->discovery.uuids) {
5075                         err = mgmt_cmd_complete(sk, hdev->id,
5076                                                 MGMT_OP_START_SERVICE_DISCOVERY,
5077                                                 MGMT_STATUS_FAILED,
5078                                                 &cp->type, sizeof(cp->type));
5079                         mgmt_pending_remove(cmd);
5080                         goto failed;
5081                 }
5082         }
5083
5084         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5085         queue_work(hdev->req_workqueue, &hdev->discov_update);
5086         err = 0;
5087
5088 failed:
5089         hci_dev_unlock(hdev);
5090         return err;
5091 }
5092
5093 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
5094 {
5095         struct mgmt_pending_cmd *cmd;
5096
5097         bt_dev_dbg(hdev, "status %u", status);
5098
5099         hci_dev_lock(hdev);
5100
5101         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
5102         if (cmd) {
5103                 cmd->cmd_complete(cmd, mgmt_status(status));
5104                 mgmt_pending_remove(cmd);
5105         }
5106
5107         hci_dev_unlock(hdev);
5108
5109         /* Handle suspend notifier */
5110         if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) {
5111                 bt_dev_dbg(hdev, "Paused discovery");
5112                 wake_up(&hdev->suspend_wait_q);
5113         }
5114 }
5115
5116 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
5117                           u16 len)
5118 {
5119         struct mgmt_cp_stop_discovery *mgmt_cp = data;
5120         struct mgmt_pending_cmd *cmd;
5121         int err;
5122
5123         bt_dev_dbg(hdev, "sock %p", sk);
5124
5125         hci_dev_lock(hdev);
5126
5127         if (!hci_discovery_active(hdev)) {
5128                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5129                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
5130                                         sizeof(mgmt_cp->type));
5131                 goto unlock;
5132         }
5133
5134         if (hdev->discovery.type != mgmt_cp->type) {
5135                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5136                                         MGMT_STATUS_INVALID_PARAMS,
5137                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
5138                 goto unlock;
5139         }
5140
5141         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
5142         if (!cmd) {
5143                 err = -ENOMEM;
5144                 goto unlock;
5145         }
5146
5147         cmd->cmd_complete = generic_cmd_complete;
5148
5149         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
5150         queue_work(hdev->req_workqueue, &hdev->discov_update);
5151         err = 0;
5152
5153 unlock:
5154         hci_dev_unlock(hdev);
5155         return err;
5156 }
5157
5158 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
5159                         u16 len)
5160 {
5161         struct mgmt_cp_confirm_name *cp = data;
5162         struct inquiry_entry *e;
5163         int err;
5164
5165         bt_dev_dbg(hdev, "sock %p", sk);
5166
5167         hci_dev_lock(hdev);
5168
5169         if (!hci_discovery_active(hdev)) {
5170                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5171                                         MGMT_STATUS_FAILED, &cp->addr,
5172                                         sizeof(cp->addr));
5173                 goto failed;
5174         }
5175
5176         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
5177         if (!e) {
5178                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5179                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
5180                                         sizeof(cp->addr));
5181                 goto failed;
5182         }
5183
5184         if (cp->name_known) {
5185                 e->name_state = NAME_KNOWN;
5186                 list_del(&e->list);
5187         } else {
5188                 e->name_state = NAME_NEEDED;
5189                 hci_inquiry_cache_update_resolve(hdev, e);
5190         }
5191
5192         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
5193                                 &cp->addr, sizeof(cp->addr));
5194
5195 failed:
5196         hci_dev_unlock(hdev);
5197         return err;
5198 }
5199
5200 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
5201                         u16 len)
5202 {
5203         struct mgmt_cp_block_device *cp = data;
5204         u8 status;
5205         int err;
5206
5207         bt_dev_dbg(hdev, "sock %p", sk);
5208
5209         if (!bdaddr_type_is_valid(cp->addr.type))
5210                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
5211                                          MGMT_STATUS_INVALID_PARAMS,
5212                                          &cp->addr, sizeof(cp->addr));
5213
5214         hci_dev_lock(hdev);
5215
5216         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
5217                                   cp->addr.type);
5218         if (err < 0) {
5219                 status = MGMT_STATUS_FAILED;
5220                 goto done;
5221         }
5222
5223         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5224                    sk);
5225         status = MGMT_STATUS_SUCCESS;
5226
5227 done:
5228         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
5229                                 &cp->addr, sizeof(cp->addr));
5230
5231         hci_dev_unlock(hdev);
5232
5233         return err;
5234 }
5235
5236 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
5237                           u16 len)
5238 {
5239         struct mgmt_cp_unblock_device *cp = data;
5240         u8 status;
5241         int err;
5242
5243         bt_dev_dbg(hdev, "sock %p", sk);
5244
5245         if (!bdaddr_type_is_valid(cp->addr.type))
5246                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
5247                                          MGMT_STATUS_INVALID_PARAMS,
5248                                          &cp->addr, sizeof(cp->addr));
5249
5250         hci_dev_lock(hdev);
5251
5252         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
5253                                   cp->addr.type);
5254         if (err < 0) {
5255                 status = MGMT_STATUS_INVALID_PARAMS;
5256                 goto done;
5257         }
5258
5259         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5260                    sk);
5261         status = MGMT_STATUS_SUCCESS;
5262
5263 done:
5264         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
5265                                 &cp->addr, sizeof(cp->addr));
5266
5267         hci_dev_unlock(hdev);
5268
5269         return err;
5270 }
5271
5272 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
5273                          u16 len)
5274 {
5275         struct mgmt_cp_set_device_id *cp = data;
5276         struct hci_request req;
5277         int err;
5278         __u16 source;
5279
5280         bt_dev_dbg(hdev, "sock %p", sk);
5281
5282         source = __le16_to_cpu(cp->source);
5283
5284         if (source > 0x0002)
5285                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
5286                                        MGMT_STATUS_INVALID_PARAMS);
5287
5288         hci_dev_lock(hdev);
5289
5290         hdev->devid_source = source;
5291         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
5292         hdev->devid_product = __le16_to_cpu(cp->product);
5293         hdev->devid_version = __le16_to_cpu(cp->version);
5294
5295         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
5296                                 NULL, 0);
5297
5298         hci_req_init(&req, hdev);
5299         __hci_req_update_eir(&req);
5300         hci_req_run(&req, NULL);
5301
5302         hci_dev_unlock(hdev);
5303
5304         return err;
5305 }
5306
5307 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
5308                                         u16 opcode)
5309 {
5310         bt_dev_dbg(hdev, "status %u", status);
5311 }
5312
5313 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
5314                                      u16 opcode)
5315 {
5316         struct cmd_lookup match = { NULL, hdev };
5317         struct hci_request req;
5318         u8 instance;
5319         struct adv_info *adv_instance;
5320         int err;
5321
5322         hci_dev_lock(hdev);
5323
5324         if (status) {
5325                 u8 mgmt_err = mgmt_status(status);
5326
5327                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
5328                                      cmd_status_rsp, &mgmt_err);
5329                 goto unlock;
5330         }
5331
5332         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
5333                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
5334         else
5335                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
5336
5337         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
5338                              &match);
5339
5340         new_settings(hdev, match.sk);
5341
5342         if (match.sk)
5343                 sock_put(match.sk);
5344
5345         /* Handle suspend notifier */
5346         if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING,
5347                                hdev->suspend_tasks)) {
5348                 bt_dev_dbg(hdev, "Paused advertising");
5349                 wake_up(&hdev->suspend_wait_q);
5350         } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING,
5351                                       hdev->suspend_tasks)) {
5352                 bt_dev_dbg(hdev, "Unpaused advertising");
5353                 wake_up(&hdev->suspend_wait_q);
5354         }
5355
5356         /* If "Set Advertising" was just disabled and instance advertising was
5357          * set up earlier, then re-enable multi-instance advertising.
5358          */
5359         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
5360             list_empty(&hdev->adv_instances))
5361                 goto unlock;
5362
5363         instance = hdev->cur_adv_instance;
5364         if (!instance) {
5365                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
5366                                                         struct adv_info, list);
5367                 if (!adv_instance)
5368                         goto unlock;
5369
5370                 instance = adv_instance->instance;
5371         }
5372
5373         hci_req_init(&req, hdev);
5374
5375         err = __hci_req_schedule_adv_instance(&req, instance, true);
5376
5377         if (!err)
5378                 err = hci_req_run(&req, enable_advertising_instance);
5379
5380         if (err)
5381                 bt_dev_err(hdev, "failed to re-configure advertising");
5382
5383 unlock:
5384         hci_dev_unlock(hdev);
5385 }
5386
5387 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
5388                            u16 len)
5389 {
5390         struct mgmt_mode *cp = data;
5391         struct mgmt_pending_cmd *cmd;
5392         struct hci_request req;
5393         u8 val, status;
5394         int err;
5395
5396         bt_dev_dbg(hdev, "sock %p", sk);
5397
5398         status = mgmt_le_support(hdev);
5399         if (status)
5400                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5401                                        status);
5402
5403         /* Enabling the experimental LL Privay support disables support for
5404          * advertising.
5405          */
5406         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
5407                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5408                                        MGMT_STATUS_NOT_SUPPORTED);
5409
5410         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5411                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5412                                        MGMT_STATUS_INVALID_PARAMS);
5413
5414         if (hdev->advertising_paused)
5415                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5416                                        MGMT_STATUS_BUSY);
5417
5418         hci_dev_lock(hdev);
5419
5420         val = !!cp->val;
5421
5422         /* The following conditions are ones which mean that we should
5423          * not do any HCI communication but directly send a mgmt
5424          * response to user space (after toggling the flag if
5425          * necessary).
5426          */
5427         if (!hdev_is_powered(hdev) ||
5428             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
5429              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
5430             hci_conn_num(hdev, LE_LINK) > 0 ||
5431             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5432              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
5433                 bool changed;
5434
5435                 if (cp->val) {
5436                         hdev->cur_adv_instance = 0x00;
5437                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
5438                         if (cp->val == 0x02)
5439                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5440                         else
5441                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5442                 } else {
5443                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
5444                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5445                 }
5446
5447                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
5448                 if (err < 0)
5449                         goto unlock;
5450
5451                 if (changed)
5452                         err = new_settings(hdev, sk);
5453
5454                 goto unlock;
5455         }
5456
5457         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
5458             pending_find(MGMT_OP_SET_LE, hdev)) {
5459                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5460                                       MGMT_STATUS_BUSY);
5461                 goto unlock;
5462         }
5463
5464         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
5465         if (!cmd) {
5466                 err = -ENOMEM;
5467                 goto unlock;
5468         }
5469
5470         hci_req_init(&req, hdev);
5471
5472         if (cp->val == 0x02)
5473                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5474         else
5475                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5476
5477         cancel_adv_timeout(hdev);
5478
5479         if (val) {
5480                 /* Switch to instance "0" for the Set Advertising setting.
5481                  * We cannot use update_[adv|scan_rsp]_data() here as the
5482                  * HCI_ADVERTISING flag is not yet set.
5483                  */
5484                 hdev->cur_adv_instance = 0x00;
5485
5486                 if (ext_adv_capable(hdev)) {
5487                         __hci_req_start_ext_adv(&req, 0x00);
5488                 } else {
5489                         __hci_req_update_adv_data(&req, 0x00);
5490                         __hci_req_update_scan_rsp_data(&req, 0x00);
5491                         __hci_req_enable_advertising(&req);
5492                 }
5493         } else {
5494                 __hci_req_disable_advertising(&req);
5495         }
5496
5497         err = hci_req_run(&req, set_advertising_complete);
5498         if (err < 0)
5499                 mgmt_pending_remove(cmd);
5500
5501 unlock:
5502         hci_dev_unlock(hdev);
5503         return err;
5504 }
5505
5506 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
5507                               void *data, u16 len)
5508 {
5509         struct mgmt_cp_set_static_address *cp = data;
5510         int err;
5511
5512         bt_dev_dbg(hdev, "sock %p", sk);
5513
5514         if (!lmp_le_capable(hdev))
5515                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5516                                        MGMT_STATUS_NOT_SUPPORTED);
5517
5518         if (hdev_is_powered(hdev))
5519                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5520                                        MGMT_STATUS_REJECTED);
5521
5522         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
5523                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
5524                         return mgmt_cmd_status(sk, hdev->id,
5525                                                MGMT_OP_SET_STATIC_ADDRESS,
5526                                                MGMT_STATUS_INVALID_PARAMS);
5527
5528                 /* Two most significant bits shall be set */
5529                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
5530                         return mgmt_cmd_status(sk, hdev->id,
5531                                                MGMT_OP_SET_STATIC_ADDRESS,
5532                                                MGMT_STATUS_INVALID_PARAMS);
5533         }
5534
5535         hci_dev_lock(hdev);
5536
5537         bacpy(&hdev->static_addr, &cp->bdaddr);
5538
5539         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
5540         if (err < 0)
5541                 goto unlock;
5542
5543         err = new_settings(hdev, sk);
5544
5545 unlock:
5546         hci_dev_unlock(hdev);
5547         return err;
5548 }
5549
5550 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5551                            void *data, u16 len)
5552 {
5553         struct mgmt_cp_set_scan_params *cp = data;
5554         __u16 interval, window;
5555         int err;
5556
5557         bt_dev_dbg(hdev, "sock %p", sk);
5558
5559         if (!lmp_le_capable(hdev))
5560                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5561                                        MGMT_STATUS_NOT_SUPPORTED);
5562
5563         interval = __le16_to_cpu(cp->interval);
5564
5565         if (interval < 0x0004 || interval > 0x4000)
5566                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5567                                        MGMT_STATUS_INVALID_PARAMS);
5568
5569         window = __le16_to_cpu(cp->window);
5570
5571         if (window < 0x0004 || window > 0x4000)
5572                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5573                                        MGMT_STATUS_INVALID_PARAMS);
5574
5575         if (window > interval)
5576                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5577                                        MGMT_STATUS_INVALID_PARAMS);
5578
5579         hci_dev_lock(hdev);
5580
5581         hdev->le_scan_interval = interval;
5582         hdev->le_scan_window = window;
5583
5584         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5585                                 NULL, 0);
5586
5587         /* If background scan is running, restart it so new parameters are
5588          * loaded.
5589          */
5590         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5591             hdev->discovery.state == DISCOVERY_STOPPED) {
5592                 struct hci_request req;
5593
5594                 hci_req_init(&req, hdev);
5595
5596                 hci_req_add_le_scan_disable(&req, false);
5597                 hci_req_add_le_passive_scan(&req);
5598
5599                 hci_req_run(&req, NULL);
5600         }
5601
5602         hci_dev_unlock(hdev);
5603
5604         return err;
5605 }
5606
5607 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5608                                       u16 opcode)
5609 {
5610         struct mgmt_pending_cmd *cmd;
5611
5612         bt_dev_dbg(hdev, "status 0x%02x", status);
5613
5614         hci_dev_lock(hdev);
5615
5616         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5617         if (!cmd)
5618                 goto unlock;
5619
5620         if (status) {
5621                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5622                                 mgmt_status(status));
5623         } else {
5624                 struct mgmt_mode *cp = cmd->param;
5625
5626                 if (cp->val)
5627                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
5628                 else
5629                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5630
5631                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5632                 new_settings(hdev, cmd->sk);
5633         }
5634
5635         mgmt_pending_remove(cmd);
5636
5637 unlock:
5638         hci_dev_unlock(hdev);
5639 }
5640
5641 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
5642                                 void *data, u16 len)
5643 {
5644         struct mgmt_mode *cp = data;
5645         struct mgmt_pending_cmd *cmd;
5646         struct hci_request req;
5647         int err;
5648
5649         bt_dev_dbg(hdev, "sock %p", sk);
5650
5651         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
5652             hdev->hci_ver < BLUETOOTH_VER_1_2)
5653                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5654                                        MGMT_STATUS_NOT_SUPPORTED);
5655
5656         if (cp->val != 0x00 && cp->val != 0x01)
5657                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5658                                        MGMT_STATUS_INVALID_PARAMS);
5659
5660         hci_dev_lock(hdev);
5661
5662         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
5663                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5664                                       MGMT_STATUS_BUSY);
5665                 goto unlock;
5666         }
5667
5668         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
5669                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5670                                         hdev);
5671                 goto unlock;
5672         }
5673
5674         if (!hdev_is_powered(hdev)) {
5675                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
5676                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5677                                         hdev);
5678                 new_settings(hdev, sk);
5679                 goto unlock;
5680         }
5681
5682         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5683                                data, len);
5684         if (!cmd) {
5685                 err = -ENOMEM;
5686                 goto unlock;
5687         }
5688
5689         hci_req_init(&req, hdev);
5690
5691         __hci_req_write_fast_connectable(&req, cp->val);
5692
5693         err = hci_req_run(&req, fast_connectable_complete);
5694         if (err < 0) {
5695                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5696                                       MGMT_STATUS_FAILED);
5697                 mgmt_pending_remove(cmd);
5698         }
5699
5700 unlock:
5701         hci_dev_unlock(hdev);
5702
5703         return err;
5704 }
5705
5706 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5707 {
5708         struct mgmt_pending_cmd *cmd;
5709
5710         bt_dev_dbg(hdev, "status 0x%02x", status);
5711
5712         hci_dev_lock(hdev);
5713
5714         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
5715         if (!cmd)
5716                 goto unlock;
5717
5718         if (status) {
5719                 u8 mgmt_err = mgmt_status(status);
5720
5721                 /* We need to restore the flag if related HCI commands
5722                  * failed.
5723                  */
5724                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
5725
5726                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5727         } else {
5728                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5729                 new_settings(hdev, cmd->sk);
5730         }
5731
5732         mgmt_pending_remove(cmd);
5733
5734 unlock:
5735         hci_dev_unlock(hdev);
5736 }
5737
5738 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5739 {
5740         struct mgmt_mode *cp = data;
5741         struct mgmt_pending_cmd *cmd;
5742         struct hci_request req;
5743         int err;
5744
5745         bt_dev_dbg(hdev, "sock %p", sk);
5746
5747         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5748                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5749                                        MGMT_STATUS_NOT_SUPPORTED);
5750
5751         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5752                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5753                                        MGMT_STATUS_REJECTED);
5754
5755         if (cp->val != 0x00 && cp->val != 0x01)
5756                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5757                                        MGMT_STATUS_INVALID_PARAMS);
5758
5759         hci_dev_lock(hdev);
5760
5761         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5762                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5763                 goto unlock;
5764         }
5765
5766         if (!hdev_is_powered(hdev)) {
5767                 if (!cp->val) {
5768                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5769                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5770                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5771                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5772                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5773                 }
5774
5775                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5776
5777                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5778                 if (err < 0)
5779                         goto unlock;
5780
5781                 err = new_settings(hdev, sk);
5782                 goto unlock;
5783         }
5784
5785         /* Reject disabling when powered on */
5786         if (!cp->val) {
5787                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5788                                       MGMT_STATUS_REJECTED);
5789                 goto unlock;
5790         } else {
5791                 /* When configuring a dual-mode controller to operate
5792                  * with LE only and using a static address, then switching
5793                  * BR/EDR back on is not allowed.
5794                  *
5795                  * Dual-mode controllers shall operate with the public
5796                  * address as its identity address for BR/EDR and LE. So
5797                  * reject the attempt to create an invalid configuration.
5798                  *
5799                  * The same restrictions applies when secure connections
5800                  * has been enabled. For BR/EDR this is a controller feature
5801                  * while for LE it is a host stack feature. This means that
5802                  * switching BR/EDR back on when secure connections has been
5803                  * enabled is not a supported transaction.
5804                  */
5805                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5806                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5807                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5808                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5809                                               MGMT_STATUS_REJECTED);
5810                         goto unlock;
5811                 }
5812         }
5813
5814         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5815                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5816                                       MGMT_STATUS_BUSY);
5817                 goto unlock;
5818         }
5819
5820         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5821         if (!cmd) {
5822                 err = -ENOMEM;
5823                 goto unlock;
5824         }
5825
5826         /* We need to flip the bit already here so that
5827          * hci_req_update_adv_data generates the correct flags.
5828          */
5829         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5830
5831         hci_req_init(&req, hdev);
5832
5833         __hci_req_write_fast_connectable(&req, false);
5834         __hci_req_update_scan(&req);
5835
5836         /* Since only the advertising data flags will change, there
5837          * is no need to update the scan response data.
5838          */
5839         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
5840
5841         err = hci_req_run(&req, set_bredr_complete);
5842         if (err < 0)
5843                 mgmt_pending_remove(cmd);
5844
5845 unlock:
5846         hci_dev_unlock(hdev);
5847         return err;
5848 }
5849
5850 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5851 {
5852         struct mgmt_pending_cmd *cmd;
5853         struct mgmt_mode *cp;
5854
5855         bt_dev_dbg(hdev, "status %u", status);
5856
5857         hci_dev_lock(hdev);
5858
5859         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5860         if (!cmd)
5861                 goto unlock;
5862
5863         if (status) {
5864                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5865                                 mgmt_status(status));
5866                 goto remove;
5867         }
5868
5869         cp = cmd->param;
5870
5871         switch (cp->val) {
5872         case 0x00:
5873                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5874                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5875                 break;
5876         case 0x01:
5877                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5878                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5879                 break;
5880         case 0x02:
5881                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5882                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5883                 break;
5884         }
5885
5886         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5887         new_settings(hdev, cmd->sk);
5888
5889 remove:
5890         mgmt_pending_remove(cmd);
5891 unlock:
5892         hci_dev_unlock(hdev);
5893 }
5894
5895 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5896                            void *data, u16 len)
5897 {
5898         struct mgmt_mode *cp = data;
5899         struct mgmt_pending_cmd *cmd;
5900         struct hci_request req;
5901         u8 val;
5902         int err;
5903
5904         bt_dev_dbg(hdev, "sock %p", sk);
5905
5906         if (!lmp_sc_capable(hdev) &&
5907             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5908                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5909                                        MGMT_STATUS_NOT_SUPPORTED);
5910
5911         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5912             lmp_sc_capable(hdev) &&
5913             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5914                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5915                                        MGMT_STATUS_REJECTED);
5916
5917         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5918                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5919                                   MGMT_STATUS_INVALID_PARAMS);
5920
5921         hci_dev_lock(hdev);
5922
5923         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5924             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5925                 bool changed;
5926
5927                 if (cp->val) {
5928                         changed = !hci_dev_test_and_set_flag(hdev,
5929                                                              HCI_SC_ENABLED);
5930                         if (cp->val == 0x02)
5931                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5932                         else
5933                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5934                 } else {
5935                         changed = hci_dev_test_and_clear_flag(hdev,
5936                                                               HCI_SC_ENABLED);
5937                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5938                 }
5939
5940                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5941                 if (err < 0)
5942                         goto failed;
5943
5944                 if (changed)
5945                         err = new_settings(hdev, sk);
5946
5947                 goto failed;
5948         }
5949
5950         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5951                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5952                                       MGMT_STATUS_BUSY);
5953                 goto failed;
5954         }
5955
5956         val = !!cp->val;
5957
5958         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5959             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5960                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5961                 goto failed;
5962         }
5963
5964         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5965         if (!cmd) {
5966                 err = -ENOMEM;
5967                 goto failed;
5968         }
5969
5970         hci_req_init(&req, hdev);
5971         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5972         err = hci_req_run(&req, sc_enable_complete);
5973         if (err < 0) {
5974                 mgmt_pending_remove(cmd);
5975                 goto failed;
5976         }
5977
5978 failed:
5979         hci_dev_unlock(hdev);
5980         return err;
5981 }
5982
5983 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5984                           void *data, u16 len)
5985 {
5986         struct mgmt_mode *cp = data;
5987         bool changed, use_changed;
5988         int err;
5989
5990         bt_dev_dbg(hdev, "sock %p", sk);
5991
5992         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5993                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5994                                        MGMT_STATUS_INVALID_PARAMS);
5995
5996         hci_dev_lock(hdev);
5997
5998         if (cp->val)
5999                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6000         else
6001                 changed = hci_dev_test_and_clear_flag(hdev,
6002                                                       HCI_KEEP_DEBUG_KEYS);
6003
6004         if (cp->val == 0x02)
6005                 use_changed = !hci_dev_test_and_set_flag(hdev,
6006                                                          HCI_USE_DEBUG_KEYS);
6007         else
6008                 use_changed = hci_dev_test_and_clear_flag(hdev,
6009                                                           HCI_USE_DEBUG_KEYS);
6010
6011         if (hdev_is_powered(hdev) && use_changed &&
6012             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6013                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6014                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6015                              sizeof(mode), &mode);
6016         }
6017
6018         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
6019         if (err < 0)
6020                 goto unlock;
6021
6022         if (changed)
6023                 err = new_settings(hdev, sk);
6024
6025 unlock:
6026         hci_dev_unlock(hdev);
6027         return err;
6028 }
6029
6030 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6031                        u16 len)
6032 {
6033         struct mgmt_cp_set_privacy *cp = cp_data;
6034         bool changed;
6035         int err;
6036
6037         bt_dev_dbg(hdev, "sock %p", sk);
6038
6039         if (!lmp_le_capable(hdev))
6040                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6041                                        MGMT_STATUS_NOT_SUPPORTED);
6042
6043         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
6044                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6045                                        MGMT_STATUS_INVALID_PARAMS);
6046
6047         if (hdev_is_powered(hdev))
6048                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6049                                        MGMT_STATUS_REJECTED);
6050
6051         hci_dev_lock(hdev);
6052
6053         /* If user space supports this command it is also expected to
6054          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
6055          */
6056         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6057
6058         if (cp->privacy) {
6059                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
6060                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
6061                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
6062                 hci_adv_instances_set_rpa_expired(hdev, true);
6063                 if (cp->privacy == 0x02)
6064                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
6065                 else
6066                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6067         } else {
6068                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
6069                 memset(hdev->irk, 0, sizeof(hdev->irk));
6070                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
6071                 hci_adv_instances_set_rpa_expired(hdev, false);
6072                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6073         }
6074
6075         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
6076         if (err < 0)
6077                 goto unlock;
6078
6079         if (changed)
6080                 err = new_settings(hdev, sk);
6081
6082 unlock:
6083         hci_dev_unlock(hdev);
6084         return err;
6085 }
6086
6087 static bool irk_is_valid(struct mgmt_irk_info *irk)
6088 {
6089         switch (irk->addr.type) {
6090         case BDADDR_LE_PUBLIC:
6091                 return true;
6092
6093         case BDADDR_LE_RANDOM:
6094                 /* Two most significant bits shall be set */
6095                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6096                         return false;
6097                 return true;
6098         }
6099
6100         return false;
6101 }
6102
6103 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6104                      u16 len)
6105 {
6106         struct mgmt_cp_load_irks *cp = cp_data;
6107         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
6108                                    sizeof(struct mgmt_irk_info));
6109         u16 irk_count, expected_len;
6110         int i, err;
6111
6112         bt_dev_dbg(hdev, "sock %p", sk);
6113
6114         if (!lmp_le_capable(hdev))
6115                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6116                                        MGMT_STATUS_NOT_SUPPORTED);
6117
6118         irk_count = __le16_to_cpu(cp->irk_count);
6119         if (irk_count > max_irk_count) {
6120                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
6121                            irk_count);
6122                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6123                                        MGMT_STATUS_INVALID_PARAMS);
6124         }
6125
6126         expected_len = struct_size(cp, irks, irk_count);
6127         if (expected_len != len) {
6128                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
6129                            expected_len, len);
6130                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6131                                        MGMT_STATUS_INVALID_PARAMS);
6132         }
6133
6134         bt_dev_dbg(hdev, "irk_count %u", irk_count);
6135
6136         for (i = 0; i < irk_count; i++) {
6137                 struct mgmt_irk_info *key = &cp->irks[i];
6138
6139                 if (!irk_is_valid(key))
6140                         return mgmt_cmd_status(sk, hdev->id,
6141                                                MGMT_OP_LOAD_IRKS,
6142                                                MGMT_STATUS_INVALID_PARAMS);
6143         }
6144
6145         hci_dev_lock(hdev);
6146
6147         hci_smp_irks_clear(hdev);
6148
6149         for (i = 0; i < irk_count; i++) {
6150                 struct mgmt_irk_info *irk = &cp->irks[i];
6151
6152                 if (hci_is_blocked_key(hdev,
6153                                        HCI_BLOCKED_KEY_TYPE_IRK,
6154                                        irk->val)) {
6155                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
6156                                     &irk->addr.bdaddr);
6157                         continue;
6158                 }
6159
6160                 hci_add_irk(hdev, &irk->addr.bdaddr,
6161                             le_addr_type(irk->addr.type), irk->val,
6162                             BDADDR_ANY);
6163         }
6164
6165         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6166
6167         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
6168
6169         hci_dev_unlock(hdev);
6170
6171         return err;
6172 }
6173
6174 #ifdef TIZEN_BT
6175 static int set_advertising_params(struct sock *sk, struct hci_dev *hdev,
6176                         void *data, u16 len)
6177 {
6178         struct mgmt_cp_set_advertising_params *cp = data;
6179         __u16 min_interval;
6180         __u16 max_interval;
6181         int err;
6182
6183         BT_DBG("%s", hdev->name);
6184
6185         if (!lmp_le_capable(hdev))
6186                 return mgmt_cmd_status(sk, hdev->id,
6187                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6188                                 MGMT_STATUS_NOT_SUPPORTED);
6189
6190         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6191                 return mgmt_cmd_status(sk, hdev->id,
6192                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6193                                 MGMT_STATUS_BUSY);
6194
6195         min_interval = __le16_to_cpu(cp->interval_min);
6196         max_interval = __le16_to_cpu(cp->interval_max);
6197
6198         if (min_interval > max_interval ||
6199             min_interval < 0x0020 || max_interval > 0x4000)
6200                 return mgmt_cmd_status(sk, hdev->id,
6201                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6202                                 MGMT_STATUS_INVALID_PARAMS);
6203
6204         hci_dev_lock(hdev);
6205
6206         hdev->le_adv_min_interval = min_interval;
6207         hdev->le_adv_max_interval = max_interval;
6208         hdev->adv_filter_policy = cp->filter_policy;
6209         hdev->adv_type = cp->type;
6210
6211         err = mgmt_cmd_complete(sk, hdev->id,
6212                         MGMT_OP_SET_ADVERTISING_PARAMS, 0, NULL, 0);
6213
6214         hci_dev_unlock(hdev);
6215
6216         return err;
6217 }
6218
6219 static void set_advertising_data_complete(struct hci_dev *hdev,
6220                         u8 status, u16 opcode)
6221 {
6222         struct mgmt_cp_set_advertising_data *cp;
6223         struct mgmt_pending_cmd *cmd;
6224
6225         BT_DBG("status 0x%02x", status);
6226
6227         hci_dev_lock(hdev);
6228
6229         cmd = pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev);
6230         if (!cmd)
6231                 goto unlock;
6232
6233         cp = cmd->param;
6234
6235         if (status)
6236                 mgmt_cmd_status(cmd->sk, hdev->id,
6237                                 MGMT_OP_SET_ADVERTISING_DATA,
6238                                 mgmt_status(status));
6239         else
6240                 mgmt_cmd_complete(cmd->sk, hdev->id,
6241                                 MGMT_OP_SET_ADVERTISING_DATA, 0,
6242                                 cp, sizeof(*cp));
6243
6244         mgmt_pending_remove(cmd);
6245
6246 unlock:
6247         hci_dev_unlock(hdev);
6248 }
6249
6250 static int set_advertising_data(struct sock *sk, struct hci_dev *hdev,
6251                         void *data, u16 len)
6252 {
6253         struct mgmt_pending_cmd *cmd;
6254         struct hci_request req;
6255         struct mgmt_cp_set_advertising_data *cp = data;
6256         struct hci_cp_le_set_adv_data adv;
6257         int err;
6258
6259         BT_DBG("%s", hdev->name);
6260
6261         if (!lmp_le_capable(hdev)) {
6262                 return mgmt_cmd_status(sk, hdev->id,
6263                                 MGMT_OP_SET_ADVERTISING_DATA,
6264                                 MGMT_STATUS_NOT_SUPPORTED);
6265         }
6266
6267         hci_dev_lock(hdev);
6268
6269         if (pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev)) {
6270                 err = mgmt_cmd_status(sk, hdev->id,
6271                                 MGMT_OP_SET_ADVERTISING_DATA,
6272                                 MGMT_STATUS_BUSY);
6273                 goto unlocked;
6274         }
6275
6276         if (len > HCI_MAX_AD_LENGTH) {
6277                 err = mgmt_cmd_status(sk, hdev->id,
6278                                 MGMT_OP_SET_ADVERTISING_DATA,
6279                                 MGMT_STATUS_INVALID_PARAMS);
6280                 goto unlocked;
6281         }
6282
6283         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING_DATA,
6284                                hdev, data, len);
6285         if (!cmd) {
6286                 err = -ENOMEM;
6287                 goto unlocked;
6288         }
6289
6290         hci_req_init(&req, hdev);
6291
6292         memset(&adv, 0, sizeof(adv));
6293         memcpy(adv.data, cp->data, len);
6294         adv.length = len;
6295
6296         hci_req_add(&req, HCI_OP_LE_SET_ADV_DATA, sizeof(adv), &adv);
6297
6298         err = hci_req_run(&req, set_advertising_data_complete);
6299         if (err < 0)
6300                 mgmt_pending_remove(cmd);
6301
6302 unlocked:
6303         hci_dev_unlock(hdev);
6304
6305         return err;
6306 }
6307
6308 static void set_scan_rsp_data_complete(struct hci_dev *hdev, u8 status,
6309                         u16 opcode)
6310 {
6311         struct mgmt_cp_set_scan_rsp_data *cp;
6312         struct mgmt_pending_cmd *cmd;
6313
6314         BT_DBG("status 0x%02x", status);
6315
6316         hci_dev_lock(hdev);
6317
6318         cmd = pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev);
6319         if (!cmd)
6320                 goto unlock;
6321
6322         cp = cmd->param;
6323
6324         if (status)
6325                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6326                                 mgmt_status(status));
6327         else
6328                 mgmt_cmd_complete(cmd->sk, hdev->id,
6329                                 MGMT_OP_SET_SCAN_RSP_DATA, 0,
6330                                 cp, sizeof(*cp));
6331
6332         mgmt_pending_remove(cmd);
6333
6334 unlock:
6335         hci_dev_unlock(hdev);
6336 }
6337
6338 static int set_scan_rsp_data(struct sock *sk, struct hci_dev *hdev, void *data,
6339                         u16 len)
6340 {
6341         struct mgmt_pending_cmd *cmd;
6342         struct hci_request req;
6343         struct mgmt_cp_set_scan_rsp_data *cp = data;
6344         struct hci_cp_le_set_scan_rsp_data rsp;
6345         int err;
6346
6347         BT_DBG("%s", hdev->name);
6348
6349         if (!lmp_le_capable(hdev))
6350                 return mgmt_cmd_status(sk, hdev->id,
6351                                 MGMT_OP_SET_SCAN_RSP_DATA,
6352                                 MGMT_STATUS_NOT_SUPPORTED);
6353
6354         hci_dev_lock(hdev);
6355
6356         if (pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev)) {
6357                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6358                                 MGMT_STATUS_BUSY);
6359                 goto unlocked;
6360         }
6361
6362         if (len > HCI_MAX_AD_LENGTH) {
6363                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6364                                 MGMT_STATUS_INVALID_PARAMS);
6365                 goto unlocked;
6366         }
6367
6368         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SCAN_RSP_DATA, hdev, data, len);
6369         if (!cmd) {
6370                 err = -ENOMEM;
6371                 goto unlocked;
6372         }
6373
6374         hci_req_init(&req, hdev);
6375
6376         memset(&rsp, 0, sizeof(rsp));
6377         memcpy(rsp.data, cp->data, len);
6378         rsp.length = len;
6379
6380         hci_req_add(&req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(rsp), &rsp);
6381
6382         err = hci_req_run(&req, set_scan_rsp_data_complete);
6383         if (err < 0)
6384                 mgmt_pending_remove(cmd);
6385
6386 unlocked:
6387         hci_dev_unlock(hdev);
6388
6389         return err;
6390 }
6391
6392 /* Adv White List feature */
6393 static void add_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6394 {
6395         struct mgmt_cp_add_dev_white_list *cp;
6396         struct mgmt_pending_cmd *cmd;
6397
6398         BT_DBG("status 0x%02x", status);
6399
6400         hci_dev_lock(hdev);
6401
6402         cmd = pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev);
6403         if (!cmd)
6404                 goto unlock;
6405
6406         cp = cmd->param;
6407
6408         if (status)
6409                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6410                            mgmt_status(status));
6411         else
6412                 mgmt_cmd_complete(cmd->sk, hdev->id,
6413                                 MGMT_OP_ADD_DEV_WHITE_LIST, 0, cp, sizeof(*cp));
6414
6415         mgmt_pending_remove(cmd);
6416
6417 unlock:
6418         hci_dev_unlock(hdev);
6419 }
6420
6421 static int add_white_list(struct sock *sk, struct hci_dev *hdev,
6422                            void *data, u16 len)
6423 {
6424         struct mgmt_pending_cmd *cmd;
6425         struct mgmt_cp_add_dev_white_list *cp = data;
6426         struct hci_request req;
6427         int err;
6428
6429         BT_DBG("%s", hdev->name);
6430
6431         if (!lmp_le_capable(hdev))
6432                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6433                                   MGMT_STATUS_NOT_SUPPORTED);
6434
6435         if (!hdev_is_powered(hdev))
6436                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6437                                   MGMT_STATUS_REJECTED);
6438
6439         hci_dev_lock(hdev);
6440
6441         if (pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev)) {
6442                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6443                                 MGMT_STATUS_BUSY);
6444                 goto unlocked;
6445         }
6446
6447         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEV_WHITE_LIST, hdev, data, len);
6448         if (!cmd) {
6449                 err = -ENOMEM;
6450                 goto unlocked;
6451         }
6452
6453         hci_req_init(&req, hdev);
6454
6455         hci_req_add(&req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(*cp), cp);
6456
6457         err = hci_req_run(&req, add_white_list_complete);
6458         if (err < 0) {
6459                 mgmt_pending_remove(cmd);
6460                 goto unlocked;
6461         }
6462
6463 unlocked:
6464         hci_dev_unlock(hdev);
6465
6466         return err;
6467 }
6468
6469 static void remove_from_white_list_complete(struct hci_dev *hdev,
6470                         u8 status, u16 opcode)
6471 {
6472         struct mgmt_cp_remove_dev_from_white_list *cp;
6473         struct mgmt_pending_cmd *cmd;
6474
6475         BT_DBG("status 0x%02x", status);
6476
6477         hci_dev_lock(hdev);
6478
6479         cmd = pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev);
6480         if (!cmd)
6481                 goto unlock;
6482
6483         cp = cmd->param;
6484
6485         if (status)
6486                 mgmt_cmd_status(cmd->sk, hdev->id,
6487                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6488                         mgmt_status(status));
6489         else
6490                 mgmt_cmd_complete(cmd->sk, hdev->id,
6491                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, 0,
6492                         cp, sizeof(*cp));
6493
6494         mgmt_pending_remove(cmd);
6495
6496 unlock:
6497         hci_dev_unlock(hdev);
6498 }
6499
6500 static int remove_from_white_list(struct sock *sk, struct hci_dev *hdev,
6501                            void *data, u16 len)
6502 {
6503         struct mgmt_pending_cmd *cmd;
6504         struct mgmt_cp_remove_dev_from_white_list *cp = data;
6505         struct hci_request req;
6506         int err;
6507
6508         BT_DBG("%s", hdev->name);
6509
6510         if (!lmp_le_capable(hdev))
6511                 return mgmt_cmd_status(sk, hdev->id,
6512                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6513                                 MGMT_STATUS_NOT_SUPPORTED);
6514
6515         if (!hdev_is_powered(hdev))
6516                 return mgmt_cmd_status(sk, hdev->id,
6517                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6518                                 MGMT_STATUS_REJECTED);
6519
6520         hci_dev_lock(hdev);
6521
6522         if (pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev)) {
6523                 err = mgmt_cmd_status(sk, hdev->id,
6524                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6525                                 MGMT_STATUS_BUSY);
6526                 goto unlocked;
6527         }
6528
6529         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6530                                 hdev, data, len);
6531         if (!cmd) {
6532                 err = -ENOMEM;
6533                 goto unlocked;
6534         }
6535
6536         hci_req_init(&req, hdev);
6537
6538         hci_req_add(&req, HCI_OP_LE_DEL_FROM_WHITE_LIST, sizeof(*cp), cp);
6539
6540         err = hci_req_run(&req, remove_from_white_list_complete);
6541         if (err < 0) {
6542                 mgmt_pending_remove(cmd);
6543                 goto unlocked;
6544         }
6545
6546 unlocked:
6547         hci_dev_unlock(hdev);
6548
6549         return err;
6550 }
6551
6552 static void clear_white_list_complete(struct hci_dev *hdev, u8 status,
6553                         u16 opcode)
6554 {
6555         struct mgmt_pending_cmd *cmd;
6556
6557         BT_DBG("status 0x%02x", status);
6558
6559         hci_dev_lock(hdev);
6560
6561         cmd = pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev);
6562         if (!cmd)
6563                 goto unlock;
6564
6565         if (status)
6566                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
6567                            mgmt_status(status));
6568         else
6569                 mgmt_cmd_complete(cmd->sk, hdev->id,
6570                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6571                                 0, NULL, 0);
6572
6573         mgmt_pending_remove(cmd);
6574
6575 unlock:
6576         hci_dev_unlock(hdev);
6577 }
6578
6579 static int clear_white_list(struct sock *sk, struct hci_dev *hdev,
6580                            void *data, u16 len)
6581 {
6582         struct mgmt_pending_cmd *cmd;
6583         struct hci_request req;
6584         int err;
6585
6586         BT_DBG("%s", hdev->name);
6587
6588         if (!lmp_le_capable(hdev))
6589                 return mgmt_cmd_status(sk, hdev->id,
6590                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6591                                 MGMT_STATUS_NOT_SUPPORTED);
6592
6593         if (!hdev_is_powered(hdev))
6594                 return mgmt_cmd_status(sk, hdev->id,
6595                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6596                                 MGMT_STATUS_REJECTED);
6597
6598         hci_dev_lock(hdev);
6599
6600         if (pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev)) {
6601                 err = mgmt_cmd_status(sk, hdev->id,
6602                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6603                                 MGMT_STATUS_BUSY);
6604                 goto unlocked;
6605         }
6606
6607         cmd = mgmt_pending_add(sk, MGMT_OP_CLEAR_DEV_WHITE_LIST,
6608                                 hdev, NULL, 0);
6609         if (!cmd) {
6610                 err = -ENOMEM;
6611                 goto unlocked;
6612         }
6613
6614         hci_req_init(&req, hdev);
6615
6616         hci_req_add(&req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
6617
6618         err = hci_req_run(&req, clear_white_list_complete);
6619         if (err < 0) {
6620                 mgmt_pending_remove(cmd);
6621                 goto unlocked;
6622         }
6623
6624 unlocked:
6625         hci_dev_unlock(hdev);
6626
6627         return err;
6628 }
6629
6630 static void set_rssi_threshold_complete(struct hci_dev *hdev,
6631                         u8 status, u16 opcode)
6632 {
6633         struct mgmt_pending_cmd *cmd;
6634
6635         BT_DBG("status 0x%02x", status);
6636
6637         hci_dev_lock(hdev);
6638
6639         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6640         if (!cmd)
6641                 goto unlock;
6642
6643         if (status)
6644                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6645                                 mgmt_status(status));
6646         else
6647                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
6648                                 NULL, 0);
6649
6650         mgmt_pending_remove(cmd);
6651
6652 unlock:
6653         hci_dev_unlock(hdev);
6654 }
6655
6656 static void set_rssi_disable_complete(struct hci_dev *hdev,
6657                         u8 status, u16 opcode)
6658 {
6659         struct mgmt_pending_cmd *cmd;
6660
6661         BT_DBG("status 0x%02x", status);
6662
6663         hci_dev_lock(hdev);
6664
6665         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6666         if (!cmd)
6667                 goto unlock;
6668
6669         if (status)
6670                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6671                                 mgmt_status(status));
6672         else
6673                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6674                                 0, NULL, 0);
6675
6676         mgmt_pending_remove(cmd);
6677
6678 unlock:
6679         hci_dev_unlock(hdev);
6680 }
6681
6682 int mgmt_set_rssi_threshold(struct sock *sk, struct hci_dev *hdev,
6683                 void *data, u16 len)
6684 {
6685         int err = 0;
6686         struct hci_cp_set_rssi_threshold th = { 0, };
6687         struct mgmt_cp_set_enable_rssi *cp = data;
6688         struct hci_conn *conn;
6689         struct mgmt_pending_cmd *cmd;
6690         struct hci_request req;
6691         __u8 dest_type;
6692
6693         hci_dev_lock(hdev);
6694
6695         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6696         if (!cmd) {
6697                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6698                                 MGMT_STATUS_FAILED);
6699                 goto unlocked;
6700         }
6701
6702         if (!lmp_le_capable(hdev)) {
6703                 mgmt_pending_remove(cmd);
6704                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6705                                 MGMT_STATUS_NOT_SUPPORTED);
6706                 goto unlocked;
6707         }
6708
6709         if (!hdev_is_powered(hdev)) {
6710                 BT_DBG("%s", hdev->name);
6711                 mgmt_pending_remove(cmd);
6712                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6713                                 MGMT_STATUS_NOT_POWERED);
6714                 goto unlocked;
6715         }
6716
6717         if (cp->link_type == 0x01)
6718                 dest_type = LE_LINK;
6719         else
6720                 dest_type = ACL_LINK;
6721
6722         /* Get LE/ACL link handle info */
6723         conn = hci_conn_hash_lookup_ba(hdev,
6724                         dest_type, &cp->bdaddr);
6725
6726         if (!conn) {
6727                 err = mgmt_cmd_complete(sk, hdev->id,
6728                                 MGMT_OP_SET_RSSI_ENABLE, 1, NULL, 0);
6729                 mgmt_pending_remove(cmd);
6730                 goto unlocked;
6731         }
6732
6733         hci_req_init(&req, hdev);
6734
6735         th.hci_le_ext_opcode = 0x0B;
6736         th.mode = 0x01;
6737         th.conn_handle = conn->handle;
6738         th.alert_mask = 0x07;
6739         th.low_th = cp->low_th;
6740         th.in_range_th = cp->in_range_th;
6741         th.high_th = cp->high_th;
6742
6743         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
6744         err = hci_req_run(&req, set_rssi_threshold_complete);
6745
6746         if (err < 0) {
6747                 mgmt_pending_remove(cmd);
6748                 BT_ERR("Error in requesting hci_req_run");
6749                 goto unlocked;
6750         }
6751
6752 unlocked:
6753         hci_dev_unlock(hdev);
6754         return err;
6755 }
6756
6757 void mgmt_rssi_enable_success(struct sock *sk, struct hci_dev *hdev,
6758                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6759 {
6760         struct mgmt_cc_rsp_enable_rssi mgmt_rp = { 0, };
6761         struct mgmt_cp_set_enable_rssi *cp = data;
6762         struct mgmt_pending_cmd *cmd;
6763
6764         if (!cp || !rp)
6765                 goto remove_cmd;
6766
6767         mgmt_rp.status = rp->status;
6768         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6769         mgmt_rp.bt_address = cp->bdaddr;
6770         mgmt_rp.link_type = cp->link_type;
6771
6772         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6773                         MGMT_STATUS_SUCCESS, &mgmt_rp,
6774                         sizeof(struct mgmt_cc_rsp_enable_rssi));
6775
6776         mgmt_event(MGMT_EV_RSSI_ENABLED, hdev, &mgmt_rp,
6777                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6778
6779         hci_conn_rssi_unset_all(hdev, mgmt_rp.link_type);
6780         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6781                         &mgmt_rp.bt_address, true);
6782
6783 remove_cmd:
6784         hci_dev_lock(hdev);
6785         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6786         if (cmd)
6787                 mgmt_pending_remove(cmd);
6788
6789         hci_dev_unlock(hdev);
6790 }
6791
6792 void mgmt_rssi_disable_success(struct sock *sk, struct hci_dev *hdev,
6793                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6794 {
6795         struct mgmt_cc_rp_disable_rssi mgmt_rp = { 0, };
6796         struct mgmt_cp_disable_rssi *cp = data;
6797         struct mgmt_pending_cmd *cmd;
6798
6799         if (!cp || !rp)
6800                 goto remove_cmd;
6801
6802         mgmt_rp.status = rp->status;
6803         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6804         mgmt_rp.bt_address = cp->bdaddr;
6805         mgmt_rp.link_type = cp->link_type;
6806
6807         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6808                         MGMT_STATUS_SUCCESS, &mgmt_rp,
6809                         sizeof(struct mgmt_cc_rsp_enable_rssi));
6810
6811         mgmt_event(MGMT_EV_RSSI_DISABLED, hdev, &mgmt_rp,
6812                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6813
6814         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6815                         &mgmt_rp.bt_address, false);
6816
6817 remove_cmd:
6818         hci_dev_lock(hdev);
6819         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6820         if (cmd)
6821                 mgmt_pending_remove(cmd);
6822
6823         hci_dev_unlock(hdev);
6824 }
6825
6826 static int mgmt_set_disable_rssi(struct sock *sk, struct hci_dev *hdev,
6827                 void *data, u16 len)
6828 {
6829         struct mgmt_pending_cmd *cmd;
6830         struct hci_request req;
6831         struct hci_cp_set_enable_rssi cp_en = { 0, };
6832         int err;
6833
6834         BT_DBG("Set Disable RSSI.");
6835
6836         cp_en.hci_le_ext_opcode = 0x01;
6837         cp_en.le_enable_cs_Features = 0x00;
6838         cp_en.data[0] = 0x00;
6839         cp_en.data[1] = 0x00;
6840         cp_en.data[2] = 0x00;
6841
6842         hci_dev_lock(hdev);
6843
6844         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6845         if (!cmd) {
6846                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6847                                 MGMT_STATUS_FAILED);
6848                 goto unlocked;
6849         }
6850
6851         if (!lmp_le_capable(hdev)) {
6852                 mgmt_pending_remove(cmd);
6853                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6854                                 MGMT_STATUS_NOT_SUPPORTED);
6855                 goto unlocked;
6856         }
6857
6858         if (!hdev_is_powered(hdev)) {
6859                 BT_DBG("%s", hdev->name);
6860                 mgmt_pending_remove(cmd);
6861                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6862                                 MGMT_STATUS_NOT_POWERED);
6863                 goto unlocked;
6864         }
6865
6866         hci_req_init(&req, hdev);
6867
6868         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
6869                         sizeof(struct hci_cp_set_enable_rssi),
6870                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
6871                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
6872
6873         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
6874         err = hci_req_run(&req, set_rssi_disable_complete);
6875
6876         if (err < 0) {
6877                 mgmt_pending_remove(cmd);
6878                 BT_ERR("Error in requesting hci_req_run");
6879                 goto unlocked;
6880         }
6881
6882 unlocked:
6883         hci_dev_unlock(hdev);
6884         return err;
6885 }
6886
6887 void mgmt_enable_rssi_cc(struct hci_dev *hdev, void *response, u8 status)
6888 {
6889         struct hci_cc_rsp_enable_rssi *rp = response;
6890         struct mgmt_pending_cmd *cmd_enable = NULL;
6891         struct mgmt_pending_cmd *cmd_disable = NULL;
6892         struct mgmt_cp_set_enable_rssi *cp_en;
6893         struct mgmt_cp_disable_rssi *cp_dis;
6894
6895         hci_dev_lock(hdev);
6896         cmd_enable = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6897         cmd_disable = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6898         hci_dev_unlock(hdev);
6899
6900         if (cmd_enable)
6901                 BT_DBG("Enable Request");
6902
6903         if (cmd_disable)
6904                 BT_DBG("Disable Request");
6905
6906         if (cmd_enable) {
6907                 cp_en = cmd_enable->param;
6908
6909                 if (status != 0x00)
6910                         return;
6911
6912                 switch (rp->le_ext_opcode) {
6913                 case 0x01:
6914                         BT_DBG("RSSI enabled.. Setting Threshold...");
6915                         mgmt_set_rssi_threshold(cmd_enable->sk, hdev,
6916                                         cp_en, sizeof(*cp_en));
6917                         break;
6918
6919                 case 0x0B:
6920                         BT_DBG("Sending RSSI enable success");
6921                         mgmt_rssi_enable_success(cmd_enable->sk, hdev,
6922                                         cp_en, rp, rp->status);
6923                         break;
6924                 }
6925
6926         } else if (cmd_disable) {
6927                 cp_dis = cmd_disable->param;
6928
6929                 if (status != 0x00)
6930                         return;
6931
6932                 switch (rp->le_ext_opcode) {
6933                 case 0x01:
6934                         BT_DBG("Sending RSSI disable success");
6935                         mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6936                                         cp_dis, rp, rp->status);
6937                         break;
6938
6939                 case 0x0B:
6940                         /*
6941                          * Only unset RSSI Threshold values for the Link if
6942                          * RSSI is monitored for other BREDR or LE Links
6943                          */
6944                         if (hci_conn_hash_lookup_rssi_count(hdev) > 1) {
6945                                 BT_DBG("Unset Threshold. Other links being monitored");
6946                                 mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6947                                                 cp_dis, rp, rp->status);
6948                         } else {
6949                                 BT_DBG("Unset Threshold. Disabling...");
6950                                 mgmt_set_disable_rssi(cmd_disable->sk, hdev,
6951                                                 cp_dis, sizeof(*cp_dis));
6952                         }
6953                         break;
6954                 }
6955         }
6956 }
6957
6958 static void set_rssi_enable_complete(struct hci_dev *hdev, u8 status,
6959                 u16 opcode)
6960 {
6961         struct mgmt_pending_cmd *cmd;
6962
6963         BT_DBG("status 0x%02x", status);
6964
6965         hci_dev_lock(hdev);
6966
6967         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6968         if (!cmd)
6969                 goto unlock;
6970
6971         if (status)
6972                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6973                                 mgmt_status(status));
6974         else
6975                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
6976                                 NULL, 0);
6977
6978         mgmt_pending_remove(cmd);
6979
6980 unlock:
6981         hci_dev_unlock(hdev);
6982 }
6983
6984 static int set_enable_rssi(struct sock *sk, struct hci_dev *hdev,
6985                 void *data, u16 len)
6986 {
6987         struct mgmt_pending_cmd *cmd;
6988         struct hci_request req;
6989         struct mgmt_cp_set_enable_rssi *cp = data;
6990         struct hci_cp_set_enable_rssi cp_en = { 0, };
6991         int err;
6992
6993         BT_DBG("Set Enable RSSI.");
6994
6995         cp_en.hci_le_ext_opcode = 0x01;
6996         cp_en.le_enable_cs_Features = 0x04;
6997         cp_en.data[0] = 0x00;
6998         cp_en.data[1] = 0x00;
6999         cp_en.data[2] = 0x00;
7000
7001         hci_dev_lock(hdev);
7002
7003         if (!lmp_le_capable(hdev)) {
7004                 err =  mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7005                                 MGMT_STATUS_NOT_SUPPORTED);
7006                 goto unlocked;
7007         }
7008
7009         if (!hdev_is_powered(hdev)) {
7010                 BT_DBG("%s", hdev->name);
7011                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7012                                 MGMT_STATUS_NOT_POWERED);
7013                 goto unlocked;
7014         }
7015
7016         if (pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev)) {
7017                 BT_DBG("%s", hdev->name);
7018                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7019                                 MGMT_STATUS_BUSY);
7020                 goto unlocked;
7021         }
7022
7023         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_ENABLE, hdev, cp,
7024                         sizeof(*cp));
7025         if (!cmd) {
7026                 BT_DBG("%s", hdev->name);
7027                 err = -ENOMEM;
7028                 goto unlocked;
7029         }
7030
7031         /* If RSSI is already enabled directly set Threshold values */
7032         if (hci_conn_hash_lookup_rssi_count(hdev) > 0) {
7033                 hci_dev_unlock(hdev);
7034                 BT_DBG("RSSI Enabled. Directly set Threshold");
7035                 err = mgmt_set_rssi_threshold(sk, hdev, cp, sizeof(*cp));
7036                 return err;
7037         }
7038
7039         hci_req_init(&req, hdev);
7040
7041         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
7042                         sizeof(struct hci_cp_set_enable_rssi),
7043                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
7044                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
7045
7046         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
7047         err = hci_req_run(&req, set_rssi_enable_complete);
7048
7049         if (err < 0) {
7050                 mgmt_pending_remove(cmd);
7051                 BT_ERR("Error in requesting hci_req_run");
7052                 goto unlocked;
7053         }
7054
7055 unlocked:
7056         hci_dev_unlock(hdev);
7057
7058         return err;
7059 }
7060
7061 static void get_raw_rssi_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7062 {
7063         struct mgmt_pending_cmd *cmd;
7064
7065         BT_DBG("status 0x%02x", status);
7066
7067         hci_dev_lock(hdev);
7068
7069         cmd = pending_find(MGMT_OP_GET_RAW_RSSI, hdev);
7070         if (!cmd)
7071                 goto unlock;
7072
7073         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7074                         MGMT_STATUS_SUCCESS, &status, 1);
7075
7076         mgmt_pending_remove(cmd);
7077
7078 unlock:
7079         hci_dev_unlock(hdev);
7080 }
7081
7082 static int get_raw_rssi(struct sock *sk, struct hci_dev *hdev, void *data,
7083                         u16 len)
7084 {
7085         struct mgmt_pending_cmd *cmd;
7086         struct hci_request req;
7087         struct mgmt_cp_get_raw_rssi *cp = data;
7088         struct hci_cp_get_raw_rssi hci_cp;
7089
7090         struct hci_conn *conn;
7091         int err;
7092         __u8 dest_type;
7093
7094         BT_DBG("Get Raw RSSI.");
7095
7096         hci_dev_lock(hdev);
7097
7098         if (!lmp_le_capable(hdev)) {
7099                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7100                                 MGMT_STATUS_NOT_SUPPORTED);
7101                 goto unlocked;
7102         }
7103
7104         if (cp->link_type == 0x01)
7105                 dest_type = LE_LINK;
7106         else
7107                 dest_type = ACL_LINK;
7108
7109         /* Get LE/BREDR link handle info */
7110         conn = hci_conn_hash_lookup_ba(hdev,
7111                         dest_type, &cp->bt_address);
7112         if (!conn) {
7113                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7114                                                    MGMT_STATUS_NOT_CONNECTED);
7115                 goto unlocked;
7116         }
7117         hci_cp.conn_handle = conn->handle;
7118
7119         if (!hdev_is_powered(hdev)) {
7120                 BT_DBG("%s", hdev->name);
7121                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7122                                 MGMT_STATUS_NOT_POWERED);
7123                 goto unlocked;
7124         }
7125
7126         if (pending_find(MGMT_OP_GET_RAW_RSSI, hdev)) {
7127                 BT_DBG("%s", hdev->name);
7128                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7129                                 MGMT_STATUS_BUSY);
7130                 goto unlocked;
7131         }
7132
7133         cmd = mgmt_pending_add(sk, MGMT_OP_GET_RAW_RSSI, hdev, data, len);
7134         if (!cmd) {
7135                 BT_DBG("%s", hdev->name);
7136                 err = -ENOMEM;
7137                 goto unlocked;
7138         }
7139
7140         hci_req_init(&req, hdev);
7141
7142         BT_DBG("Connection Handle [%d]", hci_cp.conn_handle);
7143         hci_req_add(&req, HCI_OP_GET_RAW_RSSI, sizeof(hci_cp), &hci_cp);
7144         err = hci_req_run(&req, get_raw_rssi_complete);
7145
7146         if (err < 0) {
7147                 mgmt_pending_remove(cmd);
7148                 BT_ERR("Error in requesting hci_req_run");
7149         }
7150
7151 unlocked:
7152         hci_dev_unlock(hdev);
7153
7154         return err;
7155 }
7156
7157 void mgmt_raw_rssi_response(struct hci_dev *hdev,
7158                 struct hci_cc_rp_get_raw_rssi *rp, int success)
7159 {
7160         struct mgmt_cc_rp_get_raw_rssi mgmt_rp = { 0, };
7161         struct hci_conn *conn;
7162
7163         mgmt_rp.status = rp->status;
7164         mgmt_rp.rssi_dbm = rp->rssi_dbm;
7165
7166         conn = hci_conn_hash_lookup_handle(hdev, rp->conn_handle);
7167         if (!conn)
7168                 return;
7169
7170         bacpy(&mgmt_rp.bt_address, &conn->dst);
7171         if (conn->type == LE_LINK)
7172                 mgmt_rp.link_type = 0x01;
7173         else
7174                 mgmt_rp.link_type = 0x00;
7175
7176         mgmt_event(MGMT_EV_RAW_RSSI, hdev, &mgmt_rp,
7177                         sizeof(struct mgmt_cc_rp_get_raw_rssi), NULL);
7178 }
7179
7180 static void set_disable_threshold_complete(struct hci_dev *hdev,
7181                         u8 status, u16 opcode)
7182 {
7183         struct mgmt_pending_cmd *cmd;
7184
7185         BT_DBG("status 0x%02x", status);
7186
7187         hci_dev_lock(hdev);
7188
7189         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7190         if (!cmd)
7191                 goto unlock;
7192
7193         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7194                         MGMT_STATUS_SUCCESS, &status, 1);
7195
7196         mgmt_pending_remove(cmd);
7197
7198 unlock:
7199         hci_dev_unlock(hdev);
7200 }
7201
7202 /** Removes monitoring for a link*/
7203 static int set_disable_threshold(struct sock *sk, struct hci_dev *hdev,
7204                 void *data, u16 len)
7205 {
7206         int err = 0;
7207         struct hci_cp_set_rssi_threshold th = { 0, };
7208         struct mgmt_cp_disable_rssi *cp = data;
7209         struct hci_conn *conn;
7210         struct mgmt_pending_cmd *cmd;
7211         struct hci_request req;
7212         __u8 dest_type;
7213
7214         BT_DBG("Set Disable RSSI.");
7215
7216         hci_dev_lock(hdev);
7217
7218         if (!lmp_le_capable(hdev)) {
7219                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7220                                 MGMT_STATUS_NOT_SUPPORTED);
7221                 goto unlocked;
7222         }
7223
7224         /* Get LE/ACL link handle info*/
7225         if (cp->link_type == 0x01)
7226                 dest_type = LE_LINK;
7227         else
7228                 dest_type = ACL_LINK;
7229
7230         conn = hci_conn_hash_lookup_ba(hdev, dest_type, &cp->bdaddr);
7231         if (!conn) {
7232                 err = mgmt_cmd_complete(sk, hdev->id,
7233                                 MGMT_OP_SET_RSSI_DISABLE, 1, NULL, 0);
7234                 goto unlocked;
7235         }
7236
7237         th.hci_le_ext_opcode = 0x0B;
7238         th.mode = 0x01;
7239         th.conn_handle = conn->handle;
7240         th.alert_mask = 0x00;
7241         th.low_th = 0x00;
7242         th.in_range_th = 0x00;
7243         th.high_th = 0x00;
7244
7245         if (!hdev_is_powered(hdev)) {
7246                 BT_DBG("%s", hdev->name);
7247                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7248                                 0, data, len);
7249                 goto unlocked;
7250         }
7251
7252         if (pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev)) {
7253                 BT_DBG("%s", hdev->name);
7254                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7255                                 MGMT_STATUS_BUSY);
7256                 goto unlocked;
7257         }
7258
7259         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_DISABLE, hdev, cp,
7260                         sizeof(*cp));
7261         if (!cmd) {
7262                 BT_DBG("%s", hdev->name);
7263                 err = -ENOMEM;
7264                 goto unlocked;
7265         }
7266
7267         hci_req_init(&req, hdev);
7268
7269         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
7270         err = hci_req_run(&req, set_disable_threshold_complete);
7271         if (err < 0) {
7272                 mgmt_pending_remove(cmd);
7273                 BT_ERR("Error in requesting hci_req_run");
7274                 goto unlocked;
7275         }
7276
7277 unlocked:
7278         hci_dev_unlock(hdev);
7279
7280         return err;
7281 }
7282
7283 void mgmt_rssi_alert_evt(struct hci_dev *hdev, u16 conn_handle,
7284                 s8 alert_type, s8 rssi_dbm)
7285 {
7286         struct mgmt_ev_vendor_specific_rssi_alert mgmt_ev;
7287         struct hci_conn *conn;
7288
7289         BT_DBG("RSSI alert [%2.2X %2.2X %2.2X]",
7290                         conn_handle, alert_type, rssi_dbm);
7291
7292         conn = hci_conn_hash_lookup_handle(hdev, conn_handle);
7293
7294         if (!conn) {
7295                 BT_ERR("RSSI alert Error: Device not found for handle");
7296                 return;
7297         }
7298         bacpy(&mgmt_ev.bdaddr, &conn->dst);
7299
7300         if (conn->type == LE_LINK)
7301                 mgmt_ev.link_type = 0x01;
7302         else
7303                 mgmt_ev.link_type = 0x00;
7304
7305         mgmt_ev.alert_type = alert_type;
7306         mgmt_ev.rssi_dbm = rssi_dbm;
7307
7308         mgmt_event(MGMT_EV_RSSI_ALERT, hdev, &mgmt_ev,
7309                         sizeof(struct mgmt_ev_vendor_specific_rssi_alert),
7310                         NULL);
7311 }
7312
7313 static int mgmt_start_le_discovery_failed(struct hci_dev *hdev, u8 status)
7314 {
7315         struct mgmt_pending_cmd *cmd;
7316         u8 type;
7317         int err;
7318
7319         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
7320
7321         cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
7322         if (!cmd)
7323                 return -ENOENT;
7324
7325         type = hdev->le_discovery.type;
7326
7327         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
7328                                 mgmt_status(status), &type, sizeof(type));
7329         mgmt_pending_remove(cmd);
7330
7331         return err;
7332 }
7333
7334 static void start_le_discovery_complete(struct hci_dev *hdev, u8 status,
7335                 u16 opcode)
7336 {
7337         unsigned long timeout = 0;
7338
7339         BT_DBG("status %d", status);
7340
7341         if (status) {
7342                 hci_dev_lock(hdev);
7343                 mgmt_start_le_discovery_failed(hdev, status);
7344                 hci_dev_unlock(hdev);
7345                 return;
7346         }
7347
7348         hci_dev_lock(hdev);
7349         hci_le_discovery_set_state(hdev, DISCOVERY_FINDING);
7350         hci_dev_unlock(hdev);
7351
7352         if (hdev->le_discovery.type != DISCOV_TYPE_LE)
7353                 BT_ERR("Invalid discovery type %d", hdev->le_discovery.type);
7354
7355         if (!timeout)
7356                 return;
7357
7358         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
7359 }
7360
7361 static int start_le_discovery(struct sock *sk, struct hci_dev *hdev,
7362                 void *data, u16 len)
7363 {
7364         struct mgmt_cp_start_le_discovery *cp = data;
7365         struct mgmt_pending_cmd *cmd;
7366         struct hci_cp_le_set_scan_param param_cp;
7367         struct hci_cp_le_set_scan_enable enable_cp;
7368         struct hci_request req;
7369         u8 status, own_addr_type;
7370         int err;
7371
7372         BT_DBG("%s", hdev->name);
7373
7374         hci_dev_lock(hdev);
7375
7376         if (!hdev_is_powered(hdev)) {
7377                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7378                                 MGMT_STATUS_NOT_POWERED);
7379                 goto unlock;
7380         }
7381
7382         if (hdev->le_discovery.state != DISCOVERY_STOPPED) {
7383                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7384                                 MGMT_STATUS_BUSY);
7385                 goto unlock;
7386         }
7387
7388         if (cp->type != DISCOV_TYPE_LE) {
7389                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7390                                 MGMT_STATUS_INVALID_PARAMS);
7391                 goto unlock;
7392         }
7393
7394         cmd = mgmt_pending_add(sk, MGMT_OP_START_LE_DISCOVERY, hdev, NULL, 0);
7395         if (!cmd) {
7396                 err = -ENOMEM;
7397                 goto unlock;
7398         }
7399
7400         hdev->le_discovery.type = cp->type;
7401
7402         hci_req_init(&req, hdev);
7403
7404         status = mgmt_le_support(hdev);
7405         if (status) {
7406                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7407                                 status);
7408                 mgmt_pending_remove(cmd);
7409                 goto unlock;
7410         }
7411
7412         /* If controller is scanning, it means the background scanning
7413          * is running. Thus, we should temporarily stop it in order to
7414          * set the discovery scanning parameters.
7415          */
7416         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
7417                 hci_req_add_le_scan_disable(&req, false);
7418
7419         memset(&param_cp, 0, sizeof(param_cp));
7420
7421         /* All active scans will be done with either a resolvable
7422          * private address (when privacy feature has been enabled)
7423          * or unresolvable private address.
7424          */
7425         err = hci_update_random_address(&req, true, hci_dev_test_flag(hdev, HCI_PRIVACY), &own_addr_type);
7426         if (err < 0) {
7427                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7428                                 MGMT_STATUS_FAILED);
7429                 mgmt_pending_remove(cmd);
7430                 goto unlock;
7431         }
7432
7433         param_cp.type = hdev->le_scan_type;
7434         param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
7435         param_cp.window = cpu_to_le16(hdev->le_scan_window);
7436         param_cp.own_address_type = own_addr_type;
7437         hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
7438                     &param_cp);
7439
7440         memset(&enable_cp, 0, sizeof(enable_cp));
7441         enable_cp.enable = LE_SCAN_ENABLE;
7442         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
7443
7444         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
7445                     &enable_cp);
7446
7447         err = hci_req_run(&req, start_le_discovery_complete);
7448         if (err < 0)
7449                 mgmt_pending_remove(cmd);
7450         else
7451                 hci_le_discovery_set_state(hdev, DISCOVERY_STARTING);
7452
7453 unlock:
7454         hci_dev_unlock(hdev);
7455         return err;
7456 }
7457
7458 static int mgmt_stop_le_discovery_failed(struct hci_dev *hdev, u8 status)
7459 {
7460         struct mgmt_pending_cmd *cmd;
7461         int err;
7462
7463         cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
7464         if (!cmd)
7465                 return -ENOENT;
7466
7467         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
7468                                 mgmt_status(status), &hdev->le_discovery.type,
7469                                 sizeof(hdev->le_discovery.type));
7470         mgmt_pending_remove(cmd);
7471
7472         return err;
7473 }
7474
7475 static void stop_le_discovery_complete(struct hci_dev *hdev, u8 status,
7476                 u16 opcode)
7477 {
7478         BT_DBG("status %d", status);
7479
7480         hci_dev_lock(hdev);
7481
7482         if (status) {
7483                 mgmt_stop_le_discovery_failed(hdev, status);
7484                 goto unlock;
7485         }
7486
7487         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
7488
7489 unlock:
7490         hci_dev_unlock(hdev);
7491 }
7492
7493 static int stop_le_discovery(struct sock *sk, struct hci_dev *hdev,
7494                 void *data, u16 len)
7495 {
7496         struct mgmt_cp_stop_le_discovery *mgmt_cp = data;
7497         struct mgmt_pending_cmd *cmd;
7498         struct hci_request req;
7499         int err;
7500
7501         BT_DBG("%s", hdev->name);
7502
7503         hci_dev_lock(hdev);
7504
7505         if (!hci_le_discovery_active(hdev)) {
7506                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7507                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
7508                                         sizeof(mgmt_cp->type));
7509                 goto unlock;
7510         }
7511
7512         if (hdev->le_discovery.type != mgmt_cp->type) {
7513                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7514                                         MGMT_STATUS_INVALID_PARAMS,
7515                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
7516                 goto unlock;
7517         }
7518
7519         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_LE_DISCOVERY, hdev, NULL, 0);
7520         if (!cmd) {
7521                 err = -ENOMEM;
7522                 goto unlock;
7523         }
7524
7525         hci_req_init(&req, hdev);
7526
7527         if (hdev->le_discovery.state  != DISCOVERY_FINDING) {
7528                 BT_DBG("unknown le discovery state %u",
7529                                         hdev->le_discovery.state);
7530
7531                 mgmt_pending_remove(cmd);
7532                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7533                                         MGMT_STATUS_FAILED, &mgmt_cp->type,
7534                                         sizeof(mgmt_cp->type));
7535                 goto unlock;
7536         }
7537
7538         cancel_delayed_work(&hdev->le_scan_disable);
7539         hci_req_add_le_scan_disable(&req, false);
7540
7541         err = hci_req_run(&req, stop_le_discovery_complete);
7542         if (err < 0)
7543                 mgmt_pending_remove(cmd);
7544         else
7545                 hci_le_discovery_set_state(hdev, DISCOVERY_STOPPING);
7546
7547 unlock:
7548         hci_dev_unlock(hdev);
7549         return err;
7550 }
7551
7552 /* Separate LE discovery */
7553 void mgmt_le_discovering(struct hci_dev *hdev, u8 discovering)
7554 {
7555         struct mgmt_ev_discovering ev;
7556         struct mgmt_pending_cmd *cmd;
7557
7558         BT_DBG("%s le discovering %u", hdev->name, discovering);
7559
7560         if (discovering)
7561                 cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
7562         else
7563                 cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
7564
7565         if (cmd) {
7566                 u8 type = hdev->le_discovery.type;
7567
7568                 mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
7569                                   sizeof(type));
7570                 mgmt_pending_remove(cmd);
7571         }
7572
7573         memset(&ev, 0, sizeof(ev));
7574         ev.type = hdev->le_discovery.type;
7575         ev.discovering = discovering;
7576
7577         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7578 }
7579
7580 static int disable_le_auto_connect(struct sock *sk, struct hci_dev *hdev,
7581                         void *data, u16 len)
7582 {
7583         int err;
7584
7585         BT_DBG("%s", hdev->name);
7586
7587         hci_dev_lock(hdev);
7588
7589         err = hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
7590         if (err < 0)
7591                 BT_ERR("HCI_OP_LE_CREATE_CONN_CANCEL is failed");
7592
7593         hci_dev_unlock(hdev);
7594
7595         return err;
7596 }
7597
7598 static inline int check_le_conn_update_param(u16 min, u16 max, u16 latency,
7599                 u16 to_multiplier)
7600 {
7601         u16 max_latency;
7602
7603         if (min > max || min < 6 || max > 3200)
7604                 return -EINVAL;
7605
7606         if (to_multiplier < 10 || to_multiplier > 3200)
7607                 return -EINVAL;
7608
7609         if (max >= to_multiplier * 8)
7610                 return -EINVAL;
7611
7612         max_latency = (to_multiplier * 8 / max) - 1;
7613
7614         if (latency > 499 || latency > max_latency)
7615                 return -EINVAL;
7616
7617         return 0;
7618 }
7619
7620 static int le_conn_update(struct sock *sk, struct hci_dev *hdev, void *data,
7621                 u16 len)
7622 {
7623         struct mgmt_cp_le_conn_update *cp = data;
7624
7625         struct hci_conn *conn;
7626         u16 min, max, latency, supervision_timeout;
7627         int err = -1;
7628
7629         if (!hdev_is_powered(hdev))
7630                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7631                                 MGMT_STATUS_NOT_POWERED);
7632
7633         min = __le16_to_cpu(cp->conn_interval_min);
7634         max = __le16_to_cpu(cp->conn_interval_max);
7635         latency = __le16_to_cpu(cp->conn_latency);
7636         supervision_timeout = __le16_to_cpu(cp->supervision_timeout);
7637
7638         BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x supervision_timeout: 0x%4.4x",
7639                         min, max, latency, supervision_timeout);
7640
7641         err = check_le_conn_update_param(min, max, latency,
7642                         supervision_timeout);
7643
7644         if (err < 0)
7645                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7646                                 MGMT_STATUS_INVALID_PARAMS);
7647
7648         hci_dev_lock(hdev);
7649
7650         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
7651         if (!conn) {
7652                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7653                                 MGMT_STATUS_NOT_CONNECTED);
7654                 hci_dev_unlock(hdev);
7655                 return err;
7656         }
7657
7658         hci_dev_unlock(hdev);
7659
7660         hci_le_conn_update(conn, min, max, latency, supervision_timeout);
7661
7662         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE, 0,
7663                                  NULL, 0);
7664 }
7665
7666 static void set_manufacturer_data_complete(struct hci_dev *hdev, u8 status,
7667                 u16 opcode)
7668 {
7669         struct mgmt_cp_set_manufacturer_data *cp;
7670         struct mgmt_pending_cmd *cmd;
7671
7672         BT_DBG("status 0x%02x", status);
7673
7674         hci_dev_lock(hdev);
7675
7676         cmd = pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev);
7677         if (!cmd)
7678                 goto unlock;
7679
7680         cp = cmd->param;
7681
7682         if (status)
7683                 mgmt_cmd_status(cmd->sk, hdev->id,
7684                                 MGMT_OP_SET_MANUFACTURER_DATA,
7685                                 mgmt_status(status));
7686         else
7687                 mgmt_cmd_complete(cmd->sk, hdev->id,
7688                                   MGMT_OP_SET_MANUFACTURER_DATA, 0,
7689                                   cp, sizeof(*cp));
7690
7691         mgmt_pending_remove(cmd);
7692
7693 unlock:
7694         hci_dev_unlock(hdev);
7695 }
7696
7697 static int set_manufacturer_data(struct sock *sk, struct hci_dev *hdev,
7698                 void *data, u16 len)
7699 {
7700         struct mgmt_pending_cmd *cmd;
7701         struct hci_request req;
7702         struct mgmt_cp_set_manufacturer_data *cp = data;
7703         u8 old_data[HCI_MAX_EIR_LENGTH] = {0, };
7704         u8 old_len;
7705         int err;
7706
7707         BT_DBG("%s", hdev->name);
7708
7709         if (!lmp_bredr_capable(hdev))
7710                 return mgmt_cmd_status(sk, hdev->id,
7711                                 MGMT_OP_SET_MANUFACTURER_DATA,
7712                                 MGMT_STATUS_NOT_SUPPORTED);
7713
7714         if (cp->data[0] == 0 ||
7715                         cp->data[0] - 1 > sizeof(hdev->manufacturer_data))
7716                 return mgmt_cmd_status(sk, hdev->id,
7717                                 MGMT_OP_SET_MANUFACTURER_DATA,
7718                                 MGMT_STATUS_INVALID_PARAMS);
7719
7720         if (cp->data[1] != 0xFF)
7721                 return mgmt_cmd_status(sk, hdev->id,
7722                                 MGMT_OP_SET_MANUFACTURER_DATA,
7723                                 MGMT_STATUS_NOT_SUPPORTED);
7724
7725         hci_dev_lock(hdev);
7726
7727         if (pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev)) {
7728                 err = mgmt_cmd_status(sk, hdev->id,
7729                                 MGMT_OP_SET_MANUFACTURER_DATA,
7730                                 MGMT_STATUS_BUSY);
7731                 goto unlocked;
7732         }
7733
7734         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MANUFACTURER_DATA, hdev, data,
7735                         len);
7736         if (!cmd) {
7737                 err = -ENOMEM;
7738                 goto unlocked;
7739         }
7740
7741         hci_req_init(&req, hdev);
7742
7743         /* if new data is same as previous data then return command
7744          * complete event
7745          */
7746         if (hdev->manufacturer_len == cp->data[0] - 1 &&
7747             !memcmp(hdev->manufacturer_data, cp->data + 2, cp->data[0] - 1)) {
7748                 mgmt_pending_remove(cmd);
7749                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
7750                                   0, cp, sizeof(*cp));
7751                 err = 0;
7752                 goto unlocked;
7753         }
7754
7755         old_len = hdev->manufacturer_len;
7756         if (old_len > 0)
7757                 memcpy(old_data, hdev->manufacturer_data, old_len);
7758
7759         hdev->manufacturer_len = cp->data[0] - 1;
7760         if (hdev->manufacturer_len > 0)
7761                 memcpy(hdev->manufacturer_data, cp->data + 2,
7762                                 hdev->manufacturer_len);
7763
7764         __hci_req_update_eir(&req);
7765
7766         err = hci_req_run(&req, set_manufacturer_data_complete);
7767         if (err < 0) {
7768                 mgmt_pending_remove(cmd);
7769                 goto failed;
7770         }
7771
7772 unlocked:
7773         hci_dev_unlock(hdev);
7774
7775         return err;
7776
7777 failed:
7778         memset(hdev->manufacturer_data, 0x00, sizeof(hdev->manufacturer_data));
7779         hdev->manufacturer_len = old_len;
7780         if (hdev->manufacturer_len > 0)
7781                 memcpy(hdev->manufacturer_data, old_data,
7782                        hdev->manufacturer_len);
7783         hci_dev_unlock(hdev);
7784         return err;
7785 }
7786
7787 static int le_set_scan_params(struct sock *sk, struct hci_dev *hdev,
7788                 void *data, u16 len)
7789 {
7790         struct mgmt_cp_le_set_scan_params *cp = data;
7791         __u16 interval, window;
7792         int err;
7793
7794         BT_DBG("%s", hdev->name);
7795
7796         if (!lmp_le_capable(hdev))
7797                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7798                                 MGMT_STATUS_NOT_SUPPORTED);
7799
7800         interval = __le16_to_cpu(cp->interval);
7801
7802         if (interval < 0x0004 || interval > 0x4000)
7803                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7804                                 MGMT_STATUS_INVALID_PARAMS);
7805
7806         window = __le16_to_cpu(cp->window);
7807
7808         if (window < 0x0004 || window > 0x4000)
7809                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7810                                 MGMT_STATUS_INVALID_PARAMS);
7811
7812         if (window > interval)
7813                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7814                                 MGMT_STATUS_INVALID_PARAMS);
7815
7816         hci_dev_lock(hdev);
7817
7818         hdev->le_scan_type = cp->type;
7819         hdev->le_scan_interval = interval;
7820         hdev->le_scan_window = window;
7821
7822         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS, 0,
7823                                 NULL, 0);
7824
7825         /* If background scan is running, restart it so new parameters are
7826          * loaded.
7827          */
7828         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
7829             hdev->discovery.state == DISCOVERY_STOPPED) {
7830                 struct hci_request req;
7831
7832                 hci_req_init(&req, hdev);
7833
7834                 hci_req_add_le_scan_disable(&req, false);
7835                 hci_req_add_le_passive_scan(&req);
7836
7837                 hci_req_run(&req, NULL);
7838         }
7839
7840         hci_dev_unlock(hdev);
7841
7842         return err;
7843 }
7844
7845 static int set_voice_setting(struct sock *sk, struct hci_dev *hdev,
7846                 void *data, u16 len)
7847 {
7848         struct mgmt_cp_set_voice_setting *cp = data;
7849         struct hci_conn *conn;
7850         struct hci_conn *sco_conn;
7851
7852         int err;
7853
7854         BT_DBG("%s", hdev->name);
7855
7856         if (!lmp_bredr_capable(hdev)) {
7857                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING,
7858                                 MGMT_STATUS_NOT_SUPPORTED);
7859         }
7860
7861         hci_dev_lock(hdev);
7862
7863         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
7864         if (!conn) {
7865                 err = mgmt_cmd_complete(sk, hdev->id,
7866                                 MGMT_OP_SET_VOICE_SETTING, 0, NULL, 0);
7867                 goto unlock;
7868         }
7869
7870         conn->voice_setting = cp->voice_setting;
7871         conn->sco_role = cp->sco_role;
7872
7873         sco_conn = hci_conn_hash_lookup_sco(hdev);
7874         if (sco_conn && bacmp(&sco_conn->dst, &cp->bdaddr) != 0) {
7875                 BT_ERR("There is other SCO connection.");
7876                 goto done;
7877         }
7878
7879         if (conn->sco_role == MGMT_SCO_ROLE_HANDSFREE) {
7880                 if (conn->voice_setting == 0x0063)
7881                         sco_connect_set_wbc(hdev);
7882                 else
7883                         sco_connect_set_nbc(hdev);
7884         } else {
7885                 if (conn->voice_setting == 0x0063)
7886                         sco_connect_set_gw_wbc(hdev);
7887                 else
7888                         sco_connect_set_gw_nbc(hdev);
7889         }
7890
7891 done:
7892         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING, 0,
7893                         cp, sizeof(cp));
7894
7895 unlock:
7896         hci_dev_unlock(hdev);
7897         return err;
7898 }
7899
7900 void mgmt_hardware_error(struct hci_dev *hdev, u8 err_code)
7901 {
7902         struct mgmt_ev_hardware_error ev;
7903
7904         ev.error_code = err_code;
7905         mgmt_event(MGMT_EV_HARDWARE_ERROR, hdev, &ev, sizeof(ev), NULL);
7906 }
7907
7908 void mgmt_tx_timeout_error(struct hci_dev *hdev)
7909 {
7910         mgmt_event(MGMT_EV_TX_TIMEOUT_ERROR, hdev, NULL, 0, NULL);
7911 }
7912
7913 void mgmt_multi_adv_state_change_evt(struct hci_dev *hdev, u8 adv_instance,
7914                 u8 state_change_reason, u16 connection_handle)
7915 {
7916         struct mgmt_ev_vendor_specific_multi_adv_state_changed mgmt_ev;
7917
7918         BT_DBG("Multi adv state changed [%2.2X %2.2X %2.2X]",
7919                adv_instance, state_change_reason, connection_handle);
7920
7921         mgmt_ev.adv_instance = adv_instance;
7922         mgmt_ev.state_change_reason = state_change_reason;
7923         mgmt_ev.connection_handle = connection_handle;
7924
7925         mgmt_event(MGMT_EV_MULTI_ADV_STATE_CHANGED, hdev, &mgmt_ev,
7926                 sizeof(struct mgmt_ev_vendor_specific_multi_adv_state_changed),
7927                 NULL);
7928 }
7929 #endif /* TIZEN_BT */
7930
7931 static bool ltk_is_valid(struct mgmt_ltk_info *key)
7932 {
7933         if (key->initiator != 0x00 && key->initiator != 0x01)
7934                 return false;
7935
7936         switch (key->addr.type) {
7937         case BDADDR_LE_PUBLIC:
7938                 return true;
7939
7940         case BDADDR_LE_RANDOM:
7941                 /* Two most significant bits shall be set */
7942                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7943                         return false;
7944                 return true;
7945         }
7946
7947         return false;
7948 }
7949
7950 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
7951                                void *cp_data, u16 len)
7952 {
7953         struct mgmt_cp_load_long_term_keys *cp = cp_data;
7954         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
7955                                    sizeof(struct mgmt_ltk_info));
7956         u16 key_count, expected_len;
7957         int i, err;
7958
7959         bt_dev_dbg(hdev, "sock %p", sk);
7960
7961         if (!lmp_le_capable(hdev))
7962                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7963                                        MGMT_STATUS_NOT_SUPPORTED);
7964
7965         key_count = __le16_to_cpu(cp->key_count);
7966         if (key_count > max_key_count) {
7967                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
7968                            key_count);
7969                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7970                                        MGMT_STATUS_INVALID_PARAMS);
7971         }
7972
7973         expected_len = struct_size(cp, keys, key_count);
7974         if (expected_len != len) {
7975                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
7976                            expected_len, len);
7977                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7978                                        MGMT_STATUS_INVALID_PARAMS);
7979         }
7980
7981         bt_dev_dbg(hdev, "key_count %u", key_count);
7982
7983         for (i = 0; i < key_count; i++) {
7984                 struct mgmt_ltk_info *key = &cp->keys[i];
7985
7986                 if (!ltk_is_valid(key))
7987                         return mgmt_cmd_status(sk, hdev->id,
7988                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
7989                                                MGMT_STATUS_INVALID_PARAMS);
7990         }
7991
7992         hci_dev_lock(hdev);
7993
7994         hci_smp_ltks_clear(hdev);
7995
7996         for (i = 0; i < key_count; i++) {
7997                 struct mgmt_ltk_info *key = &cp->keys[i];
7998                 u8 type, authenticated;
7999
8000                 if (hci_is_blocked_key(hdev,
8001                                        HCI_BLOCKED_KEY_TYPE_LTK,
8002                                        key->val)) {
8003                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
8004                                     &key->addr.bdaddr);
8005                         continue;
8006                 }
8007
8008                 switch (key->type) {
8009                 case MGMT_LTK_UNAUTHENTICATED:
8010                         authenticated = 0x00;
8011                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
8012                         break;
8013                 case MGMT_LTK_AUTHENTICATED:
8014                         authenticated = 0x01;
8015                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
8016                         break;
8017                 case MGMT_LTK_P256_UNAUTH:
8018                         authenticated = 0x00;
8019                         type = SMP_LTK_P256;
8020                         break;
8021                 case MGMT_LTK_P256_AUTH:
8022                         authenticated = 0x01;
8023                         type = SMP_LTK_P256;
8024                         break;
8025                 case MGMT_LTK_P256_DEBUG:
8026                         authenticated = 0x00;
8027                         type = SMP_LTK_P256_DEBUG;
8028                         fallthrough;
8029                 default:
8030                         continue;
8031                 }
8032
8033                 hci_add_ltk(hdev, &key->addr.bdaddr,
8034                             le_addr_type(key->addr.type), type, authenticated,
8035                             key->val, key->enc_size, key->ediv, key->rand);
8036         }
8037
8038         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
8039                            NULL, 0);
8040
8041         hci_dev_unlock(hdev);
8042
8043         return err;
8044 }
8045
8046 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
8047 {
8048         struct hci_conn *conn = cmd->user_data;
8049         struct mgmt_rp_get_conn_info rp;
8050         int err;
8051
8052         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
8053
8054         if (status == MGMT_STATUS_SUCCESS) {
8055                 rp.rssi = conn->rssi;
8056                 rp.tx_power = conn->tx_power;
8057                 rp.max_tx_power = conn->max_tx_power;
8058         } else {
8059                 rp.rssi = HCI_RSSI_INVALID;
8060                 rp.tx_power = HCI_TX_POWER_INVALID;
8061                 rp.max_tx_power = HCI_TX_POWER_INVALID;
8062         }
8063
8064         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
8065                                 status, &rp, sizeof(rp));
8066
8067         hci_conn_drop(conn);
8068         hci_conn_put(conn);
8069
8070         return err;
8071 }
8072
8073 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
8074                                        u16 opcode)
8075 {
8076         struct hci_cp_read_rssi *cp;
8077         struct mgmt_pending_cmd *cmd;
8078         struct hci_conn *conn;
8079         u16 handle;
8080         u8 status;
8081
8082         bt_dev_dbg(hdev, "status 0x%02x", hci_status);
8083
8084         hci_dev_lock(hdev);
8085
8086         /* Commands sent in request are either Read RSSI or Read Transmit Power
8087          * Level so we check which one was last sent to retrieve connection
8088          * handle.  Both commands have handle as first parameter so it's safe to
8089          * cast data on the same command struct.
8090          *
8091          * First command sent is always Read RSSI and we fail only if it fails.
8092          * In other case we simply override error to indicate success as we
8093          * already remembered if TX power value is actually valid.
8094          */
8095         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
8096         if (!cp) {
8097                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
8098                 status = MGMT_STATUS_SUCCESS;
8099         } else {
8100                 status = mgmt_status(hci_status);
8101         }
8102
8103         if (!cp) {
8104                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
8105                 goto unlock;
8106         }
8107
8108         handle = __le16_to_cpu(cp->handle);
8109         conn = hci_conn_hash_lookup_handle(hdev, handle);
8110         if (!conn) {
8111                 bt_dev_err(hdev, "unknown handle (%u) in conn_info response",
8112                            handle);
8113                 goto unlock;
8114         }
8115
8116         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
8117         if (!cmd)
8118                 goto unlock;
8119
8120         cmd->cmd_complete(cmd, status);
8121         mgmt_pending_remove(cmd);
8122
8123 unlock:
8124         hci_dev_unlock(hdev);
8125 }
8126
8127 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
8128                          u16 len)
8129 {
8130         struct mgmt_cp_get_conn_info *cp = data;
8131         struct mgmt_rp_get_conn_info rp;
8132         struct hci_conn *conn;
8133         unsigned long conn_info_age;
8134         int err = 0;
8135
8136         bt_dev_dbg(hdev, "sock %p", sk);
8137
8138         memset(&rp, 0, sizeof(rp));
8139         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8140         rp.addr.type = cp->addr.type;
8141
8142         if (!bdaddr_type_is_valid(cp->addr.type))
8143                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8144                                          MGMT_STATUS_INVALID_PARAMS,
8145                                          &rp, sizeof(rp));
8146
8147         hci_dev_lock(hdev);
8148
8149         if (!hdev_is_powered(hdev)) {
8150                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8151                                         MGMT_STATUS_NOT_POWERED, &rp,
8152                                         sizeof(rp));
8153                 goto unlock;
8154         }
8155
8156         if (cp->addr.type == BDADDR_BREDR)
8157                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8158                                                &cp->addr.bdaddr);
8159         else
8160                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
8161
8162         if (!conn || conn->state != BT_CONNECTED) {
8163                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8164                                         MGMT_STATUS_NOT_CONNECTED, &rp,
8165                                         sizeof(rp));
8166                 goto unlock;
8167         }
8168
8169         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
8170                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8171                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
8172                 goto unlock;
8173         }
8174
8175         /* To avoid client trying to guess when to poll again for information we
8176          * calculate conn info age as random value between min/max set in hdev.
8177          */
8178         conn_info_age = hdev->conn_info_min_age +
8179                         prandom_u32_max(hdev->conn_info_max_age -
8180                                         hdev->conn_info_min_age);
8181
8182         /* Query controller to refresh cached values if they are too old or were
8183          * never read.
8184          */
8185         if (time_after(jiffies, conn->conn_info_timestamp +
8186                        msecs_to_jiffies(conn_info_age)) ||
8187             !conn->conn_info_timestamp) {
8188                 struct hci_request req;
8189                 struct hci_cp_read_tx_power req_txp_cp;
8190                 struct hci_cp_read_rssi req_rssi_cp;
8191                 struct mgmt_pending_cmd *cmd;
8192
8193                 hci_req_init(&req, hdev);
8194                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
8195                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
8196                             &req_rssi_cp);
8197
8198                 /* For LE links TX power does not change thus we don't need to
8199                  * query for it once value is known.
8200                  */
8201                 if (!bdaddr_type_is_le(cp->addr.type) ||
8202                     conn->tx_power == HCI_TX_POWER_INVALID) {
8203                         req_txp_cp.handle = cpu_to_le16(conn->handle);
8204                         req_txp_cp.type = 0x00;
8205                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
8206                                     sizeof(req_txp_cp), &req_txp_cp);
8207                 }
8208
8209                 /* Max TX power needs to be read only once per connection */
8210                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
8211                         req_txp_cp.handle = cpu_to_le16(conn->handle);
8212                         req_txp_cp.type = 0x01;
8213                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
8214                                     sizeof(req_txp_cp), &req_txp_cp);
8215                 }
8216
8217                 err = hci_req_run(&req, conn_info_refresh_complete);
8218                 if (err < 0)
8219                         goto unlock;
8220
8221                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
8222                                        data, len);
8223                 if (!cmd) {
8224                         err = -ENOMEM;
8225                         goto unlock;
8226                 }
8227
8228                 hci_conn_hold(conn);
8229                 cmd->user_data = hci_conn_get(conn);
8230                 cmd->cmd_complete = conn_info_cmd_complete;
8231
8232                 conn->conn_info_timestamp = jiffies;
8233         } else {
8234                 /* Cache is valid, just reply with values cached in hci_conn */
8235                 rp.rssi = conn->rssi;
8236                 rp.tx_power = conn->tx_power;
8237                 rp.max_tx_power = conn->max_tx_power;
8238
8239                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8240                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8241         }
8242
8243 unlock:
8244         hci_dev_unlock(hdev);
8245         return err;
8246 }
8247
8248 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
8249 {
8250         struct hci_conn *conn = cmd->user_data;
8251         struct mgmt_rp_get_clock_info rp;
8252         struct hci_dev *hdev;
8253         int err;
8254
8255         memset(&rp, 0, sizeof(rp));
8256         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
8257
8258         if (status)
8259                 goto complete;
8260
8261         hdev = hci_dev_get(cmd->index);
8262         if (hdev) {
8263                 rp.local_clock = cpu_to_le32(hdev->clock);
8264                 hci_dev_put(hdev);
8265         }
8266
8267         if (conn) {
8268                 rp.piconet_clock = cpu_to_le32(conn->clock);
8269                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
8270         }
8271
8272 complete:
8273         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
8274                                 sizeof(rp));
8275
8276         if (conn) {
8277                 hci_conn_drop(conn);
8278                 hci_conn_put(conn);
8279         }
8280
8281         return err;
8282 }
8283
8284 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8285 {
8286         struct hci_cp_read_clock *hci_cp;
8287         struct mgmt_pending_cmd *cmd;
8288         struct hci_conn *conn;
8289
8290         bt_dev_dbg(hdev, "status %u", status);
8291
8292         hci_dev_lock(hdev);
8293
8294         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
8295         if (!hci_cp)
8296                 goto unlock;
8297
8298         if (hci_cp->which) {
8299                 u16 handle = __le16_to_cpu(hci_cp->handle);
8300                 conn = hci_conn_hash_lookup_handle(hdev, handle);
8301         } else {
8302                 conn = NULL;
8303         }
8304
8305         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
8306         if (!cmd)
8307                 goto unlock;
8308
8309         cmd->cmd_complete(cmd, mgmt_status(status));
8310         mgmt_pending_remove(cmd);
8311
8312 unlock:
8313         hci_dev_unlock(hdev);
8314 }
8315
8316 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
8317                          u16 len)
8318 {
8319         struct mgmt_cp_get_clock_info *cp = data;
8320         struct mgmt_rp_get_clock_info rp;
8321         struct hci_cp_read_clock hci_cp;
8322         struct mgmt_pending_cmd *cmd;
8323         struct hci_request req;
8324         struct hci_conn *conn;
8325         int err;
8326
8327         bt_dev_dbg(hdev, "sock %p", sk);
8328
8329         memset(&rp, 0, sizeof(rp));
8330         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8331         rp.addr.type = cp->addr.type;
8332
8333         if (cp->addr.type != BDADDR_BREDR)
8334                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8335                                          MGMT_STATUS_INVALID_PARAMS,
8336                                          &rp, sizeof(rp));
8337
8338         hci_dev_lock(hdev);
8339
8340         if (!hdev_is_powered(hdev)) {
8341                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8342                                         MGMT_STATUS_NOT_POWERED, &rp,
8343                                         sizeof(rp));
8344                 goto unlock;
8345         }
8346
8347         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8348                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8349                                                &cp->addr.bdaddr);
8350                 if (!conn || conn->state != BT_CONNECTED) {
8351                         err = mgmt_cmd_complete(sk, hdev->id,
8352                                                 MGMT_OP_GET_CLOCK_INFO,
8353                                                 MGMT_STATUS_NOT_CONNECTED,
8354                                                 &rp, sizeof(rp));
8355                         goto unlock;
8356                 }
8357         } else {
8358                 conn = NULL;
8359         }
8360
8361         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
8362         if (!cmd) {
8363                 err = -ENOMEM;
8364                 goto unlock;
8365         }
8366
8367         cmd->cmd_complete = clock_info_cmd_complete;
8368
8369         hci_req_init(&req, hdev);
8370
8371         memset(&hci_cp, 0, sizeof(hci_cp));
8372         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
8373
8374         if (conn) {
8375                 hci_conn_hold(conn);
8376                 cmd->user_data = hci_conn_get(conn);
8377
8378                 hci_cp.handle = cpu_to_le16(conn->handle);
8379                 hci_cp.which = 0x01; /* Piconet clock */
8380                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
8381         }
8382
8383         err = hci_req_run(&req, get_clock_info_complete);
8384         if (err < 0)
8385                 mgmt_pending_remove(cmd);
8386
8387 unlock:
8388         hci_dev_unlock(hdev);
8389         return err;
8390 }
8391
8392 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
8393 {
8394         struct hci_conn *conn;
8395
8396         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
8397         if (!conn)
8398                 return false;
8399
8400         if (conn->dst_type != type)
8401                 return false;
8402
8403         if (conn->state != BT_CONNECTED)
8404                 return false;
8405
8406         return true;
8407 }
8408
8409 /* This function requires the caller holds hdev->lock */
8410 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
8411                                u8 addr_type, u8 auto_connect)
8412 {
8413         struct hci_conn_params *params;
8414
8415         params = hci_conn_params_add(hdev, addr, addr_type);
8416         if (!params)
8417                 return -EIO;
8418
8419         if (params->auto_connect == auto_connect)
8420                 return 0;
8421
8422         list_del_init(&params->action);
8423
8424         switch (auto_connect) {
8425         case HCI_AUTO_CONN_DISABLED:
8426         case HCI_AUTO_CONN_LINK_LOSS:
8427                 /* If auto connect is being disabled when we're trying to
8428                  * connect to device, keep connecting.
8429                  */
8430                 if (params->explicit_connect)
8431                         list_add(&params->action, &hdev->pend_le_conns);
8432                 break;
8433         case HCI_AUTO_CONN_REPORT:
8434                 if (params->explicit_connect)
8435                         list_add(&params->action, &hdev->pend_le_conns);
8436                 else
8437                         list_add(&params->action, &hdev->pend_le_reports);
8438                 break;
8439         case HCI_AUTO_CONN_DIRECT:
8440         case HCI_AUTO_CONN_ALWAYS:
8441                 if (!is_connected(hdev, addr, addr_type))
8442                         list_add(&params->action, &hdev->pend_le_conns);
8443                 break;
8444         }
8445
8446         params->auto_connect = auto_connect;
8447
8448         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
8449                    addr, addr_type, auto_connect);
8450
8451         return 0;
8452 }
8453
8454 static void device_added(struct sock *sk, struct hci_dev *hdev,
8455                          bdaddr_t *bdaddr, u8 type, u8 action)
8456 {
8457         struct mgmt_ev_device_added ev;
8458
8459         bacpy(&ev.addr.bdaddr, bdaddr);
8460         ev.addr.type = type;
8461         ev.action = action;
8462
8463         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
8464 }
8465
8466 static int add_device(struct sock *sk, struct hci_dev *hdev,
8467                       void *data, u16 len)
8468 {
8469         struct mgmt_cp_add_device *cp = data;
8470         u8 auto_conn, addr_type;
8471         struct hci_conn_params *params;
8472         int err;
8473         u32 current_flags = 0;
8474
8475         bt_dev_dbg(hdev, "sock %p", sk);
8476
8477         if (!bdaddr_type_is_valid(cp->addr.type) ||
8478             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
8479                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8480                                          MGMT_STATUS_INVALID_PARAMS,
8481                                          &cp->addr, sizeof(cp->addr));
8482
8483         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
8484                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8485                                          MGMT_STATUS_INVALID_PARAMS,
8486                                          &cp->addr, sizeof(cp->addr));
8487
8488         hci_dev_lock(hdev);
8489
8490         if (cp->addr.type == BDADDR_BREDR) {
8491                 /* Only incoming connections action is supported for now */
8492                 if (cp->action != 0x01) {
8493                         err = mgmt_cmd_complete(sk, hdev->id,
8494                                                 MGMT_OP_ADD_DEVICE,
8495                                                 MGMT_STATUS_INVALID_PARAMS,
8496                                                 &cp->addr, sizeof(cp->addr));
8497                         goto unlock;
8498                 }
8499
8500                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
8501                                                      &cp->addr.bdaddr,
8502                                                      cp->addr.type, 0);
8503                 if (err)
8504                         goto unlock;
8505
8506                 hci_req_update_scan(hdev);
8507
8508                 goto added;
8509         }
8510
8511         addr_type = le_addr_type(cp->addr.type);
8512
8513         if (cp->action == 0x02)
8514                 auto_conn = HCI_AUTO_CONN_ALWAYS;
8515         else if (cp->action == 0x01)
8516                 auto_conn = HCI_AUTO_CONN_DIRECT;
8517         else
8518                 auto_conn = HCI_AUTO_CONN_REPORT;
8519
8520         /* Kernel internally uses conn_params with resolvable private
8521          * address, but Add Device allows only identity addresses.
8522          * Make sure it is enforced before calling
8523          * hci_conn_params_lookup.
8524          */
8525         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
8526                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8527                                         MGMT_STATUS_INVALID_PARAMS,
8528                                         &cp->addr, sizeof(cp->addr));
8529                 goto unlock;
8530         }
8531
8532         /* If the connection parameters don't exist for this device,
8533          * they will be created and configured with defaults.
8534          */
8535         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
8536                                 auto_conn) < 0) {
8537                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8538                                         MGMT_STATUS_FAILED, &cp->addr,
8539                                         sizeof(cp->addr));
8540                 goto unlock;
8541         } else {
8542                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
8543                                                 addr_type);
8544                 if (params)
8545                         current_flags = params->current_flags;
8546         }
8547
8548         hci_update_background_scan(hdev);
8549
8550 added:
8551         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
8552         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
8553                              SUPPORTED_DEVICE_FLAGS(), current_flags);
8554
8555         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8556                                 MGMT_STATUS_SUCCESS, &cp->addr,
8557                                 sizeof(cp->addr));
8558
8559 unlock:
8560         hci_dev_unlock(hdev);
8561         return err;
8562 }
8563
8564 static void device_removed(struct sock *sk, struct hci_dev *hdev,
8565                            bdaddr_t *bdaddr, u8 type)
8566 {
8567         struct mgmt_ev_device_removed ev;
8568
8569         bacpy(&ev.addr.bdaddr, bdaddr);
8570         ev.addr.type = type;
8571
8572         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
8573 }
8574
8575 static int remove_device(struct sock *sk, struct hci_dev *hdev,
8576                          void *data, u16 len)
8577 {
8578         struct mgmt_cp_remove_device *cp = data;
8579         int err;
8580
8581         bt_dev_dbg(hdev, "sock %p", sk);
8582
8583         hci_dev_lock(hdev);
8584
8585         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8586                 struct hci_conn_params *params;
8587                 u8 addr_type;
8588
8589                 if (!bdaddr_type_is_valid(cp->addr.type)) {
8590                         err = mgmt_cmd_complete(sk, hdev->id,
8591                                                 MGMT_OP_REMOVE_DEVICE,
8592                                                 MGMT_STATUS_INVALID_PARAMS,
8593                                                 &cp->addr, sizeof(cp->addr));
8594                         goto unlock;
8595                 }
8596
8597                 if (cp->addr.type == BDADDR_BREDR) {
8598                         err = hci_bdaddr_list_del(&hdev->accept_list,
8599                                                   &cp->addr.bdaddr,
8600                                                   cp->addr.type);
8601                         if (err) {
8602                                 err = mgmt_cmd_complete(sk, hdev->id,
8603                                                         MGMT_OP_REMOVE_DEVICE,
8604                                                         MGMT_STATUS_INVALID_PARAMS,
8605                                                         &cp->addr,
8606                                                         sizeof(cp->addr));
8607                                 goto unlock;
8608                         }
8609
8610                         hci_req_update_scan(hdev);
8611
8612                         device_removed(sk, hdev, &cp->addr.bdaddr,
8613                                        cp->addr.type);
8614                         goto complete;
8615                 }
8616
8617                 addr_type = le_addr_type(cp->addr.type);
8618
8619                 /* Kernel internally uses conn_params with resolvable private
8620                  * address, but Remove Device allows only identity addresses.
8621                  * Make sure it is enforced before calling
8622                  * hci_conn_params_lookup.
8623                  */
8624                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
8625                         err = mgmt_cmd_complete(sk, hdev->id,
8626                                                 MGMT_OP_REMOVE_DEVICE,
8627                                                 MGMT_STATUS_INVALID_PARAMS,
8628                                                 &cp->addr, sizeof(cp->addr));
8629                         goto unlock;
8630                 }
8631
8632                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
8633                                                 addr_type);
8634                 if (!params) {
8635                         err = mgmt_cmd_complete(sk, hdev->id,
8636                                                 MGMT_OP_REMOVE_DEVICE,
8637                                                 MGMT_STATUS_INVALID_PARAMS,
8638                                                 &cp->addr, sizeof(cp->addr));
8639                         goto unlock;
8640                 }
8641
8642                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
8643                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
8644                         err = mgmt_cmd_complete(sk, hdev->id,
8645                                                 MGMT_OP_REMOVE_DEVICE,
8646                                                 MGMT_STATUS_INVALID_PARAMS,
8647                                                 &cp->addr, sizeof(cp->addr));
8648                         goto unlock;
8649                 }
8650
8651                 list_del(&params->action);
8652                 list_del(&params->list);
8653                 kfree(params);
8654                 hci_update_background_scan(hdev);
8655
8656                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
8657         } else {
8658                 struct hci_conn_params *p, *tmp;
8659                 struct bdaddr_list *b, *btmp;
8660
8661                 if (cp->addr.type) {
8662                         err = mgmt_cmd_complete(sk, hdev->id,
8663                                                 MGMT_OP_REMOVE_DEVICE,
8664                                                 MGMT_STATUS_INVALID_PARAMS,
8665                                                 &cp->addr, sizeof(cp->addr));
8666                         goto unlock;
8667                 }
8668
8669                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
8670                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
8671                         list_del(&b->list);
8672                         kfree(b);
8673                 }
8674
8675                 hci_req_update_scan(hdev);
8676
8677                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
8678                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
8679                                 continue;
8680                         device_removed(sk, hdev, &p->addr, p->addr_type);
8681                         if (p->explicit_connect) {
8682                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
8683                                 continue;
8684                         }
8685                         list_del(&p->action);
8686                         list_del(&p->list);
8687                         kfree(p);
8688                 }
8689
8690                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
8691
8692                 hci_update_background_scan(hdev);
8693         }
8694
8695 complete:
8696         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
8697                                 MGMT_STATUS_SUCCESS, &cp->addr,
8698                                 sizeof(cp->addr));
8699 unlock:
8700         hci_dev_unlock(hdev);
8701         return err;
8702 }
8703
8704 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
8705                            u16 len)
8706 {
8707         struct mgmt_cp_load_conn_param *cp = data;
8708         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
8709                                      sizeof(struct mgmt_conn_param));
8710         u16 param_count, expected_len;
8711         int i;
8712
8713         if (!lmp_le_capable(hdev))
8714                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8715                                        MGMT_STATUS_NOT_SUPPORTED);
8716
8717         param_count = __le16_to_cpu(cp->param_count);
8718         if (param_count > max_param_count) {
8719                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
8720                            param_count);
8721                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8722                                        MGMT_STATUS_INVALID_PARAMS);
8723         }
8724
8725         expected_len = struct_size(cp, params, param_count);
8726         if (expected_len != len) {
8727                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
8728                            expected_len, len);
8729                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8730                                        MGMT_STATUS_INVALID_PARAMS);
8731         }
8732
8733         bt_dev_dbg(hdev, "param_count %u", param_count);
8734
8735         hci_dev_lock(hdev);
8736
8737         hci_conn_params_clear_disabled(hdev);
8738
8739         for (i = 0; i < param_count; i++) {
8740                 struct mgmt_conn_param *param = &cp->params[i];
8741                 struct hci_conn_params *hci_param;
8742                 u16 min, max, latency, timeout;
8743                 u8 addr_type;
8744
8745                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
8746                            param->addr.type);
8747
8748                 if (param->addr.type == BDADDR_LE_PUBLIC) {
8749                         addr_type = ADDR_LE_DEV_PUBLIC;
8750                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
8751                         addr_type = ADDR_LE_DEV_RANDOM;
8752                 } else {
8753                         bt_dev_err(hdev, "ignoring invalid connection parameters");
8754                         continue;
8755                 }
8756
8757                 min = le16_to_cpu(param->min_interval);
8758                 max = le16_to_cpu(param->max_interval);
8759                 latency = le16_to_cpu(param->latency);
8760                 timeout = le16_to_cpu(param->timeout);
8761
8762                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
8763                            min, max, latency, timeout);
8764
8765                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
8766                         bt_dev_err(hdev, "ignoring invalid connection parameters");
8767                         continue;
8768                 }
8769
8770                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
8771                                                 addr_type);
8772                 if (!hci_param) {
8773                         bt_dev_err(hdev, "failed to add connection parameters");
8774                         continue;
8775                 }
8776
8777                 hci_param->conn_min_interval = min;
8778                 hci_param->conn_max_interval = max;
8779                 hci_param->conn_latency = latency;
8780                 hci_param->supervision_timeout = timeout;
8781         }
8782
8783         hci_dev_unlock(hdev);
8784
8785         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
8786                                  NULL, 0);
8787 }
8788
8789 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
8790                                void *data, u16 len)
8791 {
8792         struct mgmt_cp_set_external_config *cp = data;
8793         bool changed;
8794         int err;
8795
8796         bt_dev_dbg(hdev, "sock %p", sk);
8797
8798         if (hdev_is_powered(hdev))
8799                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8800                                        MGMT_STATUS_REJECTED);
8801
8802         if (cp->config != 0x00 && cp->config != 0x01)
8803                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8804                                          MGMT_STATUS_INVALID_PARAMS);
8805
8806         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
8807                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8808                                        MGMT_STATUS_NOT_SUPPORTED);
8809
8810         hci_dev_lock(hdev);
8811
8812         if (cp->config)
8813                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
8814         else
8815                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
8816
8817         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
8818         if (err < 0)
8819                 goto unlock;
8820
8821         if (!changed)
8822                 goto unlock;
8823
8824         err = new_options(hdev, sk);
8825
8826         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
8827                 mgmt_index_removed(hdev);
8828
8829                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
8830                         hci_dev_set_flag(hdev, HCI_CONFIG);
8831                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8832
8833                         queue_work(hdev->req_workqueue, &hdev->power_on);
8834                 } else {
8835                         set_bit(HCI_RAW, &hdev->flags);
8836                         mgmt_index_added(hdev);
8837                 }
8838         }
8839
8840 unlock:
8841         hci_dev_unlock(hdev);
8842         return err;
8843 }
8844
8845 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
8846                               void *data, u16 len)
8847 {
8848         struct mgmt_cp_set_public_address *cp = data;
8849         bool changed;
8850         int err;
8851
8852         bt_dev_dbg(hdev, "sock %p", sk);
8853
8854         if (hdev_is_powered(hdev))
8855                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8856                                        MGMT_STATUS_REJECTED);
8857
8858         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
8859                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8860                                        MGMT_STATUS_INVALID_PARAMS);
8861
8862         if (!hdev->set_bdaddr)
8863                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8864                                        MGMT_STATUS_NOT_SUPPORTED);
8865
8866         hci_dev_lock(hdev);
8867
8868         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
8869         bacpy(&hdev->public_addr, &cp->bdaddr);
8870
8871         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
8872         if (err < 0)
8873                 goto unlock;
8874
8875         if (!changed)
8876                 goto unlock;
8877
8878         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
8879                 err = new_options(hdev, sk);
8880
8881         if (is_configured(hdev)) {
8882                 mgmt_index_removed(hdev);
8883
8884                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
8885
8886                 hci_dev_set_flag(hdev, HCI_CONFIG);
8887                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8888
8889                 queue_work(hdev->req_workqueue, &hdev->power_on);
8890         }
8891
8892 unlock:
8893         hci_dev_unlock(hdev);
8894         return err;
8895 }
8896
8897 #ifdef TIZEN_BT
8898 int mgmt_device_name_update(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name,
8899                             u8 name_len)
8900 {
8901         char buf[512];
8902         struct mgmt_ev_device_name_update *ev = (void *)buf;
8903         u16 eir_len = 0;
8904
8905         if (name_len <= 0)
8906                 return -EINVAL;
8907
8908         bacpy(&ev->addr.bdaddr, bdaddr);
8909         ev->addr.type = BDADDR_BREDR;
8910
8911         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
8912                                   name_len);
8913
8914         ev->eir_len = cpu_to_le16(eir_len);
8915
8916         return mgmt_event(MGMT_EV_DEVICE_NAME_UPDATE, hdev, buf,
8917                           sizeof(*ev) + eir_len, NULL);
8918 }
8919
8920 int mgmt_le_conn_update_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
8921                                u8 link_type, u8 addr_type, u8 status)
8922 {
8923         struct mgmt_ev_conn_update_failed ev;
8924
8925         bacpy(&ev.addr.bdaddr, bdaddr);
8926         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8927         ev.status = status;
8928
8929         return mgmt_event(MGMT_EV_CONN_UPDATE_FAILED, hdev,
8930                                 &ev, sizeof(ev), NULL);
8931 }
8932
8933 int mgmt_le_conn_updated(struct hci_dev *hdev, bdaddr_t *bdaddr,
8934                          u8 link_type, u8 addr_type, u16 conn_interval,
8935                          u16 conn_latency, u16 supervision_timeout)
8936 {
8937         struct mgmt_ev_conn_updated ev;
8938
8939         bacpy(&ev.addr.bdaddr, bdaddr);
8940         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8941         ev.conn_interval = cpu_to_le16(conn_interval);
8942         ev.conn_latency = cpu_to_le16(conn_latency);
8943         ev.supervision_timeout = cpu_to_le16(supervision_timeout);
8944
8945         return mgmt_event(MGMT_EV_CONN_UPDATED, hdev,
8946                                 &ev, sizeof(ev), NULL);
8947 }
8948
8949 /* le device found event - Pass adv type */
8950 void mgmt_le_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8951                 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, u8 *eir,
8952                 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, u8 adv_type)
8953 {
8954         char buf[512];
8955         struct mgmt_ev_le_device_found *ev = (void *)buf;
8956         size_t ev_size;
8957
8958         if (!hci_discovery_active(hdev) && !hci_le_discovery_active(hdev))
8959                 return;
8960
8961         /* Make sure that the buffer is big enough. The 5 extra bytes
8962          * are for the potential CoD field.
8963          */
8964         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
8965                 return;
8966
8967         memset(buf, 0, sizeof(buf));
8968
8969         bacpy(&ev->addr.bdaddr, bdaddr);
8970         ev->addr.type = link_to_bdaddr(link_type, addr_type);
8971         ev->rssi = rssi;
8972         ev->flags = cpu_to_le32(flags);
8973         ev->adv_type = adv_type;
8974
8975         if (eir_len > 0)
8976                 memcpy(ev->eir, eir, eir_len);
8977
8978         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, NULL))
8979                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
8980                                           dev_class, 3);
8981
8982         if (scan_rsp_len > 0)
8983                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
8984
8985         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
8986         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
8987
8988         mgmt_event(MGMT_EV_LE_DEVICE_FOUND, hdev, ev, ev_size, NULL);
8989 }
8990 #endif
8991
8992 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
8993                                              u16 opcode, struct sk_buff *skb)
8994 {
8995         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
8996         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
8997         u8 *h192, *r192, *h256, *r256;
8998         struct mgmt_pending_cmd *cmd;
8999         u16 eir_len;
9000         int err;
9001
9002         bt_dev_dbg(hdev, "status %u", status);
9003
9004         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
9005         if (!cmd)
9006                 return;
9007
9008         mgmt_cp = cmd->param;
9009
9010         if (status) {
9011                 status = mgmt_status(status);
9012                 eir_len = 0;
9013
9014                 h192 = NULL;
9015                 r192 = NULL;
9016                 h256 = NULL;
9017                 r256 = NULL;
9018         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
9019                 struct hci_rp_read_local_oob_data *rp;
9020
9021                 if (skb->len != sizeof(*rp)) {
9022                         status = MGMT_STATUS_FAILED;
9023                         eir_len = 0;
9024                 } else {
9025                         status = MGMT_STATUS_SUCCESS;
9026                         rp = (void *)skb->data;
9027
9028                         eir_len = 5 + 18 + 18;
9029                         h192 = rp->hash;
9030                         r192 = rp->rand;
9031                         h256 = NULL;
9032                         r256 = NULL;
9033                 }
9034         } else {
9035                 struct hci_rp_read_local_oob_ext_data *rp;
9036
9037                 if (skb->len != sizeof(*rp)) {
9038                         status = MGMT_STATUS_FAILED;
9039                         eir_len = 0;
9040                 } else {
9041                         status = MGMT_STATUS_SUCCESS;
9042                         rp = (void *)skb->data;
9043
9044                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
9045                                 eir_len = 5 + 18 + 18;
9046                                 h192 = NULL;
9047                                 r192 = NULL;
9048                         } else {
9049                                 eir_len = 5 + 18 + 18 + 18 + 18;
9050                                 h192 = rp->hash192;
9051                                 r192 = rp->rand192;
9052                         }
9053
9054                         h256 = rp->hash256;
9055                         r256 = rp->rand256;
9056                 }
9057         }
9058
9059         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
9060         if (!mgmt_rp)
9061                 goto done;
9062
9063         if (eir_len == 0)
9064                 goto send_rsp;
9065
9066         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
9067                                   hdev->dev_class, 3);
9068
9069         if (h192 && r192) {
9070                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9071                                           EIR_SSP_HASH_C192, h192, 16);
9072                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9073                                           EIR_SSP_RAND_R192, r192, 16);
9074         }
9075
9076         if (h256 && r256) {
9077                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9078                                           EIR_SSP_HASH_C256, h256, 16);
9079                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9080                                           EIR_SSP_RAND_R256, r256, 16);
9081         }
9082
9083 send_rsp:
9084         mgmt_rp->type = mgmt_cp->type;
9085         mgmt_rp->eir_len = cpu_to_le16(eir_len);
9086
9087         err = mgmt_cmd_complete(cmd->sk, hdev->id,
9088                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
9089                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
9090         if (err < 0 || status)
9091                 goto done;
9092
9093         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
9094
9095         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9096                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
9097                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
9098 done:
9099         kfree(mgmt_rp);
9100         mgmt_pending_remove(cmd);
9101 }
9102
9103 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
9104                                   struct mgmt_cp_read_local_oob_ext_data *cp)
9105 {
9106         struct mgmt_pending_cmd *cmd;
9107         struct hci_request req;
9108         int err;
9109
9110         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
9111                                cp, sizeof(*cp));
9112         if (!cmd)
9113                 return -ENOMEM;
9114
9115         hci_req_init(&req, hdev);
9116
9117         if (bredr_sc_enabled(hdev))
9118                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
9119         else
9120                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
9121
9122         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
9123         if (err < 0) {
9124                 mgmt_pending_remove(cmd);
9125                 return err;
9126         }
9127
9128         return 0;
9129 }
9130
9131 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
9132                                    void *data, u16 data_len)
9133 {
9134         struct mgmt_cp_read_local_oob_ext_data *cp = data;
9135         struct mgmt_rp_read_local_oob_ext_data *rp;
9136         size_t rp_len;
9137         u16 eir_len;
9138         u8 status, flags, role, addr[7], hash[16], rand[16];
9139         int err;
9140
9141         bt_dev_dbg(hdev, "sock %p", sk);
9142
9143         if (hdev_is_powered(hdev)) {
9144                 switch (cp->type) {
9145                 case BIT(BDADDR_BREDR):
9146                         status = mgmt_bredr_support(hdev);
9147                         if (status)
9148                                 eir_len = 0;
9149                         else
9150                                 eir_len = 5;
9151                         break;
9152                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9153                         status = mgmt_le_support(hdev);
9154                         if (status)
9155                                 eir_len = 0;
9156                         else
9157                                 eir_len = 9 + 3 + 18 + 18 + 3;
9158                         break;
9159                 default:
9160                         status = MGMT_STATUS_INVALID_PARAMS;
9161                         eir_len = 0;
9162                         break;
9163                 }
9164         } else {
9165                 status = MGMT_STATUS_NOT_POWERED;
9166                 eir_len = 0;
9167         }
9168
9169         rp_len = sizeof(*rp) + eir_len;
9170         rp = kmalloc(rp_len, GFP_ATOMIC);
9171         if (!rp)
9172                 return -ENOMEM;
9173
9174         if (status)
9175                 goto complete;
9176
9177         hci_dev_lock(hdev);
9178
9179         eir_len = 0;
9180         switch (cp->type) {
9181         case BIT(BDADDR_BREDR):
9182                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
9183                         err = read_local_ssp_oob_req(hdev, sk, cp);
9184                         hci_dev_unlock(hdev);
9185                         if (!err)
9186                                 goto done;
9187
9188                         status = MGMT_STATUS_FAILED;
9189                         goto complete;
9190                 } else {
9191                         eir_len = eir_append_data(rp->eir, eir_len,
9192                                                   EIR_CLASS_OF_DEV,
9193                                                   hdev->dev_class, 3);
9194                 }
9195                 break;
9196         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9197                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
9198                     smp_generate_oob(hdev, hash, rand) < 0) {
9199                         hci_dev_unlock(hdev);
9200                         status = MGMT_STATUS_FAILED;
9201                         goto complete;
9202                 }
9203
9204                 /* This should return the active RPA, but since the RPA
9205                  * is only programmed on demand, it is really hard to fill
9206                  * this in at the moment. For now disallow retrieving
9207                  * local out-of-band data when privacy is in use.
9208                  *
9209                  * Returning the identity address will not help here since
9210                  * pairing happens before the identity resolving key is
9211                  * known and thus the connection establishment happens
9212                  * based on the RPA and not the identity address.
9213                  */
9214                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
9215                         hci_dev_unlock(hdev);
9216                         status = MGMT_STATUS_REJECTED;
9217                         goto complete;
9218                 }
9219
9220                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
9221                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
9222                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
9223                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
9224                         memcpy(addr, &hdev->static_addr, 6);
9225                         addr[6] = 0x01;
9226                 } else {
9227                         memcpy(addr, &hdev->bdaddr, 6);
9228                         addr[6] = 0x00;
9229                 }
9230
9231                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
9232                                           addr, sizeof(addr));
9233
9234                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
9235                         role = 0x02;
9236                 else
9237                         role = 0x01;
9238
9239                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
9240                                           &role, sizeof(role));
9241
9242                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
9243                         eir_len = eir_append_data(rp->eir, eir_len,
9244                                                   EIR_LE_SC_CONFIRM,
9245                                                   hash, sizeof(hash));
9246
9247                         eir_len = eir_append_data(rp->eir, eir_len,
9248                                                   EIR_LE_SC_RANDOM,
9249                                                   rand, sizeof(rand));
9250                 }
9251
9252                 flags = mgmt_get_adv_discov_flags(hdev);
9253
9254                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
9255                         flags |= LE_AD_NO_BREDR;
9256
9257                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
9258                                           &flags, sizeof(flags));
9259                 break;
9260         }
9261
9262         hci_dev_unlock(hdev);
9263
9264         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
9265
9266         status = MGMT_STATUS_SUCCESS;
9267
9268 complete:
9269         rp->type = cp->type;
9270         rp->eir_len = cpu_to_le16(eir_len);
9271
9272         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
9273                                 status, rp, sizeof(*rp) + eir_len);
9274         if (err < 0 || status)
9275                 goto done;
9276
9277         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9278                                  rp, sizeof(*rp) + eir_len,
9279                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
9280
9281 done:
9282         kfree(rp);
9283
9284         return err;
9285 }
9286
9287 static u32 get_supported_adv_flags(struct hci_dev *hdev)
9288 {
9289         u32 flags = 0;
9290
9291         flags |= MGMT_ADV_FLAG_CONNECTABLE;
9292         flags |= MGMT_ADV_FLAG_DISCOV;
9293         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
9294         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
9295         flags |= MGMT_ADV_FLAG_APPEARANCE;
9296         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
9297         flags |= MGMT_ADV_PARAM_DURATION;
9298         flags |= MGMT_ADV_PARAM_TIMEOUT;
9299         flags |= MGMT_ADV_PARAM_INTERVALS;
9300         flags |= MGMT_ADV_PARAM_TX_POWER;
9301         flags |= MGMT_ADV_PARAM_SCAN_RSP;
9302
9303         /* In extended adv TX_POWER returned from Set Adv Param
9304          * will be always valid.
9305          */
9306         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
9307             ext_adv_capable(hdev))
9308                 flags |= MGMT_ADV_FLAG_TX_POWER;
9309
9310         if (ext_adv_capable(hdev)) {
9311                 flags |= MGMT_ADV_FLAG_SEC_1M;
9312                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
9313                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
9314
9315                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
9316                         flags |= MGMT_ADV_FLAG_SEC_2M;
9317
9318                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
9319                         flags |= MGMT_ADV_FLAG_SEC_CODED;
9320         }
9321
9322         return flags;
9323 }
9324
9325 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
9326                              void *data, u16 data_len)
9327 {
9328         struct mgmt_rp_read_adv_features *rp;
9329         size_t rp_len;
9330         int err;
9331         struct adv_info *adv_instance;
9332         u32 supported_flags;
9333         u8 *instance;
9334
9335         bt_dev_dbg(hdev, "sock %p", sk);
9336
9337         if (!lmp_le_capable(hdev))
9338                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9339                                        MGMT_STATUS_REJECTED);
9340
9341         /* Enabling the experimental LL Privay support disables support for
9342          * advertising.
9343          */
9344         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
9345                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9346                                        MGMT_STATUS_NOT_SUPPORTED);
9347
9348         hci_dev_lock(hdev);
9349
9350         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
9351         rp = kmalloc(rp_len, GFP_ATOMIC);
9352         if (!rp) {
9353                 hci_dev_unlock(hdev);
9354                 return -ENOMEM;
9355         }
9356
9357         supported_flags = get_supported_adv_flags(hdev);
9358
9359         rp->supported_flags = cpu_to_le32(supported_flags);
9360         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
9361         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
9362         rp->max_instances = hdev->le_num_of_adv_sets;
9363         rp->num_instances = hdev->adv_instance_cnt;
9364
9365         instance = rp->instance;
9366         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
9367                 *instance = adv_instance->instance;
9368                 instance++;
9369         }
9370
9371         hci_dev_unlock(hdev);
9372
9373         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9374                                 MGMT_STATUS_SUCCESS, rp, rp_len);
9375
9376         kfree(rp);
9377
9378         return err;
9379 }
9380
9381 static u8 calculate_name_len(struct hci_dev *hdev)
9382 {
9383         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
9384
9385         return append_local_name(hdev, buf, 0);
9386 }
9387
9388 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
9389                            bool is_adv_data)
9390 {
9391         u8 max_len = HCI_MAX_AD_LENGTH;
9392
9393         if (is_adv_data) {
9394                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
9395                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
9396                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
9397                         max_len -= 3;
9398
9399                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
9400                         max_len -= 3;
9401         } else {
9402                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
9403                         max_len -= calculate_name_len(hdev);
9404
9405                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
9406                         max_len -= 4;
9407         }
9408
9409         return max_len;
9410 }
9411
9412 static bool flags_managed(u32 adv_flags)
9413 {
9414         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
9415                             MGMT_ADV_FLAG_LIMITED_DISCOV |
9416                             MGMT_ADV_FLAG_MANAGED_FLAGS);
9417 }
9418
9419 static bool tx_power_managed(u32 adv_flags)
9420 {
9421         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
9422 }
9423
9424 static bool name_managed(u32 adv_flags)
9425 {
9426         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
9427 }
9428
9429 static bool appearance_managed(u32 adv_flags)
9430 {
9431         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
9432 }
9433
9434 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
9435                               u8 len, bool is_adv_data)
9436 {
9437         int i, cur_len;
9438         u8 max_len;
9439
9440         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
9441
9442         if (len > max_len)
9443                 return false;
9444
9445         /* Make sure that the data is correctly formatted. */
9446         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
9447                 cur_len = data[i];
9448
9449                 if (!cur_len)
9450                         continue;
9451
9452                 if (data[i + 1] == EIR_FLAGS &&
9453                     (!is_adv_data || flags_managed(adv_flags)))
9454                         return false;
9455
9456                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
9457                         return false;
9458
9459                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
9460                         return false;
9461
9462                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
9463                         return false;
9464
9465                 if (data[i + 1] == EIR_APPEARANCE &&
9466                     appearance_managed(adv_flags))
9467                         return false;
9468
9469                 /* If the current field length would exceed the total data
9470                  * length, then it's invalid.
9471                  */
9472                 if (i + cur_len >= len)
9473                         return false;
9474         }
9475
9476         return true;
9477 }
9478
9479 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
9480 {
9481         u32 supported_flags, phy_flags;
9482
9483         /* The current implementation only supports a subset of the specified
9484          * flags. Also need to check mutual exclusiveness of sec flags.
9485          */
9486         supported_flags = get_supported_adv_flags(hdev);
9487         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
9488         if (adv_flags & ~supported_flags ||
9489             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
9490                 return false;
9491
9492         return true;
9493 }
9494
9495 static bool adv_busy(struct hci_dev *hdev)
9496 {
9497         return (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
9498                 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
9499                 pending_find(MGMT_OP_SET_LE, hdev) ||
9500                 pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev) ||
9501                 pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev));
9502 }
9503
9504 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
9505                                      u16 opcode)
9506 {
9507         struct mgmt_pending_cmd *cmd;
9508         struct mgmt_cp_add_advertising *cp;
9509         struct mgmt_rp_add_advertising rp;
9510         struct adv_info *adv_instance, *n;
9511         u8 instance;
9512
9513         bt_dev_dbg(hdev, "status %u", status);
9514
9515         hci_dev_lock(hdev);
9516
9517         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
9518         if (!cmd)
9519                 cmd = pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev);
9520
9521         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
9522                 if (!adv_instance->pending)
9523                         continue;
9524
9525                 if (!status) {
9526                         adv_instance->pending = false;
9527                         continue;
9528                 }
9529
9530                 instance = adv_instance->instance;
9531
9532                 if (hdev->cur_adv_instance == instance)
9533                         cancel_adv_timeout(hdev);
9534
9535                 hci_remove_adv_instance(hdev, instance);
9536                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
9537         }
9538
9539         if (!cmd)
9540                 goto unlock;
9541
9542         cp = cmd->param;
9543         rp.instance = cp->instance;
9544
9545         if (status)
9546                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9547                                 mgmt_status(status));
9548         else
9549                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9550                                   mgmt_status(status), &rp, sizeof(rp));
9551
9552         mgmt_pending_remove(cmd);
9553
9554 unlock:
9555         hci_dev_unlock(hdev);
9556 }
9557
9558 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
9559                            void *data, u16 data_len)
9560 {
9561         struct mgmt_cp_add_advertising *cp = data;
9562         struct mgmt_rp_add_advertising rp;
9563         u32 flags;
9564         u8 status;
9565         u16 timeout, duration;
9566         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
9567         u8 schedule_instance = 0;
9568         struct adv_info *next_instance;
9569         int err;
9570         struct mgmt_pending_cmd *cmd;
9571         struct hci_request req;
9572
9573         bt_dev_dbg(hdev, "sock %p", sk);
9574
9575         status = mgmt_le_support(hdev);
9576         if (status)
9577                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9578                                        status);
9579
9580         /* Enabling the experimental LL Privay support disables support for
9581          * advertising.
9582          */
9583         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
9584                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9585                                        MGMT_STATUS_NOT_SUPPORTED);
9586
9587         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9588                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9589                                        MGMT_STATUS_INVALID_PARAMS);
9590
9591         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
9592                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9593                                        MGMT_STATUS_INVALID_PARAMS);
9594
9595         flags = __le32_to_cpu(cp->flags);
9596         timeout = __le16_to_cpu(cp->timeout);
9597         duration = __le16_to_cpu(cp->duration);
9598
9599         if (!requested_adv_flags_are_valid(hdev, flags))
9600                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9601                                        MGMT_STATUS_INVALID_PARAMS);
9602
9603         hci_dev_lock(hdev);
9604
9605         if (timeout && !hdev_is_powered(hdev)) {
9606                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9607                                       MGMT_STATUS_REJECTED);
9608                 goto unlock;
9609         }
9610
9611         if (adv_busy(hdev)) {
9612                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9613                                       MGMT_STATUS_BUSY);
9614                 goto unlock;
9615         }
9616
9617         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
9618             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
9619                                cp->scan_rsp_len, false)) {
9620                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9621                                       MGMT_STATUS_INVALID_PARAMS);
9622                 goto unlock;
9623         }
9624
9625         err = hci_add_adv_instance(hdev, cp->instance, flags,
9626                                    cp->adv_data_len, cp->data,
9627                                    cp->scan_rsp_len,
9628                                    cp->data + cp->adv_data_len,
9629                                    timeout, duration,
9630                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
9631                                    hdev->le_adv_min_interval,
9632                                    hdev->le_adv_max_interval);
9633         if (err < 0) {
9634                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9635                                       MGMT_STATUS_FAILED);
9636                 goto unlock;
9637         }
9638
9639         /* Only trigger an advertising added event if a new instance was
9640          * actually added.
9641          */
9642         if (hdev->adv_instance_cnt > prev_instance_cnt)
9643                 mgmt_advertising_added(sk, hdev, cp->instance);
9644
9645         if (hdev->cur_adv_instance == cp->instance) {
9646                 /* If the currently advertised instance is being changed then
9647                  * cancel the current advertising and schedule the next
9648                  * instance. If there is only one instance then the overridden
9649                  * advertising data will be visible right away.
9650                  */
9651                 cancel_adv_timeout(hdev);
9652
9653                 next_instance = hci_get_next_instance(hdev, cp->instance);
9654                 if (next_instance)
9655                         schedule_instance = next_instance->instance;
9656         } else if (!hdev->adv_instance_timeout) {
9657                 /* Immediately advertise the new instance if no other
9658                  * instance is currently being advertised.
9659                  */
9660                 schedule_instance = cp->instance;
9661         }
9662
9663         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
9664          * there is no instance to be advertised then we have no HCI
9665          * communication to make. Simply return.
9666          */
9667         if (!hdev_is_powered(hdev) ||
9668             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
9669             !schedule_instance) {
9670                 rp.instance = cp->instance;
9671                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9672                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9673                 goto unlock;
9674         }
9675
9676         /* We're good to go, update advertising data, parameters, and start
9677          * advertising.
9678          */
9679         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
9680                                data_len);
9681         if (!cmd) {
9682                 err = -ENOMEM;
9683                 goto unlock;
9684         }
9685
9686         hci_req_init(&req, hdev);
9687
9688         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
9689
9690         if (!err)
9691                 err = hci_req_run(&req, add_advertising_complete);
9692
9693         if (err < 0) {
9694                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9695                                       MGMT_STATUS_FAILED);
9696                 mgmt_pending_remove(cmd);
9697         }
9698
9699 unlock:
9700         hci_dev_unlock(hdev);
9701
9702         return err;
9703 }
9704
9705 static void add_ext_adv_params_complete(struct hci_dev *hdev, u8 status,
9706                                         u16 opcode)
9707 {
9708         struct mgmt_pending_cmd *cmd;
9709         struct mgmt_cp_add_ext_adv_params *cp;
9710         struct mgmt_rp_add_ext_adv_params rp;
9711         struct adv_info *adv_instance;
9712         u32 flags;
9713
9714         BT_DBG("%s", hdev->name);
9715
9716         hci_dev_lock(hdev);
9717
9718         cmd = pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev);
9719         if (!cmd)
9720                 goto unlock;
9721
9722         cp = cmd->param;
9723         adv_instance = hci_find_adv_instance(hdev, cp->instance);
9724         if (!adv_instance)
9725                 goto unlock;
9726
9727         rp.instance = cp->instance;
9728         rp.tx_power = adv_instance->tx_power;
9729
9730         /* While we're at it, inform userspace of the available space for this
9731          * advertisement, given the flags that will be used.
9732          */
9733         flags = __le32_to_cpu(cp->flags);
9734         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9735         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9736
9737         if (status) {
9738                 /* If this advertisement was previously advertising and we
9739                  * failed to update it, we signal that it has been removed and
9740                  * delete its structure
9741                  */
9742                 if (!adv_instance->pending)
9743                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
9744
9745                 hci_remove_adv_instance(hdev, cp->instance);
9746
9747                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9748                                 mgmt_status(status));
9749
9750         } else {
9751                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9752                                   mgmt_status(status), &rp, sizeof(rp));
9753         }
9754
9755 unlock:
9756         if (cmd)
9757                 mgmt_pending_remove(cmd);
9758
9759         hci_dev_unlock(hdev);
9760 }
9761
9762 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
9763                               void *data, u16 data_len)
9764 {
9765         struct mgmt_cp_add_ext_adv_params *cp = data;
9766         struct mgmt_rp_add_ext_adv_params rp;
9767         struct mgmt_pending_cmd *cmd = NULL;
9768         struct adv_info *adv_instance;
9769         struct hci_request req;
9770         u32 flags, min_interval, max_interval;
9771         u16 timeout, duration;
9772         u8 status;
9773         s8 tx_power;
9774         int err;
9775
9776         BT_DBG("%s", hdev->name);
9777
9778         status = mgmt_le_support(hdev);
9779         if (status)
9780                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9781                                        status);
9782
9783         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9784                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9785                                        MGMT_STATUS_INVALID_PARAMS);
9786
9787         /* The purpose of breaking add_advertising into two separate MGMT calls
9788          * for params and data is to allow more parameters to be added to this
9789          * structure in the future. For this reason, we verify that we have the
9790          * bare minimum structure we know of when the interface was defined. Any
9791          * extra parameters we don't know about will be ignored in this request.
9792          */
9793         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
9794                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9795                                        MGMT_STATUS_INVALID_PARAMS);
9796
9797         flags = __le32_to_cpu(cp->flags);
9798
9799         if (!requested_adv_flags_are_valid(hdev, flags))
9800                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9801                                        MGMT_STATUS_INVALID_PARAMS);
9802
9803         hci_dev_lock(hdev);
9804
9805         /* In new interface, we require that we are powered to register */
9806         if (!hdev_is_powered(hdev)) {
9807                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9808                                       MGMT_STATUS_REJECTED);
9809                 goto unlock;
9810         }
9811
9812         if (adv_busy(hdev)) {
9813                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9814                                       MGMT_STATUS_BUSY);
9815                 goto unlock;
9816         }
9817
9818         /* Parse defined parameters from request, use defaults otherwise */
9819         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
9820                   __le16_to_cpu(cp->timeout) : 0;
9821
9822         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
9823                    __le16_to_cpu(cp->duration) :
9824                    hdev->def_multi_adv_rotation_duration;
9825
9826         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
9827                        __le32_to_cpu(cp->min_interval) :
9828                        hdev->le_adv_min_interval;
9829
9830         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
9831                        __le32_to_cpu(cp->max_interval) :
9832                        hdev->le_adv_max_interval;
9833
9834         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
9835                    cp->tx_power :
9836                    HCI_ADV_TX_POWER_NO_PREFERENCE;
9837
9838         /* Create advertising instance with no advertising or response data */
9839         err = hci_add_adv_instance(hdev, cp->instance, flags,
9840                                    0, NULL, 0, NULL, timeout, duration,
9841                                    tx_power, min_interval, max_interval);
9842
9843         if (err < 0) {
9844                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9845                                       MGMT_STATUS_FAILED);
9846                 goto unlock;
9847         }
9848
9849         /* Submit request for advertising params if ext adv available */
9850         if (ext_adv_capable(hdev)) {
9851                 hci_req_init(&req, hdev);
9852                 adv_instance = hci_find_adv_instance(hdev, cp->instance);
9853
9854                 /* Updating parameters of an active instance will return a
9855                  * Command Disallowed error, so we must first disable the
9856                  * instance if it is active.
9857                  */
9858                 if (!adv_instance->pending)
9859                         __hci_req_disable_ext_adv_instance(&req, cp->instance);
9860
9861                 __hci_req_setup_ext_adv_instance(&req, cp->instance);
9862
9863                 err = hci_req_run(&req, add_ext_adv_params_complete);
9864
9865                 if (!err)
9866                         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_PARAMS,
9867                                                hdev, data, data_len);
9868                 if (!cmd) {
9869                         err = -ENOMEM;
9870                         hci_remove_adv_instance(hdev, cp->instance);
9871                         goto unlock;
9872                 }
9873
9874         } else {
9875                 rp.instance = cp->instance;
9876                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
9877                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9878                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9879                 err = mgmt_cmd_complete(sk, hdev->id,
9880                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
9881                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9882         }
9883
9884 unlock:
9885         hci_dev_unlock(hdev);
9886
9887         return err;
9888 }
9889
9890 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
9891                             u16 data_len)
9892 {
9893         struct mgmt_cp_add_ext_adv_data *cp = data;
9894         struct mgmt_rp_add_ext_adv_data rp;
9895         u8 schedule_instance = 0;
9896         struct adv_info *next_instance;
9897         struct adv_info *adv_instance;
9898         int err = 0;
9899         struct mgmt_pending_cmd *cmd;
9900         struct hci_request req;
9901
9902         BT_DBG("%s", hdev->name);
9903
9904         hci_dev_lock(hdev);
9905
9906         adv_instance = hci_find_adv_instance(hdev, cp->instance);
9907
9908         if (!adv_instance) {
9909                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9910                                       MGMT_STATUS_INVALID_PARAMS);
9911                 goto unlock;
9912         }
9913
9914         /* In new interface, we require that we are powered to register */
9915         if (!hdev_is_powered(hdev)) {
9916                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9917                                       MGMT_STATUS_REJECTED);
9918                 goto clear_new_instance;
9919         }
9920
9921         if (adv_busy(hdev)) {
9922                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9923                                       MGMT_STATUS_BUSY);
9924                 goto clear_new_instance;
9925         }
9926
9927         /* Validate new data */
9928         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
9929                                cp->adv_data_len, true) ||
9930             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
9931                                cp->adv_data_len, cp->scan_rsp_len, false)) {
9932                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9933                                       MGMT_STATUS_INVALID_PARAMS);
9934                 goto clear_new_instance;
9935         }
9936
9937         /* Set the data in the advertising instance */
9938         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
9939                                   cp->data, cp->scan_rsp_len,
9940                                   cp->data + cp->adv_data_len);
9941
9942         /* We're good to go, update advertising data, parameters, and start
9943          * advertising.
9944          */
9945
9946         hci_req_init(&req, hdev);
9947
9948         hci_req_add(&req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
9949
9950         if (ext_adv_capable(hdev)) {
9951                 __hci_req_update_adv_data(&req, cp->instance);
9952                 __hci_req_update_scan_rsp_data(&req, cp->instance);
9953                 __hci_req_enable_ext_advertising(&req, cp->instance);
9954
9955         } else {
9956                 /* If using software rotation, determine next instance to use */
9957
9958                 if (hdev->cur_adv_instance == cp->instance) {
9959                         /* If the currently advertised instance is being changed
9960                          * then cancel the current advertising and schedule the
9961                          * next instance. If there is only one instance then the
9962                          * overridden advertising data will be visible right
9963                          * away
9964                          */
9965                         cancel_adv_timeout(hdev);
9966
9967                         next_instance = hci_get_next_instance(hdev,
9968                                                               cp->instance);
9969                         if (next_instance)
9970                                 schedule_instance = next_instance->instance;
9971                 } else if (!hdev->adv_instance_timeout) {
9972                         /* Immediately advertise the new instance if no other
9973                          * instance is currently being advertised.
9974                          */
9975                         schedule_instance = cp->instance;
9976                 }
9977
9978                 /* If the HCI_ADVERTISING flag is set or there is no instance to
9979                  * be advertised then we have no HCI communication to make.
9980                  * Simply return.
9981                  */
9982                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
9983                     !schedule_instance) {
9984                         if (adv_instance->pending) {
9985                                 mgmt_advertising_added(sk, hdev, cp->instance);
9986                                 adv_instance->pending = false;
9987                         }
9988                         rp.instance = cp->instance;
9989                         err = mgmt_cmd_complete(sk, hdev->id,
9990                                                 MGMT_OP_ADD_EXT_ADV_DATA,
9991                                                 MGMT_STATUS_SUCCESS, &rp,
9992                                                 sizeof(rp));
9993                         goto unlock;
9994                 }
9995
9996                 err = __hci_req_schedule_adv_instance(&req, schedule_instance,
9997                                                       true);
9998         }
9999
10000         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
10001                                data_len);
10002         if (!cmd) {
10003                 err = -ENOMEM;
10004                 goto clear_new_instance;
10005         }
10006
10007         if (!err)
10008                 err = hci_req_run(&req, add_advertising_complete);
10009
10010         if (err < 0) {
10011                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10012                                       MGMT_STATUS_FAILED);
10013                 mgmt_pending_remove(cmd);
10014                 goto clear_new_instance;
10015         }
10016
10017         /* We were successful in updating data, so trigger advertising_added
10018          * event if this is an instance that wasn't previously advertising. If
10019          * a failure occurs in the requests we initiated, we will remove the
10020          * instance again in add_advertising_complete
10021          */
10022         if (adv_instance->pending)
10023                 mgmt_advertising_added(sk, hdev, cp->instance);
10024
10025         goto unlock;
10026
10027 clear_new_instance:
10028         hci_remove_adv_instance(hdev, cp->instance);
10029
10030 unlock:
10031         hci_dev_unlock(hdev);
10032
10033         return err;
10034 }
10035
10036 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
10037                                         u16 opcode)
10038 {
10039         struct mgmt_pending_cmd *cmd;
10040         struct mgmt_cp_remove_advertising *cp;
10041         struct mgmt_rp_remove_advertising rp;
10042
10043         bt_dev_dbg(hdev, "status %u", status);
10044
10045         hci_dev_lock(hdev);
10046
10047         /* A failure status here only means that we failed to disable
10048          * advertising. Otherwise, the advertising instance has been removed,
10049          * so report success.
10050          */
10051         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
10052         if (!cmd)
10053                 goto unlock;
10054
10055         cp = cmd->param;
10056         rp.instance = cp->instance;
10057
10058         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
10059                           &rp, sizeof(rp));
10060         mgmt_pending_remove(cmd);
10061
10062 unlock:
10063         hci_dev_unlock(hdev);
10064 }
10065
10066 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
10067                               void *data, u16 data_len)
10068 {
10069         struct mgmt_cp_remove_advertising *cp = data;
10070         struct mgmt_rp_remove_advertising rp;
10071         struct mgmt_pending_cmd *cmd;
10072         struct hci_request req;
10073         int err;
10074
10075         bt_dev_dbg(hdev, "sock %p", sk);
10076
10077         /* Enabling the experimental LL Privay support disables support for
10078          * advertising.
10079          */
10080         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
10081                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
10082                                        MGMT_STATUS_NOT_SUPPORTED);
10083
10084         hci_dev_lock(hdev);
10085
10086         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
10087                 err = mgmt_cmd_status(sk, hdev->id,
10088                                       MGMT_OP_REMOVE_ADVERTISING,
10089                                       MGMT_STATUS_INVALID_PARAMS);
10090                 goto unlock;
10091         }
10092
10093         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
10094             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
10095             pending_find(MGMT_OP_SET_LE, hdev)) {
10096                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10097                                       MGMT_STATUS_BUSY);
10098                 goto unlock;
10099         }
10100
10101         if (list_empty(&hdev->adv_instances)) {
10102                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10103                                       MGMT_STATUS_INVALID_PARAMS);
10104                 goto unlock;
10105         }
10106
10107         hci_req_init(&req, hdev);
10108
10109         /* If we use extended advertising, instance is disabled and removed */
10110         if (ext_adv_capable(hdev)) {
10111                 __hci_req_disable_ext_adv_instance(&req, cp->instance);
10112                 __hci_req_remove_ext_adv_instance(&req, cp->instance);
10113         }
10114
10115         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
10116
10117         if (list_empty(&hdev->adv_instances))
10118                 __hci_req_disable_advertising(&req);
10119
10120         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
10121          * flag is set or the device isn't powered then we have no HCI
10122          * communication to make. Simply return.
10123          */
10124         if (skb_queue_empty(&req.cmd_q) ||
10125             !hdev_is_powered(hdev) ||
10126             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
10127                 hci_req_purge(&req);
10128                 rp.instance = cp->instance;
10129                 err = mgmt_cmd_complete(sk, hdev->id,
10130                                         MGMT_OP_REMOVE_ADVERTISING,
10131                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10132                 goto unlock;
10133         }
10134
10135         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
10136                                data_len);
10137         if (!cmd) {
10138                 err = -ENOMEM;
10139                 goto unlock;
10140         }
10141
10142         err = hci_req_run(&req, remove_advertising_complete);
10143         if (err < 0)
10144                 mgmt_pending_remove(cmd);
10145
10146 unlock:
10147         hci_dev_unlock(hdev);
10148
10149         return err;
10150 }
10151
10152 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
10153                              void *data, u16 data_len)
10154 {
10155         struct mgmt_cp_get_adv_size_info *cp = data;
10156         struct mgmt_rp_get_adv_size_info rp;
10157         u32 flags, supported_flags;
10158         int err;
10159
10160         bt_dev_dbg(hdev, "sock %p", sk);
10161
10162         if (!lmp_le_capable(hdev))
10163                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10164                                        MGMT_STATUS_REJECTED);
10165
10166         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10167                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10168                                        MGMT_STATUS_INVALID_PARAMS);
10169
10170         flags = __le32_to_cpu(cp->flags);
10171
10172         /* The current implementation only supports a subset of the specified
10173          * flags.
10174          */
10175         supported_flags = get_supported_adv_flags(hdev);
10176         if (flags & ~supported_flags)
10177                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10178                                        MGMT_STATUS_INVALID_PARAMS);
10179
10180         rp.instance = cp->instance;
10181         rp.flags = cp->flags;
10182         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10183         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10184
10185         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10186                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10187
10188         return err;
10189 }
10190
10191 static const struct hci_mgmt_handler mgmt_handlers[] = {
10192         { NULL }, /* 0x0000 (no command) */
10193         { read_version,            MGMT_READ_VERSION_SIZE,
10194                                                 HCI_MGMT_NO_HDEV |
10195                                                 HCI_MGMT_UNTRUSTED },
10196         { read_commands,           MGMT_READ_COMMANDS_SIZE,
10197                                                 HCI_MGMT_NO_HDEV |
10198                                                 HCI_MGMT_UNTRUSTED },
10199         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
10200                                                 HCI_MGMT_NO_HDEV |
10201                                                 HCI_MGMT_UNTRUSTED },
10202         { read_controller_info,    MGMT_READ_INFO_SIZE,
10203                                                 HCI_MGMT_UNTRUSTED },
10204         { set_powered,             MGMT_SETTING_SIZE },
10205         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
10206         { set_connectable,         MGMT_SETTING_SIZE },
10207         { set_fast_connectable,    MGMT_SETTING_SIZE },
10208         { set_bondable,            MGMT_SETTING_SIZE },
10209         { set_link_security,       MGMT_SETTING_SIZE },
10210         { set_ssp,                 MGMT_SETTING_SIZE },
10211         { set_hs,                  MGMT_SETTING_SIZE },
10212         { set_le,                  MGMT_SETTING_SIZE },
10213         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
10214         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
10215         { add_uuid,                MGMT_ADD_UUID_SIZE },
10216         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
10217         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
10218                                                 HCI_MGMT_VAR_LEN },
10219         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
10220                                                 HCI_MGMT_VAR_LEN },
10221         { disconnect,              MGMT_DISCONNECT_SIZE },
10222         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
10223         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
10224         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
10225         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
10226         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
10227         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
10228         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
10229         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
10230         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
10231         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
10232         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
10233         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
10234         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
10235                                                 HCI_MGMT_VAR_LEN },
10236         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
10237         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
10238         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
10239         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
10240         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
10241         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
10242         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
10243         { set_advertising,         MGMT_SETTING_SIZE },
10244         { set_bredr,               MGMT_SETTING_SIZE },
10245         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
10246         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
10247         { set_secure_conn,         MGMT_SETTING_SIZE },
10248         { set_debug_keys,          MGMT_SETTING_SIZE },
10249         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
10250         { load_irks,               MGMT_LOAD_IRKS_SIZE,
10251                                                 HCI_MGMT_VAR_LEN },
10252         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
10253         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
10254         { add_device,              MGMT_ADD_DEVICE_SIZE },
10255         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
10256         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
10257                                                 HCI_MGMT_VAR_LEN },
10258         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
10259                                                 HCI_MGMT_NO_HDEV |
10260                                                 HCI_MGMT_UNTRUSTED },
10261         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
10262                                                 HCI_MGMT_UNCONFIGURED |
10263                                                 HCI_MGMT_UNTRUSTED },
10264         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
10265                                                 HCI_MGMT_UNCONFIGURED },
10266         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
10267                                                 HCI_MGMT_UNCONFIGURED },
10268         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
10269                                                 HCI_MGMT_VAR_LEN },
10270         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
10271         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
10272                                                 HCI_MGMT_NO_HDEV |
10273                                                 HCI_MGMT_UNTRUSTED },
10274         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
10275         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
10276                                                 HCI_MGMT_VAR_LEN },
10277         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
10278         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
10279         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
10280         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
10281                                                 HCI_MGMT_UNTRUSTED },
10282         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
10283         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
10284         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
10285         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
10286                                                 HCI_MGMT_VAR_LEN },
10287         { set_wideband_speech,     MGMT_SETTING_SIZE },
10288         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
10289                                                 HCI_MGMT_UNTRUSTED },
10290         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
10291                                                 HCI_MGMT_UNTRUSTED |
10292                                                 HCI_MGMT_HDEV_OPTIONAL },
10293         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
10294                                                 HCI_MGMT_VAR_LEN |
10295                                                 HCI_MGMT_HDEV_OPTIONAL },
10296         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
10297                                                 HCI_MGMT_UNTRUSTED },
10298         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
10299                                                 HCI_MGMT_VAR_LEN },
10300         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
10301                                                 HCI_MGMT_UNTRUSTED },
10302         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
10303                                                 HCI_MGMT_VAR_LEN },
10304         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
10305         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
10306         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
10307         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
10308                                                 HCI_MGMT_VAR_LEN },
10309         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
10310         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
10311                                                 HCI_MGMT_VAR_LEN },
10312         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
10313                                                 HCI_MGMT_VAR_LEN },
10314         { add_adv_patterns_monitor_rssi,
10315                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
10316                                                 HCI_MGMT_VAR_LEN },
10317 };
10318
10319 #ifdef TIZEN_BT
10320 static const struct hci_mgmt_handler tizen_mgmt_handlers[] = {
10321         { NULL }, /* 0x0000 (no command) */
10322         { set_advertising_params,  MGMT_SET_ADVERTISING_PARAMS_SIZE },
10323         { set_advertising_data,    MGMT_SET_ADV_MIN_APP_DATA_SIZE,
10324                                                 HCI_MGMT_VAR_LEN },
10325         { set_scan_rsp_data,       MGMT_SET_SCAN_RSP_MIN_APP_DATA_SIZE,
10326                                                 HCI_MGMT_VAR_LEN },
10327         { add_white_list,          MGMT_ADD_DEV_WHITE_LIST_SIZE },
10328         { remove_from_white_list,  MGMT_REMOVE_DEV_FROM_WHITE_LIST_SIZE },
10329         { clear_white_list,        MGMT_OP_CLEAR_DEV_WHITE_LIST_SIZE },
10330         { set_enable_rssi,         MGMT_SET_RSSI_ENABLE_SIZE },
10331         { get_raw_rssi,            MGMT_GET_RAW_RSSI_SIZE },
10332         { set_disable_threshold,   MGMT_SET_RSSI_DISABLE_SIZE },
10333         { start_le_discovery,      MGMT_START_LE_DISCOVERY_SIZE },
10334         { stop_le_discovery,       MGMT_STOP_LE_DISCOVERY_SIZE },
10335         { disable_le_auto_connect, MGMT_DISABLE_LE_AUTO_CONNECT_SIZE },
10336         { le_conn_update,          MGMT_LE_CONN_UPDATE_SIZE },
10337         { set_manufacturer_data,   MGMT_SET_MANUFACTURER_DATA_SIZE },
10338         { le_set_scan_params,      MGMT_LE_SET_SCAN_PARAMS_SIZE },
10339         { set_voice_setting,       MGMT_SET_VOICE_SETTING_SIZE },
10340 };
10341 #endif
10342
10343 void mgmt_index_added(struct hci_dev *hdev)
10344 {
10345         struct mgmt_ev_ext_index ev;
10346
10347         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10348                 return;
10349
10350         switch (hdev->dev_type) {
10351         case HCI_PRIMARY:
10352                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10353                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
10354                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10355                         ev.type = 0x01;
10356                 } else {
10357                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
10358                                          HCI_MGMT_INDEX_EVENTS);
10359                         ev.type = 0x00;
10360                 }
10361                 break;
10362         case HCI_AMP:
10363                 ev.type = 0x02;
10364                 break;
10365         default:
10366                 return;
10367         }
10368
10369         ev.bus = hdev->bus;
10370
10371         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
10372                          HCI_MGMT_EXT_INDEX_EVENTS);
10373 }
10374
10375 void mgmt_index_removed(struct hci_dev *hdev)
10376 {
10377         struct mgmt_ev_ext_index ev;
10378         u8 status = MGMT_STATUS_INVALID_INDEX;
10379
10380         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10381                 return;
10382
10383         switch (hdev->dev_type) {
10384         case HCI_PRIMARY:
10385                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
10386
10387                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10388                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
10389                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10390                         ev.type = 0x01;
10391                 } else {
10392                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
10393                                          HCI_MGMT_INDEX_EVENTS);
10394                         ev.type = 0x00;
10395                 }
10396                 break;
10397         case HCI_AMP:
10398                 ev.type = 0x02;
10399                 break;
10400         default:
10401                 return;
10402         }
10403
10404         ev.bus = hdev->bus;
10405
10406         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
10407                          HCI_MGMT_EXT_INDEX_EVENTS);
10408 }
10409
10410 /* This function requires the caller holds hdev->lock */
10411 static void restart_le_actions(struct hci_dev *hdev)
10412 {
10413         struct hci_conn_params *p;
10414
10415         list_for_each_entry(p, &hdev->le_conn_params, list) {
10416                 /* Needed for AUTO_OFF case where might not "really"
10417                  * have been powered off.
10418                  */
10419                 list_del_init(&p->action);
10420
10421                 switch (p->auto_connect) {
10422                 case HCI_AUTO_CONN_DIRECT:
10423                 case HCI_AUTO_CONN_ALWAYS:
10424                         list_add(&p->action, &hdev->pend_le_conns);
10425                         break;
10426                 case HCI_AUTO_CONN_REPORT:
10427                         list_add(&p->action, &hdev->pend_le_reports);
10428                         break;
10429                 default:
10430                         break;
10431                 }
10432         }
10433 }
10434
10435 void mgmt_power_on(struct hci_dev *hdev, int err)
10436 {
10437         struct cmd_lookup match = { NULL, hdev };
10438
10439         bt_dev_dbg(hdev, "err %d", err);
10440
10441         hci_dev_lock(hdev);
10442
10443         if (!err) {
10444                 restart_le_actions(hdev);
10445                 hci_update_background_scan(hdev);
10446         }
10447
10448         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
10449
10450         new_settings(hdev, match.sk);
10451
10452         if (match.sk)
10453                 sock_put(match.sk);
10454
10455         hci_dev_unlock(hdev);
10456 }
10457
10458 void __mgmt_power_off(struct hci_dev *hdev)
10459 {
10460         struct cmd_lookup match = { NULL, hdev };
10461         u8 status, zero_cod[] = { 0, 0, 0 };
10462
10463         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
10464
10465         /* If the power off is because of hdev unregistration let
10466          * use the appropriate INVALID_INDEX status. Otherwise use
10467          * NOT_POWERED. We cover both scenarios here since later in
10468          * mgmt_index_removed() any hci_conn callbacks will have already
10469          * been triggered, potentially causing misleading DISCONNECTED
10470          * status responses.
10471          */
10472         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
10473                 status = MGMT_STATUS_INVALID_INDEX;
10474         else
10475                 status = MGMT_STATUS_NOT_POWERED;
10476
10477         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
10478
10479         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
10480                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
10481                                    zero_cod, sizeof(zero_cod),
10482                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
10483                 ext_info_changed(hdev, NULL);
10484         }
10485
10486         new_settings(hdev, match.sk);
10487
10488         if (match.sk)
10489                 sock_put(match.sk);
10490 }
10491
10492 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
10493 {
10494         struct mgmt_pending_cmd *cmd;
10495         u8 status;
10496
10497         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
10498         if (!cmd)
10499                 return;
10500
10501         if (err == -ERFKILL)
10502                 status = MGMT_STATUS_RFKILLED;
10503         else
10504                 status = MGMT_STATUS_FAILED;
10505
10506         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
10507
10508         mgmt_pending_remove(cmd);
10509 }
10510
10511 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
10512                        bool persistent)
10513 {
10514         struct mgmt_ev_new_link_key ev;
10515
10516         memset(&ev, 0, sizeof(ev));
10517
10518         ev.store_hint = persistent;
10519         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
10520         ev.key.addr.type = BDADDR_BREDR;
10521         ev.key.type = key->type;
10522         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
10523         ev.key.pin_len = key->pin_len;
10524
10525         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
10526 }
10527
10528 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
10529 {
10530         switch (ltk->type) {
10531         case SMP_LTK:
10532         case SMP_LTK_RESPONDER:
10533                 if (ltk->authenticated)
10534                         return MGMT_LTK_AUTHENTICATED;
10535                 return MGMT_LTK_UNAUTHENTICATED;
10536         case SMP_LTK_P256:
10537                 if (ltk->authenticated)
10538                         return MGMT_LTK_P256_AUTH;
10539                 return MGMT_LTK_P256_UNAUTH;
10540         case SMP_LTK_P256_DEBUG:
10541                 return MGMT_LTK_P256_DEBUG;
10542         }
10543
10544         return MGMT_LTK_UNAUTHENTICATED;
10545 }
10546
10547 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
10548 {
10549         struct mgmt_ev_new_long_term_key ev;
10550
10551         memset(&ev, 0, sizeof(ev));
10552
10553         /* Devices using resolvable or non-resolvable random addresses
10554          * without providing an identity resolving key don't require
10555          * to store long term keys. Their addresses will change the
10556          * next time around.
10557          *
10558          * Only when a remote device provides an identity address
10559          * make sure the long term key is stored. If the remote
10560          * identity is known, the long term keys are internally
10561          * mapped to the identity address. So allow static random
10562          * and public addresses here.
10563          */
10564         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
10565             (key->bdaddr.b[5] & 0xc0) != 0xc0)
10566                 ev.store_hint = 0x00;
10567         else
10568                 ev.store_hint = persistent;
10569
10570         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
10571         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
10572         ev.key.type = mgmt_ltk_type(key);
10573         ev.key.enc_size = key->enc_size;
10574         ev.key.ediv = key->ediv;
10575         ev.key.rand = key->rand;
10576
10577         if (key->type == SMP_LTK)
10578                 ev.key.initiator = 1;
10579
10580         /* Make sure we copy only the significant bytes based on the
10581          * encryption key size, and set the rest of the value to zeroes.
10582          */
10583         memcpy(ev.key.val, key->val, key->enc_size);
10584         memset(ev.key.val + key->enc_size, 0,
10585                sizeof(ev.key.val) - key->enc_size);
10586
10587         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
10588 }
10589
10590 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
10591 {
10592         struct mgmt_ev_new_irk ev;
10593
10594         memset(&ev, 0, sizeof(ev));
10595
10596         ev.store_hint = persistent;
10597
10598         bacpy(&ev.rpa, &irk->rpa);
10599         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
10600         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
10601         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
10602
10603         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
10604 }
10605
10606 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
10607                    bool persistent)
10608 {
10609         struct mgmt_ev_new_csrk ev;
10610
10611         memset(&ev, 0, sizeof(ev));
10612
10613         /* Devices using resolvable or non-resolvable random addresses
10614          * without providing an identity resolving key don't require
10615          * to store signature resolving keys. Their addresses will change
10616          * the next time around.
10617          *
10618          * Only when a remote device provides an identity address
10619          * make sure the signature resolving key is stored. So allow
10620          * static random and public addresses here.
10621          */
10622         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
10623             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
10624                 ev.store_hint = 0x00;
10625         else
10626                 ev.store_hint = persistent;
10627
10628         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
10629         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
10630         ev.key.type = csrk->type;
10631         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
10632
10633         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
10634 }
10635
10636 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
10637                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
10638                          u16 max_interval, u16 latency, u16 timeout)
10639 {
10640         struct mgmt_ev_new_conn_param ev;
10641
10642         if (!hci_is_identity_address(bdaddr, bdaddr_type))
10643                 return;
10644
10645         memset(&ev, 0, sizeof(ev));
10646         bacpy(&ev.addr.bdaddr, bdaddr);
10647         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
10648         ev.store_hint = store_hint;
10649         ev.min_interval = cpu_to_le16(min_interval);
10650         ev.max_interval = cpu_to_le16(max_interval);
10651         ev.latency = cpu_to_le16(latency);
10652         ev.timeout = cpu_to_le16(timeout);
10653
10654         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
10655 }
10656
10657 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
10658                            u8 *name, u8 name_len)
10659 {
10660         char buf[512];
10661         struct mgmt_ev_device_connected *ev = (void *) buf;
10662         u16 eir_len = 0;
10663         u32 flags = 0;
10664
10665         bacpy(&ev->addr.bdaddr, &conn->dst);
10666         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10667
10668         if (conn->out)
10669                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
10670
10671         ev->flags = __cpu_to_le32(flags);
10672
10673         /* We must ensure that the EIR Data fields are ordered and
10674          * unique. Keep it simple for now and avoid the problem by not
10675          * adding any BR/EDR data to the LE adv.
10676          */
10677         if (conn->le_adv_data_len > 0) {
10678                 memcpy(&ev->eir[eir_len],
10679                        conn->le_adv_data, conn->le_adv_data_len);
10680                 eir_len = conn->le_adv_data_len;
10681         } else {
10682                 if (name_len > 0)
10683                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
10684                                                   name, name_len);
10685
10686                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
10687                         eir_len = eir_append_data(ev->eir, eir_len,
10688                                                   EIR_CLASS_OF_DEV,
10689                                                   conn->dev_class, 3);
10690         }
10691
10692         ev->eir_len = cpu_to_le16(eir_len);
10693
10694         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
10695                     sizeof(*ev) + eir_len, NULL);
10696 }
10697
10698 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
10699 {
10700         struct sock **sk = data;
10701
10702         cmd->cmd_complete(cmd, 0);
10703
10704         *sk = cmd->sk;
10705         sock_hold(*sk);
10706
10707         mgmt_pending_remove(cmd);
10708 }
10709
10710 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
10711 {
10712         struct hci_dev *hdev = data;
10713         struct mgmt_cp_unpair_device *cp = cmd->param;
10714
10715         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
10716
10717         cmd->cmd_complete(cmd, 0);
10718         mgmt_pending_remove(cmd);
10719 }
10720
10721 bool mgmt_powering_down(struct hci_dev *hdev)
10722 {
10723         struct mgmt_pending_cmd *cmd;
10724         struct mgmt_mode *cp;
10725
10726         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
10727         if (!cmd)
10728                 return false;
10729
10730         cp = cmd->param;
10731         if (!cp->val)
10732                 return true;
10733
10734         return false;
10735 }
10736
10737 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
10738                               u8 link_type, u8 addr_type, u8 reason,
10739                               bool mgmt_connected)
10740 {
10741         struct mgmt_ev_device_disconnected ev;
10742         struct sock *sk = NULL;
10743
10744         /* The connection is still in hci_conn_hash so test for 1
10745          * instead of 0 to know if this is the last one.
10746          */
10747         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
10748                 cancel_delayed_work(&hdev->power_off);
10749                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
10750         }
10751
10752         if (!mgmt_connected)
10753                 return;
10754
10755         if (link_type != ACL_LINK && link_type != LE_LINK)
10756                 return;
10757
10758         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
10759
10760         bacpy(&ev.addr.bdaddr, bdaddr);
10761         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10762         ev.reason = reason;
10763
10764         /* Report disconnects due to suspend */
10765         if (hdev->suspended)
10766                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
10767
10768         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
10769
10770         if (sk)
10771                 sock_put(sk);
10772
10773         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
10774                              hdev);
10775 }
10776
10777 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
10778                             u8 link_type, u8 addr_type, u8 status)
10779 {
10780         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
10781         struct mgmt_cp_disconnect *cp;
10782         struct mgmt_pending_cmd *cmd;
10783
10784         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
10785                              hdev);
10786
10787         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
10788         if (!cmd)
10789                 return;
10790
10791         cp = cmd->param;
10792
10793         if (bacmp(bdaddr, &cp->addr.bdaddr))
10794                 return;
10795
10796         if (cp->addr.type != bdaddr_type)
10797                 return;
10798
10799         cmd->cmd_complete(cmd, mgmt_status(status));
10800         mgmt_pending_remove(cmd);
10801 }
10802
10803 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10804                          u8 addr_type, u8 status)
10805 {
10806         struct mgmt_ev_connect_failed ev;
10807
10808         /* The connection is still in hci_conn_hash so test for 1
10809          * instead of 0 to know if this is the last one.
10810          */
10811         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
10812                 cancel_delayed_work(&hdev->power_off);
10813                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
10814         }
10815
10816         bacpy(&ev.addr.bdaddr, bdaddr);
10817         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10818         ev.status = mgmt_status(status);
10819
10820         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
10821 }
10822
10823 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
10824 {
10825         struct mgmt_ev_pin_code_request ev;
10826
10827         bacpy(&ev.addr.bdaddr, bdaddr);
10828         ev.addr.type = BDADDR_BREDR;
10829         ev.secure = secure;
10830
10831         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
10832 }
10833
10834 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10835                                   u8 status)
10836 {
10837         struct mgmt_pending_cmd *cmd;
10838
10839         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
10840         if (!cmd)
10841                 return;
10842
10843         cmd->cmd_complete(cmd, mgmt_status(status));
10844         mgmt_pending_remove(cmd);
10845 }
10846
10847 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10848                                       u8 status)
10849 {
10850         struct mgmt_pending_cmd *cmd;
10851
10852         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
10853         if (!cmd)
10854                 return;
10855
10856         cmd->cmd_complete(cmd, mgmt_status(status));
10857         mgmt_pending_remove(cmd);
10858 }
10859
10860 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
10861                               u8 link_type, u8 addr_type, u32 value,
10862                               u8 confirm_hint)
10863 {
10864         struct mgmt_ev_user_confirm_request ev;
10865
10866         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10867
10868         bacpy(&ev.addr.bdaddr, bdaddr);
10869         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10870         ev.confirm_hint = confirm_hint;
10871         ev.value = cpu_to_le32(value);
10872
10873         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
10874                           NULL);
10875 }
10876
10877 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
10878                               u8 link_type, u8 addr_type)
10879 {
10880         struct mgmt_ev_user_passkey_request ev;
10881
10882         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10883
10884         bacpy(&ev.addr.bdaddr, bdaddr);
10885         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10886
10887         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
10888                           NULL);
10889 }
10890
10891 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10892                                       u8 link_type, u8 addr_type, u8 status,
10893                                       u8 opcode)
10894 {
10895         struct mgmt_pending_cmd *cmd;
10896
10897         cmd = pending_find(opcode, hdev);
10898         if (!cmd)
10899                 return -ENOENT;
10900
10901         cmd->cmd_complete(cmd, mgmt_status(status));
10902         mgmt_pending_remove(cmd);
10903
10904         return 0;
10905 }
10906
10907 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10908                                      u8 link_type, u8 addr_type, u8 status)
10909 {
10910         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10911                                           status, MGMT_OP_USER_CONFIRM_REPLY);
10912 }
10913
10914 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10915                                          u8 link_type, u8 addr_type, u8 status)
10916 {
10917         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10918                                           status,
10919                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
10920 }
10921
10922 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10923                                      u8 link_type, u8 addr_type, u8 status)
10924 {
10925         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10926                                           status, MGMT_OP_USER_PASSKEY_REPLY);
10927 }
10928
10929 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10930                                          u8 link_type, u8 addr_type, u8 status)
10931 {
10932         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10933                                           status,
10934                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
10935 }
10936
10937 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
10938                              u8 link_type, u8 addr_type, u32 passkey,
10939                              u8 entered)
10940 {
10941         struct mgmt_ev_passkey_notify ev;
10942
10943         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10944
10945         bacpy(&ev.addr.bdaddr, bdaddr);
10946         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10947         ev.passkey = __cpu_to_le32(passkey);
10948         ev.entered = entered;
10949
10950         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
10951 }
10952
10953 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
10954 {
10955         struct mgmt_ev_auth_failed ev;
10956         struct mgmt_pending_cmd *cmd;
10957         u8 status = mgmt_status(hci_status);
10958
10959         bacpy(&ev.addr.bdaddr, &conn->dst);
10960         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10961         ev.status = status;
10962
10963         cmd = find_pairing(conn);
10964
10965         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
10966                     cmd ? cmd->sk : NULL);
10967
10968         if (cmd) {
10969                 cmd->cmd_complete(cmd, status);
10970                 mgmt_pending_remove(cmd);
10971         }
10972 }
10973
10974 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
10975 {
10976         struct cmd_lookup match = { NULL, hdev };
10977         bool changed;
10978
10979         if (status) {
10980                 u8 mgmt_err = mgmt_status(status);
10981                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
10982                                      cmd_status_rsp, &mgmt_err);
10983                 return;
10984         }
10985
10986         if (test_bit(HCI_AUTH, &hdev->flags))
10987                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
10988         else
10989                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
10990
10991         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
10992                              &match);
10993
10994         if (changed)
10995                 new_settings(hdev, match.sk);
10996
10997         if (match.sk)
10998                 sock_put(match.sk);
10999 }
11000
11001 static void clear_eir(struct hci_request *req)
11002 {
11003         struct hci_dev *hdev = req->hdev;
11004         struct hci_cp_write_eir cp;
11005
11006         if (!lmp_ext_inq_capable(hdev))
11007                 return;
11008
11009         memset(hdev->eir, 0, sizeof(hdev->eir));
11010
11011         memset(&cp, 0, sizeof(cp));
11012
11013         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
11014 }
11015
11016 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
11017 {
11018         struct cmd_lookup match = { NULL, hdev };
11019         struct hci_request req;
11020         bool changed = false;
11021
11022         if (status) {
11023                 u8 mgmt_err = mgmt_status(status);
11024
11025                 if (enable && hci_dev_test_and_clear_flag(hdev,
11026                                                           HCI_SSP_ENABLED)) {
11027                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
11028                         new_settings(hdev, NULL);
11029                 }
11030
11031                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
11032                                      &mgmt_err);
11033                 return;
11034         }
11035
11036         if (enable) {
11037                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
11038         } else {
11039                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
11040                 if (!changed)
11041                         changed = hci_dev_test_and_clear_flag(hdev,
11042                                                               HCI_HS_ENABLED);
11043                 else
11044                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
11045         }
11046
11047         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
11048
11049         if (changed)
11050                 new_settings(hdev, match.sk);
11051
11052         if (match.sk)
11053                 sock_put(match.sk);
11054
11055         hci_req_init(&req, hdev);
11056
11057         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
11058                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
11059                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
11060                                     sizeof(enable), &enable);
11061                 __hci_req_update_eir(&req);
11062         } else {
11063                 clear_eir(&req);
11064         }
11065
11066         hci_req_run(&req, NULL);
11067 }
11068
11069 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
11070 {
11071         struct cmd_lookup *match = data;
11072
11073         if (match->sk == NULL) {
11074                 match->sk = cmd->sk;
11075                 sock_hold(match->sk);
11076         }
11077 }
11078
11079 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
11080                                     u8 status)
11081 {
11082         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
11083
11084         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
11085         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
11086         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
11087
11088         if (!status) {
11089                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
11090                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
11091                 ext_info_changed(hdev, NULL);
11092         }
11093
11094         if (match.sk)
11095                 sock_put(match.sk);
11096 }
11097
11098 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
11099 {
11100         struct mgmt_cp_set_local_name ev;
11101         struct mgmt_pending_cmd *cmd;
11102
11103         if (status)
11104                 return;
11105
11106         memset(&ev, 0, sizeof(ev));
11107         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
11108         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
11109
11110         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
11111         if (!cmd) {
11112                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
11113
11114                 /* If this is a HCI command related to powering on the
11115                  * HCI dev don't send any mgmt signals.
11116                  */
11117                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
11118                         return;
11119         }
11120
11121         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
11122                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
11123         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
11124 }
11125
11126 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
11127 {
11128         int i;
11129
11130         for (i = 0; i < uuid_count; i++) {
11131                 if (!memcmp(uuid, uuids[i], 16))
11132                         return true;
11133         }
11134
11135         return false;
11136 }
11137
11138 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
11139 {
11140         u16 parsed = 0;
11141
11142         while (parsed < eir_len) {
11143                 u8 field_len = eir[0];
11144                 u8 uuid[16];
11145                 int i;
11146
11147                 if (field_len == 0)
11148                         break;
11149
11150                 if (eir_len - parsed < field_len + 1)
11151                         break;
11152
11153                 switch (eir[1]) {
11154                 case EIR_UUID16_ALL:
11155                 case EIR_UUID16_SOME:
11156                         for (i = 0; i + 3 <= field_len; i += 2) {
11157                                 memcpy(uuid, bluetooth_base_uuid, 16);
11158                                 uuid[13] = eir[i + 3];
11159                                 uuid[12] = eir[i + 2];
11160                                 if (has_uuid(uuid, uuid_count, uuids))
11161                                         return true;
11162                         }
11163                         break;
11164                 case EIR_UUID32_ALL:
11165                 case EIR_UUID32_SOME:
11166                         for (i = 0; i + 5 <= field_len; i += 4) {
11167                                 memcpy(uuid, bluetooth_base_uuid, 16);
11168                                 uuid[15] = eir[i + 5];
11169                                 uuid[14] = eir[i + 4];
11170                                 uuid[13] = eir[i + 3];
11171                                 uuid[12] = eir[i + 2];
11172                                 if (has_uuid(uuid, uuid_count, uuids))
11173                                         return true;
11174                         }
11175                         break;
11176                 case EIR_UUID128_ALL:
11177                 case EIR_UUID128_SOME:
11178                         for (i = 0; i + 17 <= field_len; i += 16) {
11179                                 memcpy(uuid, eir + i + 2, 16);
11180                                 if (has_uuid(uuid, uuid_count, uuids))
11181                                         return true;
11182                         }
11183                         break;
11184                 }
11185
11186                 parsed += field_len + 1;
11187                 eir += field_len + 1;
11188         }
11189
11190         return false;
11191 }
11192
11193 static void restart_le_scan(struct hci_dev *hdev)
11194 {
11195         /* If controller is not scanning we are done. */
11196         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
11197                 return;
11198
11199         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
11200                        hdev->discovery.scan_start +
11201                        hdev->discovery.scan_duration))
11202                 return;
11203
11204         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
11205                            DISCOV_LE_RESTART_DELAY);
11206 }
11207
11208 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
11209                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
11210 {
11211         /* If a RSSI threshold has been specified, and
11212          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
11213          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
11214          * is set, let it through for further processing, as we might need to
11215          * restart the scan.
11216          *
11217          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
11218          * the results are also dropped.
11219          */
11220         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11221             (rssi == HCI_RSSI_INVALID ||
11222             (rssi < hdev->discovery.rssi &&
11223              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
11224                 return  false;
11225
11226         if (hdev->discovery.uuid_count != 0) {
11227                 /* If a list of UUIDs is provided in filter, results with no
11228                  * matching UUID should be dropped.
11229                  */
11230                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
11231                                    hdev->discovery.uuids) &&
11232                     !eir_has_uuids(scan_rsp, scan_rsp_len,
11233                                    hdev->discovery.uuid_count,
11234                                    hdev->discovery.uuids))
11235                         return false;
11236         }
11237
11238         /* If duplicate filtering does not report RSSI changes, then restart
11239          * scanning to ensure updated result with updated RSSI values.
11240          */
11241         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
11242                 restart_le_scan(hdev);
11243
11244                 /* Validate RSSI value against the RSSI threshold once more. */
11245                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11246                     rssi < hdev->discovery.rssi)
11247                         return false;
11248         }
11249
11250         return true;
11251 }
11252
11253 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11254                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
11255                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
11256 {
11257         char buf[512];
11258         struct mgmt_ev_device_found *ev = (void *)buf;
11259         size_t ev_size;
11260
11261         /* Don't send events for a non-kernel initiated discovery. With
11262          * LE one exception is if we have pend_le_reports > 0 in which
11263          * case we're doing passive scanning and want these events.
11264          */
11265         if (!hci_discovery_active(hdev)) {
11266                 if (link_type == ACL_LINK)
11267                         return;
11268                 if (link_type == LE_LINK &&
11269                     list_empty(&hdev->pend_le_reports) &&
11270                     !hci_is_adv_monitoring(hdev)) {
11271                         return;
11272                 }
11273         }
11274
11275         if (hdev->discovery.result_filtering) {
11276                 /* We are using service discovery */
11277                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
11278                                      scan_rsp_len))
11279                         return;
11280         }
11281
11282         if (hdev->discovery.limited) {
11283                 /* Check for limited discoverable bit */
11284                 if (dev_class) {
11285                         if (!(dev_class[1] & 0x20))
11286                                 return;
11287                 } else {
11288                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
11289                         if (!flags || !(flags[0] & LE_AD_LIMITED))
11290                                 return;
11291                 }
11292         }
11293
11294         /* Make sure that the buffer is big enough. The 5 extra bytes
11295          * are for the potential CoD field.
11296          */
11297         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
11298                 return;
11299
11300         memset(buf, 0, sizeof(buf));
11301
11302         /* In case of device discovery with BR/EDR devices (pre 1.2), the
11303          * RSSI value was reported as 0 when not available. This behavior
11304          * is kept when using device discovery. This is required for full
11305          * backwards compatibility with the API.
11306          *
11307          * However when using service discovery, the value 127 will be
11308          * returned when the RSSI is not available.
11309          */
11310         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
11311             link_type == ACL_LINK)
11312                 rssi = 0;
11313
11314         bacpy(&ev->addr.bdaddr, bdaddr);
11315         ev->addr.type = link_to_bdaddr(link_type, addr_type);
11316         ev->rssi = rssi;
11317         ev->flags = cpu_to_le32(flags);
11318
11319         if (eir_len > 0)
11320                 /* Copy EIR or advertising data into event */
11321                 memcpy(ev->eir, eir, eir_len);
11322
11323         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
11324                                        NULL))
11325                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
11326                                           dev_class, 3);
11327
11328         if (scan_rsp_len > 0)
11329                 /* Append scan response data to event */
11330                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
11331
11332         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
11333         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
11334
11335         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
11336 }
11337
11338 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11339                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
11340 {
11341         struct mgmt_ev_device_found *ev;
11342         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
11343         u16 eir_len;
11344
11345         ev = (struct mgmt_ev_device_found *) buf;
11346
11347         memset(buf, 0, sizeof(buf));
11348
11349         bacpy(&ev->addr.bdaddr, bdaddr);
11350         ev->addr.type = link_to_bdaddr(link_type, addr_type);
11351         ev->rssi = rssi;
11352
11353         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
11354                                   name_len);
11355
11356         ev->eir_len = cpu_to_le16(eir_len);
11357
11358         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
11359 }
11360
11361 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
11362 {
11363         struct mgmt_ev_discovering ev;
11364
11365         bt_dev_dbg(hdev, "discovering %u", discovering);
11366
11367         memset(&ev, 0, sizeof(ev));
11368         ev.type = hdev->discovery.type;
11369         ev.discovering = discovering;
11370
11371         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
11372 }
11373
11374 void mgmt_suspending(struct hci_dev *hdev, u8 state)
11375 {
11376         struct mgmt_ev_controller_suspend ev;
11377
11378         ev.suspend_state = state;
11379         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
11380 }
11381
11382 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
11383                    u8 addr_type)
11384 {
11385         struct mgmt_ev_controller_resume ev;
11386
11387         ev.wake_reason = reason;
11388         if (bdaddr) {
11389                 bacpy(&ev.addr.bdaddr, bdaddr);
11390                 ev.addr.type = addr_type;
11391         } else {
11392                 memset(&ev.addr, 0, sizeof(ev.addr));
11393         }
11394
11395         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
11396 }
11397
11398 static struct hci_mgmt_chan chan = {
11399         .channel        = HCI_CHANNEL_CONTROL,
11400         .handler_count  = ARRAY_SIZE(mgmt_handlers),
11401         .handlers       = mgmt_handlers,
11402 #ifdef TIZEN_BT
11403         .tizen_handler_count    = ARRAY_SIZE(tizen_mgmt_handlers),
11404         .tizen_handlers = tizen_mgmt_handlers,
11405 #endif
11406         .hdev_init      = mgmt_init_hdev,
11407 };
11408
11409 int mgmt_init(void)
11410 {
11411         return hci_mgmt_chan_register(&chan);
11412 }
11413
11414 void mgmt_exit(void)
11415 {
11416         hci_mgmt_chan_unregister(&chan);
11417 }